last executing test programs: 2m59.530644865s ago: executing program 0 (id=1108): r0 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000040)=@bpq0, 0x10) 2m59.530096228s ago: executing program 0 (id=1109): r0 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x2c02) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000080)={0x1, 0xfff, 0x9, 0x0, 0xff}) close(r0) 2m59.503767998s ago: executing program 0 (id=1110): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="500000000206050000000000000000000000000005000400000000000900020073797a31000000000500010007000000050005000a00000015000300686173683a69702c706f72742c6e6574"], 0x50}}, 0x0) 2m59.470217117s ago: executing program 0 (id=1111): symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) (async) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000500)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (async) chdir(&(0x7f00000001c0)='./bus\x00') (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) (async, rerun: 64) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) (async, rerun: 32) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) (rerun: 32) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$unix(0x1, 0x1, 0x0) (async) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x78, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @multicast2}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x14, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MAXIP={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x3e}}, @CTA_NAT_V4_MINIP={0x8, 0x1, @multicast2}]}]}, 0x78}}, 0x0) 2m59.382596147s ago: executing program 0 (id=1112): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'wp256-generic\x00'}, 0x58) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000800)={@ptr={0x70742a85, 0x0, 0x0, 0xf0, 0x2, 0x1e}, @ptr={0x70742a85, 0xfc, &(0x7f0000000400)=""/216, 0xd8, 0x1, 0xffffffffffffffff}, @fda={0x66646185, 0x9, 0x1, 0xb4}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) 2m59.158898357s ago: executing program 0 (id=1113): syz_emit_vhci(0x0, 0x0) 2m58.887807459s ago: executing program 32 (id=1113): syz_emit_vhci(0x0, 0x0) 9.047266258s ago: executing program 1 (id=2542): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000020605000000000a000000000000000005000400000000000900020073797a31000000000500010007000000050005000a00000015000300686173683a69702c706f72742c6e6574"], 0x50}}, 0x0) 4.07729452s ago: executing program 4 (id=2571): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) accept4(r0, &(0x7f00000002c0)=@phonet, &(0x7f0000000340)=0x80, 0x1800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$BTRFS_IOC_BALANCE_CTL(r3, 0x40049421, 0x3) read$FUSE(r0, &(0x7f0000002780)={0x2020}, 0x2020) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0xffffffffffffffff, 0xffff}) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) sendmmsg$inet6(r1, &(0x7f00000006c0)=[{{&(0x7f0000000240)={0xa, 0x4e23, 0x4, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="140000000000000029000000430000000d000000000000001400000000000000290000003e0000000100000000000000a800000000000000290000003700000084110000000000000740000000020e7ff579010000000000000001000000000000000100000000000000070000000000000001000000000000000100008000000000cd0b00000000000004011a0720c087ec9006020400080000000000000004000000000000000900000000000000c20400000005000100050200050718000000010408050001800000000000000004000000000000000038"], 0x110}}], 0x1, 0x931766f6319eed40) sendfile(r1, r0, 0x0, 0x80000000) creat(&(0x7f0000000280)='./file0\x00', 0x101) 3.755710919s ago: executing program 4 (id=2582): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz0\x00', {}, 0x0, [0x80000000, 0x3, 0x3ff, 0x8, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xffffffff, 0x8, 0x99, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0xfffffffc, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x1], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x5, 0x5ee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x1ff, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffff8, 0x2, 0x0, 0x2000079, 0x400, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6e, 0x0, 0x0, 0x4, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4771, 0x0, 0x0, 0xfffffffe], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4], [0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x4, 0x800, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x40, 0x0, 0x0, 0x200, 0x0, 0x0, 0x8000000, 0x40, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x5) syz_io_uring_setup(0x8d2, &(0x7f0000000a00)={0x0, 0x0, 0x3010}, &(0x7f0000000540), &(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket$inet6(0xa, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="043e1f0a00c9000201"], 0x22) ioctl$UI_SET_SWBIT(0xffffffffffffffff, 0x4004556d, 0x3) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000580)={'syz1\x00', {0x9, 0x8, 0x5, 0x2}, 0x2c, [0x5, 0x5, 0x1, 0x9, 0x3, 0x0, 0x5, 0x0, 0x7, 0xa34, 0x6, 0x7fffffff, 0x8, 0x18, 0xe, 0x7fff, 0x9, 0x7, 0x21a, 0x9, 0x3, 0x7fffffff, 0x1, 0xa, 0x5, 0xfffffffe, 0x9, 0x7, 0x400, 0x0, 0x3, 0x800, 0x5146, 0xffff, 0x2, 0x8, 0x6, 0x7fff, 0x8, 0xfffffffe, 0x0, 0x4, 0x9, 0x49, 0x7, 0x3, 0xfffffeab, 0x0, 0x2, 0x21, 0x6, 0x4, 0x5, 0x7fffffff, 0x8, 0xa, 0xc, 0x6, 0x6ffc, 0x200, 0x1, 0x4, 0x1, 0x1b0f], [0x0, 0x4, 0x20007fff, 0x7, 0x6, 0x6, 0x5, 0x10000, 0xa, 0x10, 0x2, 0x3, 0x8, 0x3, 0x8d8f, 0x8, 0x7, 0xff, 0x1, 0xffffffff, 0x3, 0x10, 0x1, 0x800, 0x2, 0xb, 0xe, 0x401, 0x1, 0x6, 0x401, 0x8000, 0x2, 0x2, 0x1, 0x8, 0x2, 0x100, 0x1, 0x73, 0x8, 0x0, 0xe, 0x4, 0x5, 0x2, 0x1076, 0x3, 0x9, 0x6e37663b, 0x7, 0x7, 0x3, 0x8, 0x0, 0x6, 0x6, 0x8000, 0x0, 0x5, 0x7, 0xa, 0x4, 0x1], [0x7510e92a, 0x80000001, 0x8118, 0x0, 0x2, 0x5344, 0x3, 0x5, 0x4, 0x3, 0x401, 0x4, 0x3, 0x986, 0x0, 0x7f, 0xf, 0x5, 0x9, 0x3, 0x10000, 0x5, 0x0, 0x4, 0x3, 0x75, 0x31fa, 0x4, 0x17, 0x4, 0x4, 0x0, 0x4, 0x5, 0x4, 0x7, 0x7e79, 0xedd1, 0x8, 0x0, 0x3, 0x8, 0xffff, 0x3, 0x200000, 0x6, 0x6, 0xfffffff7, 0x1000, 0x9, 0x1, 0x2, 0x0, 0x3, 0x4, 0xff, 0xc, 0x3ff, 0x6, 0xff, 0x25, 0x81, 0xffff7fff, 0x64], [0x16, 0x1, 0x2, 0x8000, 0x4, 0x5, 0x8, 0xfff, 0x3, 0x9, 0x0, 0x38, 0x4, 0x4, 0x2, 0x101, 0xa80, 0x8, 0x6, 0x6, 0xaf, 0xfffffff9, 0xa1d, 0x1c, 0x0, 0x5, 0x17, 0x40, 0x2, 0x4, 0x7, 0x0, 0x5, 0x10, 0x2, 0x2e6, 0xfff, 0x5, 0x6, 0x400, 0x6, 0x9, 0xa70110d2, 0x9, 0xffffffff, 0x1, 0x80000001, 0x80000001, 0x1, 0x1e, 0x2, 0xff, 0x80, 0x8, 0x2, 0x3168, 0xa, 0x1, 0x7e, 0x8, 0x0, 0x5, 0xc4312da, 0x4]}, 0x45c) bind$pptp(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x2, {0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000500)=0x8) r3 = openat$comedi(0xffffffffffffff9c, 0x0, 0x181001, 0x0) ioctl$COMEDI_INSN(r3, 0x8028640c, &(0x7f0000000080)={0xc000002, 0x0, 0x0, 0x2dd}) ioctl$TCFLSH(r2, 0x400455c8, 0x400000009) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000100)=0x2) r4 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_buf(r4, 0x0, 0x1a, 0x0, 0x0) write(r1, &(0x7f0000000140)="41000200010001", 0x7) close(r1) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000580)={0x2, 0x0, @ioapic={0xeeee0000, 0xb, 0xfefffffb, 0xfffffffc, 0x0, [{0xc, 0xfc, 0x8, '\x00', 0xb4}, {0x83, 0x6, 0x7, '\x00', 0x4b}, {0xf9, 0x0, 0x7, '\x00', 0xd6}, {0x0, 0x5, 0x0, '\x00', 0x8}, {0x5, 0xd, 0x8}, {0x2, 0x5, 0x6, '\x00', 0xff}, {0xe, 0xe, 0x47, '\x00', 0x6}, {0xd, 0x90, 0x4, '\x00', 0xe9}, {0xe, 0x6, 0xa7, '\x00', 0x1}, {0x9, 0xcc, 0x16, '\x00', 0x5}, {0x1, 0x9, 0x15, '\x00', 0x8}, {0x0, 0x3, 0x9b, '\x00', 0x7}, {0x1, 0xca, 0x80, '\x00', 0x4}, {0x3, 0xf1, 0x6, '\x00', 0xb2}, {0x8, 0x4, 0x0, '\x00', 0xfd}, {0x6, 0x0, 0x4, '\x00', 0x9}, {0x7, 0x2, 0x4, '\x00', 0x3}, {0xee, 0x3, 0x2, '\x00', 0xff}, {0xf, 0x41, 0x6, '\x00', 0x1}, {0x9, 0x8, 0x54, '\x00', 0xbf}, {0x1, 0x4, 0x4, '\x00', 0x6}, {0xd, 0x40, 0x7, '\x00', 0x4}, {0x5, 0xfd, 0x7, '\x00', 0x2}, {0x5, 0x6, 0xfa, '\x00', 0x40}]}}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 3.224188633s ago: executing program 4 (id=2581): r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) sendmmsg$inet(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000800)="2fae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de15aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4dbf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff690894405a0b6abc3c4d0f6a16c0a95c0508bd7eeffcd1da0b17f7701448658864b429e9472edfeffbf34d6e7c78f4aa73c0", 0x2de}, {&(0x7f0000000bc0)="ab29d92826349952eb8f7a2a74f535bc9739c1df57144c51a3391625b8b5354134b06ef1355506aeae96e3f097503998f375a054cf3d7de4fe53ea51518955349cdbadca60e1c65cc18dbe99369be03e492fb55fc9067bb6f7f7c3ee1720000000054a63ac58225ed0502f5ac8999e0c74a5dbb320bd54ec813e8bee6bfa5cbfb0726ac1b6ad97d802d5fae186f0769421fb965c7396854e2a3ac844a3769f8449901ba5e2b2da1ff6119aeb26ac204cfc6b54be73b6f195491ae2c0cb26b0cba61dae7a17740e8112ff188919c6e2e31a2a074863edba4a0e58b61faec4a42c29d7f9e48a43b8cb7d3c5a1e5aa67f87538140f8d633a54bceb8b1dda2397ea147d3b26e903f608b6ab1844ea7cf630d828118bba0f0f85e2e6316ae1ed9a2a7d08a05c170cb76bf111930df0cf760f7768571afdefe82a95296cee7c010f748a97046efcc774e7d85edbd5058104fef4942fb4430da89f67d1fea33bf2acfb793a610b3738b393eed8633fc8e8f630932206960e9076c7d7fc99fce018701c50d39b811a7427a7a9fcb340c2755541f228462010ec40ba945a0febd460dad5d548f1be090f5dbaa8ae8835dc47ed2537681827f6129759272574cf58f2f33e47a0e416573cfdcfb44ed9dd4ce41af4de9c471c49f12f090934c3b32f2f4777c65b1574826727f5f62", 0x1e9}, {&(0x7f00000000c0)}, {&(0x7f0000000200)="f610e61fc81cc3edc86f0500194d27a5a42cf1880b0dfd1ecda0fd0ed9a444b7fbb161860c", 0x25}], 0x4, 0x0, 0x0, 0x900}}], 0x1, 0x0) 3.122709302s ago: executing program 4 (id=2584): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000004280)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1e}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x5, 0x84}}}, 0x84}}, 0x20050800) 2.886528548s ago: executing program 4 (id=2585): r0 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000040)=@bpq0, 0x10) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc0405519, &(0x7f0000000080)={{0x3, 0x4}, 0x0, [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x0, 0x0, 0x0, 0xcb4, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x6, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31413bb4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x10000000000000]}) r2 = signalfd(r0, &(0x7f0000000080)={[0x80]}, 0x8) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r2) 2.434590512s ago: executing program 4 (id=2587): r0 = syz_open_dev$tty1(0xc, 0x4, 0x3) r1 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) syz_usb_disconnect(r1) r2 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x200) syz_usb_disconnect(r2) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCRMFF(r2, 0x4004550d, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000780)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x20, 0x1, 0x2, "fdc1"}, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000480)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="40f4ff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) ioctl$KDSIGACCEPT(r0, 0x5607, 0x4) 2.396644431s ago: executing program 3 (id=2588): r0 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) read$FUSE(r0, &(0x7f0000003bc0)={0x2020}, 0x2020) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000200)=0x14) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000240)={@loopback, r1}, 0x14) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="580000000102010800000000000000000a000000440002802c00018014000300fe8000000000000000000000000000bb14000400fc010000000000000008000000000000100002800500010006000000040003"], 0x58}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40440, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_PIT2(r6, 0xc008aeba, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$devlink(&(0x7f00000007c0), r7) sendmsg$DEVLINK_CMD_PORT_SET(r7, &(0x7f00000008c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010029bd700200000000000000000e0001006e659f78287464657673696d0000000f0002006e657464657673696d3000000800030003000000060017000200000081b1b1dc3775c134a6de00646ffab867238d756722f472abaa7384ce8e20e4617624ede9c30674035bc3b9d53959a244355c6942b93b3d0853e219e8aa44cec7a1ac4f2eb80dd07b430211794dc37f2160b8d17fb0b0f9c74349b279863ac3bfc90dfcbaac06829158bea491a045629b6c88bb78ea6fd2612a209b722f7a7d4f00ee344f6f0ed5aeb7258f589404ea0ca41836909ad933fdfa294551796c481a6cf08878af6c0bc4ec8b43c005546ef1f2119ef0f796b1e2460ea7a706f9710a3c83fe874efd0a"], 0x44}, 0x1, 0x0, 0x0, 0x20008800}, 0x4000000) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r9, 0x0, 0x40, &(0x7f0000000080)="8c5d7b87b32ecae06ac8cfe890364ab911d8c33439477a7591f6914e91c6821ee7163f8ae1896184d48797997716158aad89f66dd67480ce8ff178ef748cfcdcf54127d5ff95cbcaebf10a3b7cddafa2c0fa6aa2feffff077680203c02d0c623", 0x60) ioprio_set$pid(0x2, 0x0, 0x0) preadv2(r4, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fe00}], 0x1, 0x0, 0x0, 0x2b) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000000206010100000000000000fcff10000005000400000000000900020073797a30000000000500010007000000050005000a000000140007800800114000000000080012400000ffff16000300686173683a6e65742c706f72742c6e657400"], 0x64}}, 0x0) 2.11529408s ago: executing program 3 (id=2589): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f8ff0f0000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0xfe) 1.974901482s ago: executing program 3 (id=2590): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz0\x00', {}, 0x0, [0x80000000, 0x3, 0x3ff, 0x8, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xffffffff, 0x8, 0x99, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0xfffffffc, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x1], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x5, 0x5ee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x1ff, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffff8, 0x2, 0x0, 0x2000079, 0x400, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6e, 0x0, 0x0, 0x4, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4771, 0x0, 0x0, 0xfffffffe], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4], [0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x4, 0x800, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x40, 0x0, 0x0, 0x200, 0x0, 0x0, 0x8000000, 0x40, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x5) syz_io_uring_setup(0x8d2, &(0x7f0000000a00)={0x0, 0x0, 0x3010}, &(0x7f0000000540), &(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket$inet6(0xa, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="043e1f0a00c9000201"], 0x22) ioctl$UI_SET_SWBIT(0xffffffffffffffff, 0x4004556d, 0x3) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000580)={'syz1\x00', {0x9, 0x8, 0x5, 0x2}, 0x2c, [0x5, 0x5, 0x1, 0x9, 0x3, 0x0, 0x5, 0x0, 0x7, 0xa34, 0x6, 0x7fffffff, 0x8, 0x18, 0xe, 0x7fff, 0x9, 0x7, 0x21a, 0x9, 0x3, 0x7fffffff, 0x1, 0xa, 0x5, 0xfffffffe, 0x9, 0x7, 0x400, 0x0, 0x3, 0x800, 0x5146, 0xffff, 0x2, 0x8, 0x6, 0x7fff, 0x8, 0xfffffffe, 0x0, 0x4, 0x9, 0x49, 0x7, 0x3, 0xfffffeab, 0x0, 0x2, 0x21, 0x6, 0x4, 0x5, 0x7fffffff, 0x8, 0xa, 0xc, 0x6, 0x6ffc, 0x200, 0x1, 0x4, 0x1, 0x1b0f], [0x0, 0x4, 0x20007fff, 0x7, 0x6, 0x6, 0x5, 0x10000, 0xa, 0x10, 0x2, 0x3, 0x8, 0x3, 0x8d8f, 0x8, 0x7, 0xff, 0x1, 0xffffffff, 0x3, 0x10, 0x1, 0x800, 0x2, 0xb, 0xe, 0x401, 0x1, 0x6, 0x401, 0x8000, 0x2, 0x2, 0x1, 0x8, 0x2, 0x100, 0x1, 0x73, 0x8, 0x0, 0xe, 0x4, 0x5, 0x2, 0x1076, 0x3, 0x9, 0x6e37663b, 0x7, 0x7, 0x3, 0x8, 0x0, 0x6, 0x6, 0x8000, 0x0, 0x5, 0x7, 0xa, 0x4, 0x1], [0x7510e92a, 0x80000001, 0x8118, 0x0, 0x2, 0x5344, 0x3, 0x5, 0x4, 0x3, 0x401, 0x4, 0x3, 0x986, 0x0, 0x7f, 0xf, 0x5, 0x9, 0x3, 0x10000, 0x5, 0x0, 0x4, 0x3, 0x75, 0x31fa, 0x4, 0x17, 0x4, 0x4, 0x0, 0x4, 0x5, 0x4, 0x7, 0x7e79, 0xedd1, 0x8, 0x0, 0x3, 0x8, 0xffff, 0x3, 0x200000, 0x6, 0x6, 0xfffffff7, 0x1000, 0x9, 0x1, 0x2, 0x0, 0x3, 0x4, 0xff, 0xc, 0x3ff, 0x6, 0xff, 0x25, 0x81, 0xffff7fff, 0x64], [0x16, 0x1, 0x2, 0x8000, 0x4, 0x5, 0x8, 0xfff, 0x3, 0x9, 0x0, 0x38, 0x4, 0x4, 0x2, 0x101, 0xa80, 0x8, 0x6, 0x6, 0xaf, 0xfffffff9, 0xa1d, 0x1c, 0x0, 0x5, 0x17, 0x40, 0x2, 0x4, 0x7, 0x0, 0x5, 0x10, 0x2, 0x2e6, 0xfff, 0x5, 0x6, 0x400, 0x6, 0x9, 0xa70110d2, 0x9, 0xffffffff, 0x1, 0x80000001, 0x80000001, 0x1, 0x1e, 0x2, 0xff, 0x80, 0x8, 0x2, 0x3168, 0xa, 0x1, 0x7e, 0x8, 0x0, 0x5, 0xc4312da, 0x4]}, 0x45c) bind$pptp(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x2, {0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000500)=0x8) r3 = openat$comedi(0xffffffffffffff9c, 0x0, 0x181001, 0x0) ioctl$COMEDI_INSN(r3, 0x8028640c, &(0x7f0000000080)={0xc000002, 0x0, 0x0, 0x2dd}) ioctl$TCFLSH(r2, 0x400455c8, 0x400000009) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000100)=0x2) r4 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_buf(r4, 0x0, 0x1a, 0x0, 0x0) write(r1, &(0x7f0000000140)="41000200010001", 0x7) close(r1) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000580)={0x2, 0x0, @ioapic={0xeeee0000, 0xb, 0xfefffffb, 0xfffffffc, 0x0, [{0xc, 0xfc, 0x8, '\x00', 0xb4}, {0x83, 0x6, 0x7, '\x00', 0x4b}, {0xf9, 0x0, 0x7, '\x00', 0xd6}, {0x0, 0x5, 0x0, '\x00', 0x8}, {0x5, 0xd, 0x8}, {0x2, 0x5, 0x6, '\x00', 0xff}, {0xe, 0xe, 0x47, '\x00', 0x6}, {0xd, 0x90, 0x4, '\x00', 0xe9}, {0xe, 0x6, 0xa7, '\x00', 0x1}, {0x9, 0xcc, 0x16, '\x00', 0x5}, {0x1, 0x9, 0x15, '\x00', 0x8}, {0x0, 0x3, 0x9b, '\x00', 0x7}, {0x1, 0xca, 0x80, '\x00', 0x4}, {0x3, 0xf1, 0x6, '\x00', 0xb2}, {0x8, 0x4, 0x0, '\x00', 0xfd}, {0x6, 0x0, 0x4, '\x00', 0x9}, {0x7, 0x2, 0x4, '\x00', 0x3}, {0xee, 0x3, 0x2, '\x00', 0xff}, {0xf, 0x41, 0x6, '\x00', 0x1}, {0x9, 0x8, 0x54, '\x00', 0xbf}, {0x1, 0x4, 0x4, '\x00', 0x6}, {0xd, 0x40, 0x7, '\x00', 0x4}, {0x5, 0xfd, 0x7, '\x00', 0x2}, {0x5, 0x6, 0xfa, '\x00', 0x40}]}}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.568103439s ago: executing program 3 (id=2591): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000210a0000060900020073797a3100000000090001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 1.410610996s ago: executing program 3 (id=2592): r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) sendmmsg$inet(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000800)="2fae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de15aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4dbf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff690894405a0b6abc3c4d0f6a16c0a95c0508bd7eeffcd1da0b17f7701448658864b429e9472edfeffbf34d6e7c78f4aa73c0", 0x2de}, {&(0x7f0000000bc0)="ab29d92826349952eb8f7a2a74f535bc9739c1df57144c51a3391625b8b5354134b06ef1355506aeae96e3f097503998f375a054cf3d7de4fe53ea51518955349cdbadca60e1c65cc18dbe99369be03e492fb55fc9067bb6f7f7c3ee1720000000054a63ac58225ed0502f5ac8999e0c74a5dbb320bd54ec813e8bee6bfa5cbfb0726ac1b6ad97d802d5fae186f0769421fb965c7396854e2a3ac844a3769f8449901ba5e2b2da1ff6119aeb26ac204cfc6b54be73b6f195491ae2c0cb26b0cba61dae7a17740e8112ff188919c6e2e31a2a074863edba4a0e58b61faec4a42c29d7f9e48a43b8cb7d3c5a1e5aa67f87538140f8d633a54bceb8b1dda2397ea147d3b26e903f608b6ab1844ea7cf630d828118bba0f0f85e2e6316ae1ed9a2a7d08a05c170cb76bf111930df0cf760f7768571afdefe82a95296cee7c010f748a97046efcc774e7d85edbd5058104fef4942fb4430da89f67d1fea33bf2acfb793a610b3738b393eed8633fc8e8f630932206960e9076c7d7fc99fce018701c50d39b811a7427a7a9fcb340c2755541f228462010ec40ba945a0febd460dad5d548f1be090f5dbaa8ae8835dc47ed2537681827f6129759272574cf58f2f33e47a0e416573cfdcfb44ed9dd4ce41af4de9c471c49f12f090934c3b32f2f4777c65b1574826727f5f62", 0x1e9}, {&(0x7f00000000c0)="05437c98b91b1455046f57b5fc913814bde2bbeac2104eaea9c9d01a7838d859207067c10aa7352abbdf98e9bf033a3184a11e84639d3b9164d9c5d729f3dd409d39ff6d5cf367cd", 0x48}, {&(0x7f0000000200)="f610e61fc81cc3edc86f0500194d27a5a42cf1880b0dfd1ecda0fd0ed9a444b7fbb161860c", 0x25}], 0x4, 0x0, 0x0, 0x900}}], 0x1, 0x0) 1.339166107s ago: executing program 3 (id=2593): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000dc0), r0) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000e00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="010027bd7000fddbdf2502ffffdf"], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f0000000080)={0x1c, r2, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c874}, 0x20044000) syz_usb_connect(0x5, 0x24, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0xa3, 0xd6, 0x13, 0x20, 0x102c, 0x6151, 0x3265, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc5, 0x2, 0x0, 0x2e, 0x85, 0xfe}}]}}]}}, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r5, 0x8002f515, &(0x7f00000001c0)) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r11, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x8, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r11, 0xae80, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r11, 0x4048ae9b, &(0x7f0000000000)={0xe0000, 0x0, {[0x8000000000000000, 0x10, 0xc, 0x100000000, 0x3, 0x0, 0x6, 0x885]}}) ioctl$KVM_RUN(r11, 0xae80, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x18, r7, 0x200, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0xc000}, 0x48000) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x20, r12, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r13}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x0) fchdir(r3) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x9) 1.066678593s ago: executing program 2 (id=2595): ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1e) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000480)={{0x0, 0xefae, 0x80, 0x3}, 'syz1\x00', 0x51}) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) 1.007043284s ago: executing program 2 (id=2596): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) accept4(r0, &(0x7f00000002c0)=@phonet, &(0x7f0000000340)=0x80, 0x1800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$BTRFS_IOC_BALANCE_CTL(r3, 0x40049421, 0x3) read$FUSE(r0, &(0x7f0000002780)={0x2020}, 0x2020) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r5, 0xc040aed4, &(0x7f0000000080)={0xffffffffffffffff, 0xffff}) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) sendmmsg$inet6(r1, &(0x7f00000006c0)=[{{&(0x7f0000000240)={0xa, 0x4e23, 0x4, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="140000000000000029000000430000000d000000000000001400000000000000290000003e0000000100000000000000a800000000000000290000003700000084110000000000000740000000020e7ff579010000000000000001000000000000000100000000000000070000000000000001000000000000000100008000000000cd0b00000000000004011a0720c087ec9006020400080000000000000004000000000000000900000000000000c20400000005000100050200050718000000010408050001800000000000000004000000000000000038"], 0x110}}], 0x1, 0x931766f6319eed40) sendfile(r1, r0, 0x0, 0x80000000) creat(&(0x7f0000000280)='./file0\x00', 0x101) 754.569851ms ago: executing program 2 (id=2597): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000c0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) 645.85525ms ago: executing program 1 (id=2543): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01000000000004000000010000001400020077673100000000000000000000000000100008800c00008008000300feffff7f"], 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async, rerun: 64) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) (async) prctl$PR_SET_SECUREBITS(0x1c, 0x1d) (async, rerun: 32) setuid(0xee01) (async, rerun: 32) setresgid(0x0, 0xee01, 0x0) (async) r5 = semget$private(0x0, 0x4, 0x29b) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 32) semop(r5, &(0x7f0000000000)=[{0x0, 0x203}, {}], 0x2) (rerun: 32) semctl$GETALL(r5, 0x0, 0xd, &(0x7f0000003fc0)=""/62) (async) sendmsg$NL80211_CMD_SET_CQM(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0104c95e9f8c98bd72b6958cf1e4bae22dbd7000fcdbdf253f00000008009fc2", @ANYBLOB="63698eca161164fbf2ebb16c7fee75d45ec864ecac256c33bcf63bf8c044727cb1134dae7feb389bba76d9d742750e3a206c05fbc6c9edf2d5d2cb100f814c42a361b737888e0758a5d42c53f6d353fc2fac351bd18640189473bd641e33d122270a93ad253fe7be7446dcc2325b342decebee0d0ce2c0c0a4f546db8758cff0dc8cc7617c554f4ede8ff55bce28cb7e81dc1a853fff82a6a29b585145e8a0a28a7f617e50ca57829c16d9e0a4fc1792ed413fc2b300c7326b804125222f9fce9c6b509ee8672f", @ANYBLOB="18005e8009000100ffffffbef9ffffff08000200fcffffff"], 0x34}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPATH(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40003010}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x70, r4, 0x300, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x7ff, 0x51}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x70}, 0x1, 0x0, 0x0, 0x918}, 0x810) (async) r7 = syz_open_dev$video4linux(&(0x7f0000000000), 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r7, 0xc0305602, &(0x7f00000011c0)={0x0, 0x1}) (async) ioctl$VIDIOC_G_OUTPUT(r7, 0x8004562e, &(0x7f0000000100)) r8 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r8, 0x5412, &(0x7f00000000c0)=0xb) ioctl$TCSETSW2(r8, 0x402c542c, &(0x7f0000000040)={0xfffffff8, 0x401, 0xfffffffd, 0xffff, 0x7, "0441920887e87fcb367800000000080100", 0x4, 0x200}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(r9, 0x29, 0x23, 0x0, 0x0) (async) ioctl$TIOCSTI(r8, 0x5412, &(0x7f0000000080)=0x8) 586.297247ms ago: executing program 2 (id=2598): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80b00, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz0\x00', {}, 0x0, [0x80000000, 0x3, 0x3ff, 0x8, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xffffffff, 0x8, 0x99, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0xfffffffc, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x1], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x5, 0x5ee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x1ff, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffff8, 0x2, 0x0, 0x2000079, 0x400, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6e, 0x0, 0x0, 0x4, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4771, 0x0, 0x0, 0xfffffffe], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffc, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4], [0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x4, 0x800, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x40, 0x0, 0x0, 0x200, 0x0, 0x0, 0x8000000, 0x40, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x5) syz_io_uring_setup(0x8d2, &(0x7f0000000a00)={0x0, 0x0, 0x3010}, &(0x7f0000000540), &(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket$inet6(0xa, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000280)=ANY=[@ANYBLOB="043e1f0a00c9000201"], 0x22) ioctl$UI_SET_SWBIT(0xffffffffffffffff, 0x4004556d, 0x3) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000580)={'syz1\x00', {0x9, 0x8, 0x5, 0x2}, 0x2c, [0x5, 0x5, 0x1, 0x9, 0x3, 0x0, 0x5, 0x0, 0x7, 0xa34, 0x6, 0x7fffffff, 0x8, 0x18, 0xe, 0x7fff, 0x9, 0x7, 0x21a, 0x9, 0x3, 0x7fffffff, 0x1, 0xa, 0x5, 0xfffffffe, 0x9, 0x7, 0x400, 0x0, 0x3, 0x800, 0x5146, 0xffff, 0x2, 0x8, 0x6, 0x7fff, 0x8, 0xfffffffe, 0x0, 0x4, 0x9, 0x49, 0x7, 0x3, 0xfffffeab, 0x0, 0x2, 0x21, 0x6, 0x4, 0x5, 0x7fffffff, 0x8, 0xa, 0xc, 0x6, 0x6ffc, 0x200, 0x1, 0x4, 0x1, 0x1b0f], [0x0, 0x4, 0x20007fff, 0x7, 0x6, 0x6, 0x5, 0x10000, 0xa, 0x10, 0x2, 0x3, 0x8, 0x3, 0x8d8f, 0x8, 0x7, 0xff, 0x1, 0xffffffff, 0x3, 0x10, 0x1, 0x800, 0x2, 0xb, 0xe, 0x401, 0x1, 0x6, 0x401, 0x8000, 0x2, 0x2, 0x1, 0x8, 0x2, 0x100, 0x1, 0x73, 0x8, 0x0, 0xe, 0x4, 0x5, 0x2, 0x1076, 0x3, 0x9, 0x6e37663b, 0x7, 0x7, 0x3, 0x8, 0x0, 0x6, 0x6, 0x8000, 0x0, 0x5, 0x7, 0xa, 0x4, 0x1], [0x7510e92a, 0x80000001, 0x8118, 0x0, 0x2, 0x5344, 0x3, 0x5, 0x4, 0x3, 0x401, 0x4, 0x3, 0x986, 0x0, 0x7f, 0xf, 0x5, 0x9, 0x3, 0x10000, 0x5, 0x0, 0x4, 0x3, 0x75, 0x31fa, 0x4, 0x17, 0x4, 0x4, 0x0, 0x4, 0x5, 0x4, 0x7, 0x7e79, 0xedd1, 0x8, 0x0, 0x3, 0x8, 0xffff, 0x3, 0x200000, 0x6, 0x6, 0xfffffff7, 0x1000, 0x9, 0x1, 0x2, 0x0, 0x3, 0x4, 0xff, 0xc, 0x3ff, 0x6, 0xff, 0x25, 0x81, 0xffff7fff, 0x64], [0x16, 0x1, 0x2, 0x8000, 0x4, 0x5, 0x8, 0xfff, 0x3, 0x9, 0x0, 0x38, 0x4, 0x4, 0x2, 0x101, 0xa80, 0x8, 0x6, 0x6, 0xaf, 0xfffffff9, 0xa1d, 0x1c, 0x0, 0x5, 0x17, 0x40, 0x2, 0x4, 0x7, 0x0, 0x5, 0x10, 0x2, 0x2e6, 0xfff, 0x5, 0x6, 0x400, 0x6, 0x9, 0xa70110d2, 0x9, 0xffffffff, 0x1, 0x80000001, 0x80000001, 0x1, 0x1e, 0x2, 0xff, 0x80, 0x8, 0x2, 0x3168, 0xa, 0x1, 0x7e, 0x8, 0x0, 0x5, 0xc4312da, 0x4]}, 0x45c) bind$pptp(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x2, {0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000500)=0x8) r3 = openat$comedi(0xffffffffffffff9c, 0x0, 0x181001, 0x0) ioctl$COMEDI_INSN(r3, 0x8028640c, &(0x7f0000000080)={0xc000002, 0x0, 0x0, 0x2dd}) ioctl$TCFLSH(r2, 0x400455c8, 0x400000009) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000100)=0x2) r4 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_buf(r4, 0x0, 0x1a, 0x0, 0x0) write(r1, &(0x7f0000000140)="41000200010001", 0x7) close(r1) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000580)={0x2, 0x0, @ioapic={0xeeee0000, 0xb, 0xfefffffb, 0xfffffffc, 0x0, [{0xc, 0xfc, 0x8, '\x00', 0xb4}, {0x83, 0x6, 0x7, '\x00', 0x4b}, {0xf9, 0x0, 0x7, '\x00', 0xd6}, {0x0, 0x5, 0x0, '\x00', 0x8}, {0x5, 0xd, 0x8}, {0x2, 0x5, 0x6, '\x00', 0xff}, {0xe, 0xe, 0x47, '\x00', 0x6}, {0xd, 0x90, 0x4, '\x00', 0xe9}, {0xe, 0x6, 0xa7, '\x00', 0x1}, {0x9, 0xcc, 0x16, '\x00', 0x5}, {0x1, 0x9, 0x15, '\x00', 0x8}, {0x0, 0x3, 0x9b, '\x00', 0x7}, {0x1, 0xca, 0x80, '\x00', 0x4}, {0x3, 0xf1, 0x6, '\x00', 0xb2}, {0x8, 0x4, 0x0, '\x00', 0xfd}, {0x6, 0x0, 0x4, '\x00', 0x9}, {0x7, 0x2, 0x4, '\x00', 0x3}, {0xee, 0x3, 0x2, '\x00', 0xff}, {0xf, 0x41, 0x6, '\x00', 0x1}, {0x9, 0x8, 0x54, '\x00', 0xbf}, {0x1, 0x4, 0x4, '\x00', 0x6}, {0xd, 0x40, 0x7, '\x00', 0x4}, {0x5, 0xfd, 0x7, '\x00', 0x2}, {0x5, 0x6, 0xfa, '\x00', 0x40}]}}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 494.967027ms ago: executing program 1 (id=2599): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=ANY=[@ANYBLOB="1400000010000100000000000000fffffff5000a2c000000050a03000000000000000000020000000c00024000000000000000010900010073797a300000000033000000080a0300000000000000000002000003090001"], 0x74}}, 0x0) 303.859748ms ago: executing program 1 (id=2600): mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000800)={[], 0x500}) (async) pipe(&(0x7f0000000080)={0xffffffffffffffff}) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) (async) splice(r0, 0x0, r1, 0x0, 0x4ffe6, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) (async, rerun: 64) ptrace$setregs(0xd, r2, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") (rerun: 64) ptrace$getregset(0x4205, r2, 0x2, &(0x7f0000000180)={0x0, 0xfffffffffffffe98}) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000000)={0x0, 0x0, {r2}, {0xffffffffffffffff}, 0x5, 0xffffffffffffffff}) (async) r4 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_buf(r4, 0x0, 0x29, 0x0, 0x0) syz_open_procfs(r3, &(0x7f0000000040)='maps\x00') 177.864394ms ago: executing program 2 (id=2601): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0xfffffff6, @private0, 0x9}]}, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000001c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x3000000, 0xd4}, 0x9c) 128.976849ms ago: executing program 1 (id=2602): r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) sendmmsg$inet(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000800)="2fae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de15aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4dbf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff690894405a0b6abc3c4d0f6a16c0a95c0508bd7eeffcd1da0b17f7701448658864b429e9472edfeffbf34d6e7c78f4aa73c0", 0x2de}, {&(0x7f0000000bc0)="ab29d92826349952eb8f7a2a74f535bc9739c1df57144c51a3391625b8b5354134b06ef1355506aeae96e3f097503998f375a054cf3d7de4fe53ea51518955349cdbadca60e1c65cc18dbe99369be03e492fb55fc9067bb6f7f7c3ee1720000000054a63ac58225ed0502f5ac8999e0c74a5dbb320bd54ec813e8bee6bfa5cbfb0726ac1b6ad97d802d5fae186f0769421fb965c7396854e2a3ac844a3769f8449901ba5e2b2da1ff6119aeb26ac204cfc6b54be73b6f195491ae2c0cb26b0cba61dae7a17740e8112ff188919c6e2e31a2a074863edba4a0e58b61faec4a42c29d7f9e48a43b8cb7d3c5a1e5aa67f87538140f8d633a54bceb8b1dda2397ea147d3b26e903f608b6ab1844ea7cf630d828118bba0f0f85e2e6316ae1ed9a2a7d08a05c170cb76bf111930df0cf760f7768571afdefe82a95296cee7c010f748a97046efcc774e7d85edbd5058104fef4942fb4430da89f67d1fea33bf2acfb793a610b3738b393eed8633fc8e8f630932206960e9076c7d7fc99fce018701c50d39b811a7427a7a9fcb340c2755541f228462010ec40ba945a0febd460dad5d548f1be090f5dbaa8ae8835dc47ed2537681827f6129759272574cf58f2f33e47a0e416573cfdcfb44ed9dd4ce41af4de9c471c49f12f090934c3b32f2f4777c65b1574826727f5f62", 0x1e9}, {&(0x7f00000000c0)="05437c98b91b1455046f57b5fc913814bde2bbeac2104eaea9c9d01a7838d859207067c10aa7352abbdf98e9bf033a3184a11e84639d3b9164d9c5d729f3dd409d39ff6d5cf367cd939f790732e8d2310e876fcb299cd44b72bda697035b7b475bc35afbb483db39ac864dbee0c9760c22a1d32d83588afd7c994652413b22db76874ca052ef2013317eb7fc", 0x8c}, {&(0x7f0000000200)}], 0x4, 0x0, 0x0, 0x900}}], 0x1, 0x0) 79.537393ms ago: executing program 2 (id=2603): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x550, 0x40, 0x1000, 0x4, 0xd968d5b908ac0cde, 0x1, {0x0, 0x8}, {0x350}, {0x100f4ef, 0x0, 0xff8e}, {0x0, 0x0, 0xffe}, 0x1, 0x100, 0x0, 0xd614, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0xfffffc00, 0x0, 0x0, 0x8, 0x0, 0x0, 0xb}) 0s ago: executing program 1 (id=2604): mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a0104000000000000000007000000090001c573797a300000000048000000210a01040000000000000000070002000900010073797a30000000000c0009800800014060000002080005400000002d08000a40000000000900020073797a3200000000140000001000010000000000000000000084000a"], 0x90}, 0x1, 0x0, 0x0, 0x8054}, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f00000002c0)=0x7, 0x4) r2 = socket$netlink(0x10, 0x3, 0x4) recvmsg$kcm(r2, &(0x7f0000001840)={&(0x7f0000000240)=@l2tp={0x2, 0x0, @loopback}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000000400)=""/193, 0xc1}, {&(0x7f0000000540)=""/200, 0xc8}, {&(0x7f0000000640)=""/4096, 0x1000}, {&(0x7f0000000300)=""/113, 0x71}, {&(0x7f0000000140)}, {&(0x7f0000001640)=""/82, 0x52}, {&(0x7f00000016c0)=""/218, 0xda}], 0x7, &(0x7f0000000380)=""/44, 0x2c}, 0x2002) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a09000000ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) rmdir(&(0x7f00000001c0)='./file1\x00') chroot(&(0x7f0000000000)='./bus\x00') openat$fuse(0xffffffffffffff9c, &(0x7f0000000500), 0x42, 0x0) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) (async) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) (async) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a0104000000000000000007000000090001c573797a300000000048000000210a01040000000000000000070002000900010073797a30000000000c0009800800014060000002080005400000002d08000a40000000000900020073797a3200000000140000001000010000000000000000000084000a"], 0x90}, 0x1, 0x0, 0x0, 0x8054}, 0x0) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) (async) listen(r0, 0x0) (async) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f00000002c0)=0x7, 0x4) (async) socket$netlink(0x10, 0x3, 0x4) (async) recvmsg$kcm(r2, &(0x7f0000001840)={&(0x7f0000000240)=@l2tp={0x2, 0x0, @loopback}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000000400)=""/193, 0xc1}, {&(0x7f0000000540)=""/200, 0xc8}, {&(0x7f0000000640)=""/4096, 0x1000}, {&(0x7f0000000300)=""/113, 0x71}, {&(0x7f0000000140)}, {&(0x7f0000001640)=""/82, 0x52}, {&(0x7f00000016c0)=""/218, 0xda}], 0x7, &(0x7f0000000380)=""/44, 0x2c}, 0x2002) (async) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a09000000ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) (async) rmdir(&(0x7f00000001c0)='./file1\x00') (async) chroot(&(0x7f0000000000)='./bus\x00') (async) openat$fuse(0xffffffffffffff9c, &(0x7f0000000500), 0x42, 0x0) (async) kernel console output (not intermixed with test programs): 57][ T798] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 347.892894][ T798] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 347.926720][ T798] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 347.955845][ T798] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 347.981850][ T798] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 90 [ 347.991731][ T798] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 347.995657][T12321] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2289'. [ 348.143144][ T798] usb 3-1: USB disconnect, device number 80 [ 348.169679][ T9] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 348.340707][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 348.348096][ T9] usb 4-1: config 0 has an invalid interface number: 145 but max is 1 [ 348.357170][ T9] usb 4-1: config 0 has an invalid interface number: 43 but max is 1 [ 348.368454][ T9] usb 4-1: config 0 has no interface number 0 [ 348.377358][ T9] usb 4-1: config 0 has no interface number 1 [ 348.384151][ T9] usb 4-1: config 0 interface 43 altsetting 250 bulk endpoint 0xF has invalid maxpacket 1023 [ 348.396962][ T9] usb 4-1: config 0 interface 43 altsetting 250 has a duplicate endpoint with address 0x2, skipping [ 348.408610][ T9] usb 4-1: config 0 interface 43 altsetting 250 has an endpoint descriptor with address 0xCE, changing to 0x8E [ 348.420993][ T9] usb 4-1: config 0 interface 43 altsetting 250 endpoint 0x8E has an invalid bInterval 180, changing to 11 [ 348.433090][ T9] usb 4-1: config 0 interface 43 altsetting 250 endpoint 0x8E has invalid maxpacket 16902, setting to 1024 [ 348.447080][ T9] usb 4-1: config 0 interface 43 altsetting 250 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 348.460872][ T9] usb 4-1: config 0 interface 145 has no altsetting 0 [ 348.467762][ T9] usb 4-1: config 0 interface 43 has no altsetting 0 [ 348.492349][ T9] usb 4-1: New USB device found, idVendor=06cd, idProduct=0104, bcdDevice=c8.6a [ 348.501765][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.509814][ T9] usb 4-1: Product: syz [ 348.515015][ T9] usb 4-1: Manufacturer: syz [ 348.519656][ T9] usb 4-1: SerialNumber: syz [ 348.527129][ T9] usb 4-1: config 0 descriptor?? [ 348.728048][T12323] FAULT_INJECTION: forcing a failure. [ 348.728048][T12323] name failslab, interval 1, probability 0, space 0, times 0 [ 348.741082][T12323] CPU: 1 UID: 0 PID: 12323 Comm: syz.2.2292 Not tainted syzkaller #0 PREEMPT(full) [ 348.741105][T12323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 348.741117][T12323] Call Trace: [ 348.741125][T12323] [ 348.741133][T12323] dump_stack_lvl+0x189/0x250 [ 348.741158][T12323] ? __pfx____ratelimit+0x10/0x10 [ 348.741185][T12323] ? __pfx_dump_stack_lvl+0x10/0x10 [ 348.741204][T12323] ? __pfx__printk+0x10/0x10 [ 348.741229][T12323] ? __pfx___might_resched+0x10/0x10 [ 348.741252][T12323] should_fail_ex+0x414/0x560 [ 348.741276][T12323] should_failslab+0xa8/0x100 [ 348.741294][T12323] kmem_cache_alloc_node_noprof+0x8c/0x710 [ 348.741309][T12323] ? __alloc_skb+0x112/0x2d0 [ 348.741323][T12323] __alloc_skb+0x112/0x2d0 [ 348.741337][T12323] netlink_ack+0x146/0xa50 [ 348.741368][T12323] netlink_rcv_skb+0x28c/0x470 [ 348.741390][T12323] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 348.741412][T12323] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 348.741440][T12323] ? bpf_lsm_capable+0x9/0x20 [ 348.741454][T12323] ? security_capable+0x7e/0x2e0 [ 348.741470][T12323] nfnetlink_rcv+0x282/0x2590 [ 348.741482][T12323] ? __kernel_text_address+0xd/0x40 [ 348.741495][T12323] ? unwind_get_return_address+0x4d/0x90 [ 348.741512][T12323] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 348.741533][T12323] ? arch_stack_walk+0xfc/0x150 [ 348.741568][T12323] ? stack_trace_save+0x9c/0xe0 [ 348.741587][T12323] ? __pfx_stack_trace_save+0x10/0x10 [ 348.741604][T12323] ? trim_netdev_trace+0x320/0x440 [ 348.741613][T12323] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 348.741624][T12323] ? save_netdev_trace_buffer+0x4b5/0x5a0 [ 348.741639][T12323] ? __pfx_save_netdev_trace_buffer+0x10/0x10 [ 348.741647][T12323] ? ref_tracker_free+0x63a/0x7d0 [ 348.741665][T12323] ? __netlink_deliver_tap+0x636/0x8b0 [ 348.741684][T12323] ? netlink_deliver_tap+0x19c/0x1b0 [ 348.741703][T12323] ? netlink_unicast+0x7fa/0x9e0 [ 348.741719][T12323] ? netlink_sendmsg+0x805/0xb30 [ 348.741738][T12323] ? __sock_sendmsg+0x21c/0x270 [ 348.741749][T12323] ? ____sys_sendmsg+0x505/0x830 [ 348.741761][T12323] ? ___sys_sendmsg+0x21f/0x2a0 [ 348.741771][T12323] ? __x64_sys_sendmsg+0x19b/0x260 [ 348.741782][T12323] ? do_syscall_64+0xfa/0xfa0 [ 348.741793][T12323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.741813][T12323] ? __skb_clone+0x483/0x7a0 [ 348.741842][T12323] ? skb_clone+0x246/0x3a0 [ 348.741867][T12323] ? __netlink_deliver_tap+0x866/0x8b0 [ 348.741888][T12323] ? netlink_deliver_tap+0x2e/0x1b0 [ 348.741905][T12323] ? netlink_deliver_tap+0x2e/0x1b0 [ 348.741921][T12323] netlink_unicast+0x82f/0x9e0 [ 348.741936][T12323] ? __pfx_netlink_unicast+0x10/0x10 [ 348.741948][T12323] ? netlink_sendmsg+0x642/0xb30 [ 348.741966][T12323] ? skb_put+0x11b/0x210 [ 348.741989][T12323] netlink_sendmsg+0x805/0xb30 [ 348.742019][T12323] ? __pfx_netlink_sendmsg+0x10/0x10 [ 348.742043][T12323] ? aa_sock_msg_perm+0xf1/0x1d0 [ 348.742058][T12323] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 348.742068][T12323] ? __pfx_netlink_sendmsg+0x10/0x10 [ 348.742080][T12323] __sock_sendmsg+0x21c/0x270 [ 348.742091][T12323] ____sys_sendmsg+0x505/0x830 [ 348.742113][T12323] ? __pfx_____sys_sendmsg+0x10/0x10 [ 348.742145][T12323] ? import_iovec+0x74/0xa0 [ 348.742178][T12323] ___sys_sendmsg+0x21f/0x2a0 [ 348.742199][T12323] ? __pfx____sys_sendmsg+0x10/0x10 [ 348.742229][T12323] ? __fget_files+0x2a/0x420 [ 348.742242][T12323] ? __fget_files+0x3a0/0x420 [ 348.742268][T12323] __x64_sys_sendmsg+0x19b/0x260 [ 348.742293][T12323] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 348.742324][T12323] ? __pfx_ksys_write+0x10/0x10 [ 348.742346][T12323] ? do_syscall_64+0xbe/0xfa0 [ 348.742359][T12323] do_syscall_64+0xfa/0xfa0 [ 348.742370][T12323] ? lockdep_hardirqs_on+0x9c/0x150 [ 348.742381][T12323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.742391][T12323] ? clear_bhb_loop+0x60/0xb0 [ 348.742406][T12323] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.742423][T12323] RIP: 0033:0x7f9dcd58efc9 [ 348.742439][T12323] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 348.742454][T12323] RSP: 002b:00007f9dce341038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 348.742473][T12323] RAX: ffffffffffffffda RBX: 00007f9dcd7e5fa0 RCX: 00007f9dcd58efc9 [ 348.742487][T12323] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 348.742498][T12323] RBP: 00007f9dce341090 R08: 0000000000000000 R09: 0000000000000000 [ 348.742504][T12323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 348.742511][T12323] R13: 00007f9dcd7e6038 R14: 00007f9dcd7e5fa0 R15: 00007ffd80e1dab8 [ 348.742527][T12323] [ 349.313425][T12319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 349.323035][T12319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 349.449121][ T9] keyspan_pda 4-1:0.145: required endpoints missing [ 349.482392][ T5891] mvusb_mdio 5-1:150.59: probe with driver mvusb_mdio failed with error -5 [ 349.495591][ T9] keyspan_pda 4-1:0.43: Keyspan PDA converter detected [ 349.499129][T12333] netlink: 'syz.4.2295': attribute type 10 has an invalid length. [ 349.512759][ T9] usb 4-1: Keyspan PDA converter now attached to ttyUSB0 [ 349.520880][ T5891] usb 5-1: USB disconnect, device number 56 [ 349.558667][ T9] usb 4-1: USB disconnect, device number 97 [ 349.602350][ T9] keyspan_pda ttyUSB0: Keyspan PDA converter now disconnected from ttyUSB0 [ 349.624352][ T9] keyspan_pda 4-1:0.43: device disconnected [ 349.976803][ T9] usb 5-1: new low-speed USB device number 57 using dummy_hcd [ 350.015864][T12343] netlink: 'syz.3.2299': attribute type 10 has an invalid length. [ 350.024166][T12343] bridge0: port 3(netdevsim0) entered blocking state [ 350.031758][T12343] bridge0: port 3(netdevsim0) entered disabled state [ 350.038606][T12343] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 350.049070][T12343] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 350.057314][T12343] bridge0: port 3(netdevsim0) entered blocking state [ 350.064215][T12343] bridge0: port 3(netdevsim0) entered forwarding state [ 350.095397][T12343] IPVS: set_ctl: invalid protocol: 29 172.20.20.12:20000 [ 350.139219][ T9] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 350.147057][ T9] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 350.158586][ T9] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 350.171431][ T9] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 350.183748][ T9] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 350.206688][ T9] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 350.222862][ T9] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 350.234344][ T9] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 350.246798][ T9] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 350.258363][ T9] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 350.273139][ T9] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 350.281060][ T9] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 350.295763][ T9] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 350.307783][ T9] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 350.319448][ T9] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 350.333922][ T9] usb 5-1: string descriptor 0 read error: -22 [ 350.340248][ T9] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 350.349928][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.380918][ T9] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 350.483198][T12359] 9pnet: Could not find request transport: f [ 350.520480][T12362] loop4: detected capacity change from 0 to 2559 [ 350.527488][T12362] buffer_io_error: 317 callbacks suppressed [ 350.527505][T12362] Buffer I/O error on dev loop4, logical block 0, async page read [ 350.543818][T12362] Buffer I/O error on dev loop4, logical block 0, async page read [ 350.551921][T12362] Buffer I/O error on dev loop4, logical block 0, async page read [ 350.561040][T12362] Buffer I/O error on dev loop4, logical block 0, async page read [ 350.569343][T12362] Buffer I/O error on dev loop4, logical block 0, async page read [ 350.577835][T12362] Buffer I/O error on dev loop4, logical block 0, async page read [ 350.586057][T12362] loop4: unable to read partition table [ 350.591691][T12363] Buffer I/O error on dev loop4, logical block 0, lost async page write [ 350.591799][T12363] Buffer I/O error on dev loop4, logical block 1, lost async page write [ 350.591887][T12363] Buffer I/O error on dev loop4, logical block 2, lost async page write [ 350.608812][T12362] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 350.617592][T12363] Buffer I/O error on dev loop4, logical block 3, lost async page write [ 350.634719][ T5954] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 350.664248][T12365] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 350.678885][T12365] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 350.688130][ T798] usb 5-1: USB disconnect, device number 57 [ 350.718135][ T5196] ldm_validate_partition_table(): Disk read failed. [ 350.725243][ T5196] Dev loop4: unable to read RDB block 0 [ 350.732339][ T5196] loop4: unable to read partition table [ 350.749874][T12341] adutux: No device or device unplugged -19 [ 350.800243][ T5954] usb 4-1: Using ep0 maxpacket: 8 [ 350.809056][ T5954] usb 4-1: config 150 has an invalid interface number: 59 but max is 0 [ 350.809083][ T5954] usb 4-1: config 150 has no interface number 0 [ 350.809111][ T5954] usb 4-1: config 150 interface 59 has no altsetting 0 [ 350.814068][ T5954] usb 4-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice=36.86 [ 350.814096][ T5954] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 350.814114][ T5954] usb 4-1: Product: syz [ 350.814130][ T5954] usb 4-1: Manufacturer: syz [ 350.814145][ T5954] usb 4-1: SerialNumber: syz [ 351.281467][ T9] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 351.444031][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 351.455151][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 351.465208][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 351.479653][ T9] usb 2-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 351.491181][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 351.504762][ T9] usb 2-1: config 0 descriptor?? [ 351.565891][T12383] netlink: 43 bytes leftover after parsing attributes in process `syz.4.2315'. [ 351.570238][ T2152] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 351.753893][ T2152] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 351.764969][ T2152] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 351.776392][ T2152] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 351.785832][ T2152] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 351.793916][ T2152] usb 3-1: Manufacturer: syz [ 351.806207][ T2152] usb 3-1: config 0 descriptor?? [ 351.965419][ T9] acrux 0003:1A34:0802.001F: hidraw0: USB HID v0.00 Device [HID 1a34:0802] on usb-dummy_hcd.1-1/input0 [ 351.978518][ T9] acrux 0003:1A34:0802.001F: no inputs found [ 351.984547][ T9] acrux 0003:1A34:0802.001F: Failed to enable force feedback support, error: -19 [ 352.176016][ T9] usb 2-1: USB disconnect, device number 96 [ 352.190481][ T798] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 352.353572][ T798] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 352.363959][ T798] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 352.373101][ T798] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.384119][ T798] usb 5-1: config 0 descriptor?? [ 352.393266][ T798] pwc: Askey VC010 type 2 USB webcam detected. [ 352.675197][ T2152] uclogic 0003:256C:006D.0020: interface is invalid, ignoring [ 352.824517][ T798] pwc: recv_control_msg error -32 req 02 val 2b00 [ 352.831816][ T798] pwc: recv_control_msg error -32 req 02 val 2700 [ 352.839619][ T798] pwc: recv_control_msg error -32 req 02 val 2c00 [ 352.847178][ T798] pwc: recv_control_msg error -32 req 04 val 1000 [ 352.854297][ T798] pwc: recv_control_msg error -32 req 04 val 1300 [ 352.861285][ T798] pwc: recv_control_msg error -32 req 04 val 1400 [ 352.868688][ T798] pwc: recv_control_msg error -32 req 02 val 2000 [ 352.875840][ T798] pwc: recv_control_msg error -32 req 02 val 2100 [ 352.882861][ T798] pwc: recv_control_msg error -32 req 04 val 1500 [ 352.893919][T12381] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2314'. [ 352.903628][T12381] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2314'. [ 352.913059][T12381] netlink: 'syz.2.2314': attribute type 5 has an invalid length. [ 352.922402][T12381] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2314'. [ 352.944079][ T5911] usb 3-1: USB disconnect, device number 81 [ 353.324109][ T2152] usb 2-1: new full-speed USB device number 97 using dummy_hcd [ 353.332791][ T798] pwc: recv_control_msg error -71 req 02 val 2600 [ 353.339920][ T798] pwc: recv_control_msg error -71 req 02 val 2900 [ 353.346852][ T798] pwc: recv_control_msg error -71 req 02 val 2800 [ 353.353872][ T798] pwc: recv_control_msg error -71 req 04 val 1100 [ 353.361086][ T798] pwc: recv_control_msg error -71 req 04 val 1200 [ 353.368995][ T798] pwc: Registered as video103. [ 353.377982][ T798] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input69 [ 353.393902][ T798] usb 5-1: USB disconnect, device number 58 [ 353.497503][ T2152] usb 2-1: not running at top speed; connect to a high speed hub [ 353.530115][ T2152] usb 2-1: config 2 has an invalid interface number: 227 but max is 0 [ 353.548683][ T2152] usb 2-1: config 2 has no interface number 0 [ 353.555022][ T2152] usb 2-1: config 2 interface 227 has no altsetting 0 [ 353.575236][ T2152] usb 2-1: New USB device found, idVendor=093a, idProduct=2601, bcdDevice=2c.d4 [ 353.576266][ T5954] mvusb_mdio 4-1:150.59: probe with driver mvusb_mdio failed with error -5 [ 353.592248][ T2152] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 353.605774][ T5954] usb 4-1: USB disconnect, device number 98 [ 353.606305][ T2152] usb 2-1: Product: syz [ 353.619017][ T2152] usb 2-1: Manufacturer: syz [ 353.636070][ T2152] usb 2-1: SerialNumber: syz [ 353.879500][T12398] netlink: 184 bytes leftover after parsing attributes in process `syz.1.2319'. [ 353.895987][ T2152] gspca_main: pac7311-2.14.0 probing 093a:2601 [ 353.904310][ T2152] gspca_pac7311: reg_w() failed index 0xff, value 0x01, error -71 [ 353.917012][ T2152] pac7311 2-1:2.227: probe with driver pac7311 failed with error -71 [ 353.931092][ T2152] usb 2-1: USB disconnect, device number 97 [ 354.047969][T12417] netlink: 'syz.3.2328': attribute type 14 has an invalid length. [ 354.361349][ T2152] usb 4-1: new low-speed USB device number 99 using dummy_hcd [ 354.425459][ T5891] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 354.541302][T12430] netlink: 'syz.1.2334': attribute type 10 has an invalid length. [ 354.588707][ T5891] usb 5-1: Using ep0 maxpacket: 8 [ 354.596062][ T5891] usb 5-1: config 150 has an invalid interface number: 59 but max is 0 [ 354.604508][ T5891] usb 5-1: config 150 has no interface number 0 [ 354.616455][ T5891] usb 5-1: config 150 interface 59 has no altsetting 0 [ 354.626164][ T5891] usb 5-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice=36.86 [ 354.635558][ T5891] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.643887][ T5891] usb 5-1: Product: syz [ 354.648108][ T5891] usb 5-1: Manufacturer: syz [ 354.652885][ T5891] usb 5-1: SerialNumber: syz [ 355.185643][ T5911] usb 2-1: new full-speed USB device number 98 using dummy_hcd [ 355.356894][ T5911] usb 2-1: not running at top speed; connect to a high speed hub [ 355.365610][ T5911] usb 2-1: config 8 has an invalid interface number: 247 but max is 0 [ 355.374043][ T5911] usb 2-1: config 8 has no interface number 0 [ 355.380321][ T5911] usb 2-1: config 8 interface 247 altsetting 54 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 355.391488][ T5911] usb 2-1: config 8 interface 247 altsetting 54 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 355.402598][ T5911] usb 2-1: config 8 interface 247 altsetting 54 has an invalid endpoint descriptor of length 2, skipping [ 355.413873][ T5911] usb 2-1: config 8 interface 247 altsetting 54 has an invalid descriptor for endpoint zero, skipping [ 355.424883][ T5911] usb 2-1: config 8 interface 247 altsetting 54 endpoint 0x2 has invalid maxpacket 16384, setting to 64 [ 355.437795][ T5911] usb 2-1: config 8 interface 247 altsetting 54 has 7 endpoint descriptors, different from the interface descriptor's value: 6 [ 355.451003][ T5911] usb 2-1: config 8 interface 247 has no altsetting 0 [ 355.459844][ T5911] usb 2-1: New USB device found, idVendor=0763, idProduct=1021, bcdDevice= 6.6d [ 355.468951][ T5911] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 355.477000][ T5911] usb 2-1: Product: syz [ 355.481161][ T5911] usb 2-1: Manufacturer: syz [ 355.485796][ T5911] usb 2-1: SerialNumber: syz [ 355.493834][T12441] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 355.725785][ T5911] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 355.773565][ T5911] usb 2-1: USB disconnect, device number 98 [ 355.819689][ T5830] udevd[5830]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:8.247/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 355.837199][ T52] Bluetooth: hci1: command 0x1003 tx timeout [ 355.843868][ T5832] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 356.393970][T12446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 356.410213][T12446] bond0: (slave rose0): Enslaving as an active interface with an up link [ 356.681919][ T5916] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 356.753630][T12464] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 356.846402][ T5916] usb 2-1: unable to get BOS descriptor or descriptor too short [ 356.856548][ T5916] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 356.868402][ T5916] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 356.884097][ T5916] usb 2-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=6b.75 [ 356.894178][ T5916] usb 2-1: New USB device strings: Mfr=98, Product=2, SerialNumber=3 [ 356.902866][ T5916] usb 2-1: Product: syz [ 356.908218][ T5916] usb 2-1: Manufacturer: syz [ 356.912948][ T5916] usb 2-1: SerialNumber: syz [ 356.933147][ T5916] smsusb:smsusb_probe: board id=8, interface number 0 [ 356.941001][ T5916] smsusb:smsusb_probe: Device initialized with return code -19 [ 357.177700][T12446] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 357.189339][T12446] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 357.203599][ T5911] usb 2-1: USB disconnect, device number 99 [ 357.345292][ T2152] usb 4-1: unable to get BOS descriptor or descriptor too short [ 357.398636][ T2152] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 357.420758][ T2152] usb 4-1: can't read configurations, error -71 [ 357.455364][ T5891] mvusb_mdio 5-1:150.59: probe with driver mvusb_mdio failed with error -5 [ 357.471728][ T5891] usb 5-1: USB disconnect, device number 59 [ 357.871503][T12512] loop4: detected capacity change from 0 to 2559 [ 357.878377][T12512] buffer_io_error: 333 callbacks suppressed [ 357.878393][T12512] Buffer I/O error on dev loop4, logical block 0, async page read [ 357.896360][T12512] Buffer I/O error on dev loop4, logical block 0, async page read [ 357.913535][T12512] Buffer I/O error on dev loop4, logical block 0, async page read [ 357.926138][T12512] Buffer I/O error on dev loop4, logical block 0, async page read [ 357.942970][T12512] Buffer I/O error on dev loop4, logical block 0, async page read [ 357.951125][T12512] Buffer I/O error on dev loop4, logical block 0, async page read [ 357.959304][T12512] Buffer I/O error on dev loop4, logical block 0, async page read [ 357.965082][ T5954] usb 5-1: new low-speed USB device number 60 using dummy_hcd [ 357.967469][T12512] Buffer I/O error on dev loop4, logical block 0, async page read [ 357.983809][T12512] ldm_validate_partition_table(): Disk read failed. [ 357.993516][T12512] Buffer I/O error on dev loop4, logical block 0, async page read [ 358.001662][T12512] Buffer I/O error on dev loop4, logical block 0, async page read [ 358.009937][T12512] Dev loop4: unable to read RDB block 0 [ 358.016026][T12512] loop4: unable to read partition table [ 358.022057][T12512] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 358.046622][ T5196] ldm_validate_partition_table(): Disk read failed. [ 358.054581][ T5196] Dev loop4: unable to read RDB block 0 [ 358.060562][ T5196] loop4: unable to read partition table [ 358.110081][ T2152] usb 4-1: new low-speed USB device number 100 using dummy_hcd [ 358.151848][ T5954] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 358.159698][ T5954] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 358.172356][ T5954] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 358.179035][ T5891] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 358.184588][ T5954] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 358.203533][ T5954] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 358.216490][ T5954] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 358.227779][ T5954] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 358.238998][ T5954] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 358.251047][ T5954] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 358.262568][ T5954] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 358.277197][ T5954] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 358.284638][ T5954] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 358.296526][ T5954] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 358.296637][ T2152] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 358.308569][ T5954] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 358.327173][ T2152] usb 4-1: config 0 has no interface number 0 [ 358.330177][ T5954] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 358.333603][ T2152] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 358.361137][ T5954] usb 5-1: string descriptor 0 read error: -22 [ 358.367563][ T5954] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 358.373431][ T2152] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 358.377631][ T5954] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.387591][ T5891] usb 2-1: Using ep0 maxpacket: 8 [ 358.403876][ T2152] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 358.414304][ T5954] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 358.414700][ T2152] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 358.414813][ T5891] usb 2-1: config 150 has an invalid interface number: 59 but max is 0 [ 358.440431][ T5891] usb 2-1: config 150 has no interface number 0 [ 358.448417][ T2152] usb 4-1: config 0 descriptor?? [ 358.453820][ T5891] usb 2-1: config 150 interface 59 has no altsetting 0 [ 358.461089][T12503] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 358.463815][ T5891] usb 2-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice=36.86 [ 358.542822][ T2152] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior1 [ 358.553807][ T5891] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.561821][ T5891] usb 2-1: Product: syz [ 358.570056][ T5891] usb 2-1: Manufacturer: syz [ 358.574896][ T5891] usb 2-1: SerialNumber: syz [ 358.656846][T12525] sctp: [Deprecated]: syz.2.2355 (pid 12525) Use of struct sctp_assoc_value in delayed_ack socket option. [ 358.656846][T12525] Use struct sctp_sack_info instead [ 358.698508][T12526] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 358.722906][T12526] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 358.726811][T12503] netlink: 'syz.3.2351': attribute type 39 has an invalid length. [ 358.741510][ T5954] usb 5-1: USB disconnect, device number 60 [ 358.767857][ T5911] usb 4-1: USB disconnect, device number 100 [ 358.921765][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805baaf400: rx timeout, send abort [ 359.457988][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805baad800: rx timeout, send abort [ 359.466357][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805baaf400: abort rx timeout. Force session deactivation [ 359.598236][T12537] input: syz0 as /devices/virtual/input/input71 [ 359.633747][ T5911] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 359.804399][ T5911] usb 5-1: Using ep0 maxpacket: 32 [ 359.813512][ T5911] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 359.823942][ T5911] usb 5-1: config 0 has no interface number 0 [ 359.832965][ T5911] usb 5-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 359.842906][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.851697][ T5911] usb 5-1: Product: syz [ 359.855876][ T5911] usb 5-1: Manufacturer: syz [ 359.860598][ T5911] usb 5-1: SerialNumber: syz [ 359.868087][ T5911] usb 5-1: config 0 descriptor?? [ 359.876925][ T5911] radio-si470x 5-1:0.35: could not find interrupt in endpoint [ 359.877884][T12544] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 359.885375][ T5911] radio-si470x 5-1:0.35: probe with driver radio-si470x failed with error -5 [ 359.911347][ T5954] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 360.000969][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805baad800: abort rx timeout. Force session deactivation [ 360.082465][ T5954] usb 3-1: Using ep0 maxpacket: 32 [ 360.089633][ T5911] radio-raremono 5-1:0.35: this is not Thanko's Raremono. [ 360.096937][ T5954] usb 3-1: config 0 has an invalid interface number: 37 but max is 1 [ 360.105398][ T5911] usbhid 5-1:0.35: couldn't find an input interrupt endpoint [ 360.113959][ T5954] usb 3-1: config 0 has no interface number 1 [ 360.123072][ T5954] usb 3-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=20.a3 [ 360.132438][ T5954] usb 3-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 360.140658][ T5954] usb 3-1: Product: syz [ 360.144842][ T5954] usb 3-1: Manufacturer: syz [ 360.149594][ T5954] usb 3-1: SerialNumber: syz [ 360.156660][ T5954] usb 3-1: config 0 descriptor?? [ 360.161734][ T5916] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 360.309656][ T5911] usb 5-1: USB disconnect, device number 61 [ 360.321567][ T5916] usb 4-1: unable to get BOS descriptor or descriptor too short [ 360.331106][ T5916] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 360.341814][ T5916] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 360.353597][ T5916] usb 4-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=6b.75 [ 360.362906][ T5916] usb 4-1: New USB device strings: Mfr=98, Product=2, SerialNumber=3 [ 360.371015][ T5916] usb 4-1: Product: syz [ 360.375979][ T5916] usb 4-1: Manufacturer: syz [ 360.380607][ T5916] usb 4-1: SerialNumber: syz [ 360.394715][ T5916] smsusb:smsusb_probe: board id=8, interface number 0 [ 360.401686][ T5916] smsusb:smsusb_probe: Device initialized with return code -19 [ 360.401754][ T5954] qcserial 3-1:0.37: Qualcomm USB modem converter detected [ 360.617786][T12544] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 360.626595][T12544] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 361.001752][T12552] tipc: Started in network mode [ 361.001784][T12552] tipc: Node identity fe8000000000000000000000000000aa, cluster identity 4711 [ 361.004549][T12552] tipc: Enabled bearer , priority 10 [ 361.148143][ T5891] mvusb_mdio 2-1:150.59: probe with driver mvusb_mdio failed with error -5 [ 361.180038][ T5891] usb 2-1: USB disconnect, device number 100 [ 361.305228][T12565] input: syz0 as /devices/virtual/input/input72 [ 361.515963][ T5891] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 361.677899][ T5891] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 361.688193][ T5891] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 361.698475][ T5891] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 361.707587][ T5891] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 361.715688][ T5891] usb 2-1: SerialNumber: syz [ 361.794504][ T5954] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 361.932494][ T5954] usb 5-1: device descriptor read/64, error -71 [ 361.946079][ T5891] usb 2-1: 0:2 : does not exist [ 361.959445][ T5891] usb 2-1: USB disconnect, device number 101 [ 361.981790][ T7489] udevd[7489]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 362.189174][ T5954] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 362.200081][ T5891] tipc: Node number set to 4269801642 [ 362.338876][ T5954] usb 5-1: device descriptor read/64, error -71 [ 362.456738][ T5954] usb usb5-port1: attempt power cycle [ 362.820079][ T5954] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 362.841954][ T5954] usb 5-1: device descriptor read/8, error -71 [ 362.859998][ T798] usb 3-1: USB disconnect, device number 82 [ 362.868779][ T798] qcserial 3-1:0.37: device disconnected [ 362.930581][T12585] tipc: Enabling of bearer rejected, failed to enable media [ 362.970935][T12587] netlink: 19 bytes leftover after parsing attributes in process `syz.2.2377'. [ 363.012823][ T5911] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 363.045648][ T43] usb 4-1: USB disconnect, device number 101 [ 363.100519][ T5954] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 363.131382][ T5954] usb 5-1: device descriptor read/8, error -71 [ 363.194545][ T5911] usb 2-1: Using ep0 maxpacket: 8 [ 363.196318][ T5911] usb 2-1: config 150 has an invalid interface number: 59 but max is 0 [ 363.196345][ T5911] usb 2-1: config 150 has no interface number 0 [ 363.196375][ T5911] usb 2-1: config 150 interface 59 has no altsetting 0 [ 363.198628][ T5911] usb 2-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice=36.86 [ 363.198660][ T5911] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.198679][ T5911] usb 2-1: Product: syz [ 363.198693][ T5911] usb 2-1: Manufacturer: syz [ 363.198709][ T5911] usb 2-1: SerialNumber: syz [ 363.260746][ T5954] usb usb5-port1: unable to enumerate USB device [ 363.739826][ T5916] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 363.846722][ T5954] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 363.879003][ T5916] usb 3-1: device descriptor read/64, error -71 [ 364.017828][ T5954] usb 4-1: Using ep0 maxpacket: 32 [ 364.024521][ T5954] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 364.035621][ T5954] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 364.045473][ T5954] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 364.055660][ T5954] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 364.066355][ T5954] usb 4-1: config 0 descriptor?? [ 364.076669][ T5954] hub 4-1:0.0: USB hub found [ 364.135591][ T5916] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 364.285118][ T5916] usb 3-1: device descriptor read/64, error -71 [ 364.403020][ T5916] usb usb3-port1: attempt power cycle [ 364.504059][ T5954] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 364.729998][T12620] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 364.744356][T12620] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 364.767596][ T5954] usbhid 4-1:0.0: can't add hid device: -71 [ 364.775457][ T5916] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 364.788465][ T5954] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 364.810071][ T5916] usb 3-1: device descriptor read/8, error -71 [ 364.832383][ T5954] usb 4-1: USB disconnect, device number 102 [ 365.076591][ T5916] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 365.098418][ T5916] usb 3-1: device descriptor read/8, error -71 [ 365.215727][ T5916] usb usb3-port1: unable to enumerate USB device [ 365.226256][ T5954] usb 5-1: new full-speed USB device number 66 using dummy_hcd [ 365.365256][ T5954] usb 5-1: device descriptor read/64, error -71 [ 365.643316][ T5954] usb 5-1: new full-speed USB device number 67 using dummy_hcd [ 365.782241][ T5954] usb 5-1: device descriptor read/64, error -71 [ 365.803703][ T2152] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 365.900156][ T5954] usb usb5-port1: attempt power cycle [ 365.936505][ T5911] mvusb_mdio 2-1:150.59: probe with driver mvusb_mdio failed with error -5 [ 365.951455][ T5911] usb 2-1: USB disconnect, device number 102 [ 365.953581][ T2152] usb 4-1: device descriptor read/64, error -71 [ 366.006198][T12637] loop4: detected capacity change from 0 to 2559 [ 366.014170][ T7489] buffer_io_error: 27 callbacks suppressed [ 366.014186][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 366.028703][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 366.036741][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 366.044740][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 366.052723][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 366.060645][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 366.068548][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 366.076525][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 366.085106][ T7489] ldm_validate_partition_table(): Disk read failed. [ 366.091790][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 366.099776][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 366.108186][ T7489] Dev loop4: unable to read RDB block 0 [ 366.114335][ T7489] loop4: unable to read partition table [ 366.122340][T12637] ldm_validate_partition_table(): Disk read failed. [ 366.129802][T12637] Dev loop4: unable to read RDB block 0 [ 366.136215][T12637] loop4: unable to read partition table [ 366.142196][T12637] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 366.231391][ T2152] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 366.263495][ T5954] usb 5-1: new full-speed USB device number 68 using dummy_hcd [ 366.285449][ T5954] usb 5-1: device descriptor read/8, error -71 [ 366.370383][ T2152] usb 4-1: device descriptor read/64, error -71 [ 366.488206][ T2152] usb usb4-port1: attempt power cycle [ 366.520224][ T5916] usb 2-1: new full-speed USB device number 103 using dummy_hcd [ 366.541537][ T5954] usb 5-1: new full-speed USB device number 69 using dummy_hcd [ 366.565135][ T5954] usb 5-1: device descriptor read/8, error -71 [ 366.681720][ T5954] usb usb5-port1: unable to enumerate USB device [ 366.686039][ T5916] usb 2-1: New USB device found, idVendor=103d, idProduct=0101, bcdDevice=77.ea [ 366.697310][ T5916] usb 2-1: New USB device strings: Mfr=64, Product=2, SerialNumber=3 [ 366.705601][ T5916] usb 2-1: Product: syz [ 366.709870][ T5916] usb 2-1: Manufacturer: syz [ 366.714590][ T5916] usb 2-1: SerialNumber: syz [ 366.724273][ T5916] usb 2-1: config 0 descriptor?? [ 366.744879][ T5916] usb 2-1: cannot find UAC_HEADER [ 366.769120][ T5916] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 366.807241][ T7489] udevd[7489]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 366.852390][ T2152] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 366.866358][T12647] input: syz1 as /devices/virtual/input/input74 [ 366.875567][ T2152] usb 4-1: device descriptor read/8, error -71 [ 367.129700][ T2152] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 367.152287][ T2152] usb 4-1: device descriptor read/8, error -71 [ 367.269886][ T2152] usb usb4-port1: unable to enumerate USB device [ 367.290082][ T5954] usb 3-1: new low-speed USB device number 87 using dummy_hcd [ 367.462545][ T5954] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 367.470033][ T5954] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 367.480987][ T5954] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 367.492680][ T5954] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 367.504051][ T5954] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 367.516125][ T5954] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 367.523567][ T5954] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 367.534301][ T5954] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 367.546039][ T5954] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 367.557208][ T5954] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 367.569704][ T5954] usb 3-1: config 168 descriptor has 1 excess byte, ignoring [ 367.577108][ T5954] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 367.587835][ T5954] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 367.599506][ T5954] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 367.610664][ T5954] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 367.624454][ T5954] usb 3-1: string descriptor 0 read error: -22 [ 367.630733][ T5954] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 367.639856][ T5954] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.655332][ T5954] adutux 3-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 367.928742][T12654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 367.938543][T12654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 367.947897][ T5916] usb 3-1: USB disconnect, device number 87 [ 368.588451][ T5916] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 368.755339][ T5916] usb 5-1: Using ep0 maxpacket: 8 [ 368.756686][ T5916] usb 5-1: config 150 has an invalid interface number: 59 but max is 0 [ 368.756704][ T5916] usb 5-1: config 150 has no interface number 0 [ 368.756727][ T5916] usb 5-1: config 150 interface 59 has no altsetting 0 [ 368.758571][ T5916] usb 5-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice=36.86 [ 368.758596][ T5916] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.758615][ T5916] usb 5-1: Product: syz [ 368.758629][ T5916] usb 5-1: Manufacturer: syz [ 368.758642][ T5916] usb 5-1: SerialNumber: syz [ 368.926084][T12677] input: syz0 as /devices/virtual/input/input75 [ 368.926207][ T43] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 369.008658][ T5916] mvusb_mdio 5-1:150.59: probe with driver mvusb_mdio failed with error -5 [ 369.030148][ T5916] usb 5-1: USB disconnect, device number 70 [ 369.137457][ T43] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 369.151453][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 369.158398][ T43] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 369.172182][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.194645][ T43] usb 3-1: config 0 descriptor?? [ 369.406140][ T5954] usb 2-1: USB disconnect, device number 103 [ 369.553745][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 369.564384][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 369.573327][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 369.581471][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 369.596447][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 369.602645][T12702] FAULT_INJECTION: forcing a failure. [ 369.602645][T12702] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 369.626561][ T5832] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 369.642970][T12702] CPU: 0 UID: 0 PID: 12702 Comm: syz.1.2418 Not tainted syzkaller #0 PREEMPT(full) [ 369.642995][T12702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 369.643010][T12702] Call Trace: [ 369.643017][T12702] [ 369.643025][T12702] dump_stack_lvl+0x189/0x250 [ 369.643051][T12702] ? __pfx____ratelimit+0x10/0x10 [ 369.643071][T12702] ? __pfx_dump_stack_lvl+0x10/0x10 [ 369.643089][T12702] ? __pfx__printk+0x10/0x10 [ 369.643109][T12702] ? __might_fault+0xb0/0x130 [ 369.643140][T12702] should_fail_ex+0x414/0x560 [ 369.643163][T12702] _copy_from_user+0x2d/0xb0 [ 369.643187][T12702] csum_and_copy_from_iter_full+0x4a1/0x1ed0 [ 369.643230][T12702] ? __pfx_csum_and_copy_from_iter_full+0x10/0x10 [ 369.643261][T12702] ? rcu_is_watching+0x15/0xb0 [ 369.643280][T12702] ? trace_kmalloc+0x1f/0xd0 [ 369.643299][T12702] ? __kmalloc_node_track_caller_noprof+0x590/0x810 [ 369.643326][T12702] ip_generic_getfrag+0x12f/0x2b0 [ 369.643348][T12702] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 369.643368][T12702] ? skb_put+0x11b/0x210 [ 369.643390][T12702] __ip6_append_data+0x3974/0x3f30 [ 369.643409][T12702] ? __lock_acquire+0xab9/0xd20 [ 369.643450][T12702] ? __pfx_raw6_getfrag+0x10/0x10 [ 369.643488][T12702] ? __pfx___ip6_append_data+0x10/0x10 [ 369.643505][T12702] ? __pfx_ip6_mtu+0x10/0x10 [ 369.643531][T12702] ip6_append_data+0x1c1/0x380 [ 369.643551][T12702] ? __pfx_raw6_getfrag+0x10/0x10 [ 369.643573][T12702] rawv6_sendmsg+0x1286/0x1830 [ 369.643618][T12702] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 369.643662][T12702] ? __pfx_aa_sk_perm+0x10/0x10 [ 369.643687][T12702] ? sock_rps_record_flow+0x19/0x410 [ 369.643711][T12702] ? inet_sendmsg+0x2f4/0x370 [ 369.643729][T12702] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 369.643750][T12702] __sock_sendmsg+0x19c/0x270 [ 369.643772][T12702] ____sys_sendmsg+0x52d/0x830 [ 369.643798][T12702] ? __pfx_____sys_sendmsg+0x10/0x10 [ 369.643830][T12702] ? import_iovec+0x74/0xa0 [ 369.643856][T12702] ___sys_sendmsg+0x21f/0x2a0 [ 369.643880][T12702] ? __pfx____sys_sendmsg+0x10/0x10 [ 369.643943][T12702] ? __might_fault+0xb0/0x130 [ 369.643969][T12702] __sys_sendmmsg+0x227/0x430 [ 369.643997][T12702] ? __pfx___sys_sendmmsg+0x10/0x10 [ 369.644028][T12702] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 369.644066][T12702] ? ksys_write+0x22a/0x250 [ 369.644088][T12702] ? __pfx_ksys_write+0x10/0x10 [ 369.644109][T12702] __x64_sys_sendmmsg+0xa0/0xc0 [ 369.644130][T12702] do_syscall_64+0xfa/0xfa0 [ 369.644149][T12702] ? lockdep_hardirqs_on+0x9c/0x150 [ 369.644166][T12702] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.644182][T12702] ? clear_bhb_loop+0x60/0xb0 [ 369.644202][T12702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 369.644224][T12702] RIP: 0033:0x7f212738efc9 [ 369.644241][T12702] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 369.644254][T12702] RSP: 002b:00007f21281cf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 369.644274][T12702] RAX: ffffffffffffffda RBX: 00007f21275e5fa0 RCX: 00007f212738efc9 [ 369.644287][T12702] RDX: 0000000000000002 RSI: 0000200000000000 RDI: 0000000000000003 [ 369.644297][T12702] RBP: 00007f21281cf090 R08: 0000000000000000 R09: 0000000000000000 [ 369.644308][T12702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 369.644317][T12702] R13: 00007f21275e6038 R14: 00007f21275e5fa0 R15: 00007fff14633398 [ 369.644345][T12702] [ 370.090597][ T5832] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 370.111894][ T5832] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 370.135518][ T5832] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 370.143373][ T5832] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 370.388397][T12718] JFS: charset not found [ 370.388588][T12721] input: syz0 as /devices/virtual/input/input76 [ 370.399092][ T60] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.521396][ T60] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.524672][ T5954] usb 3-1: USB disconnect, device number 88 [ 370.604228][ T60] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.626591][ T5911] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 370.714757][ T60] bridge0: port 3(netdevsim0) entered disabled state [ 370.740144][ T60] netdevsim netdevsim3 netdevsim0 (unregistering): left allmulticast mode [ 370.749177][ T60] netdevsim netdevsim3 netdevsim0 (unregistering): left promiscuous mode [ 370.767618][ T60] bridge0: port 3(netdevsim0) entered disabled state [ 370.778389][ T5911] usb 5-1: device descriptor read/64, error -71 [ 370.789293][ T60] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 371.032882][ T5911] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 371.067487][T12699] chnl_net:caif_netlink_parms(): no params data found [ 371.080376][ T60] bridge_slave_1: left allmulticast mode [ 371.091691][ T60] bridge_slave_1: left promiscuous mode [ 371.097073][ T9] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 371.098346][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 371.121276][ T60] bridge_slave_0: left allmulticast mode [ 371.126963][ T60] bridge_slave_0: left promiscuous mode [ 371.145594][ T60] bridge0: port 1(bridge_slave_0) entered disabled state [ 371.182623][ T5911] usb 5-1: device descriptor read/64, error -71 [ 371.273499][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 64, changing to 10 [ 371.295024][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 371.305995][ T9] usb 3-1: New USB device found, idVendor=046a, idProduct=0023, bcdDevice= 0.00 [ 371.319784][ T5911] usb usb5-port1: attempt power cycle [ 371.334269][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 371.362044][ T9] usb 3-1: config 0 descriptor?? [ 371.610090][ T60] bridge0 (unregistering): left allmulticast mode [ 371.679891][T12763] sctp: [Deprecated]: syz.1.2430 (pid 12763) Use of struct sctp_assoc_value in delayed_ack socket option. [ 371.679891][T12763] Use struct sctp_sack_info instead [ 371.717348][ T5911] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 371.750196][ T5911] usb 5-1: device descriptor read/8, error -71 [ 371.860045][ T60] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 371.871276][ T60] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 371.881798][ T60] bond0 (unregistering): Released all slaves [ 371.958796][ T60] tipc: Disabling bearer [ 371.973280][ T60] tipc: Left network mode [ 372.006214][ T5911] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 372.041189][ T5911] usb 5-1: device descriptor read/8, error -71 [ 372.073609][T12773] input: syz0 as /devices/virtual/input/input77 [ 372.157269][ T5911] usb usb5-port1: unable to enumerate USB device [ 372.170326][T12699] bridge0: port 1(bridge_slave_0) entered blocking state [ 372.180329][T12699] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.185369][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 372.193797][T12699] bridge_slave_0: entered allmulticast mode [ 372.194315][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 372.204934][T12699] bridge_slave_0: entered promiscuous mode [ 372.213154][ T9] usb 3-1: USB disconnect, device number 89 [ 372.224548][T12699] bridge0: port 2(bridge_slave_1) entered blocking state [ 372.233275][T12699] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.240530][T12699] bridge_slave_1: entered allmulticast mode [ 372.254337][T12699] bridge_slave_1: entered promiscuous mode [ 372.307298][T12699] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 372.341551][T12699] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 372.352037][ T52] Bluetooth: hci1: command tx timeout [ 372.404581][T12782] loop4: detected capacity change from 0 to 2559 [ 372.413354][ T7489] buffer_io_error: 27 callbacks suppressed [ 372.413369][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 372.428720][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 372.437661][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 372.437770][T12699] team0: Port device team_slave_0 added [ 372.447783][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 372.459518][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 372.464993][T12699] team0: Port device team_slave_1 added [ 372.484747][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 372.493662][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 372.502043][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 372.515527][ T7489] ldm_validate_partition_table(): Disk read failed. [ 372.524824][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 372.533738][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 372.542806][ T7489] Dev loop4: unable to read RDB block 0 [ 372.550658][T12699] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 372.562737][ T7489] loop4: unable to read partition table [ 372.569541][T12699] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 372.607218][T12699] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 372.611821][T12782] ldm_validate_partition_table(): Disk read failed. [ 372.619944][T12699] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 372.632803][T12699] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 372.636473][T12782] Dev loop4: unable to read RDB block 0 [ 372.658785][T12699] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 372.688880][T12782] loop4: unable to read partition table [ 372.695328][ T5916] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 372.701574][ T5916] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 372.714712][T12782] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 372.755757][ T5196] ldm_validate_partition_table(): Disk read failed. [ 372.790879][ T5196] Dev loop4: unable to read RDB block 0 [ 372.802909][T12699] hsr_slave_0: entered promiscuous mode [ 372.811894][ T5196] loop4: unable to read partition table [ 372.824391][T12699] hsr_slave_1: entered promiscuous mode [ 372.844837][T12699] debugfs: 'hsr0' already exists in 'hsr' [ 372.850619][T12699] Cannot create hsr debugfs directory [ 373.088850][ T60] veth1_macvtap: left promiscuous mode [ 373.094576][ T60] veth0_macvtap: left promiscuous mode [ 373.100339][ T60] veth1_vlan: left promiscuous mode [ 373.105789][ T60] veth0_vlan: left promiscuous mode [ 373.288664][T12808] input: syz0 as /devices/virtual/input/input78 [ 373.597179][T12814] netlink: 'syz.4.2442': attribute type 10 has an invalid length. [ 373.682527][ T60] team0 (unregistering): Port device team_slave_1 removed [ 373.721373][ T60] team0 (unregistering): Port device team_slave_0 removed [ 374.467525][T12832] input: syz0 as /devices/virtual/input/input79 [ 375.180908][ T2152] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 375.250480][T12699] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 375.312518][T12699] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 375.364257][ T2152] usb 2-1: Using ep0 maxpacket: 8 [ 375.367370][T12699] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 375.380766][ T2152] usb 2-1: config 0 has an invalid interface number: 186 but max is 0 [ 375.405318][ T2152] usb 2-1: config 0 has no interface number 0 [ 375.421758][T12699] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 375.436508][ T2152] usb 2-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 375.451779][ T2152] usb 2-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 375.484952][ T2152] usb 2-1: New USB device found, idVendor=07c0, idProduct=1500, bcdDevice=b8.c5 [ 375.504826][ T2152] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.514420][ T2152] usb 2-1: Product: syz [ 375.523748][ T2152] usb 2-1: Manufacturer: syz [ 375.534057][ T2152] usb 2-1: SerialNumber: syz [ 375.546900][T12881] tipc: Enabling of bearer rejected, failed to enable media [ 375.561683][ T2152] usb 2-1: config 0 descriptor?? [ 375.599259][T12883] input: syz0 as /devices/virtual/input/input80 [ 375.753540][T12699] 8021q: adding VLAN 0 to HW filter on device bond0 [ 375.780286][T12699] 8021q: adding VLAN 0 to HW filter on device team0 [ 375.803422][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 375.810629][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 375.835700][ T2152] iowarrior 2-1:0.186: IOWarrior product=0x1500, serial=42424242 interface=186 now attached to iowarrior0 [ 375.843422][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 375.854243][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 375.895134][T12699] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 375.911925][T12699] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 375.995097][ T9] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 376.058698][ T2152] usb 2-1: USB disconnect, device number 104 [ 376.171450][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=08b6, bcdDevice=ca.8e [ 376.202817][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 376.224354][ T9] pwc: Logitech/Cisco VT Camera webcam detected. [ 376.335191][T12699] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 376.439857][ T9] pwc: Failed to set LED on/off time (-71) [ 376.466643][ T9] pwc: send_video_command error -71 [ 376.471898][ T9] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 376.496489][T12699] veth0_vlan: entered promiscuous mode [ 376.504396][ T9] Philips webcam 3-1:127.0: probe with driver Philips webcam failed with error -71 [ 376.525449][T12699] veth1_vlan: entered promiscuous mode [ 376.534279][ T9] usb 3-1: USB disconnect, device number 90 [ 376.588278][T12699] veth0_macvtap: entered promiscuous mode [ 376.617860][T12699] veth1_macvtap: entered promiscuous mode [ 376.673043][T12699] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 376.710145][T12699] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 376.753137][ T60] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 376.785863][ T60] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 376.785931][ T60] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 376.785965][ T60] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.032264][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 377.040136][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 377.152532][ T3082] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 377.181786][ T3082] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 377.317253][T12937] input: syz0 as /devices/virtual/input/input81 [ 377.771264][T12960] sctp: [Deprecated]: syz.3.2474 (pid 12960) Use of int in max_burst socket option. [ 377.771264][T12960] Use struct sctp_assoc_value instead [ 377.774965][T12962] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2476'. [ 377.983884][ T2152] usb 3-1: new full-speed USB device number 91 using dummy_hcd [ 378.015609][T12972] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2478'. [ 378.193389][ T2152] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 378.222393][ T2152] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.248648][T12981] netlink: 'syz.4.2481': attribute type 4 has an invalid length. [ 378.253458][ T2152] usb 3-1: Product: syz [ 378.262722][T12983] loop4: detected capacity change from 0 to 2559 [ 378.263352][ T2152] usb 3-1: Manufacturer: syz [ 378.280530][T12983] buffer_io_error: 43 callbacks suppressed [ 378.280546][T12983] Buffer I/O error on dev loop4, logical block 0, async page read [ 378.291875][ T2152] usb 3-1: SerialNumber: syz [ 378.300006][T12981] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2481'. [ 378.309863][T12983] Buffer I/O error on dev loop4, logical block 0, async page read [ 378.326821][T12983] Buffer I/O error on dev loop4, logical block 0, async page read [ 378.328569][ T2152] usb 3-1: config 0 descriptor?? [ 378.351409][T12983] Buffer I/O error on dev loop4, logical block 0, async page read [ 378.376069][T12981] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 378.391957][T12983] Buffer I/O error on dev loop4, logical block 0, async page read [ 378.392117][T12983] Buffer I/O error on dev loop4, logical block 0, async page read [ 378.392255][T12983] Buffer I/O error on dev loop4, logical block 0, async page read [ 378.392374][T12983] Buffer I/O error on dev loop4, logical block 0, async page read [ 378.463478][T12983] ldm_validate_partition_table(): Disk read failed. [ 378.470889][T12983] Buffer I/O error on dev loop4, logical block 0, async page read [ 378.486580][T12983] Buffer I/O error on dev loop4, logical block 0, async page read [ 378.520188][T12983] Dev loop4: unable to read RDB block 0 [ 378.526263][T12983] loop4: unable to read partition table [ 378.564183][T12983] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 378.594212][ T2152] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 378.981042][ T5916] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 379.150373][ T5916] usb 2-1: Using ep0 maxpacket: 16 [ 379.158306][ T5916] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 379.166831][ T5916] usb 2-1: config 0 has no interface number 0 [ 379.173161][ T5916] usb 2-1: config 0 interface 1 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 379.185068][ T5916] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 379.196615][ T5916] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 379.210671][ T5916] usb 2-1: New USB device found, idVendor=1a86, idProduct=752d, bcdDevice=2d.4d [ 379.221110][ T5916] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 379.230496][ T5916] usb 2-1: Product: syz [ 379.236259][ T5916] usb 2-1: Manufacturer: syz [ 379.241220][ T5916] usb 2-1: SerialNumber: syz [ 379.257532][ T5916] usb 2-1: config 0 descriptor?? [ 379.269179][ T5916] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 379.327019][ T5916] snd-usb-audio 2-1:0.1: probe with driver snd-usb-audio failed with error -12 [ 379.352933][ T5857] usb 4-1: new full-speed USB device number 107 using dummy_hcd [ 379.397049][ T5830] udevd[5830]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 379.488827][T12999] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2487'. [ 379.500120][ T5916] usb 2-1: USB disconnect, device number 105 [ 379.523949][ T5857] usb 4-1: device descriptor read/64, error -71 [ 379.780490][ T5857] usb 4-1: new full-speed USB device number 108 using dummy_hcd [ 379.941269][ T5857] usb 4-1: device descriptor read/64, error -71 [ 380.058953][ T5857] usb usb4-port1: attempt power cycle [ 380.120829][ T2152] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 380.155512][ T2152] usb 3-1: USB disconnect, device number 91 [ 380.379280][ T43] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 380.432858][ T5857] usb 4-1: new full-speed USB device number 109 using dummy_hcd [ 380.454834][ T5857] usb 4-1: device descriptor read/8, error -71 [ 380.550396][ T2152] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 380.553384][ T43] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 380.568324][ T43] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 380.578329][ T43] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 380.588476][ T43] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 380.598521][ T43] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 380.608672][ T43] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 380.618783][ T43] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 380.627859][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 380.635873][ T43] usb 2-1: SerialNumber: syz [ 380.710833][ T5857] usb 4-1: new full-speed USB device number 110 using dummy_hcd [ 380.718639][ T2152] usb 5-1: Using ep0 maxpacket: 8 [ 380.725616][ T2152] usb 5-1: config 150 has an invalid interface number: 59 but max is 0 [ 380.734468][ T2152] usb 5-1: config 150 has no interface number 0 [ 380.740845][ T2152] usb 5-1: config 150 interface 59 has no altsetting 0 [ 380.752823][ T2152] usb 5-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice=36.86 [ 380.763656][ T2152] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.771965][ T5857] usb 4-1: device descriptor read/8, error -71 [ 380.779625][ T2152] usb 5-1: Product: syz [ 380.783812][ T2152] usb 5-1: Manufacturer: syz [ 380.790057][ T2152] usb 5-1: SerialNumber: syz [ 380.862605][ T5962] usb 2-1: USB disconnect, device number 106 [ 380.892933][ T5857] usb usb4-port1: unable to enumerate USB device [ 380.900562][T13039] tipc: Enabling of bearer rejected, failed to enable media [ 380.946274][T13041] netlink: 'syz.2.2503': attribute type 10 has an invalid length. [ 380.954218][T13041] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2503'. [ 380.968833][T13041] bridge0: port 3(ipvlan1) entered blocking state [ 380.975496][T13041] bridge0: port 3(ipvlan1) entered disabled state [ 380.982285][T13041] ipvlan1: entered allmulticast mode [ 380.987589][T13041] veth0_vlan: entered allmulticast mode [ 380.995735][T13041] ipvlan1: left allmulticast mode [ 381.001095][T13041] veth0_vlan: left allmulticast mode [ 381.006758][T13041] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 381.992309][T13056] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2509'. [ 382.130332][T13062] input: syz0 as /devices/virtual/input/input82 [ 382.228459][T13066] FAULT_INJECTION: forcing a failure. [ 382.228459][T13066] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 382.242728][T13066] CPU: 1 UID: 0 PID: 13066 Comm: syz.2.2513 Not tainted syzkaller #0 PREEMPT(full) [ 382.242752][T13066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 382.242764][T13066] Call Trace: [ 382.242775][T13066] [ 382.242784][T13066] dump_stack_lvl+0x189/0x250 [ 382.242808][T13066] ? __pfx____ratelimit+0x10/0x10 [ 382.242829][T13066] ? __pfx_dump_stack_lvl+0x10/0x10 [ 382.242849][T13066] ? __pfx__printk+0x10/0x10 [ 382.242869][T13066] ? __might_fault+0xb0/0x130 [ 382.242900][T13066] should_fail_ex+0x414/0x560 [ 382.242926][T13066] _copy_from_user+0x2d/0xb0 [ 382.242950][T13066] csum_and_copy_from_iter_full+0x694/0x1ed0 [ 382.242994][T13066] ? __pfx_csum_and_copy_from_iter_full+0x10/0x10 [ 382.243019][T13066] ? __alloc_skb+0x142/0x2d0 [ 382.243038][T13066] ? rcu_is_watching+0x15/0xb0 [ 382.243050][T13066] ? trace_kmalloc+0x1f/0xd0 [ 382.243062][T13066] ? __kmalloc_node_track_caller_noprof+0x590/0x810 [ 382.243080][T13066] ip_generic_getfrag+0x12f/0x2b0 [ 382.243096][T13066] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 382.243116][T13066] ? skb_put+0x11b/0x210 [ 382.243140][T13066] __ip6_append_data+0x3974/0x3f30 [ 382.243161][T13066] ? __lock_acquire+0xab9/0xd20 [ 382.243197][T13066] ? __pfx_raw6_getfrag+0x10/0x10 [ 382.243220][T13066] ? __pfx___ip6_append_data+0x10/0x10 [ 382.243229][T13066] ? __pfx_ip6_mtu+0x10/0x10 [ 382.243245][T13066] ip6_append_data+0x1c1/0x380 [ 382.243266][T13066] ? __pfx_raw6_getfrag+0x10/0x10 [ 382.243290][T13066] rawv6_sendmsg+0x1286/0x1830 [ 382.243336][T13066] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 382.243363][T13066] ? __pfx_aa_sk_perm+0x10/0x10 [ 382.243377][T13066] ? sock_rps_record_flow+0x19/0x410 [ 382.243391][T13066] ? inet_sendmsg+0x2f4/0x370 [ 382.243404][T13066] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 382.243425][T13066] __sock_sendmsg+0x19c/0x270 [ 382.243448][T13066] ____sys_sendmsg+0x52d/0x830 [ 382.243475][T13066] ? __pfx_____sys_sendmsg+0x10/0x10 [ 382.243499][T13066] ? import_iovec+0x74/0xa0 [ 382.243515][T13066] ___sys_sendmsg+0x21f/0x2a0 [ 382.243529][T13066] ? __pfx____sys_sendmsg+0x10/0x10 [ 382.243577][T13066] ? __might_fault+0xb0/0x130 [ 382.243605][T13066] __sys_sendmmsg+0x227/0x430 [ 382.243632][T13066] ? __pfx___sys_sendmmsg+0x10/0x10 [ 382.243652][T13066] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 382.243674][T13066] ? ksys_write+0x22a/0x250 [ 382.243687][T13066] ? __pfx_ksys_write+0x10/0x10 [ 382.243703][T13066] __x64_sys_sendmmsg+0xa0/0xc0 [ 382.243728][T13066] do_syscall_64+0xfa/0xfa0 [ 382.243748][T13066] ? lockdep_hardirqs_on+0x9c/0x150 [ 382.243768][T13066] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.243785][T13066] ? clear_bhb_loop+0x60/0xb0 [ 382.243798][T13066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.243807][T13066] RIP: 0033:0x7f9dcd58efc9 [ 382.243818][T13066] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 382.243826][T13066] RSP: 002b:00007f9dce341038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 382.243837][T13066] RAX: ffffffffffffffda RBX: 00007f9dcd7e5fa0 RCX: 00007f9dcd58efc9 [ 382.243845][T13066] RDX: 0000000000000002 RSI: 0000200000000000 RDI: 0000000000000003 [ 382.243855][T13066] RBP: 00007f9dce341090 R08: 0000000000000000 R09: 0000000000000000 [ 382.243866][T13066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 382.243876][T13066] R13: 00007f9dcd7e6038 R14: 00007f9dcd7e5fa0 R15: 00007ffd80e1dab8 [ 382.243908][T13066] [ 382.740777][T13073] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2516'. [ 382.838546][T13079] loop4: detected capacity change from 0 to 2559 [ 382.848318][T13079] ldm_validate_partition_table(): Disk read failed. [ 382.855665][T13079] Dev loop4: unable to read RDB block 0 [ 382.862033][T13079] loop4: unable to read partition table [ 382.880028][T13079] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 383.135619][T13094] input: syz0 as /devices/virtual/input/input83 [ 383.186452][T13096] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2527'. [ 383.215408][T13096] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2527'. [ 383.474683][ T9] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 383.532592][ T2152] mvusb_mdio 5-1:150.59: probe with driver mvusb_mdio failed with error -5 [ 383.551997][ T2152] usb 5-1: USB disconnect, device number 75 [ 383.609064][ T5891] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 383.713004][ T9] usb 2-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 383.722574][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 383.734353][ T9] usb 2-1: Product: syz [ 383.741043][ T9] usb 2-1: Manufacturer: syz [ 383.754511][ T9] usb 2-1: SerialNumber: syz [ 383.763510][ T9] usb 2-1: config 0 descriptor?? [ 383.778622][ T9] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 383.786368][ T5891] usb 4-1: Using ep0 maxpacket: 8 [ 383.806321][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 383.816550][ T5891] usb 4-1: config 0 has an invalid interface number: 112 but max is 3 [ 383.839328][ T5891] usb 4-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 383.850941][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 383.863174][ T5891] usb 4-1: config 0 has an invalid interface number: 146 but max is 3 [ 383.872698][ T5891] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 383.882282][T13129] input: syz0 as /devices/virtual/input/input84 [ 383.883648][ T9] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 383.903550][ T5891] usb 4-1: config 0 has 2 interfaces, different from the descriptor's value: 4 [ 383.912834][ T9] usb 2-1: media controller created [ 383.929581][ T5891] usb 4-1: config 0 has no interface number 0 [ 383.940279][ T5891] usb 4-1: config 0 has no interface number 1 [ 383.946497][ T5891] usb 4-1: config 0 interface 112 altsetting 25 bulk endpoint 0x8 has invalid maxpacket 1024 [ 383.958015][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 383.967793][ T5891] usb 4-1: config 0 interface 112 altsetting 25 has an invalid descriptor for endpoint zero, skipping [ 383.987780][ T5891] usb 4-1: config 0 interface 112 altsetting 25 endpoint 0xF has an invalid bInterval 247, changing to 11 [ 384.002438][T13099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 384.012660][T13099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 384.013408][ T5891] usb 4-1: config 0 interface 146 altsetting 0 has a duplicate endpoint with address 0x1, skipping [ 384.033457][ T5891] usb 4-1: config 0 interface 146 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 8 [ 384.046903][ T9] cxusb: set interface failed [ 384.051676][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 384.060376][ T5891] usb 4-1: config 0 interface 112 has no altsetting 0 [ 384.072979][ T5891] usb 4-1: Dual-Role OTG device on HNP port [ 384.084492][ T5891] usb 4-1: New USB device found, idVendor=19d2, idProduct=1225, bcdDevice=55.e5 [ 384.093664][ T5891] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 384.102262][ T5891] usb 4-1: Product: syz [ 384.106436][ T5891] usb 4-1: Manufacturer: syz [ 384.108829][ T5962] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 384.111037][ T5891] usb 4-1: SerialNumber: syz [ 384.134727][ T9] DVB: Unable to find symbol mt352_attach() [ 384.140799][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 384.159991][ T9] zl10353_read_register: readreg error (reg=127, ret==-121) [ 384.172540][ T5891] usb 4-1: config 0 descriptor?? [ 384.180773][ T9] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 384.192713][T13102] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 384.209269][ T5891] usb-storage 4-1:0.112: USB Mass Storage device detected [ 384.242652][ T5891] usb-storage 4-1:0.112: Quirks match for vid 19d2 pid 1225: 1 [ 384.282595][ T9] rc_core: IR keymap rc-dvico-mce not found [ 384.288528][ T9] Registered IR keymap rc-empty [ 384.297307][ T9] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 384.309795][ T9] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input85 [ 384.324936][ T5962] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 384.331581][ T9] dvb-usb: schedule remote query interval to 100 msecs. [ 384.336210][ T5962] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 384.342150][ T9] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 384.358309][ T5962] usb 3-1: config 0 descriptor?? [ 384.368596][ T9] usb 2-1: USB disconnect, device number 107 [ 384.439654][ T9] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 384.528685][ T43] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 384.579903][T13127] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2538'. [ 384.595234][ T5962] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 384.699771][ T43] usb 5-1: Using ep0 maxpacket: 32 [ 384.707558][ T43] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 384.726800][ T43] usb 5-1: config 0 has no interface number 0 [ 384.740843][ T43] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 384.751173][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 384.759648][ T43] usb 5-1: Product: syz [ 384.766017][ T43] usb 5-1: Manufacturer: syz [ 384.770654][ T43] usb 5-1: SerialNumber: syz [ 384.780142][ T43] usb 5-1: config 0 descriptor?? [ 384.807007][ T43] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 384.859185][ T5962] [drm:udl_init] *ERROR* Selecting channel failed [ 384.911366][ T5962] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 2 [ 384.928640][ T5962] [drm] Initialized udl on minor 2 [ 384.947984][ T5962] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 384.968531][ T5962] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 384.978114][ T798] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 384.986152][ T798] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 385.005116][ T5962] usb 3-1: USB disconnect, device number 92 [ 385.021785][ T43] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 385.063678][ T43] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 385.103105][ T5832] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 385.115903][ T5832] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 385.124790][ T5832] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 385.134145][ T5832] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 385.149058][ T5832] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 385.173314][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 385.181492][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 385.189102][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 385.212162][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 385.220998][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 385.458591][ T30] audit: type=1326 audit(1761874464.737:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13138 comm="syz.4.2540" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f483078efc9 code=0x0 [ 385.561820][T13153] tipc: Enabling of bearer rejected, failed to enable media [ 385.606286][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 385.606758][ T9] usb 5-1: USB disconnect, device number 76 [ 385.638020][ T9] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 385.674446][ T9] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 385.706113][ T9] quatech2 5-1:0.51: device disconnected [ 385.720321][ T6588] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.762536][T13145] chnl_net:caif_netlink_parms(): no params data found [ 385.805139][ T6588] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.872940][ T6588] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.958452][ T6588] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.010869][T13145] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.018710][T13145] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.028121][T13157] program syz.2.2546 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 386.032213][T13145] bridge_slave_0: entered allmulticast mode [ 386.038094][T13156] program syz.2.2546 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 386.045680][T13145] bridge_slave_0: entered promiscuous mode [ 386.072115][T13145] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.081842][T13145] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.089111][T13145] bridge_slave_1: entered allmulticast mode [ 386.098169][T13145] bridge_slave_1: entered promiscuous mode [ 386.199912][T13163] input: syz0 as /devices/virtual/input/input86 [ 386.221066][T13145] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 386.241072][T13145] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 386.334971][T13145] team0: Port device team_slave_0 added [ 386.405372][ T5891] usb-storage 4-1:0.146: USB Mass Storage device detected [ 386.455330][ T5891] usb-storage 4-1:0.146: Quirks match for vid 19d2 pid 1225: 1 [ 386.517947][ T30] audit: type=1107 audit(1761874465.728:73): pid=13169 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 386.582954][ T5891] usb 4-1: USB disconnect, device number 111 [ 386.789823][T13177] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2551'. [ 386.838371][ T5916] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 386.889356][ T6588] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 386.899853][ T6588] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 386.909795][ T6588] bond0 (unregistering): Released all slaves [ 386.925630][T13145] team0: Port device team_slave_1 added [ 386.999388][ T5916] usb 3-1: Using ep0 maxpacket: 16 [ 387.017855][ T5916] usb 3-1: config 1 has an invalid descriptor of length 126, skipping remainder of the config [ 387.053421][ T5916] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 387.070033][T13145] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 387.081026][ T5916] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 387.083570][T13182] FAULT_INJECTION: forcing a failure. [ 387.083570][T13182] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 387.095047][T13145] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 387.105545][T13182] CPU: 1 UID: 0 PID: 13182 Comm: syz.3.2552 Not tainted syzkaller #0 PREEMPT(full) [ 387.105573][T13182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 387.105585][T13182] Call Trace: [ 387.105592][T13182] [ 387.105600][T13182] dump_stack_lvl+0x189/0x250 [ 387.105625][T13182] ? __pfx____ratelimit+0x10/0x10 [ 387.105646][T13182] ? __pfx_dump_stack_lvl+0x10/0x10 [ 387.105665][T13182] ? __pfx__printk+0x10/0x10 [ 387.105684][T13182] ? __might_fault+0xb0/0x130 [ 387.105717][T13182] should_fail_ex+0x414/0x560 [ 387.105741][T13182] _copy_from_user+0x2d/0xb0 [ 387.105765][T13182] csum_and_copy_from_iter_full+0x694/0x1ed0 [ 387.105813][T13182] ? __pfx_csum_and_copy_from_iter_full+0x10/0x10 [ 387.105843][T13182] ? rcu_is_watching+0x15/0xb0 [ 387.105862][T13182] ? trace_kmalloc+0x1f/0xd0 [ 387.105883][T13182] ? __kmalloc_node_track_caller_noprof+0x590/0x810 [ 387.105910][T13182] ip_generic_getfrag+0x12f/0x2b0 [ 387.105932][T13182] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 387.105953][T13182] ? skb_put+0x11b/0x210 [ 387.105976][T13182] __ip6_append_data+0x3974/0x3f30 [ 387.105995][T13182] ? __lock_acquire+0xab9/0xd20 [ 387.106037][T13182] ? __pfx_raw6_getfrag+0x10/0x10 [ 387.106076][T13182] ? __pfx___ip6_append_data+0x10/0x10 [ 387.106092][T13182] ? __pfx_ip6_mtu+0x10/0x10 [ 387.106119][T13182] ip6_append_data+0x1c1/0x380 [ 387.106141][T13182] ? __pfx_raw6_getfrag+0x10/0x10 [ 387.106164][T13182] rawv6_sendmsg+0x1286/0x1830 [ 387.106201][T13182] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 387.106246][T13182] ? __pfx_aa_sk_perm+0x10/0x10 [ 387.106269][T13182] ? sock_rps_record_flow+0x19/0x410 [ 387.106292][T13182] ? inet_sendmsg+0x2f4/0x370 [ 387.106311][T13182] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 387.106331][T13182] __sock_sendmsg+0x19c/0x270 [ 387.106352][T13182] ____sys_sendmsg+0x52d/0x830 [ 387.106379][T13182] ? __pfx_____sys_sendmsg+0x10/0x10 [ 387.106409][T13182] ? import_iovec+0x74/0xa0 [ 387.106436][T13182] ___sys_sendmsg+0x21f/0x2a0 [ 387.106459][T13182] ? __pfx____sys_sendmsg+0x10/0x10 [ 387.106522][T13182] ? __might_fault+0xb0/0x130 [ 387.106547][T13182] __sys_sendmmsg+0x227/0x430 [ 387.106573][T13182] ? __pfx___sys_sendmmsg+0x10/0x10 [ 387.106604][T13182] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 387.106640][T13182] ? ksys_write+0x22a/0x250 [ 387.106662][T13182] ? __pfx_ksys_write+0x10/0x10 [ 387.106686][T13182] __x64_sys_sendmmsg+0xa0/0xc0 [ 387.106709][T13182] do_syscall_64+0xfa/0xfa0 [ 387.106728][T13182] ? lockdep_hardirqs_on+0x9c/0x150 [ 387.106747][T13182] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.106764][T13182] ? clear_bhb_loop+0x60/0xb0 [ 387.106789][T13182] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.106805][T13182] RIP: 0033:0x7f109c38efc9 [ 387.106821][T13182] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 387.106835][T13182] RSP: 002b:00007f109d2a8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 387.106854][T13182] RAX: ffffffffffffffda RBX: 00007f109c5e5fa0 RCX: 00007f109c38efc9 [ 387.106867][T13182] RDX: 0000000000000002 RSI: 0000200000000000 RDI: 0000000000000003 [ 387.106878][T13182] RBP: 00007f109d2a8090 R08: 0000000000000000 R09: 0000000000000000 [ 387.106889][T13182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 387.106899][T13182] R13: 00007f109c5e6038 R14: 00007f109c5e5fa0 R15: 00007ffdf4ea7508 [ 387.106929][T13182] [ 387.263278][T13188] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2553'. [ 387.263356][ T5916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.336108][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 387.336769][ T5916] usb 3-1: Product: syz [ 387.362332][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 387.366348][ T5916] usb 3-1: Manufacturer: syz [ 387.430682][ T52] Bluetooth: hci3: command tx timeout [ 387.438576][T13145] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 387.554826][ T5916] usb 3-1: SerialNumber: syz [ 387.601291][T13194] netlink: 'syz.4.2554': attribute type 1 has an invalid length. [ 387.644977][T13195] input: syz0 as /devices/virtual/input/input87 [ 387.654703][ T6588] tipc: Disabling bearer [ 387.670949][ T6588] tipc: Disabling bearer [ 387.715480][ T6588] tipc: Left network mode [ 387.720402][T13145] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 387.753536][T13145] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 387.807888][ T5916] usb 3-1: 0:2 : does not exist [ 387.812938][ T5916] usb 3-1: usbmixer: too many channels (33) in unit 5 [ 387.865930][T13145] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 387.874581][ T5916] usb 3-1: USB disconnect, device number 93 [ 387.989748][ T7489] udevd[7489]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 388.124946][T13145] hsr_slave_0: entered promiscuous mode [ 388.145567][T13145] hsr_slave_1: entered promiscuous mode [ 388.152185][T13145] debugfs: 'hsr0' already exists in 'hsr' [ 388.185752][T13145] Cannot create hsr debugfs directory [ 388.243990][ T6588] hsr_slave_0: left promiscuous mode [ 388.261425][ T6588] hsr_slave_1: left promiscuous mode [ 388.268086][ T6588] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 388.287945][ T6588] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 388.304507][ T6588] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 388.311974][ T6588] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 388.343587][ T6588] veth1_macvtap: left promiscuous mode [ 388.355099][ T6588] veth0_macvtap: left promiscuous mode [ 388.365732][ T6588] veth1_vlan: left promiscuous mode [ 388.372302][ T6588] veth0_vlan: left promiscuous mode [ 388.526422][T13223] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2562'. [ 388.536913][ T5916] usb 4-1: new full-speed USB device number 112 using dummy_hcd [ 388.625767][T13229] netlink: 19 bytes leftover after parsing attributes in process `syz.2.2565'. [ 388.722919][ T5916] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 388.733209][T13232] 9pnet: Could not find request transport: fv [ 388.744901][ T5916] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 388.758257][ T5916] usb 4-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47 [ 388.767406][ T5916] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 388.788953][ T5916] usb 4-1: config 0 descriptor?? [ 388.817995][ T5916] qmi_wwan 4-1:0.0: probe with driver qmi_wwan failed with error -22 [ 388.881996][ T9] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 389.013358][ T5916] usb 4-1: USB disconnect, device number 112 [ 389.044665][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 389.056956][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 389.067817][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 389.080903][ T9] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 389.081553][ T6588] team0 (unregistering): Port device team_slave_1 removed [ 389.090031][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.095309][ T9] usb 5-1: config 0 descriptor?? [ 389.152224][ T6588] team0 (unregistering): Port device team_slave_0 removed [ 389.352567][ T9] plantronics 0003:047F:FFFF.0021: reserved main item tag 0xe [ 389.362719][ T9] plantronics 0003:047F:FFFF.0021: unknown main item tag 0x0 [ 389.398307][ T9] plantronics 0003:047F:FFFF.0021: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 389.438031][ T9] usb 5-1: USB disconnect, device number 77 [ 389.531794][T13239] fido_id[13239]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 389.631462][ T52] Bluetooth: hci3: command tx timeout [ 389.820374][T13255] loop4: detected capacity change from 0 to 2559 [ 389.830153][ T7489] buffer_io_error: 32 callbacks suppressed [ 389.830167][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 389.844756][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 389.853125][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 389.867271][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 389.875230][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 389.883333][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 389.891855][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 389.900586][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 389.919268][ T7489] ldm_validate_partition_table(): Disk read failed. [ 389.941374][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 389.952418][ T7489] Buffer I/O error on dev loop4, logical block 0, async page read [ 389.960583][ T7489] Dev loop4: unable to read RDB block 0 [ 389.967778][ T7489] loop4: unable to read partition table [ 389.976573][T13255] ldm_validate_partition_table(): Disk read failed. [ 389.990816][T13255] Dev loop4: unable to read RDB block 0 [ 390.020455][T13255] loop4: unable to read partition table [ 390.026615][T13260] netlink: 'syz.2.2575': attribute type 1 has an invalid length. [ 390.033490][T13255] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 390.302259][T13272] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2577'. [ 390.361154][T13275] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2578'. [ 390.605805][ T6588] IPVS: stop unused estimator thread 0... [ 390.645913][T13289] loop4: detected capacity change from 0 to 2559 [ 390.669860][ T6069] ldm_validate_partition_table(): Disk read failed. [ 390.688327][ T6069] Dev loop4: unable to read RDB block 0 [ 390.694402][ T6069] loop4: unable to read partition table [ 390.715140][T13289] ldm_validate_partition_table(): Disk read failed. [ 390.732277][T13289] Dev loop4: unable to read RDB block 0 [ 390.748442][T13289] loop4: unable to read partition table [ 390.778062][T13289] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 390.870323][ T9] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 390.892496][T13298] FAULT_INJECTION: forcing a failure. [ 390.892496][T13298] name failslab, interval 1, probability 0, space 0, times 0 [ 390.933180][T13298] CPU: 1 UID: 0 PID: 13298 Comm: syz.3.2586 Not tainted syzkaller #0 PREEMPT(full) [ 390.933205][T13298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 390.933216][T13298] Call Trace: [ 390.933224][T13298] [ 390.933233][T13298] dump_stack_lvl+0x189/0x250 [ 390.933270][T13298] ? __pfx____ratelimit+0x10/0x10 [ 390.933292][T13298] ? __pfx_dump_stack_lvl+0x10/0x10 [ 390.933314][T13298] ? __pfx__printk+0x10/0x10 [ 390.933341][T13298] ? __pfx___might_resched+0x10/0x10 [ 390.933359][T13298] ? fs_reclaim_acquire+0x7d/0x100 [ 390.933382][T13298] should_fail_ex+0x414/0x560 [ 390.933409][T13298] should_failslab+0xa8/0x100 [ 390.933430][T13298] kmem_cache_alloc_node_noprof+0x8c/0x710 [ 390.933456][T13298] ? __alloc_skb+0x112/0x2d0 [ 390.933476][T13298] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 390.933500][T13298] __alloc_skb+0x112/0x2d0 [ 390.933525][T13298] __ip6_append_data+0x2c16/0x3f30 [ 390.933546][T13298] ? __lock_acquire+0xab9/0xd20 [ 390.933592][T13298] ? __pfx_raw6_getfrag+0x10/0x10 [ 390.933632][T13298] ? __pfx___ip6_append_data+0x10/0x10 [ 390.933650][T13298] ? __pfx_ip6_mtu+0x10/0x10 [ 390.933678][T13298] ip6_append_data+0x1c1/0x380 [ 390.933703][T13298] ? __pfx_raw6_getfrag+0x10/0x10 [ 390.933729][T13298] rawv6_sendmsg+0x1286/0x1830 [ 390.933768][T13298] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 390.933819][T13298] ? __pfx_aa_sk_perm+0x10/0x10 [ 390.933845][T13298] ? sock_rps_record_flow+0x19/0x410 [ 390.933869][T13298] ? inet_sendmsg+0x2f4/0x370 [ 390.933889][T13298] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 390.933910][T13298] __sock_sendmsg+0x19c/0x270 [ 390.933933][T13298] ____sys_sendmsg+0x52d/0x830 [ 390.933960][T13298] ? __pfx_____sys_sendmsg+0x10/0x10 [ 390.933987][T13298] ? import_iovec+0x74/0xa0 [ 390.934012][T13298] ___sys_sendmsg+0x21f/0x2a0 [ 390.934034][T13298] ? __pfx____sys_sendmsg+0x10/0x10 [ 390.934092][T13298] ? __might_fault+0xb0/0x130 [ 390.934113][T13298] __sys_sendmmsg+0x227/0x430 [ 390.934135][T13298] ? __pfx___sys_sendmmsg+0x10/0x10 [ 390.934160][T13298] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 390.934193][T13298] ? ksys_write+0x22a/0x250 [ 390.934211][T13298] ? __pfx_ksys_write+0x10/0x10 [ 390.934233][T13298] __x64_sys_sendmmsg+0xa0/0xc0 [ 390.934259][T13298] do_syscall_64+0xfa/0xfa0 [ 390.934275][T13298] ? lockdep_hardirqs_on+0x9c/0x150 [ 390.934291][T13298] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.934306][T13298] ? clear_bhb_loop+0x60/0xb0 [ 390.934325][T13298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.934341][T13298] RIP: 0033:0x7f109c38efc9 [ 390.934356][T13298] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 390.934369][T13298] RSP: 002b:00007f109d2a8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 390.934387][T13298] RAX: ffffffffffffffda RBX: 00007f109c5e5fa0 RCX: 00007f109c38efc9 [ 390.934399][T13298] RDX: 0000000000000002 RSI: 0000200000000000 RDI: 0000000000000003 [ 390.934411][T13298] RBP: 00007f109d2a8090 R08: 0000000000000000 R09: 0000000000000000 [ 390.934421][T13298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 390.934431][T13298] R13: 00007f109c5e6038 R14: 00007f109c5e5fa0 R15: 00007ffdf4ea7508 [ 390.934456][T13298] [ 391.053180][T13145] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 391.258175][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 391.297742][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 391.308344][ T9] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 391.332299][T13145] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 391.333057][ T9] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 391.354602][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 391.363476][ T9] usb 3-1: SerialNumber: syz [ 391.372259][T13145] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 391.391926][ T9] usb 3-1: 0:2 : does not exist [ 391.400414][T13145] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 391.403467][T13304] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2588'. [ 391.418134][T13304] netlink: 'syz.3.2588': attribute type 3 has an invalid length. [ 391.576551][ T5916] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 391.611028][T13145] 8021q: adding VLAN 0 to HW filter on device bond0 [ 391.634301][T13317] netlink: 'syz.3.2589': attribute type 10 has an invalid length. [ 391.677669][T13145] 8021q: adding VLAN 0 to HW filter on device team0 [ 391.712802][ T6060] bridge0: port 1(bridge_slave_0) entered blocking state [ 391.720073][ T6060] bridge0: port 1(bridge_slave_0) entered forwarding state [ 391.750544][ T6060] bridge0: port 2(bridge_slave_1) entered blocking state [ 391.757824][ T6060] bridge0: port 2(bridge_slave_1) entered forwarding state [ 391.771825][ T5916] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 391.781595][ T5916] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 391.792979][ T5916] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 391.802293][ T5916] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 391.815791][ T5916] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 391.835294][ T9] usb 3-1: USB disconnect, device number 94 [ 391.853906][ T52] Bluetooth: hci3: command tx timeout [ 391.910568][ T5916] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 391.921652][ T5916] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 391.957177][T13145] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 391.981440][ T5916] usb 5-1: Product: syz [ 391.990092][ T5916] usb 5-1: Manufacturer: syz [ 392.027445][ T5916] cdc_wdm 5-1:1.0: skipping garbage [ 392.043697][ T5916] cdc_wdm 5-1:1.0: skipping garbage [ 392.062898][ T5916] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 392.072805][ T5916] cdc_wdm 5-1:1.0: Unknown control protocol [ 392.182463][T13335] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2591'. [ 392.248651][ T9] usb 5-1: USB disconnect, device number 78 [ 392.372649][T13145] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 392.397419][T13345] nbd: must specify an index to disconnect [ 392.488287][T13145] veth0_vlan: entered promiscuous mode [ 392.513656][T13145] veth1_vlan: entered promiscuous mode [ 392.562932][T13145] veth0_macvtap: entered promiscuous mode [ 392.575307][T13145] veth1_macvtap: entered promiscuous mode [ 392.617591][T13145] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 392.646555][T13145] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 392.672123][ T6060] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.683302][ T43] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 392.706579][ T6060] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.732347][ T6060] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.751500][ T6060] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 392.863157][ T6060] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 392.877733][ T6060] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 392.894944][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 392.911754][ T43] usb 4-1: config 0 has an invalid interface number: 197 but max is 0 [ 392.924265][ T43] usb 4-1: config 0 has no interface number 0 [ 392.933821][ T43] usb 4-1: config 0 interface 197 has no altsetting 0 [ 392.947891][ T6060] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 392.960621][ T43] usb 4-1: New USB device found, idVendor=102c, idProduct=6151, bcdDevice=32.65 [ 392.967288][ T6060] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 392.970135][ T5962] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 392.985394][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.007920][ T43] usb 4-1: Product: syz [ 393.015277][ T43] usb 4-1: Manufacturer: syz [ 393.026392][ T43] usb 4-1: SerialNumber: syz [ 393.043048][T13363] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2597'. [ 393.063371][ T43] usb 4-1: config 0 descriptor?? [ 393.077877][ T43] gspca_main: etoms-2.14.0 probing 102c:6151 [ 393.150362][ T5962] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 393.178027][ T5962] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 393.199241][ T5962] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 393.230452][ T5962] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 393.257253][ T5962] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 393.299149][T13377] netlink: 19 bytes leftover after parsing attributes in process `syz.1.2599'. [ 393.319056][ T5962] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 393.335406][ T5962] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 393.344604][ T5962] usb 5-1: Product: syz [ 393.349285][ T5962] usb 5-1: Manufacturer: syz [ 393.413171][ T5962] cdc_wdm 5-1:1.0: skipping garbage [ 393.419812][ T5962] cdc_wdm 5-1:1.0: skipping garbage [ 393.435534][ T5962] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 393.444920][ T5962] cdc_wdm 5-1:1.0: Unknown control protocol [ 393.495728][ T43] usb 4-1: USB disconnect, device number 113 [ 393.641132][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.646866][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.652826][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.658680][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.664573][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.670436][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.676782][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.682647][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.688999][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.694886][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.700755][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.700963][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.701170][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.701375][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.701743][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.701783][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.702234][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.702441][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.702639][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.702975][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.703177][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.703213][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.703412][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.703452][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.703672][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.703883][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.704108][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.704309][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.704505][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.704550][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.704744][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.704939][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.705137][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.705336][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.705534][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.705737][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.705941][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.706143][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.706342][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.706548][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.706758][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.706959][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.707161][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.707361][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.707569][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.707767][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.707967][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.708169][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.708371][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.708573][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.708778][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.708978][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.709176][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.709375][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.709578][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.709781][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.709984][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.710186][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.710386][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.710591][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.710804][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.711015][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.711227][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.711440][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.711649][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.711866][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.712074][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.712281][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.712491][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.712703][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.712910][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.713114][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.713320][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.713530][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.713744][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.713954][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.714163][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.714471][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.715770][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.715975][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.716175][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.716373][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.716572][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.716774][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.716972][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.717170][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.717372][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.717422][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.717780][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.718109][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.718312][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.718582][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.718789][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.719063][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.719271][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.719503][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.719549][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.719758][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.719967][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.720172][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.720382][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.720613][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.720822][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.721034][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.721244][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.721454][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.721664][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.721880][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.722087][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.722296][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.722503][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.722711][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.722914][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.723117][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.723318][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.723523][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.723734][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.723941][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.724151][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.724358][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.724566][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.724771][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.724976][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.725187][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.725235][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.725440][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.725642][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.725849][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.726055][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.726259][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.726464][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.726670][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.726884][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.727091][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.727294][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.727496][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.727707][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.727905][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.727939][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.728132][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.728171][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.728365][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.728565][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.728611][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.728806][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.728844][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.729034][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.729227][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.729422][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.729623][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.729827][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.730037][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.730249][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.730459][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.730680][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.730890][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.731099][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.731303][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.731513][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.731722][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.731927][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.732132][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.732338][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.732543][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.732750][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.732956][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.733164][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.733369][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.733582][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.733784][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.733982][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.734187][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.734389][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.734591][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.734789][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.734991][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.735197][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.735405][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.735610][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.736116][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.736304][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.736339][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.736533][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.737025][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.737234][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.737276][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.737481][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.737711][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.737752][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.738369][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.738575][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.738623][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.738826][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.739030][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.739234][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.739435][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.739633][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.739829][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.740030][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.740230][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.740427][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.740621][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.740815][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.741009][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.741209][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.741473][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.741682][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.741886][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.742085][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.742280][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.742479][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.742682][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.742883][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.743088][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.743287][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.743485][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.743694][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.743898][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.744102][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.744303][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.744507][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.744773][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.744973][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.745204][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.745411][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.745661][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.745892][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.746088][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.746363][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.746886][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.747169][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.747728][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.747919][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.747961][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.748276][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.748318][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.748517][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.748737][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.748939][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.749173][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.749374][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.749420][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.749625][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.749819][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.750010][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.750197][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.750384][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.750577][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.750623][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.750821][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.750861][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.751053][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.751094][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.751292][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.751336][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.751536][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.751571][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.751772][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.751819][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.752022][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.752068][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.752274][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.752319][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.752643][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.752694][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.752891][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.752930][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.753124][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.753168][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.753365][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.753412][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.753615][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.753656][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.753863][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.753911][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.754117][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.754162][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.754366][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.754406][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.754607][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.754655][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.754867][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.754910][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.755107][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.755146][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.755339][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.755379][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.755575][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.755617][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.755816][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.755863][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.756083][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.756125][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.756326][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.756370][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.756567][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.756607][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.756808][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.756857][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.757060][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.757104][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.757311][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.757513][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.757558][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.757765][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.757810][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.758011][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.758055][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.758258][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.758305][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.758508][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.758553][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.758759][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.758809][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.759014][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.759059][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.759260][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.759304][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.759507][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.759555][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.759758][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.759797][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.759993][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.760037][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.760235][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.760279][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.760478][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.760520][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.760717][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.760760][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.760951][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.760991][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.761187][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 393.761226][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 393.761426][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.577533][ C0] cdc_wdm 5-1:1.0: Cannot schedule work [ 395.584839][ T5962] ------------[ cut here ]------------ [ 395.587537][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.590660][ T5962] faux_driver vkms: [drm] vblank wait timed out on crtc 0 [ 395.597182][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.609747][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.613291][ T5962] WARNING: drivers/gpu/drm/drm_vblank.c:1320 at drm_wait_one_vblank+0x570/0x5b0, CPU#1: kworker/1:7/5962 [ 395.615730][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.626654][ T5962] Modules linked in: [ 395.633271][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.636578][ T5962] CPU: 1 UID: 0 PID: 5962 Comm: kworker/1:7 Not tainted syzkaller #0 PREEMPT(full) [ 395.642589][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.651707][ T5962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 395.657790][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.667380][ T5962] Workqueue: events drm_fb_helper_damage_work [ 395.673664][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.679216][ T5962] RIP: 0010:drm_wait_one_vblank+0x570/0x5b0 [ 395.685506][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.690919][ T5962] Code: ff df 80 3c 08 00 74 08 4c 89 e7 e8 ca f1 e4 fc 4d 8b 2c 24 48 c7 c7 40 4f f4 8b 4c 89 fe 4c 89 ea 44 89 f1 e8 f1 ee 41 fc 90 <0f> 0b 90 90 49 bd 00 00 00 00 00 fc ff df e9 a7 fc ff ff 44 89 f9 [ 395.696887][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.716752][ T5962] RSP: 0018:ffffc9000ae97880 EFLAGS: 00010246 [ 395.722753][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.728626][ T5962] RAX: 701e14042d3f1e00 RBX: 1ffff11004a6ac01 RCX: ffff888033b8dac0 [ 395.734385][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.742233][ T5962] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 395.747950][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.755679][ T5962] RBP: ffffc9000ae97968 R08: ffffffff8fbef977 R09: 1ffffffff1f7df2e [ 395.761669][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.769393][ T5962] R10: dffffc0000000000 R11: fffffbfff1f7df2f R12: ffff8880252a4000 [ 395.775606][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.782986][ T5962] R13: ffffffff8c06f9e0 R14: 0000000000000000 R15: ffffffff8c08a2a0 [ 395.789329][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.796711][ T5962] FS: 0000000000000000(0000) GS:ffff888125b9f000(0000) knlGS:0000000000000000 [ 395.802801][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.811226][ T5962] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 395.817041][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.823460][ T5962] CR2: 00007f9dcd7b4198 CR3: 0000000077572000 CR4: 00000000003526f0 [ 395.829242][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.837055][ T5962] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 395.842910][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.850687][ T5962] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 395.856526][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.864432][ T5962] Call Trace: [ 395.870319][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.873254][ T5962] [ 395.879588][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.881837][ T5962] ? __pfx_drm_wait_one_vblank+0x10/0x10 [ 395.888001][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.893143][ T5962] ? __pfx_autoremove_wake_function+0x10/0x10 [ 395.898979][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.904884][ T5962] ? drm_vblank_get+0x150/0x270 [ 395.910755][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.915384][ T5962] drm_client_modeset_wait_for_vblank+0xc5/0xf0 [ 395.921273][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.927308][ T5962] drm_fb_helper_damage_work+0xce/0x6c0 [ 395.933173][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.938546][ T5962] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 395.944379][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.950361][ T5962] ? _raw_spin_unlock_irq+0x23/0x50 [ 395.956179][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.961170][ T5962] ? process_one_work+0x868/0x15d0 [ 395.967346][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.971916][ T5962] process_one_work+0x94a/0x15d0 [ 395.977710][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.982447][ T5962] ? __lock_acquire+0xab9/0xd20 [ 395.988974][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 395.993009][ T5962] ? __pfx_process_one_work+0x10/0x10 [ 395.999116][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.004053][ T5962] ? assign_work+0x3a1/0x410 [ 396.010083][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.014244][ T5962] worker_thread+0x9b0/0xee0 [ 396.020010][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.024431][ T5962] kthread+0x711/0x8a0 [ 396.030203][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.034047][ T5962] ? __pfx_worker_thread+0x10/0x10 [ 396.039868][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.044848][ T5962] ? __pfx_kthread+0x10/0x10 [ 396.050681][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.055196][ T5962] ? _raw_spin_unlock_irq+0x23/0x50 [ 396.061029][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.061361][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.066559][ T5962] ? lockdep_hardirqs_on+0x9c/0x150 [ 396.072403][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.077923][ T5962] ? __pfx_kthread+0x10/0x10 [ 396.083270][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.088719][ T5962] ret_from_fork+0x4bc/0x870 [ 396.093436][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.098853][ T5962] ? __pfx_ret_from_fork+0x10/0x10 [ 396.104125][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.109083][ T5962] ? __switch_to_asm+0x39/0x70 [ 396.114404][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.119850][ T5962] ? __switch_to_asm+0x33/0x70 [ 396.124811][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.130279][ T5962] ? __pfx_kthread+0x10/0x10 [ 396.135532][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.140716][ T5962] ret_from_fork_asm+0x1a/0x30 [ 396.145500][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.145699][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.151332][ T5962] [ 396.156273][ C0] cdc_wdm 5-1:1.0: Stall on int endpoint [ 396.161748][ T5962] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 396.161766][ T5962] CPU: 1 UID: 0 PID: 5962 Comm: kworker/1:7 Not tainted syzkaller #0 PREEMPT(full) [ 396.161787][ T5962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 396.161800][ T5962] Workqueue: events drm_fb_helper_damage_work [ 396.161824][ T5962] Call Trace: [ 396.161834][ T5962] [ 396.161844][ T5962] dump_stack_lvl+0x99/0x250 [ 396.161867][ T5962] ? __asan_memcpy+0x40/0x70 [ 396.161890][ T5962] ? __pfx_dump_stack_lvl+0x10/0x10 [ 396.161911][ T5962] ? __pfx__printk+0x10/0x10 [ 396.161944][ T5962] vpanic+0x237/0x6d0 [ 396.161960][ T5962] ? __pfx_vpanic+0x10/0x10 [ 396.161974][ T5962] ? is_bpf_text_address+0x292/0x2b0 [ 396.161993][ T5962] ? is_bpf_text_address+0x26/0x2b0 [ 396.162019][ T5962] panic+0xb9/0xc0 [ 396.162035][ T5962] ? __pfx_panic+0x10/0x10 [ 396.162060][ T5962] ? ret_from_fork_asm+0x1a/0x30 [ 396.162087][ T5962] __warn+0x334/0x4c0 [ 396.162102][ T5962] ? drm_wait_one_vblank+0x570/0x5b0 [ 396.162128][ T5962] ? drm_wait_one_vblank+0x570/0x5b0 [ 396.162151][ T5962] report_bug+0x2be/0x4f0 [ 396.162171][ T5962] ? drm_wait_one_vblank+0x570/0x5b0 [ 396.162195][ T5962] ? drm_wait_one_vblank+0x570/0x5b0 [ 396.162218][ T5962] ? drm_wait_one_vblank+0x572/0x5b0 [ 396.162239][ T5962] handle_bug+0x84/0x160 [ 396.162263][ T5962] exc_invalid_op+0x1a/0x50 [ 396.162286][ T5962] asm_exc_invalid_op+0x1a/0x20 [ 396.162304][ T5962] RIP: 0010:drm_wait_one_vblank+0x570/0x5b0 [ 396.162327][ T5962] Code: ff df 80 3c 08 00 74 08 4c 89 e7 e8 ca f1 e4 fc 4d 8b 2c 24 48 c7 c7 40 4f f4 8b 4c 89 fe 4c 89 ea 44 89 f1 e8 f1 ee 41 fc 90 <0f> 0b 90 90 49 bd 00 00 00 00 00 fc ff df e9 a7 fc ff ff 44 89 f9 [ 396.162341][ T5962] RSP: 0018:ffffc9000ae97880 EFLAGS: 00010246 [ 396.162357][ T5962] RAX: 701e14042d3f1e00 RBX: 1ffff11004a6ac01 RCX: ffff888033b8dac0 [ 396.162378][ T5962] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 396.162390][ T5962] RBP: ffffc9000ae97968 R08: ffffffff8fbef977 R09: 1ffffffff1f7df2e [ 396.162403][ T5962] R10: dffffc0000000000 R11: fffffbfff1f7df2f R12: ffff8880252a4000 [ 396.162417][ T5962] R13: ffffffff8c06f9e0 R14: 0000000000000000 R15: ffffffff8c08a2a0 [ 396.162450][ T5962] ? __pfx_drm_wait_one_vblank+0x10/0x10 [ 396.162474][ T5962] ? __pfx_autoremove_wake_function+0x10/0x10 [ 396.162504][ T5962] ? drm_vblank_get+0x150/0x270 [ 396.162529][ T5962] drm_client_modeset_wait_for_vblank+0xc5/0xf0 [ 396.162553][ T5962] drm_fb_helper_damage_work+0xce/0x6c0 [ 396.162580][ T5962] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 396.162600][ T5962] ? _raw_spin_unlock_irq+0x23/0x50 [ 396.162623][ T5962] ? process_one_work+0x868/0x15d0 [ 396.162639][ T5962] process_one_work+0x94a/0x15d0 [ 396.162655][ T5962] ? __lock_acquire+0xab9/0xd20 [ 396.162699][ T5962] ? __pfx_process_one_work+0x10/0x10 [ 396.162725][ T5962] ? assign_work+0x3a1/0x410 [ 396.162747][ T5962] worker_thread+0x9b0/0xee0 [ 396.162793][ T5962] kthread+0x711/0x8a0 [ 396.162818][ T5962] ? __pfx_worker_thread+0x10/0x10 [ 396.162835][ T5962] ? __pfx_kthread+0x10/0x10 [ 396.162858][ T5962] ? _raw_spin_unlock_irq+0x23/0x50 [ 396.162876][ T5962] ? lockdep_hardirqs_on+0x9c/0x150 [ 396.162894][ T5962] ? __pfx_kthread+0x10/0x10 [ 396.162916][ T5962] ret_from_fork+0x4bc/0x870 [ 396.162943][ T5962] ? __pfx_ret_from_fork+0x10/0x10 [ 396.162974][ T5962] ? __switch_to_asm+0x39/0x70 [ 396.162994][ T5962] ? __switch_to_asm+0x33/0x70 [ 396.163014][ T5962] ? __pfx_kthread+0x10/0x10 [ 396.163036][ T5962] ret_from_fork_asm+0x1a/0x30 [ 396.163073][ T5962] [ 396.513659][ T5962] Kernel Offset: disabled [ 396.517999][ T5962] Rebooting in 86400 seconds..