last executing test programs: 16.960236552s ago: executing program 3 (id=793): r0 = socket$inet6(0xa, 0x3, 0xff) sendmsg$inet6(r0, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x0, 0x4, @dev, 0x9}, 0x18, &(0x7f0000000180)=[{&(0x7f0000000040)="daffc3fa80002cd21721a4af36a4a2ab00000000000000025a91f64b007f0c6a96903d68d51f9405", 0x28}], 0x1}, 0x4b00) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'gretap0\x00', &(0x7f0000000080)={'gre0\x00', 0x0, 0x0, 0x7800, 0x241, 0x0, {{0x6, 0x4, 0x1, 0x9, 0x18, 0x65, 0x0, 0x8d, 0x29, 0x0, @local, @remote, {[@noop]}}}}}) r2 = socket(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) r4 = socket$inet6(0xa, 0x6, 0x7) setsockopt$sock_int(r4, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) listen(r4, 0xfffeffff) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x5}, 0x10) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="280000001a00010000000000080000000200000000000000000000000c0009000b000107", @ANYRES32=0x0, @ANYBLOB="401adcbe1afafba6d6d68fc74a2a2511c8bd9b28d647ddc2a282872455290248d871ee0be3914d5d87cf92433636aa61581547e1ef00ac150ae231523a9a103bf20a4824d961bd10a4d21e9e51375d72"], 0x28}}, 0x0) socketpair$unix(0x1, 0x9, 0x0, &(0x7f0000000540)) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000300)={0x0, 0x0, 0xffffffffffffffff}) r6 = syz_open_dev$dri(&(0x7f0000000500), 0x102009, 0x81) ioctl$DRM_IOCTL_MODE_GET_LEASE(r6, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r6, 0xc01864b1, &(0x7f0000000340)={r7, 0x1, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r5, 0xc04064aa, &(0x7f00000004c0)={&(0x7f0000000340), &(0x7f0000000380)=[{}, {}, {}, {}, {}, {}, {}, {}], r7, 0x0, '\x00', 0x0, 0x8}) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r8, 0xffffffffffffffff, 0x0) r9 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$search(0xa, r9, &(0x7f00000000c0)='dns_resolver\x00', &(0x7f0000000140)={'syz', 0x1, 0x2e}, 0xffffffffffffffff) clock_gettime(0xfffffffffffffffb, 0x0) setresuid(0x0, 0x0, 0x0) r10 = openat(0xffffffffffffffff, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) write$smackfs_label(r10, &(0x7f00000002c0)=ANY=[@ANYBLOB='\v\x00\x00\x00\x00\x00\x00\x00\x00'], 0x9) capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200000}) truncate(&(0x7f00000001c0)='./file0\x00', 0x80) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@multicast2, @in=@remote, 0x4e22, 0x8001, 0x4e24, 0x0, 0xa, 0x80, 0x80, 0x32, r1}, {0x36b, 0xffffffffffff4bc2, 0x7, 0x5, 0xa28e, 0xfff, 0xfffffffffffffff8, 0x8}, {0x98d, 0x6, 0x5, 0x2}, 0x2, 0x6e6bb2, 0x2, 0x1, 0x0, 0x2}, {{@in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4d4}, 0xa, @in6=@loopback, 0x3503, 0x1, 0x3, 0x58, 0x3, 0x8}}, 0xe8) 16.383249412s ago: executing program 3 (id=796): socket$inet_tcp(0x2, 0x1, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22042, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x17, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe89}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x2000000, 0x6, 0x0, &(0x7f0000000200)="63eced8e46dc", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x4, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_u}]}}) write$P9_RVERSION(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="150000006bffff"], 0x15) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2, 0x0) r6 = dup(r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) sendfile(r6, r6, 0x0, 0xffffffff) 13.868416905s ago: executing program 2 (id=802): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000810000d0c28bd7000fcdbffad7700", @ANYRES32, @ANYRES32], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e02"], 0x0, 0x37, 0x0, 0x1, 0x0, 0x10000}, 0x28) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x0, 0x0, {0x2, 0x20, 0x20}, [@RTA_DST={0x8, 0x1, @local}]}, 0x24}}, 0x40054) ioctl$KVM_X86_SET_MSR_FILTER(0xffffffffffffffff, 0x4188aec6, &(0x7f0000002cc0)={0x1, [{0x0, 0x3540, 0x6, &(0x7f0000000640)="7a650e526bd0998268bb5847d9beacc47a22df873eab4b8b91133675482eaa56ace8db59bed9aa07d4e390c7c9f98c462b55612196911e3c4e510ede3efde35eec990f22a76cf752e507c1e2de2920a9fc0790cc176bd2b901e4127b09835ae6d0d196048bb19a64d26f20a05b95c69f371882ef2e20c5606ed1b2ebcf09a4a333f6e1c3c4fb64d8182df4ab09d0a381d966977fc041cea9bdf0aa31fe51efe9211b9b8e6e4551b6438f8efcc41265574ff6504435eb22a678a99768f0327ded8fdcb41f27c2024d2b923f7dc5df5bf62af447b121dd9f94d766d6cebdeb02f611ab10e57af4b3268fb3f9777373bd5fd6b82f730e67c4eab113d8e65d7405be3e5d92dc5e7e85d34bb8b7c894cbed629ecc25c288b3d4556a85a1e2150cac5b686a8de29ab7c35040b77875bfa0e451dc0869cfe105bd115e7cf48f44dfdf26be65f3b727fd88d6395d051e49c060998e84b19377fcb20fe2eb392335e5a9d84555ef037aab37169ce761aa8a8ec08ea87e3a3b896f3d1b2380bc8256e0f7ea7dc488382e6112b53a7bb269d6261f87e0e0e0cef9152f8a67f412148f34880c970101fbd7b0e8fc49d6a5c87e487b7b175b15be26b6b8e1ed8527614dcefcfd80f8392560c8b706418b7de8fbb7a666a7e7f322dc70373606bf39efa04616cb99d662dfc591061bde5ed27a66aa7edbfec1eb0b1e843c372b84c3ed514a0aadf523b8669e526765d429824aeaa0a6f4c185754d437d977a1f586431dc256ce5aa7c25be259de3a0ae6e5bcdf56b4c7e8199fe6b461e78467cfac19de6956056ef57e93d3a7df8f646f4a9002b100edb0a6caa72b3f6eb29dc54de58120d27daff9cd61c64107e1bcb3b3212e1e2aa24fb24dc2dafc636c82ad25da9d934e46c7783d8f915337612feb348857ce2262240dfe51ec94d9d61074959f167b9840b20f003883bf167149228d7f03eafde851427cd1966a96aeae05b51ae4cd82f4b4dad60a070c01a8b500e2683f7136e331602e76845262825d7f3764cf1a05ad95d88aab71d41484f63fa6a43c044c7f03130552321933bc40b888fd0cc55939ff79a5059516f3b80c7ba8188ffb6a259a34567ee52c1f9df0f6c91737d688e36d076a49d1045cac30d5ed52a10381c96d9f22e469cc531bb06853d18b8f8625d2a917e795ffa4407fa75713510a3f5370e1ecbf7a5ff68a90a1eda077531cf4d399d4908f138c936e1931c72240070c6a6255f5fd03966e9a06c1d481e8e3d128e880776e572177780a3481c49bd86c174e152bafed245d58ef3428c645b08e48833960d1b5223d7be0c67a2b2c7531390d1837a84ed004a00cb4b0cd6e78824da032b48c49ec006d14206dc3d0c67d7ca87e9ea0faddc3e0b0c917c64eefeebf79e3a16c958db63a08a5d4d7210273aba3e56a4cd4cccb044750ff97749505ff1332b2dd30990849ab1500e1947d0abfb0c59760f0a502806ee1bce56fbb42251dd6ac8b709c73a6b8c548c2b23cf351dc498810e477bd082464e76702703b56d3cd2f3d8a2e00f19d8ffa3c236d3601f169c9dfe9c316f8cbe63c3801a51ea5ac785694a0c653cd28d68c5a81c2590d2aeea8c8688b2e88f46c4f99890e51b42cce485fcb4d91557fb3912b36b0dbeac8df44e945eb9937141402fb2aa1476185e1f8c37f6c98bc937f36d9c7237135132a54a03067b002b9c657ab0daa253af66eee78b0309cb8532dd2dee800c8349b731da0efa66ead82eebe0102279df5aa281fe1d86c0dbf154910d5e8a113ecbddbd046367b9e2acfa7cc406f61b472bbec6919534615ed81b664da956ce6586bf4c92d63ef371dfec5f9ce748931d585cadc9372a95a1372c7213e2c52fca253945afeee02e9f2de2d9452c85fd2dbdc87cb6c25697dfcbed8a0eba381835e6c360f3861367ec98a9a9ccf956d6cbfb706fee0d391cf82a0d4662792274f52fc2b5d72a43ec74a86400e62d3652f607774cfad1504bc0476570d532b527bf0d7012804b2e6fdf9a9414f10b16c9374f2b065348d865b309e37750d3a7e12394e356c48c9fa0d4a9a43f689f6cbf70b09a3b9782cc3d5d93480f8a7a21a049780fc6bf21f1eca938a37afcbb2b929a0c502e164d2571e78d214b359d97e3edc0ad5c7fd1625b4ece33e1f569676e9a7262ead857873f77ef149d2f8c5a09ab19ae384a7f957f612a24283c35327aa969b20711309644c5b3e6c89da94e1f5da54246bd771468a1adc8a8d601e0b12769604f0f07ca43ce2a8a2f4b5654c0b76b146c49038e07db54dae702580b97096911f034fc1797029de8b7c213c902d1d754e77ff85e6222e745db9d5d2d45c5d29a8b6de0f27e5701fdf12b09fd6c70baa0f85a424c21ce0796dbe1fd366b94fcdf64ea232b3e88"}, {0x0, 0x0, 0x41ff7484, 0x0}, {0x0, 0x0, 0x100d5ba, 0x0}, {0x2, 0x0, 0x4, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x2, 0x0, 0x3, 0x0}, {0x2, 0x0, 0xa2d, 0x0}, {0x1, 0x0, 0x1, 0x0}, {0x1, 0x0, 0xf3f, 0x0}, {0x4, 0x0, 0x1000, 0x0}, {0x3, 0x0, 0x6, 0x0}, {0x3, 0x0, 0x1000, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x0, 0x0, 0x1545, 0x0}, {0x2, 0x0, 0x3, 0x0}, {0x1, 0x0, 0x40005, 0x0}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8880, 0x85) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 13.480904455s ago: executing program 4 (id=804): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb2570000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000001c0)='sched_switch\x00', r5}, 0xe) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000008c0)={'syztnl2\x00', 0x0}) socket$nl_generic(0x10, 0x3, 0x10) read$FUSE(r0, &(0x7f0000000200)={0x2020}, 0x2020) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', 0x0, 0x2200892, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x4eb) syz_genetlink_get_family_id$nl80211(&(0x7f0000002380), 0xffffffffffffffff) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{}, 0x0, 0x0}, 0x20) syz_emit_ethernet(0x42, &(0x7f0000000040)={@broadcast, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "1e1907", 0xc, 0x2f, 0x0, @remote, @mcast2, {[], {0x0, 0x6558, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}}, 0x0) 13.22609734s ago: executing program 2 (id=805): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000002c0)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) fsopen(&(0x7f00000002c0)='sockfs\x00', 0x1) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r4, 0x4b72, &(0x7f0000000040)={0x0, 0x4000000, 0x8, 0xd, 0x200, &(0x7f0000001500)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309000a0000fdfd000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000005000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={0xffffffffffffffff, 0x0, 0x0}, 0x10) 11.827670244s ago: executing program 4 (id=806): openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x20201) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000080)={0x1000, 0x3, {0xffffffffffffffff}, {0xee00}, 0x38b1, 0x9}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/protocols\x00') mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 11.413914203s ago: executing program 2 (id=808): syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000240)={0x2c, &(0x7f0000000000)={0x0, 0x9, 0x64, {0x64, 0x30, "85262928f95d38909e1db88ee37c17f86c5fa54189e442a79e3318622dff9bd97dfdf1a4122a53a4da136943ccd9a0e9db587161d4337d3ae09989088bf40e428a634cf8083245459c1cebfbf3cc8193892d6e21742dcd7cc5f1948846c8cd4b2f1a"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201050037057b082d0800014b702c02030109021200070100a0000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="400006"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000600)={0x2c, &(0x7f0000000440)={0x40}, 0x0, 0x0, 0x0, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008000200", @ANYRES32=r4], 0x1c}, 0x1, 0x0, 0x0, 0x4008085}, 0x4000000) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x92, 0xec, 0xc6, 0x20, 0x5ac, 0x77c2, 0xeb3a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x20, 0x0, [{{0x9, 0x4, 0xc4, 0x1, 0x0, 0xff, 0xfd, 0x1, 0x80}}]}}]}}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="fe"], 0x20) r5 = io_uring_setup(0x18e3, &(0x7f00000000c0)={0x0, 0x60b13d, 0x80, 0x0, 0x334}) ioctl$TUNSETOWNER(0xffffffffffffffff, 0x400454cc, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000997aa910c6250290ba41010203010902120001000000000904"], 0x0) syz_usb_connect$uac1(0x2, 0x9c, &(0x7f0000000280)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8a, 0x3, 0x1, 0xaa, 0x20, 0xa, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x3ff, 0x9}, [@extension_unit={0xc, 0x24, 0x8, 0x6, 0xffff, 0x6, "527fb86004"}, @output_terminal={0x9, 0x24, 0x3, 0x3, 0x1ff, 0x3, 0x4, 0x7}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x5, 0x2, 0xde, 0x6, "333ce07a"}]}, {{0x9, 0x5, 0x1, 0x9, 0x600, 0xe4, 0x6, 0x7, {0x7, 0x25, 0x1, 0x1, 0x0, 0xc640}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x3, 0x5, 0x4, "ee"}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x0, 0x4, 0x9e, {0x7, 0x25, 0x1, 0x80, 0x80, 0xfff7}}}}}}}]}}, &(0x7f0000000580)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x300, 0x3, 0x4, 0xb9, 0x20, 0x3}, 0xb, &(0x7f0000000340)=ANY=[@ANYBLOB="050f0b00020b03100b0000"], 0x7, [{0x65, &(0x7f0000000380)=ANY=[@ANYBLOB="65031403273c8536d248bf26606b4f9a8004b4fb7668750195e59f3b4a54c1f8a26b7e7bedc82309e4fac723c2f5fe65c028d8ac1339069cdfcb8b45a2792b71c747b4f64c9cd1a0a67ed03338874514cbcab5f5ac"]}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x437}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x813}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x438}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x40a}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x2c09}}, {0x13, &(0x7f0000000680)=@string={0x13, 0x3, "63ae02203955dfe786259a545bf56a9797"}}]}) r6 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000180)=ANY=[@ANYRES32=r5], 0x0) syz_usb_control_io$printer(r6, 0x0, &(0x7f0000000040)={0x34, &(0x7f0000004400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, &(0x7f00000000c0)={'pcl812\x00', [0x8001, 0xfff, 0x1, 0x0, 0x2, 0x321, 0x8, 0x7, 0xa, 0x100, 0x2, 0x1, 0x8, 0x4, 0x6, 0xfffffffe, 0x1, 0x1a449, 0x20000004, 0x40000001, 0x89, 0x7fe, 0xf27, 0x6, 0xb, 0x8, 0x5, 0x8, 0x4, 0x10000, 0xfffffff8]}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r9 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000010c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0xffffffffffffffff, &(0x7f00000000c0)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {0x0, r10, r9}}, 0x18) writev(r8, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) syz_usb_disconnect(r6) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000640)={0x1, 0x10000, 0x8, 0x1, 0x9}) 11.188728034s ago: executing program 4 (id=809): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x0, 0x96, 0xd1, 0xca}}]}}]}}, 0x0) gettid() (async) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000000)) (async) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x5, &(0x7f0000000040)=[{0xefda, 0x6, 0x0, 0xd}, {0x1, 0x4, 0x3, 0x9}, {0x800, 0x7f, 0xc, 0x401}, {0x1, 0xe, 0x27}, {0x1, 0x4, 0x9, 0x5}]}) r2 = syz_open_dev$video4linux(&(0x7f00000001c0), 0x3, 0x40483) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 11.08049864s ago: executing program 1 (id=810): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000002000000000000000700000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b000000b7000000000000eb9500"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x18) fremovexattr(0xffffffffffffffff, &(0x7f0000000000)=@random={'user.', '^$[\x00'}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e24, 0xfffffffe, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x23, 0x0, &(0x7f0000000140)) connect$unix(r4, &(0x7f0000000480)=@abs={0x0, 0x0, 0x8004e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, 0x0, 0x0, 0x2, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)=ANY=[@ANYBLOB="54020000170001000000000000000000200100000000000000000000000000010000000000000000ac141400000000000000000000000000fc020000000000000003000000000000e000000200001000000000000000000000000000000000080a00000000000000", @ANYBLOB="09b01ebb2e12e9047fe303ebe375d97a44f5d938a23fb8b7499a5dcc189d094f25ef6ff23210feb5f9513ed5ceeef18b0c5290725af7496c994b66bca4ec3a310bf0b5d05f84e8c0e1cb32b84a13cc92d9e1cc4345d966544b860df9e864134136ad9cb1a87b13245283fd6f0874c09b444db1521b361f34c7f398bbce40e3bbe3629dc5bfa9a0f7ffc49aba74a491d1fa198abb02fe90337c605903fb4e5328ab9891d9cbdeeea14a77d56ae1042f0062b698fb600831d5e30a", @ANYRES32=0x0, @ANYBLOB="1242ffff040000000000000000000037660b6aff00000000000000000000000000000000000000000200002000000000", @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000e0270300000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000650d000000000000e1000000000000000007000000ff0f0000000000000000000008000b000000000008001600000000000c001500000000005d0000000401050000000000000000000000ffff00000000000000003300000002000000e00000020000000000000000000000000000000000000000000000000000000000000000ff010000000000000000000000000001000000003c0000000a000000fe8000000000000000000000000000aa0000000001000000000000000000000000000000ff010000000000000000000000000001000000002b0000000a000000fe8800000000000000000000000000010000000000000000000000000000000000000000ff020000000000000000000000000001000000003200000002000000fe8000000000000000000000000000000000000004"], 0x254}}, 0x0) 10.074948611s ago: executing program 1 (id=813): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x4000000000000001, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000880)={0xfffffffd, 0x1, 0x8, 0x8000, 0x10, "c588c203364d75c74c9b84836eae88a902fdf6"}) getxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)=@known='system.posix_acl_access\x00', 0x0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000003300)={&(0x7f000011c000/0x1000)=nil, 0x2000, 0x0, 0x0, 0x0, &(0x7f0000003340)=""/4085, 0x1005, 0x1, 0x0, 0xfd4d}, &(0x7f00000021c0)=0x40) r2 = accept$netrom(0xffffffffffffffff, &(0x7f0000002100)={{0x3, @null}, [@netrom, @remote, @bcast, @null, @remote, @bcast, @rose, @netrom]}, &(0x7f0000002180)=0x48) pipe2(&(0x7f0000003200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000003240)="beb9574608306291dce65f63c8", 0xd) getsockopt$sock_int(r2, 0x1, 0x2c, 0x0, &(0x7f0000000000)) syz_usb_connect(0x2, 0x3bb, &(0x7f0000003280)=ANY=[@ANYRES64, @ANYRESHEX=0x0, @ANYRES32=r2, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRESHEX=r4, @ANYRESHEX=0x0, @ANYBLOB="2f705ec59c7dcc479129"], 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r6, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast2}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @dev={0xfe, 0x80, '\x00', 0x1c}}]}, 0x5c}, 0x1, 0x620b}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f00000022c0)={&(0x7f0000002200), 0xc, &(0x7f0000002280)={&(0x7f0000002240)={0x1c, r6, 0x300, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_SESSION_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x10) r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) read$FUSE(r7, &(0x7f00000000c0)={0x2020}, 0x2020) 8.532510134s ago: executing program 0 (id=815): r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x48, 0x3ed, 0x1, 0x70bd28, 0x25dfdbfb, "17e4a1899ed2b470ed077847469486cd172655212a2e056e46d0b89c5b23788a4a8bbd03a2670b735e1698860b60d679724a7449c4", ["", "", "", "", ""]}, 0x48}, 0x1, 0x0, 0x0, 0x20050}, 0x810) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) setrlimit(0x7, &(0x7f0000000400)) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 8.32202405s ago: executing program 0 (id=816): syz_usb_connect(0x5, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d0918108ac051582588f0000000109022d00010000000009040000030b08000009058d"], 0x0) 8.146971287s ago: executing program 3 (id=817): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) setrlimit(0x6, 0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000)={0x1, 0x2, 0xe37ffffffffffe}) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f00000007c0)={0x1, 0x7, 0xa}) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() r2 = syz_open_dev$loop(&(0x7f0000000100), 0x4, 0xca042) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.current\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00", [0x0, 0x5dd]}}) syz_usb_connect(0x0, 0x4a, 0x0, 0x0) close(0x3) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000001540), 0x2) writev(r6, &(0x7f0000000040)=[{&(0x7f0000000300)="ffdf17c4bf9a63f0a7a4ff3918ae3193ce5a933b7e172503edd589b0869639e3dc03e31a000000001141a22129bb55e17886a2cdad13cc21", 0x38}], 0x1) 8.025301595s ago: executing program 4 (id=818): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000002c0)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) fsopen(&(0x7f00000002c0)='sockfs\x00', 0x1) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r4, 0x4b72, &(0x7f0000000040)={0x0, 0x4000000, 0x8, 0xd, 0x200, &(0x7f0000001500)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309000a0000fdfd000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000005000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={0xffffffffffffffff, 0x0, 0x0}, 0x10) 8.006744435s ago: executing program 2 (id=819): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb2570000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000001c0)='sched_switch\x00', r5}, 0xe) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000008c0)={'syztnl2\x00', 0x0}) socket$nl_generic(0x10, 0x3, 0x10) read$FUSE(r0, &(0x7f0000000200)={0x2020}, 0x2020) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', 0x0, 0x2200892, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x4eb) syz_genetlink_get_family_id$nl80211(&(0x7f0000002380), 0xffffffffffffffff) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{}, 0x0, 0x0}, 0x20) syz_emit_ethernet(0x42, &(0x7f0000000040)={@broadcast, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "1e1907", 0xc, 0x2f, 0x0, @remote, @mcast2, {[], {0x0, 0x6558, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}}, 0x0) 6.678212371s ago: executing program 1 (id=820): r0 = syz_clone(0x1000011, 0x0, 0x0, 0x0, 0x0, 0x0) io_setup(0x2, &(0x7f0000000000)=0x0) r2 = eventfd(0x0) io_submit(r1, 0x2, &(0x7f0000000280)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x100, r2, &(0x7f0000000100)="0000fd6000000000", 0x8, 0x3}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x0, r2, 0x0, 0x0, 0x1000d, 0x0, 0x3, r2}]) r3 = socket(0x10, 0x803, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x24}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4040818}, 0x0) syz_open_procfs(r0, &(0x7f0000000380)='net/ip6_tables_targets\x00') syz_clone(0xe200, 0x0, 0x0, 0x0, 0x0, 0x0) getpid() r6 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=@base={0x7, 0x4, 0x100, 0x401, 0x28}, 0x50) bind$can_j1939(r3, &(0x7f0000000140)={0x1d, r5, 0x2, {0x0, 0x1, 0x3}, 0xff}, 0x18) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r6}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000400)='sys_enter\x00', r7}, 0x18) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0), 0x0, 0x0, 0x0) 5.353529318s ago: executing program 2 (id=821): r0 = syz_clone(0x1000011, 0x0, 0x0, 0x0, 0x0, 0x0) io_setup(0x2, &(0x7f0000000000)=0x0) r2 = eventfd(0x0) io_submit(r1, 0x2, &(0x7f0000000280)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x100, r2, &(0x7f0000000100)="0000fd6000000000", 0x8, 0x3}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x0, r2, 0x0, 0x0, 0x1000d, 0x0, 0x3, r2}]) r3 = socket(0x10, 0x803, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x2, 0xfff3}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x24}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4040818}, 0x0) syz_open_procfs(r0, &(0x7f0000000380)='net/ip6_tables_targets\x00') syz_clone(0xe200, 0x0, 0x0, 0x0, 0x0, 0x0) getpid() r6 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=@base={0x7, 0x4, 0x100, 0x401, 0x28}, 0x50) bind$can_j1939(r3, &(0x7f0000000140)={0x1d, r5, 0x2, {0x0, 0x1, 0x3}, 0xff}, 0x18) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r6}, {}, {0x85, 0x0, 0x0, 0x1b}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000400)='sys_enter\x00', r7}, 0x18) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r6}, 0x4) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0), 0x0, 0x0, 0x0) 5.233336409s ago: executing program 0 (id=822): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) pipe2(&(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000001bc0)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000003c0)={@remote, 0x1d, r5}) r6 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r6, &(0x7f00000000c0)=ANY=[@ANYBLOB='+\x00\x00\x00\b'], 0x2b) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r8, 0x8933, &(0x7f0000000b80)={'batadv_slave_0\x00', 0x0}) setsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000300)={@remote, r9}, 0x14) close_range(r2, 0xffffffffffffffff, 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r10, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) r11 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r11, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x4, 0x6, 0x50, @empty, @private0, 0x20, 0x20, 0x3}}) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a00000004000000026bbbd664d09200cc05ed480000000000", @ANYRES32=0x1, @ANYBLOB="0200"/19, @ANYRES32=0x0, @ANYRES32], 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000012c0)={0x0, 0x0, 0xffffffffffffffff, 0x0, 0x7, r12}, 0x38) r13 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000ac0), 0x802, 0x0) statx(r2, &(0x7f00000018c0)='./file0\x00', 0x7000, 0x800, &(0x7f0000001900)) sendmmsg$unix(r1, &(0x7f0000002080)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000007c0)=[{&(0x7f0000001200)="dee07f712cbc8ef053bfbc37f54e5f6f9ed9e711d341ba961b22e75097177c816346e1a7e3227b2bc6aea0420d61773fb60dc4213c6bf12452329482a1e721e7eff9a4d23aad5f98d0f1c3f2fa8870dfa2a7ccd1dcc000df05c45ec3bfeeab06c53f66b3c933b5dfd0d220600bd50794ef522dcbaefe6c0d2b1b2d68b7f0cfdf9386209978be8f68cee7", 0x8a}, {&(0x7f0000000400)="7b51de769e1ade1a539519ba46e25ea9316f616bc1209978d2bee61b6ec964a64a0b1a537a3342c7d6c98b6237a1b7f9777cc64609d160119200ddc247eb053e61ed5393014a5e776407e39583a476b220617e1f3609639b1b1ec7678b5694a49b7009aa3726b399988c766a9b33d547b9d036ac2037f0a94e7f88710528096920", 0x81}, {&(0x7f00000002c0)="32c2b64d6f6d1dbcd018574c26194a42eb81098133008cd025cd8d761a9f038f92e8a91a24c49e9e97f11875dc75afaba1e14b4b97", 0x35}, {&(0x7f00000004c0)="86d9e2b0eab5e4f4cabbf5d0681d244d25877f9362ba200ceee14a9146a611ef5f20678b7b2d7676dbd6e7055802c447e320521b4a8c35135a929ea3eaae16365875a8671742a22f254da4385a7825fbdad9db7ae30e7a1e07c1a2d36a93efccf313ee08d4a1ee296eb67f428620d157d2329d2c3aa924035794b354b5fe5aaa7e301d425d28d5dc2149a6f0c75a4f1f9ba84367044e51841b18a96809e7c51c46829fa9851a11cf9926fad54239513a3ae1c7f20ad16cb5fbad46512b0e8f5312bc25a5a14e00583b0f6200bad97589ca00d9189d6d0391ba8b", 0xda}, {&(0x7f00000005c0)="89fdd02a706c99c3af93158f683fe557d7a63fc992ee6e4a4c9c15aa32bca86ac9178a15674c11a5f9f9d68ddad8c6507e6886fb06a5587d7493c4743ce7b25e5970e3095d7ccdf3d158faf400b48c4bddc233d7afb77e08fc91bc5783ba098183c873e7262eb393894342d77bce0a950f0048cbdb178f89ff319bd3f7875297f34916bfccd463eac3b122ebd99d63d34999b42ab7d3dcb4db662d90217fb2f765f0a378333d7234cf9876302342b1c0c22975d8e7e80d123cbb5bfcbbc1647f302937644529bfb8e3c4f09ffa32fcfe22a20bfea52cd119e685d2f0", 0xdc}, {&(0x7f00000006c0)="932854bf049f8811fd2424e6e93e741c1ab671c6f5cab59d2267950a299c20f500979cbd74cf3f3a06f10104db180348f6c01f8175a1238cfb41cec91ef3035a031f3f31955e368adf54f7d33b5dcb5435e034b3beebae05e1dba51a0e7e832745d8f06eaf0570c522f5aac6862a89561f7b1640fb60a9a3e73e13447cfd82e88cd8ade7016526d21e0c8c23a5009edece1f226064009b0a294235e52423c6663b84e98722ad8b01456df3fc56c8c8f06fbb406f9d3f5f371d0bcf9f03356ae309e538f9d492434e0a2a5142", 0xcc}, {&(0x7f0000000340)="d8b5bcadd4c4ca4f88ff69e2f208cec62d60d7f982eb804f0050b56ce0a9a1f41bdda42c03103f", 0x27}, {&(0x7f0000000880)="3302ccb141cd9d90eeee961fedad01720710f4896f7425ec648027f2a1cbc3ba22277b7b9c922a1b7461eff7120d13c5f844b653cf8ce74f50b63765b837448957761d1c85810d30bcdc6504144ba8a70c1167ef19c8459354597a135c50415b4b09f28181aff762c4344670e3915054e234e129717e3e00ba61ba6f881d0e33268665526b1966df1d4c41b168fa6d527a53a2acbbe2d9bf3317777aefd3701ebb21365561a908a8e5aa37c7b11140042319c2bffce916e5a40be58ec7050975d93268383e7a274adf9f4acc1a0d", 0xce}], 0x8, &(0x7f0000000bc0)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0xffffffffffffffff}}}, @rights={{0x18, 0x1, 0x1, [r10, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [r6, r3, 0xffffffffffffffff, r0, r6]}}, @rights={{0x34, 0x1, 0x1, [r6, 0xffffffffffffffff, r11, r7, 0xffffffffffffffff, r7, r12, r1, r0]}}, @rights={{0x20, 0x1, 0x1, [r1, r1, r8, r13]}}], 0xb8, 0x4}}, {{&(0x7f0000000b00)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000001680)}}, {{&(0x7f00000012c0)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, &(0x7f0000001a00), 0x0, 0x40000}}, {{&(0x7f0000001a40)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000001b00)=[{&(0x7f0000001ac0)="7f5ffeeadcc3be48498bea337b75705e9b626cf7a755f5bbe80944693f21856a5712c86b75a571501a1265667411a6d8bd4a", 0x32}, {&(0x7f0000001c00)="c4a7b1295e5492629e177dd7c01cd3a6c801d8fdce535b3c45bc91a47376398ebe8abc3a55b0151cf2ad2dd170bff5bcc0f152fac26a9bac8cac60039ea18c99daa149b0466a2d7c7a6431ec746306a6a74f2c86dfe89e1be71fa555276c5d5f3e8810b563f0377192a9d1c8407191e78664cb9558268d17402d17bb42aee6d7d1a921fe18d7e42c20f60ad2461df2ea4b85c93c3f5fb3ad58bf6b2056322b3e33e08de155a4669b72fc98cec251054ab7b49634c925a22bf0eda649c735bcb8e288418281abd40d564105f7557342fbf0404561", 0xd4}], 0x2}}, {{&(0x7f0000001b40)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000002000)=[{&(0x7f0000001d00)="c3026f534bbc4773898e42f90a277f82988073982d62ce96c7d151820d0df3c0f1f268bb452c301ba5551470edde869480894fa1bdf5899c77bc2d047de7c36258bd19774b0e9f758153e373e586bebbe443c152718186b155f5be4cb0a1d129857b78404541223a8d103fbef73f62c71f8f3292b283445f5f6fe69068d315d845dd73c6f396d5c7a6e4513b9d8daef0087f6873ae328862e050494dacf88148a7c52a54d1067be35f1226585499273644a54947505cf7edddb81cac360c615a269532", 0xc3}, {&(0x7f0000001e00)="7b550ba19e4690625310432569e5f105c1cb6576f45191e73d4ae9efacede1b3a7207dee71d3f0fc5e648f7af28681eafc266f79507b635da6a0ea6e85a39b5232bbf0619a8e2c3ed20c2b9910d1dae4ab0f69edffa8cd561366f153c362c34785b2b32117ac8d6ba00ae18467266ec0f654db607a2acc1f5de6936a65135f063e1587ab37a274db", 0x88}, {&(0x7f0000001ec0)="4f656e6c06f7a9baea9204f84fddd1844fb867c4c29b9916bb6acff3885e1b1f0d503ce7f76b818e2072ddd5741622e4f236fb938b8112b3baac2c4dfa77894e7f6c3150b0d12a78bb0144e8cb5e1faffd3c2964012c4acc7bfcd6fa0cfc20e9335f05f51ab6c14e8c8ea0bd86869b9a4a4cf1977de2d6d67cd303cbdc6189c784f47074d03ddf46421331ef612b9382d50df04abd9b19f2f28d357fa8a280f8cfc77e9702b2c0f7621b92c9facfa58182653e0b4a", 0xb5}, {&(0x7f0000001fc0)="e4c885701874340c19f09674a0db9cae0ba6ea05c9065d872e6eed9262f67e247f5867b32161e17a27e5271ca10075ade4", 0x31}], 0x4, &(0x7f0000002040), 0x0, 0x4000000}}], 0x5, 0x24008010) setsockopt$sock_int(r10, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) 5.081015829s ago: executing program 0 (id=823): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb2570000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000001c0)='sched_switch\x00', r5}, 0xe) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000008c0)={'syztnl2\x00', 0x0}) socket$nl_generic(0x10, 0x3, 0x10) read$FUSE(r0, &(0x7f0000000200)={0x2020}, 0x2020) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', 0x0, 0x2200892, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x4eb) openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{}, 0x0, 0x0}, 0x20) syz_emit_ethernet(0x42, &(0x7f0000000040)={@broadcast, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "1e1907", 0xc, 0x2f, 0x0, @remote, @mcast2, {[], {0x0, 0x6558, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}}, 0x0) 4.935581211s ago: executing program 3 (id=824): gettid() timer_create(0x2, &(0x7f0000000040)={0x0, 0x7, 0x4, @tid=0xffffffffffffffff}, &(0x7f0000044000)=0x0) timer_settime(0x0, 0x1, &(0x7f0000000500)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x9) timer_create(0x7, &(0x7f0000000000)={0x0, 0x27, 0x0, @thr={&(0x7f0000001500)="c8e2c8bc0836d8b5cc6819c81d0dd7193dd28b4864dc5fb5fda86a3e79ee0d4a039b77a129174b23e4ac6845f6460a58cab599447718b44b614871b7d4e17515740844d1dfffe7bbd77776ece0f495d9013e81cdf57ae3501fc214875c5d300d2e3cd6c18355bd9a8e2f0b2ca14a383913870edb34e606acb23a73773d874f75e7acd70e1e471867cdc0494e120f0a4c761e86121c01c1c8e392dd97ba52e6d7d7d2f24a1ce8fc46d89fc35da8a3b801006f1ceb5f455ceb6d0c77c83657dcb24ea8262c9d38bc11082db53c2fa177d37a3b9c525cc0a1a5a8b270fbac2490b9286113f6b7aef6f40890456907aca4b963fa14c7d1657769c80e9a630d11779d26a32684abe46447831b47b828580f2c19c2b581c351644c4d2ddc03c473a198f620ce00a139941cca82c4e20a824e111f042744ab27609e8a698e731b1578e72b8163efd6ff92a12d3864ac9fdf18324afb0548bb8575a580407a6276973d4c5727198f2f415df5c6e8fb9a66bb33eb11ef005c9f1a390bf6d5f8c66e977aa70b58f148ffe1fbb022d4b53b3df7a3af0c6473e379ee81df7c0b2f27cb728d546a239353f9d9fea63216e8e04cc3720dfe5b0678b7f12ec0eb443f8b3bce363d128760307573d8f44faad5cf44c639c9360484517137c1f3eecb8251d76f6c660c25df1f7fa69d11fcad996d35bce3826e3c344c98009cf02c905a7abdc26efcf255a02ed3a99f5e6a692d8c900fe9d735fdde565632d6c2b1a08382de98d9e14dd393e42431f063209947d2061e6a7a5a98836993358356c34fadc9493220ef3220f6a4ae20d850baf6ed79ae33fd204f724f6923311e737ae3e204b75ccee01413b70e7f943a420d9a09976f4db17b1ee2707d6c8ef65b9d302774887405378789912a73eb3d1eb75f1bef0c79ef445ca59c6860b32d5df8948b8a1cb20d17b8513553e361a95857f2f7101b614b8e92ecf188cedd2a1e68479e443e7cd1a149d41c8ace758cbceff771e0d6730749c4206395177c208b2fc2211357933b21750d13a2998a9e8fb438199560e2bce2859338fc20406e80a4da4553c01c93bb556187513494467490efee031d76c36f6b0f40ff732f940d6be23163e36dc237805c2a7b8f1243def067ddb323556c531cea25efa5c6d798159195f4f696d793dc6d8e3a1889298ce708b9b475eeeb83ea47e7c7092589a15e545afb8a26d023c376f6fb4d8778a28ec29b0b5cc788e7a3ca957b5fe3e0886fe99ece0b11e6a79bece312b700aac1de621332f7d785253baecd3c52d489c78846d3370484601bc6c0947268f3555b965c402a6a35e45813bd9af1d859062a99d1546ea759ada2b6ac7c20ca2bd2f10764e105007168e3914a31bca408808292e7bddf78501a13a2b6696277132c425fe4fd5f0afa434885e9f18d911a6a1b9ae360e507ee36270618e732d61fe7a0978dbb9117322991165bda3e43625431b9d07a29d154b4d6f7cc40b6734c24e3b740b1762a1d37f83c05ae9bb3510632a973b8b5238fbc7878fc09a59642d8d346aefecbb0da1946d011b9263ab47a551c42827776e4ebded98a75bb70a984f40a8ce0eb0a74fe0521a2cc4d2d234a2942124479a435a8d6ba36aeb9ad50460122b7bba4ed768b40401e5677473b576e108b2c5d6417c7b84532527b5c2a2544be75bf826a01a5b08e1529b8a48666d03e7961f8873815f96bcacc1986139b13c5a369c4bb59d5cc852729e8afc18770222ed86a7905a9f06c2275a5a7e22638e2add7c958689577b83e1eca16a47025d7eb6f1a111812fb9abb3cd5ee3b73c20d91f37c47527cc813f7a1b50f013d50e835d2f90ee8d3736633e5a8b4cf1e43292ab1509cd99d79f75a61573393d753a5d853080a653eac064fa8482652e0ba6ac3081897df72420cb1f82ae604c37cad8c02bee744956ea75762eebb80280a450b45a0ee3a5456ed1a8ae9ea05b6f0d63cf0c459ccac7f624b1e5b5f70023a9120c567cf1089c5c1e026547f84e95c93b8abb23bc40968aece596e0071c73f76ca40a14c4f9bb1002df95ca1e5cb849818714aa93a256926851076401d29f592d984bec00f1fb9c300462cfd669c0bfc637275d5a20070b9693ae1e85a8265d23661d042ff2be59e395ec77a31a9ae7eb5e5db4db9835b374db187bd6cff06811716d94ff67025b934ad152ef4650c9462ff9bd6f4f533748f186be1e2f244b4c93bd26a77cb64bd98ef8ab13552b12be60a29a1b7ec402f60bdd86a60d63638a3385e034daec495f8dc3962906d7a9ecba90f07cd06785af3e3cf49cda55a0a681d1af110d5abca8196a55110b2e2dac03417f4a2104b222dd1fd350ee96e3188b21ae190c5e98410e7d1ac66a2acad49d5e8f78c8901c2cb85bc9657572f0b91835c8c540bd97968f593237bc6e481f941b786372d743c76e86a0626d9d61079037bbfa740460bf3d23d998a466c07d65328f369e6d9ef72baf37c4468bfc2b8085feb61e3408f10e0811c40c893f1fe93c5e709b87117f1b5baf29f7568243e374fddf36911716106560e233c3e7fe2109d1165f0dcf0854e3329ca082baffd26bbf4abc17a5b9e77c72c685215738c34b4d813673886333d966cd76d345e03af6391372ea57f4e2ad47dda85ad21a7bd497715484980d2cdcb74d6527b0c9247f06284961a70fca9f3d0871d8d90dc612c02c4833cdeb02a4a747054db0c8b10d1f0921b07a5848404910d628e478591bd80203ccb392c580d248d210d6fb5626cc86ace95b3bbf56bc15ad405bc0e506aa021c2b330db56b1144b850befc79a2ff1da8d1b8ec65fd370bc16b012003d5c486b26a291294e31ae9bc4d78ccc3e23397c2fa8b916c73a7765a1fb776e6a4324f4c9910fe87ee1f3e47f3f5d31a0e01582bbb89f114e57a0be230e819589e08a025c909681d746733718ce1704a0d0ad301eb4dd36b24c9ac6d5058f2172fc5ef51c7ae3957f6022aece254bd45d76b303f80671e4fab7c71686ece943defd1c159266f330d5e8407de106c537810d40e83a017e2ee8fcc0dae2e6dd0c2d1de558b70ba988678ad5c3ccd157cbaecca3ce2841d5cd3adb80c62180c216b5b288ddd24a68625cef6468439b327fe4940a2ee5d2c41565bb9e9108bfd819c5693acee32989978a3f3867b4de6ed928427b76cd8d35c781a7c1c72e60cb24de8fd10226b0485fc495e2592b4739c51b1fec0d55aab379fbfb975047712161b535afc27ef1733ed35d92cf95ad8dfacaf7982fcd42fa047ca15cb9c800399ee8271743f6f82e877c547d7a94348885114887ca48678369bf71d0baa320a56b2c9439930a0e2698292e91028597bd97815e5e4136ab8ac4179ca0ea41bf24df9a44806b740ff7279fed573c7eaa2b2093bcf0862703c7fa87e30b7cbb61e9d5d4927330c42a87cc6112c6c90592e404c722c9a7d213a9215093f328d83f5e8c8086e00b06af741264a6b3edfb8083717a46e9b78351989336dac9e9156543efc85baa527765a591e1d991f00d1452200a28edd0e95325328b5bc655f545bacf062b06ffb3ac3d5f12f61815a33aecdcf5cf21ec09cb34cd6455a244e872ccca829b3f29d98ed60c861f89b95eb72783ce7da07e5832ad68aa94b867d451bbde656a185be2fe1e51b690ede1c5b8c8d3cdda02a55e85be8e5bec11932aa735c5e259b4ae6dda91d29a6e0d95922fede38f6611693bc425eed2a19432fefc0628dba55228d3459409a50a801f2a9ff1c4bfafc73c241321457e40ab7b4b0040b4001dbe4d17be859e40fa1a244bd3658aa681c392e4a2613919fcd89cce94b357002618e521b6a829817241c14d2314bb033389d91178946fca2bbd39dae4c3626f965b7c1d77826d7b7758abf0db9cc4fd0943e454f6938e8da1b474d7ea20803df080a5db92dc8cbc601e92274d10699caafa2f41887a773b92bd39956551a18f7eadf437722e91bcc8bde6df1af1b15f8cc924fc9da43cc724b1917837d1ecec084c83a8e1c937a7e2fc6c46432be420e0e1e6e817c69ff977571b4291dca7629fdc2856a7e582243d463cdb646d50e5cf67095820538cce32be5407b391a2193f28905aaf03f84c657029df8bf6d01f73d4206ace4a10ab01c44820633ddaecd7f3bd34529b9d9afcba40b0d38552fd88e707b49a27450f11b4be44f03f921ee015cda10b3a8b68aaff5d348c2b34b55e684e91ac7ac0c5215d83817103aeff849ffee908a0345d22683ce40504571e5f1d8280e4710a5187f3130cd9b071567039080fdbc3f5a0546ab906bcefe8a2069753b885b32d20af88f7d285d991ef7db500dfb59bde1eef80b8b919d6cbe879353046cf05656c86b2d34b220aba0c09df418aa12f85165915bea5cb57db14dad935d6ce1354936e38f1b10113310f27e094922577d895118dfa562e6ed276848be6f48a7549d8c6812eafa82ff0eb24f841972f2cdaab57ec1d0c2e365f20b9bd80c20717ad8d04cc457b9b695c3b38cfb71f891f00a199e28901e8370bb4ee7c5143f3e0f689ab8fe4e8e59868acb13655e1466dc2b31da746ee31d4cef830495192c6f90d2cfcdcfd5a3ab407da08873c9325b620cb454187227236c25ec6c1c3120a4e1e74089db33c25b90574dcad34400682b2046cab3fe7726457f31a031dab7015dcf279f1394dba13ef0ebaecb80961ae359f6171d51be640ddc47956c6797325650adc295a9c7d7b456243f552a7c93d81dcc432a2aee8e708c350ee34381e2fbd27cacdeda8c64b95cb947fb4c8b25ad0b5b1005f3ec26aafdc0a56211c0c9db36b534a235fa8cffd502379c358221c321296ad6149a1598e7db549f4df3b6cf4ff5ce86454de1b23686d3d66618c3fbf9089701289a67f893d1c1eb7cfe5291878f8b5251add8f9aaa9016d3f929760434cfe86b4956367e3713bb8f7535d23cf57272aef97fd4ee0d21c1a40095be45729d25bc89500ad47baf29f10add3662218f8e62eb5f4c22995184f516ada7e81a2e494e86c277b68e5ce361cf684b92c3b82af0302705833708e8a429e5fb7d87f1d725c579efc94e77097d6584227457fde5f3471e95406164783fcf19a7828872180d5fa1d499a580c6753618d38e08d0d83e7c5f593e79fd59fe10fb13d0129183d4a997aeee9c62e838397cdf7b7f3ea9d3e518545a2c910a35d7b8eabca2eb0b033c3674b7768654bf925e8888b9c46af884535c66985cf7d3960fc1824d151a8e2facb930fd41a2133475e1d22dc87b22149cd88fb01db1b0dc46bebf2905f30b5388b0061f36760b5d6f734fcbb6fe9714784622a2305553bfa20f7d93e1907edd30dff4a8cba183ab18424c493fe3a057f2ad460c4a66487b29ded7fb04188f4a226b001116a3c8e9f6a43094aa1332341f2a2468c4b1c5a83d2affaf6aff182204f5fdb3805a7a6a22f3287964ef315f7a81c9d1d5b39ca31ba5edba998507657de1f40722288a4a1e381b8b2526553319a6487652b5077bb9cad7fab30fc0b1e0b64d587c1b046e25d7064903cbd08ebd87bda9881bf199e8b17fdcf114c4b926f518d3835884a9fc1df498cb46a780b77cd6fb6bd9fb88cfdf654deb6619e16b5b20b787912ff1c5cce84c1b02c3547b4185c57df56bc68f4596842e28b9e57e4bb499073ecebd7afa2a12732853b42386012a98f9cf2d7aa185e6791747386d06c3d8ec24348f2b960fda7c45e55cf8534762e5310310ebd7d2d5ba526c47d77cea622b02362ea44256d0b029336ddabd159128e99df25f", &(0x7f0000000080)="007c165c886a9d6237245427fb7a791f722119f998f6f3031f74245a0f296866c69f2078816a4efc78fac7be7ad97dc67c49fb7067b2a07a468c183e38f106534ad474ac17abd034a45ab4856fc74c8e9025a43fe7b663ee56402044ea6aa35ef82029904a7e86d634b2058176bb5d097dc2e45be34f67577d4bc3279e507ea667b0d9a64855512257c2e10f145c5de735252ae3783ba9d41d1085a12a0596de7acff0ac5b0369dde8adb52fe7a60ac5d52d010dd239d87846a43d1686a7369c161d77658a28dbfc877e588b2db6035a4950729b9b94d49f20"}}, &(0x7f0000000180)=0x0) timer_gettime(r1, &(0x7f00000001c0)) syz_open_dev$cec(&(0x7f00000014c0), 0x0, 0x20000) timer_gettime(r0, 0x0) 4.70346954s ago: executing program 3 (id=825): mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000180)='tmpfs\x00', 0x2204c96, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100"/13], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() recvmsg(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000dc0)=""/255, 0xff}], 0x1, &(0x7f0000000480)=""/5, 0x5}, 0x40000010) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x5) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000840000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000300000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x2c, 0x2, 0x1, 0x5, 0x0, 0x0, {0xa, 0x0, 0x4}, [@CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x4}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x3}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0xe}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000880}, 0x880) sendmmsg$inet6(r4, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x80020}, 0x1c, &(0x7f0000000500)=[{&(0x7f00000034c0)}], 0x1}}], 0x1, 0x34000811) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000000640)=ANY=[@ANYBLOB="30e01b3981ddca14"], 0x1000f) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000001240), 0x111, 0xc}}, 0x20) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000340)={0x0}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000580)={r6, 0xc6, "f6416a80b4364024a22ba5a11404c52f6fd44f1f09c0c3c4b0a54be636a5b2883e05fef4d480b171356bbb99c4d1c3b20e0353ff343707a118a9b1e07f8f91082ca16d6d9029b5d2360df8c5337b5716ff51dd644e3bb557276fbb0f85eac07c47869bf06abc5d4b8c8cacfe0c85542dd428b454b351241a8ac0a5e74382f81f454374f82d6efee9531abfa3d28224ac0583faad167ece6793601747ea6339a9c4a5f6f8742ba908841d3451e23353fab5b248f7743311007f23e274e9d9206b2919008d759d"}, &(0x7f00000001c0)=0xce) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') lseek(r7, 0x80000000, 0x3) 3.476051146s ago: executing program 1 (id=826): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = fsopen(&(0x7f0000000000)='udf\x00', 0x0) r2 = getpgrp(0xffffffffffffffff) r3 = syz_open_procfs$userns(r2, &(0x7f0000000180)) setns(r3, 0x40000000) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000200)='\x00 \x8b.\xf32I\x1aK\xf4\r\x8b\x1fuJ^.\x03\xd4Y \xfa^o\x9f\x1eft\x80P\x00\x18\xa9\x7f\"#\x85\x1c\xf2\xc6\xd9\xba\x9c\"\xcc\xfd;\xfb\xf2\xe2h\x81\\\xaa\x8b\xbc\xa5\x89\xd8\xe3\x12\x81R\xd4!5\x12\xd3Y\xa3\xfc1\xb0\xd4\xc7o\x01\xf8p\xa9\xc9\xd4]\xc5\x14\a)?\xe9:Y\xd9r\x18TM\x96&\f2)e\xdb\x9ft\xbdD\xcf', &(0x7f0000000480)='i_#harset\xe9m\xe1\xed\xc39\x052\x9a\xc1\x06?\x04GD\xbco\x17!\xb8\xa8\xc4\xfa\xac\x06M\xb0\xde\xf7{\x03\xa4o\x0f\x1b\xef\xc7\b\x00\x00\x00\x00\x00\x00\x00\x9eY\xf0[-C\xde\xbfS\x06\x14\xd8\xc1\xaeA\xb6\a\b\x00\x00\x00.\x9eA\xae\xd5\f\x83\x9d\xd2U\x8c\x82NT\xb5mv\x8c\x82\x18\xb4\\\xd6M_\xbf\b \xc8\x00\x00\x006\xd8\x1d\x9ah\xb0^\x86\xc6\xb3\xcf\x0e\xf7\x85#C\xb5\x88\xf80[)\xe3\x14\x99\x10\x042r\x8e\xddK|\x88\xe41-\x91\xd7\x17\xcd\x83\x1e\x96U\xddy\x98\xe4p\xb9\x85\xd9\xe9\x87\xcb5<\xf38?\x00\x87\x0eN\xda\xe58\xfc1\xa4\x11tj+\xc9\x85\\\x03\x12\xb9\xefvwgj\xcf\xca\t\x97eOJ\xc9\x9a\xb4\xc6p3\xca\xacq\xac\xf8\xdc\xb4\xe0b\x93D\x12\xdc6\n\x93\xe3\xebv\xe7\xa2Vq\xd9m\a\xa7\xf2\x9b\x12\x9a\x8f\xca\x93\xca\xc6\x8a\xc87c\x9d\x8c\x1f\x92pF\t\x04\xeb\x88\xb5\xf2\xad\xb8\x15\n[ }Z^=\xd1\x9a\xab\xc9\x89Je\x83\x00\xb9\xdb\xf6\x85\xf9\xe5\v\xff\x94O\x82\xb2rp\xe7\xe27\xf3\xaa\xa1%a\xc4\xc4\x8f\xe5\xcf\x9d\xe5.;\xa9\xf4\xc92\x02)\xe4\xce\x06-\'\xa2\xc6\r\xd6\xaeO\xa6\xd0\xb0\x19\x0f\xfc\x98_^\xf2=\x00\x18\xf7iD', 0x0) read(r1, 0x0, 0x0) r4 = syz_open_dev$radio(&(0x7f0000000140), 0x0, 0x2) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r5, 0x84, 0x81, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r5, 0x84, 0x15, &(0x7f00000001c0)={0xf}, 0x1) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205647, &(0x7f0000000100)={0xf010004, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f90d, 0x0, '\x00', @value64=0xfffffffffffffffe}}) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r6, 0xaf01, 0x0) r7 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r6, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r6, 0x4004af07, &(0x7f0000000000)=r7) ioctl$VHOST_SET_VRING_KICK(r6, 0x4008af20, &(0x7f0000000040)={0x1, r7}) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000780)={0x1, 0x1, &(0x7f0000000380)=""/240, &(0x7f0000000900)=""/103, &(0x7f0000000800)=""/90}) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000b00)={0x2, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}, {0xdddd0000, 0x5b, &(0x7f00000009c0)=""/91}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r6, 0x4004af61, &(0x7f0000000980)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r7, 0xc400941d, &(0x7f0000000380)={0x0, 0xcdf, 0xf}) read$FUSE(0xffffffffffffffff, 0x0, 0x0) memfd_create(&(0x7f0000000780)='\x01\xfd\xae.+\xa6\x8c\xb6?2\x199\x94S,|x?Ue[\xbd\xe1!\x033\xbc\'#\xff\x17\x9b%\xf3[d \x06\x00\x00\x00\x97A\xc2\xd8\xf0Uq!\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xeb\xe4\x9aR\xe5,\x82\x03\x00\x19\x8d\xe8\xc6\xb9\xe4\xb4\x99\x8a\x19\xe5\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xcc\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\x16\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xef!\x8f\xf6]-\xf1k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7cdv[\t\x00\x8d\xf3\xcc1\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6\xbel\x9b.o\xbe\x80\x9dx\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9k\x83\xfc\xa4\xad4\x03\xa2X\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfcN\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\xaf\xa2\x14]p+\x96\x1ei|n\xda\xee\\\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\xf8\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11Z\xe6:\x03\xce\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xdfY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0\xe1\x86\t\xaf\vi\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xad\x86\xd7\x15&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96?\x00\x00\x00\x00\x00\x00\x00\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKl\xcc\xa4:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcb\xcaXe\xe1\xa2\xaa\x02\x86\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01O\xd3r\xa2\xa9u\x93>m\xd7q\'\xdf\xfajo\xd8n\xa7\xecJi\xde\xdf\x7f\xe3\xc4*Z 4\xe8S$\xa1H=\xdf\x05\xf3\xc3T\xd1\xdd\xc6f\xa4\xb4\x96\\\xa0\xf9\x0f\x17\x11{\xb6\x9d\xd21\xc1\x90Vj\x13r\x00\x00\xde\x03\xab\xff\x8as0\xc6E\xca\"\xd9*\x9a\x15\xb95r\x8f\xaaj\x82\xd6\xd2%\xed\xa2WQ\xec2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xccX\xfdRB\xffU\xe9\xfa\x1f\xf6\xce\b\xde@\x061\xc6z\xe4\xe0\xc9?\xa7\x94>\x9c\xd1\xa5o\x04\xaaim\xae\xfe\xc7f\xa3\x96\xd7\xb4c)r{\r#\xddI&\n\xf2\xec\xd4\xff\x9f\x136zZ-2\x80\xfbH+\x9b8\xf3\xed\xdf\xa2my\xb28c[\xc3\xfe\xb5M\x84\x97\xa5\'s\xe9\xdc=)I\xabLt2\x9c\v\xd9S', 0x6) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000080)=ANY=[@ANYBLOB="1802000000000000000000000000000085100000010000009500000000000000180000000001000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000288500000070000000"], &(0x7f0000000000)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0xa}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r8, 0xe0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000003c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000100), &(0x7f0000000440)=[0x0, 0x0], 0x0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000500), &(0x7f0000000540), 0x8, 0x5c, 0x8, 0x8, &(0x7f0000000580)}}, 0x10) 3.391164627s ago: executing program 0 (id=827): socket$nl_audit(0x10, 0x3, 0x9) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) setrlimit(0x7, &(0x7f0000000400)) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 3.094939015s ago: executing program 0 (id=828): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) getpid() recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000002c0)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) fsopen(&(0x7f00000002c0)='sockfs\x00', 0x1) ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, &(0x7f0000000040)={0x0, 0x4000000, 0x8, 0xd, 0x200, &(0x7f0000001500)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309000a0000fdfd000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000005000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) getrlimit(0x5, &(0x7f0000000280)) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.641264555s ago: executing program 1 (id=829): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x7, 0x4, 0x100, 0x6, 0x8}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x9, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000001850000001b000000b700000000000000850000002300000095"], &(0x7f0000000780)='GPL\x00', 0x1000000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r2}, 0x18) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x17) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f0000000480)={0x1, 0x0, [{0x80000008, 0x10001, 0x4, 0x7ff, 0x5, 0x0, 0x2}]}) 2.623607056s ago: executing program 4 (id=830): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x400) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180500000000c800000000004b64ffec850000007d000000850000002a00000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000480)=@abs={0x0, 0x0, 0x8004e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000480)=ANY=[@ANYBLOB="040e07000514"], 0xa) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, 0x0, 0x4000000) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0xfffffffffffffdf5, 0x0, 0xffffffc3}, 0x24040084) timer_create(0x4, &(0x7f0000000040)={0x0, 0x1a, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000100)) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa6820000}, 0x0) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000002, 0x8012, r0, 0x0) 2.590111085s ago: executing program 2 (id=831): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000bc0)={0x11, 0x4, &(0x7f0000000ac0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffff1e}, [@call={0x85, 0x0, 0x0, 0x37}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41000, 0x61, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000000000010d804dd00000000000001090224000100000001090400eb010300000009210500000122050009058103"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="18"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f0000000140)={0x0, 0xffff, 0x4, {0x2, @raw_data="3d924b8271394fa4ec01eb92492ff84715d1a004d08b012a7cafe27a5f313d31bbdae50511ca5be6bfe92437ed0d21b5180e375be56b3b9306d7dbb26bf9f22de7ac7681cca450055250217bdf1113b4258293ba4efed33147bda8454dd115bd5ba066ba06f2854cc96db9a98055cbde9fd084a1223ada91ed2e832907a01ab5ee65f997b617f73d1aa5a6dfc47acdc5eb834f8e448469d235e4380cbcc3310200970349a3c1374ffec96177b67caa0656f9664277cadb8597e7d911ad1da457ef9744b0993c57a7"}}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r3, 0xc058565d, &(0x7f00000003c0)=@fd={0x0, 0x2, 0x4, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "f06e4b56"}, 0x0, 0x4, {}, 0x11}) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x1) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, &(0x7f0000000080)={[{@quota}, {@usrquota_inode_hardlimit={'usrquota_inode_hardlimit', 0x3d, [0x37]}}]}) chdir(&(0x7f0000000240)='./file0\x00') mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) syz_usb_control_io$hid(r2, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) r4 = syz_usb_connect$cdc_ecm(0x2, 0x5e, &(0x7f0000000600)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4c, 0x1, 0x1, 0x5, 0xb0, 0x2, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x2, 0x6, 0x0, 0x10, {{0x8, 0x24, 0x6, 0x0, 0x0, '3l\f'}, {0x5, 0x24, 0x0, 0xfffe}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x2, 0x400, 0x80}, [@call_mgmt={0x5, 0x24, 0x1, 0x0, 0x90}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x40, 0x8, 0x8, 0x2}}], {{0x9, 0x5, 0x82, 0x2, 0x20, 0xb, 0x1a, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x3, 0x9, 0x2}}}}}]}}]}}, &(0x7f0000000940)={0xa, &(0x7f0000000680)={0xa, 0x6, 0x340, 0x4, 0x6, 0x9, 0x8, 0xff}, 0x5d, &(0x7f00000006c0)={0x5, 0xf, 0x5d, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x8, 0x6, 0x9, 0x7}, @ptm_cap={0x3}, @ssp_cap={0x24, 0x10, 0xa, 0x2, 0x6, 0x2, 0xf000, 0x5, [0x0, 0xffff0f, 0xc03f, 0x3f30, 0x3fc0, 0xcf]}, @wireless={0xb, 0x10, 0x1, 0xc, 0x20, 0x1, 0xc9, 0x2, 0x3}, @ssp_cap={0x1c, 0x10, 0xa, 0x1, 0x4, 0x159, 0xf00, 0xf50, [0x3f30, 0x3f00, 0x30, 0x1f40]}]}, 0x6, [{0x93, &(0x7f0000000740)=@string={0x93, 0x3, "b0cdf3ee4ed03bbd27ae2e90af98e4a39c8296f21a7835c2978baff8da38516c0369e472fa7fb6e13b66fa616fc922390f7e4f40fc5219291589b9482c3e26dede12f32103b4d33c16922465b75b39660a92da93bdf1812d4dcac27a03f02ed3c14d3ae420e92260e8254cbba2f4d9395b251b9ec984055d94eea2270556cd532100b2123037d3cb9f8d23a736e7123397"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x3001}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0xf8ff}}, {0x4, &(0x7f0000000880)=@string={0x4, 0x3, "a85e"}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x200a}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x44c}}]}) syz_usb_control_io$cdc_ecm(r4, &(0x7f0000000b40)={0x14, &(0x7f00000009c0)={0x0, 0xe, 0xf9, {0xf9, 0x22, "7a470a968fef276e5b7f8c587cd2d82c23ea8dcca42064af57933a90402970f369a043c447c604a76999b84a9d330b5c60a60bd24e4a3f7393b561bbcbd650edbc860150520a4f560b1aa14965f638aa26ce9ea680c5629c339a623edcf46d388cb816495532b7b7536f00acaa844753cd5127c14b2dab4b60722e5a4c3b821f26f87761e70eda387ada26a2fa1958b3ca02f4398dcf0cfb768a5ce03685077cdf622ca3936d743480f322b9d337d5d1b5eb757462399abc13fd2aa6cabe16bef34efbd6754dbd2f14dbbef4b7cde9dcdc0be082b3341c3584b034e46ed9b9c2081f568436740799e76689ffafced86c3847b1585daed1"}}, &(0x7f0000000b00)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000d40)={0x1c, &(0x7f0000000c80)={0x20, 0x18, 0x3e, "3265eccf46feeeae2aa34dc8904dd7d6fac0e1778dc017a6b25a315ec3896b9dd8db17172a8cf6705c60b11af58bec6c34fa7d1af9e5bb6bd33cbdeaa3e7"}, &(0x7f0000000b80)={0x0, 0xa, 0x1}, &(0x7f0000000d00)={0x0, 0x8, 0x1, 0xc}}) r5 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r5, 0x720, &(0x7f0000000180)={0x1, 0x9, 0x2, &(0x7f0000000080)={0xb, "c6c1f7b51030c4a4c54bf28fac0200000000000000bc117b5452b3b94bce47509d"}}) 2.110792951s ago: executing program 3 (id=832): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) getpid() recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000002c0)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x0) r4 = fsopen(&(0x7f00000002c0)='sockfs\x00', 0x1) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r5, 0x4b72, &(0x7f0000000040)={0x0, 0x4000000, 0x8, 0xd, 0x200, &(0x7f0000001500)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309000a0000fdfd000f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000005000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={0xffffffffffffffff, 0x0, 0x0}, 0x10) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(0xffffffffffffffff, 0x2def, 0x1f74, 0xc, 0x0, 0x0) 933.173803ms ago: executing program 1 (id=833): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) pipe2(&(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000001bc0)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000003c0)={@remote, 0x1d, r5}) r6 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r6, &(0x7f00000000c0)=ANY=[@ANYBLOB='+\x00\x00\x00\b'], 0x2b) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r8, 0x8933, &(0x7f0000000b80)={'batadv_slave_0\x00', 0x0}) setsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000300)={@remote, r9}, 0x14) close_range(r2, 0xffffffffffffffff, 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r10, 0x29, 0x4b, &(0x7f0000000100)=0x401, 0x4) r11 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r11, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x4, 0x8, 0x4, 0x6, 0x50, @empty, @private0, 0x20, 0x20, 0x3}}) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a00000004000000026bbbd664d09200cc05ed480000000000", @ANYRES32=0x1, @ANYBLOB="0200"/19, @ANYRES32=0x0, @ANYRES32], 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000012c0)={0x0, 0x0, 0xffffffffffffffff, 0x0, 0x7, r12}, 0x38) r13 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000ac0), 0x802, 0x0) statx(r2, &(0x7f00000018c0)='./file0\x00', 0x7000, 0x800, &(0x7f0000001900)) sendmmsg$unix(r1, &(0x7f0000002080)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000007c0)=[{&(0x7f0000001200)="dee07f712cbc8ef053bfbc37f54e5f6f9ed9e711d341ba961b22e75097177c816346e1a7e3227b2bc6aea0420d61773fb60dc4213c6bf12452329482a1e721e7eff9a4d23aad5f98d0f1c3f2fa8870dfa2a7ccd1dcc000df05c45ec3bfeeab06c53f66b3c933b5dfd0d220600bd50794ef522dcbaefe6c0d2b1b2d68b7f0cfdf9386209978be8f68cee7", 0x8a}, {&(0x7f0000000400)="7b51de769e1ade1a539519ba46e25ea9316f616bc1209978d2bee61b6ec964a64a0b1a537a3342c7d6c98b6237a1b7f9777cc64609d160119200ddc247eb053e61ed5393014a5e776407e39583a476b220617e1f3609639b1b1ec7678b5694a49b7009aa3726b399988c766a9b33d547b9d036ac2037f0a94e7f88710528096920", 0x81}, {&(0x7f00000002c0)="32c2b64d6f6d1dbcd018574c26194a42eb81098133008cd025cd8d761a9f038f92e8a91a24c49e9e97f11875dc75afaba1e14b4b97", 0x35}, {&(0x7f00000004c0)="86d9e2b0eab5e4f4cabbf5d0681d244d25877f9362ba200ceee14a9146a611ef5f20678b7b2d7676dbd6e7055802c447e320521b4a8c35135a929ea3eaae16365875a8671742a22f254da4385a7825fbdad9db7ae30e7a1e07c1a2d36a93efccf313ee08d4a1ee296eb67f428620d157d2329d2c3aa924035794b354b5fe5aaa7e301d425d28d5dc2149a6f0c75a4f1f9ba84367044e51841b18a96809e7c51c46829fa9851a11cf9926fad54239513a3ae1c7f20ad16cb5fbad46512b0e8f5312bc25a5a14e00583b0f6200bad97589ca00d9189d6d0391ba8b", 0xda}, {&(0x7f00000005c0)="89fdd02a706c99c3af93158f683fe557d7a63fc992ee6e4a4c9c15aa32bca86ac9178a15674c11a5f9f9d68ddad8c6507e6886fb06a5587d7493c4743ce7b25e5970e3095d7ccdf3d158faf400b48c4bddc233d7afb77e08fc91bc5783ba098183c873e7262eb393894342d77bce0a950f0048cbdb178f89ff319bd3f7875297f34916bfccd463eac3b122ebd99d63d34999b42ab7d3dcb4db662d90217fb2f765f0a378333d7234cf9876302342b1c0c22975d8e7e80d123cbb5bfcbbc1647f302937644529bfb8e3c4f09ffa32fcfe22a20bfea52cd119e685d2f0", 0xdc}, {&(0x7f00000006c0)="932854bf049f8811fd2424e6e93e741c1ab671c6f5cab59d2267950a299c20f500979cbd74cf3f3a06f10104db180348f6c01f8175a1238cfb41cec91ef3035a031f3f31955e368adf54f7d33b5dcb5435e034b3beebae05e1dba51a0e7e832745d8f06eaf0570c522f5aac6862a89561f7b1640fb60a9a3e73e13447cfd82e88cd8ade7016526d21e0c8c23a5009edece1f226064009b0a294235e52423c6663b84e98722ad8b01456df3fc56c8c8f06fbb406f9d3f5f371d0bcf9f03356ae309e538f9d492434e0a2a5142", 0xcc}, {&(0x7f0000000340)="d8b5bcadd4c4ca4f88ff69e2f208cec62d60d7f982eb804f0050b56ce0a9a1f41bdda42c03103f", 0x27}, {&(0x7f0000000880)="3302ccb141cd9d90eeee961fedad01720710f4896f7425ec648027f2a1cbc3ba22277b7b9c922a1b7461eff7120d13c5f844b653cf8ce74f50b63765b837448957761d1c85810d30bcdc6504144ba8a70c1167ef19c8459354597a135c50415b4b09f28181aff762c4344670e3915054e234e129717e3e00ba61ba6f881d0e33268665526b1966df1d4c41b168fa6d527a53a2acbbe2d9bf3317777aefd3701ebb21365561a908a8e5aa37c7b11140042319c2bffce916e5a40be58ec7050975d93268383e7a274adf9f4acc1a0d", 0xce}], 0x8, &(0x7f0000000bc0)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0xffffffffffffffff}}}, @rights={{0x18, 0x1, 0x1, [r10, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [r6, r3, 0xffffffffffffffff, r0, r6]}}, @rights={{0x34, 0x1, 0x1, [r6, 0xffffffffffffffff, r11, r7, 0xffffffffffffffff, r7, r12, r1, r0]}}, @rights={{0x20, 0x1, 0x1, [r1, r1, r8, r13]}}], 0xb8, 0x4}}, {{&(0x7f0000000b00)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000001680)}}, {{&(0x7f00000012c0)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, &(0x7f0000001a00), 0x0, 0x40000}}, {{&(0x7f0000001a40)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000001b00)=[{&(0x7f0000001ac0)="7f5ffeeadcc3be48498bea337b75705e9b626cf7a755f5bbe80944693f21856a5712c86b75a571501a1265667411a6d8bd4a", 0x32}, {&(0x7f0000001c00)="c4a7b1295e5492629e177dd7c01cd3a6c801d8fdce535b3c45bc91a47376398ebe8abc3a55b0151cf2ad2dd170bff5bcc0f152fac26a9bac8cac60039ea18c99daa149b0466a2d7c7a6431ec746306a6a74f2c86dfe89e1be71fa555276c5d5f3e8810b563f0377192a9d1c8407191e78664cb9558268d17402d17bb42aee6d7d1a921fe18d7e42c20f60ad2461df2ea4b85c93c3f5fb3ad58bf6b2056322b3e33e08de155a4669b72fc98cec251054ab7b49634c925a22bf0eda649c735bcb8e288418281abd40d564105f7557342fbf0404561", 0xd4}], 0x2}}, {{&(0x7f0000001b40)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000002000)=[{&(0x7f0000001d00)="c3026f534bbc4773898e42f90a277f82988073982d62ce96c7d151820d0df3c0f1f268bb452c301ba5551470edde869480894fa1bdf5899c77bc2d047de7c36258bd19774b0e9f758153e373e586bebbe443c152718186b155f5be4cb0a1d129857b78404541223a8d103fbef73f62c71f8f3292b283445f5f6fe69068d315d845dd73c6f396d5c7a6e4513b9d8daef0087f6873ae328862e050494dacf88148a7c52a54d1067be35f1226585499273644a54947505cf7edddb81cac360c615a269532", 0xc3}, {&(0x7f0000001e00)="7b550ba19e4690625310432569e5f105c1cb6576f45191e73d4ae9efacede1b3a7207dee71d3f0fc5e648f7af28681eafc266f79507b635da6a0ea6e85a39b5232bbf0619a8e2c3ed20c2b9910d1dae4ab0f69edffa8cd561366f153c362c34785b2b32117ac8d6ba00ae18467266ec0f654db607a2acc1f5de6936a65135f063e1587ab37a274db", 0x88}, {&(0x7f0000001ec0)="4f656e6c06f7a9baea9204f84fddd1844fb867c4c29b9916bb6acff3885e1b1f0d503ce7f76b818e2072ddd5741622e4f236fb938b8112b3baac2c4dfa77894e7f6c3150b0d12a78bb0144e8cb5e1faffd3c2964012c4acc7bfcd6fa0cfc20e9335f05f51ab6c14e8c8ea0bd86869b9a4a4cf1977de2d6d67cd303cbdc6189c784f47074d03ddf46421331ef612b9382d50df04abd9b19f2f28d357fa8a280f8cfc77e9702b2c0f7621b92c9facfa58182653e0b4a", 0xb5}, {&(0x7f0000001fc0)="e4c885701874340c19f09674a0db9cae0ba6ea05c9065d872e6eed9262f67e247f5867b32161e17a27e5271ca10075ade4", 0x31}], 0x4, &(0x7f0000002040), 0x0, 0x4000000}}], 0x5, 0x24008010) setsockopt$sock_int(r10, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) 0s ago: executing program 4 (id=834): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, &(0x7f0000006880)={0x1, [{0x2, 0x28, 0xffffffff, &(0x7f0000000000)="daabf704a8"}, {0x3, 0x28, 0x6, &(0x7f0000000080)="176396604d"}, {0x0, 0x148, 0xf7a8, &(0x7f0000000140)="09ed5ea87793af10bca04f3cac719118de3e7bf774c7b2cff2dd40aea9b8848bb3c166dd8cf1c21c5d"}, {0x0, 0x0, 0x5, 0x0}, {0x1, 0x0, 0x3ff, &(0x7f00000000c0)}, {0x6704d6a2955ace6e, 0x0, 0x8, 0x0}, {0x3, 0x0, 0x4, 0x0}, {0x1, 0x0, 0x2, 0x0}, {0x1, 0x0, 0xe, 0x0}, {0x3, 0x0, 0xfffffffc, 0x0}, {0x1, 0x0, 0x1ff, &(0x7f0000005600)}, {0x3, 0x0, 0x80000000, 0x0}, {0x3, 0x0, 0x1ff, 0x0}, {0x3, 0x0, 0x3, 0x0}, {0x2, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x5, 0x0}]}) kernel console output (not intermixed with test programs): T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.724838][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.724904][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.724969][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.725034][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.725101][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.725171][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.725235][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.725301][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.725367][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.725432][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.725496][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.732428][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 189.897408][ T5796] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 189.930768][ T10] usb 1-1: USB disconnect, device number 18 [ 189.941451][ T5798] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 189.957526][ T5796] usb 5-1: device descriptor read/8, error -71 [ 190.037483][ T6734] usb 4-1: USB disconnect, device number 18 [ 190.352810][ T5796] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 190.368080][ T5796] usb 5-1: device descriptor read/8, error -71 [ 191.057743][ T5796] usb usb5-port1: unable to enumerate USB device [ 194.362957][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.363027][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.378701][ T6324] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 194.542112][ T6324] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 194.542141][ T6324] usb 5-1: config 4 has 0 interfaces, different from the descriptor's value: 1 [ 194.542178][ T6324] usb 5-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 194.542201][ T6324] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.547350][ T6734] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 194.677445][ T6064] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 194.698398][ T6734] usb 2-1: no configurations [ 194.698410][ T6734] usb 2-1: can't read configurations, error -22 [ 194.827736][ T6064] usb 1-1: Using ep0 maxpacket: 8 [ 194.827909][ T6734] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 194.830742][ T6064] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 194.830796][ T6064] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 194.830818][ T6064] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.856320][ T6064] usb 1-1: config 0 descriptor?? [ 194.978258][ T6734] usb 2-1: no configurations [ 194.978278][ T6734] usb 2-1: can't read configurations, error -22 [ 194.978601][ T6734] usb usb2-port1: attempt power cycle [ 195.069314][ T6064] usb 1-1: USB disconnect, device number 19 [ 195.317869][ T6734] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 195.339771][ T6734] usb 2-1: no configurations [ 195.339791][ T6734] usb 2-1: can't read configurations, error -22 [ 195.467341][ T6734] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 195.488785][ T6734] usb 2-1: no configurations [ 195.488807][ T6734] usb 2-1: can't read configurations, error -22 [ 195.489258][ T6734] usb usb2-port1: unable to enumerate USB device [ 197.107897][ T6026] usb 5-1: USB disconnect, device number 20 [ 197.437423][ T7003] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 198.769525][ T804] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 198.865714][ T7093] netlink: 20 bytes leftover after parsing attributes in process `syz.1.372'. [ 198.897304][ T7003] usb 3-1: Using ep0 maxpacket: 8 [ 198.900015][ T7003] usb 3-1: unable to get BOS descriptor or descriptor too short [ 198.901318][ T7003] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 198.901344][ T7003] usb 3-1: config 1 has no interface number 1 [ 198.901392][ T7003] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 198.905703][ T7003] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 198.905729][ T7003] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 198.905747][ T7003] usb 3-1: Product: syz [ 198.905761][ T7003] usb 3-1: Manufacturer: syz [ 198.905774][ T7003] usb 3-1: SerialNumber: syz [ 199.067303][ T804] usb 1-1: Using ep0 maxpacket: 8 [ 199.072041][ T804] usb 1-1: config 0 has an invalid interface number: 142 but max is 0 [ 199.072070][ T804] usb 1-1: config 0 has no interface number 0 [ 199.076650][ T804] usb 1-1: New USB device found, idVendor=1066, idProduct=0300, bcdDevice=5c.40 [ 199.076677][ T804] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.076696][ T804] usb 1-1: Product: syz [ 199.076709][ T804] usb 1-1: Manufacturer: syz [ 199.076723][ T804] usb 1-1: SerialNumber: syz [ 199.161947][ T804] usb 1-1: config 0 descriptor?? [ 199.245385][ T7003] usb 3-1: 2:1 : no UAC_FORMAT_TYPE desc [ 199.293697][ T10] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 199.433673][ T7003] usb 3-1: USB disconnect, device number 19 [ 199.448038][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 199.453597][ T10] usb 4-1: config 0 interface 0 altsetting 235 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 199.453639][ T10] usb 4-1: config 0 interface 0 altsetting 235 endpoint 0x81 has invalid wMaxPacketSize 0 [ 199.453661][ T10] usb 4-1: config 0 interface 0 has no altsetting 0 [ 199.453693][ T10] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 199.453713][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.507692][ T10] usb 4-1: config 0 descriptor?? [ 199.567639][ T5996] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 199.637396][ T804] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 199.647083][ T6312] udevd[6312]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 199.717350][ T5996] usb 5-1: Using ep0 maxpacket: 8 [ 199.765947][ T5996] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 199.765981][ T5996] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 199.766049][ T5996] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 199.766071][ T5996] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 49 [ 199.766109][ T5996] usb 5-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 199.766130][ T5996] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.805533][ T5996] usb 5-1: config 0 descriptor?? [ 199.814520][ T7103] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 199.843388][ T804] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 199.843443][ T804] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 199.843466][ T804] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.951968][ T804] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 200.068265][ T7103] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.076628][ T7103] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.093736][ C1] Bluetooth: hci5: Unexpected continuation: 1 bytes [ 200.107907][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.108071][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.108144][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.109651][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.110526][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.110657][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.110811][ T7097] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.116726][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.116860][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.116928][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.117554][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.117849][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.117942][ T7097] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.118740][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.118814][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.118932][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.119216][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.119289][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.120041][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.120324][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.120394][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.120681][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.120960][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.121034][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.121313][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.121601][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.121670][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.121789][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.121912][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.121980][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.122098][ T5114] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 200.258775][ T10] usbhid 4-1:0.0: can't add hid device: -71 [ 200.259397][ T10] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 200.289774][ T10] usb 4-1: USB disconnect, device number 19 [ 200.328990][ T5798] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 200.329759][ T6734] usb 5-1: USB disconnect, device number 21 [ 200.437469][ T5996] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 200.571213][ T7003] usb 1-1: USB disconnect, device number 20 [ 200.607611][ T5996] usb 3-1: Using ep0 maxpacket: 16 [ 200.609077][ T5996] usb 3-1: config 0 interface 0 altsetting 235 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 200.609095][ T5996] usb 3-1: config 0 interface 0 altsetting 235 endpoint 0x81 has invalid wMaxPacketSize 0 [ 200.609106][ T5996] usb 3-1: config 0 interface 0 has no altsetting 0 [ 200.609124][ T5996] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 200.609135][ T5996] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.618410][ T5996] usb 3-1: config 0 descriptor?? [ 201.003461][ T804] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 201.004248][ T804] stv0680 2-1:4.0: last error: 208, command = 0xf8 [ 201.163498][ T7107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.168169][ T7107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.209291][ T7003] usb 2-1: USB disconnect, device number 20 [ 201.216738][ T5996] usbhid 3-1:0.0: can't add hid device: -71 [ 201.216859][ T5996] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 201.250622][ T5996] usb 3-1: USB disconnect, device number 20 [ 202.895802][ T7139] binder_alloc: 7138: binder_alloc_buf, no vma [ 203.057364][ T6667] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 203.217276][ T6667] usb 2-1: Using ep0 maxpacket: 16 [ 203.218939][ T6667] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 203.218969][ T6667] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 203.885188][ T6667] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 203.885219][ T6667] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.885239][ T6667] usb 2-1: Product: syz [ 203.885252][ T6667] usb 2-1: Manufacturer: syz [ 203.885267][ T6667] usb 2-1: SerialNumber: syz [ 204.002711][ T7003] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 204.040459][ T6667] usb 2-1: config 0 descriptor?? [ 204.068867][ T6667] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 204.068903][ T6667] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 204.177545][ T7003] usb 4-1: Using ep0 maxpacket: 8 [ 204.198296][ T7003] usb 4-1: config 0 has an invalid interface number: 142 but max is 0 [ 204.198325][ T7003] usb 4-1: config 0 has no interface number 0 [ 204.201271][ T7003] usb 4-1: New USB device found, idVendor=1066, idProduct=0300, bcdDevice=5c.40 [ 204.201299][ T7003] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.201317][ T7003] usb 4-1: Product: syz [ 204.201331][ T7003] usb 4-1: Manufacturer: syz [ 204.201344][ T7003] usb 4-1: SerialNumber: syz [ 204.206968][ T7003] usb 4-1: config 0 descriptor?? [ 204.450062][ T7003] usb 4-1: USB disconnect, device number 20 [ 204.678084][ T6667] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 204.679647][ T6667] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 204.680048][ T6667] em28xx 2-1:0.0: AC97 chip type couldn't be determined [ 204.680065][ T6667] em28xx 2-1:0.0: No AC97 audio processor [ 204.737845][ T6667] usb 2-1: USB disconnect, device number 21 [ 204.741062][ T6667] em28xx 2-1:0.0: Disconnecting em28xx [ 204.748341][ T6667] em28xx 2-1:0.0: Freeing device [ 205.438397][ T6483] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 205.627715][ T6483] usb 4-1: Using ep0 maxpacket: 8 [ 205.782750][ T7160] netlink: 300 bytes leftover after parsing attributes in process `syz.2.394'. [ 206.393067][ T6483] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 206.393102][ T6483] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 206.393123][ T6483] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 206.393145][ T6483] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 49 [ 206.393181][ T6483] usb 4-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 206.393202][ T6483] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.412640][ T6483] usb 4-1: config 0 descriptor?? [ 206.414077][ T7152] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 206.669132][ T7152] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 206.669645][ T7152] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 206.673185][ C1] Bluetooth: hci5: Unexpected continuation: 1 bytes [ 206.699916][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.700559][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.710635][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.715807][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.716272][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.716943][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.727419][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.727506][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.727574][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.727650][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.727718][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.727789][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.727853][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.728490][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.728568][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.728647][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.728713][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.728786][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.728852][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.728921][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.728992][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.729082][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.729152][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.729218][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.729283][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.729348][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.729415][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.729480][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.729545][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 206.884655][ T5114] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 206.902759][ T6483] usb 4-1: USB disconnect, device number 21 [ 208.867356][ T6734] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 209.040283][ T6734] usb 4-1: Using ep0 maxpacket: 16 [ 209.590049][ T6734] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=29.00 [ 209.590082][ T6734] usb 4-1: New USB device strings: Mfr=84, Product=2, SerialNumber=3 [ 209.590101][ T6734] usb 4-1: Product: syz [ 209.590115][ T6734] usb 4-1: Manufacturer: syz [ 209.590130][ T6734] usb 4-1: SerialNumber: syz [ 209.605976][ T6734] usb 4-1: config 0 descriptor?? [ 209.616499][ T6734] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 209.773412][ T6734] usb 4-1: Detected FT4233HP [ 209.926068][ T6734] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 209.934562][ T6734] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 209.955867][ T6734] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 209.982540][ T6734] usb 4-1: USB disconnect, device number 22 [ 210.000512][ T6734] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 210.001332][ T6734] ftdi_sio 4-1:0.0: device disconnected [ 210.074620][ T7198] netlink: 'syz.2.408': attribute type 1 has an invalid length. [ 210.074643][ T7198] netlink: 244 bytes leftover after parsing attributes in process `syz.2.408'. [ 210.790934][ T7198] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 210.805902][ T7198] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 210.806273][ T7198] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 210.806525][ T7198] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 210.806770][ T7198] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 211.617330][ T7194] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 211.780081][ T7194] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 211.780139][ T7194] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 211.780161][ T7194] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.850959][ T7194] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 212.672435][ T5114] Bluetooth: hci1: command 0x0c1a tx timeout [ 212.948572][ T5802] Bluetooth: hci0: command 0x0c1a tx timeout [ 212.948620][ T5114] Bluetooth: hci4: command 0x0c1a tx timeout [ 212.948654][ T61] Bluetooth: hci2: command 0x0c1a tx timeout [ 212.948685][ T5798] Bluetooth: hci3: command 0x0c1a tx timeout [ 212.956960][ T7194] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 212.991320][ T7194] stv0680 2-1:4.0: last error: 208, command = 0xf8 [ 213.221380][ T804] usb 2-1: USB disconnect, device number 22 [ 214.390329][ T7246] netlink: 'syz.0.422': attribute type 1 has an invalid length. [ 214.390353][ T7246] netlink: 244 bytes leftover after parsing attributes in process `syz.0.422'. [ 214.517546][ T6029] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 214.647377][ T6029] usb 3-1: device descriptor read/64, error -71 [ 214.904877][ T6029] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 215.026531][ T7251] netlink: 300 bytes leftover after parsing attributes in process `syz.1.423'. [ 215.047435][ T6029] usb 3-1: device descriptor read/64, error -71 [ 215.156796][ T7246] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 215.157864][ T7246] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 215.158927][ T7246] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 215.159249][ T7246] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 215.159993][ T7246] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 215.365380][ T6029] usb usb3-port1: attempt power cycle [ 215.538112][ T7256] FAULT_INJECTION: forcing a failure. [ 215.538112][ T7256] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 215.538146][ T7256] CPU: 0 UID: 0 PID: 7256 Comm: syz.4.426 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 215.538167][ T7256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 215.538178][ T7256] Call Trace: [ 215.538186][ T7256] [ 215.538194][ T7256] dump_stack_lvl+0xe8/0x150 [ 215.538224][ T7256] should_fail_ex+0x46c/0x600 [ 215.538255][ T7256] _copy_to_user+0x31/0xb0 [ 215.538276][ T7256] simple_read_from_buffer+0xe1/0x170 [ 215.538305][ T7256] proc_fail_nth_read+0x1b6/0x220 [ 215.538334][ T7256] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 215.538364][ T7256] ? rw_verify_area+0x2ac/0x4e0 [ 215.538386][ T7256] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 215.538413][ T7256] vfs_read+0x206/0xa30 [ 215.538445][ T7256] ? __pfx_vfs_read+0x10/0x10 [ 215.538472][ T7256] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 215.538492][ T7256] ? lockdep_hardirqs_on+0x7b/0x110 [ 215.538510][ T7256] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 215.538527][ T7256] ? mutex_lock_nested+0x154/0x1d0 [ 215.538550][ T7256] ? fdget_pos+0x253/0x320 [ 215.538577][ T7256] ksys_read+0x14b/0x260 [ 215.538603][ T7256] ? __pfx_ksys_read+0x10/0x10 [ 215.538624][ T7256] ? fput+0xa0/0xd0 [ 215.538655][ T7256] do_syscall_64+0xec/0xf80 [ 215.538672][ T7256] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.538690][ T7256] ? trace_irq_disable+0x37/0x100 [ 215.538709][ T7256] ? clear_bhb_loop+0x60/0xb0 [ 215.538732][ T7256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.538750][ T7256] RIP: 0033:0x7f3d546ce15c [ 215.538774][ T7256] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 215.538791][ T7256] RSP: 002b:00007f3d52936030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 215.538812][ T7256] RAX: ffffffffffffffda RBX: 00007f3d54925fa0 RCX: 00007f3d546ce15c [ 215.538826][ T7256] RDX: 000000000000000f RSI: 00007f3d529360a0 RDI: 0000000000000005 [ 215.538839][ T7256] RBP: 00007f3d52936090 R08: 0000000000000000 R09: 0000000000000000 [ 215.538851][ T7256] R10: 0000200000000440 R11: 0000000000000246 R12: 0000000000000001 [ 215.538864][ T7256] R13: 00007f3d54926038 R14: 00007f3d54925fa0 R15: 00007ffc5f329308 [ 215.538896][ T7256] [ 215.698970][ T6029] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 215.730421][ T6029] usb 3-1: device descriptor read/8, error -71 [ 216.087346][ T6029] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 216.108129][ T6029] usb 3-1: device descriptor read/8, error -71 [ 216.229701][ T6029] usb usb3-port1: unable to enumerate USB device [ 216.347353][ T5947] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 216.499068][ T5947] usb 1-1: Using ep0 maxpacket: 16 [ 216.503865][ T5947] usb 1-1: config 0 interface 0 altsetting 235 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 216.503898][ T5947] usb 1-1: config 0 interface 0 altsetting 235 endpoint 0x81 has invalid wMaxPacketSize 0 [ 216.503920][ T5947] usb 1-1: config 0 interface 0 has no altsetting 0 [ 216.503952][ T5947] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 216.503974][ T5947] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 216.510815][ T5947] usb 1-1: config 0 descriptor?? [ 216.527390][ T5798] Bluetooth: hci1: command 0x0c1a tx timeout [ 216.947149][ T7265] overlayfs: failed to resolve './file1': -2 [ 217.157390][ T5798] Bluetooth: hci0: command 0x0c1a tx timeout [ 217.190471][ T5947] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 217.190507][ T5947] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 217.190532][ T5947] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x1 [ 217.190556][ T5947] mcp2221 0003:04D8:00DD.0006: unknown main item tag 0x0 [ 217.191455][ T5947] mcp2221 0003:04D8:00DD.0006: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 217.247325][ T61] Bluetooth: hci3: command 0x0c1a tx timeout [ 217.247369][ T61] Bluetooth: hci2: command 0x0c1a tx timeout [ 217.247408][ T5798] Bluetooth: hci4: command 0x0c1a tx timeout [ 217.404220][ T7265] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.447755][ T7265] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.453575][ T7194] usb 1-1: USB disconnect, device number 21 [ 217.457448][ T5807] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 219.371306][ T5807] usb 4-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 219.371368][ T5807] usb 4-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 219.371391][ T5807] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.420781][ T5807] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 219.631794][ T7288] netlink: 'syz.4.435': attribute type 1 has an invalid length. [ 219.631818][ T7288] netlink: 244 bytes leftover after parsing attributes in process `syz.4.435'. [ 220.448206][ T5807] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 220.448229][ T5807] stv0680 4-1:4.0: STV(e): camera ping failed!! [ 220.554627][ T5807] stv0680 4-1:4.0: last error: 208, command = 0xf8 [ 220.632090][ T7291] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 220.632404][ T7291] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 220.632675][ T7291] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 220.632930][ T7291] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 220.664080][ T7291] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 220.770405][ T6734] usb 4-1: USB disconnect, device number 23 [ 221.487679][ T7311] netlink: 300 bytes leftover after parsing attributes in process `syz.4.439'. [ 222.677457][ T5801] Bluetooth: hci1: command 0x0c1a tx timeout [ 222.677512][ T5802] Bluetooth: hci0: command 0x0c1a tx timeout [ 222.677553][ T5114] Bluetooth: hci2: command 0x0c1a tx timeout [ 222.677592][ T61] Bluetooth: hci3: command 0x0c1a tx timeout [ 222.677629][ T5798] Bluetooth: hci4: command 0x0c1a tx timeout [ 223.575386][ T5807] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 223.767342][ T5807] usb 5-1: Using ep0 maxpacket: 16 [ 223.769667][ T5807] usb 5-1: config 0 interface 0 altsetting 235 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 223.769701][ T5807] usb 5-1: config 0 interface 0 altsetting 235 endpoint 0x81 has invalid wMaxPacketSize 0 [ 223.769724][ T5807] usb 5-1: config 0 interface 0 has no altsetting 0 [ 223.769757][ T5807] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 223.769779][ T5807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.860050][ T5807] usb 5-1: config 0 descriptor?? [ 223.863672][ T7332] netlink: 'syz.1.449': attribute type 1 has an invalid length. [ 223.863691][ T7332] netlink: 244 bytes leftover after parsing attributes in process `syz.1.449'. [ 224.708427][ T7323] overlayfs: failed to resolve './file1': -2 [ 225.680116][ T7332] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 225.680365][ T7332] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 225.680576][ T7332] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 225.680814][ T7332] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 225.681039][ T7332] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 225.824222][ T5807] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 225.824270][ T5807] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 225.824296][ T5807] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x1 [ 225.824321][ T5807] mcp2221 0003:04D8:00DD.0007: unknown main item tag 0x0 [ 225.869922][ T5807] mcp2221 0003:04D8:00DD.0007: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 226.036782][ T7320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 226.042241][ T7320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 226.070254][ T5807] usb 5-1: USB disconnect, device number 22 [ 227.782831][ T5801] Bluetooth: hci1: command 0x0c1a tx timeout [ 227.791127][ T5802] Bluetooth: hci0: command 0x0c1a tx timeout [ 227.794061][ T5114] Bluetooth: hci2: command 0x0c1a tx timeout [ 227.794289][ T61] Bluetooth: hci3: command 0x0c1a tx timeout [ 227.795329][ T5798] Bluetooth: hci4: command 0x0c1a tx timeout [ 228.430971][ T7371] netlink: 300 bytes leftover after parsing attributes in process `syz.3.458'. [ 229.405182][ T6324] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 229.764408][ T6324] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 229.764478][ T6324] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 229.764501][ T6324] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.371445][ T6324] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 231.271175][ T7383] process 'syz.1.461' launched './file0' with NULL argv: empty string added [ 231.275060][ T7383] Invalid argument reading file caps for ./file0 [ 231.321311][ T7383] tmpfs: Bad value for 'nr_blocks' [ 231.418634][ T6324] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 231.418659][ T6324] stv0680 1-1:4.0: STV(e): camera ping failed!! [ 231.419524][ T6324] stv0680 1-1:4.0: last error: 208, command = 0xf8 [ 231.590841][ T7394] netlink: 'syz.3.464': attribute type 1 has an invalid length. [ 231.590862][ T7394] netlink: 244 bytes leftover after parsing attributes in process `syz.3.464'. [ 231.627960][ T6483] usb 1-1: USB disconnect, device number 22 [ 232.347312][ T7393] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 232.354222][ T7393] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 232.354393][ T7393] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 232.354564][ T7393] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 232.354724][ T7393] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 232.587307][ T6324] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 233.489736][ T6324] usb 3-1: Using ep0 maxpacket: 16 [ 233.492115][ T6324] usb 3-1: config 0 interface 0 altsetting 235 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 233.492147][ T6324] usb 3-1: config 0 interface 0 altsetting 235 endpoint 0x81 has invalid wMaxPacketSize 0 [ 233.492171][ T6324] usb 3-1: config 0 interface 0 has no altsetting 0 [ 233.492203][ T6324] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 233.492224][ T6324] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.531829][ T5857] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 233.561881][ T6324] usb 3-1: config 0 descriptor?? [ 233.903230][ T5798] Bluetooth: hci1: command 0x0c1a tx timeout [ 234.380738][ T5802] Bluetooth: hci0: command 0x0c1a tx timeout [ 234.383822][ T5114] Bluetooth: hci2: command 0x0c1a tx timeout [ 234.388497][ T61] Bluetooth: hci3: command 0x0c1a tx timeout [ 234.388876][ T5798] Bluetooth: hci4: command 0x0c1a tx timeout [ 234.587492][ T5857] usb 2-1: Using ep0 maxpacket: 16 [ 234.591635][ T5857] usb 2-1: config 0 interface 0 altsetting 235 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 234.591666][ T5857] usb 2-1: config 0 interface 0 altsetting 235 endpoint 0x81 has invalid wMaxPacketSize 0 [ 234.591689][ T5857] usb 2-1: config 0 interface 0 has no altsetting 0 [ 234.591721][ T5857] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 234.591742][ T5857] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.610693][ T5857] usb 2-1: config 0 descriptor?? [ 234.789563][ T7431] netlink: 300 bytes leftover after parsing attributes in process `syz.4.474'. [ 234.965748][ T7413] overlayfs: failed to resolve './file1': -2 [ 234.975145][ T6324] mcp2221 0003:04D8:00DD.0008: unknown main item tag 0x0 [ 234.975188][ T6324] mcp2221 0003:04D8:00DD.0008: unknown main item tag 0x0 [ 234.975215][ T6324] mcp2221 0003:04D8:00DD.0008: unknown main item tag 0x1 [ 234.975240][ T6324] mcp2221 0003:04D8:00DD.0008: unknown main item tag 0x0 [ 234.976291][ T6324] mcp2221 0003:04D8:00DD.0008: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.2-1/input0 [ 235.154750][ T7403] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.160624][ T7403] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.191991][ T6324] usb 3-1: USB disconnect, device number 25 [ 235.262915][ T5857] mcp2221 0003:04D8:00DD.0009: unknown main item tag 0x0 [ 235.262956][ T5857] mcp2221 0003:04D8:00DD.0009: unknown main item tag 0x0 [ 235.262984][ T5857] mcp2221 0003:04D8:00DD.0009: unknown main item tag 0x1 [ 235.263011][ T5857] mcp2221 0003:04D8:00DD.0009: unknown main item tag 0x0 [ 235.263945][ T5857] mcp2221 0003:04D8:00DD.0009: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 235.377319][ T5807] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 235.448581][ T7413] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.453455][ T7413] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.499325][ T5947] usb 2-1: USB disconnect, device number 23 [ 235.527286][ T5807] usb 4-1: Using ep0 maxpacket: 16 [ 235.529120][ T5807] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 235.529179][ T5807] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 235.529205][ T5807] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 235.529226][ T5807] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 235.529248][ T5807] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 235.534163][ T5807] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 235.534191][ T5807] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 235.534207][ T5807] usb 4-1: Manufacturer: syz [ 236.723127][ T5807] usb 4-1: config 0 descriptor?? [ 237.019448][ T5807] rc_core: IR keymap rc-hauppauge not found [ 237.019469][ T5807] Registered IR keymap rc-empty [ 237.019635][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.054262][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.080389][ T5807] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 237.105136][ T5807] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input41 [ 237.150264][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.177896][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.212478][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.247662][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.267448][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.297591][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.327362][ T7194] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 237.333063][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.357436][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.377403][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.400757][ T5807] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 237.477390][ T7194] usb 3-1: Using ep0 maxpacket: 8 [ 237.479466][ T7194] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 237.479500][ T7194] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 237.479521][ T7194] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 237.479542][ T7194] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 49 [ 237.479579][ T7194] usb 3-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 237.479601][ T7194] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.560734][ T7194] usb 3-1: config 0 descriptor?? [ 237.562059][ T7440] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 237.581864][ T5807] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 237.581890][ T5807] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 237.623255][ T5807] usb 4-1: USB disconnect, device number 24 [ 237.828033][ T7440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 237.830862][ T7440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 237.849184][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.849681][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.849756][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.849830][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.849896][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.849963][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850029][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850099][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850164][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850230][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850295][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850361][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850426][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850493][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850557][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850622][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850689][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850758][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850830][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850896][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.850960][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.851025][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 237.851088][ T61] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 238.052239][ T5798] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 238.074474][ T6667] usb 3-1: USB disconnect, device number 26 [ 238.259989][ T7452] 9p: Bad value for 'rfdno' [ 238.378800][ T7457] netlink: 'syz.3.482': attribute type 1 has an invalid length. [ 238.378815][ T7457] netlink: 244 bytes leftover after parsing attributes in process `syz.3.482'. [ 239.517150][ T7457] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 239.518977][ T7457] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 239.519501][ T7457] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 239.520524][ T7457] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 239.520883][ T7457] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 240.825144][ T61] Bluetooth: hci1: command 0x0c1a tx timeout [ 241.127342][ T6483] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 241.287337][ T6483] usb 1-1: Using ep0 maxpacket: 16 [ 241.290698][ T6483] usb 1-1: config 0 interface 0 altsetting 235 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 241.290731][ T6483] usb 1-1: config 0 interface 0 altsetting 235 endpoint 0x81 has invalid wMaxPacketSize 0 [ 241.290753][ T6483] usb 1-1: config 0 interface 0 has no altsetting 0 [ 241.290784][ T6483] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 241.290806][ T6483] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.311902][ T6483] usb 1-1: config 0 descriptor?? [ 241.382421][ T7494] vxcan0: tx drop: invalid da for name 0x0000000000000015 [ 241.558116][ T61] Bluetooth: hci4: command 0x0c1a tx timeout [ 241.558155][ T5801] Bluetooth: hci0: command 0x0c1a tx timeout [ 241.558299][ T5802] Bluetooth: hci2: command 0x0c1a tx timeout [ 241.559494][ T5114] Bluetooth: hci3: command 0x0c1a tx timeout [ 241.587585][ T5996] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 241.647369][ T5114] Bluetooth: hci5: command 0x1003 tx timeout [ 241.652569][ T5798] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 241.764292][ T5996] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 241.764346][ T5996] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 241.764402][ T5996] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.811358][ T5996] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 241.816749][ T6483] mcp2221 0003:04D8:00DD.000A: unknown main item tag 0x0 [ 241.816784][ T6483] mcp2221 0003:04D8:00DD.000A: unknown main item tag 0x0 [ 241.816811][ T6483] mcp2221 0003:04D8:00DD.000A: unknown main item tag 0x1 [ 241.816836][ T6483] mcp2221 0003:04D8:00DD.000A: unknown main item tag 0x0 [ 241.839541][ T6483] mcp2221 0003:04D8:00DD.000A: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 241.916539][ T7501] siw: device registration error -23 [ 242.014850][ T7474] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 242.015344][ T7474] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 242.035309][ T6064] usb 1-1: USB disconnect, device number 23 [ 242.291144][ T7509] netlink: 'syz.3.498': attribute type 1 has an invalid length. [ 242.291166][ T7509] netlink: 244 bytes leftover after parsing attributes in process `syz.3.498'. [ 243.167990][ T5996] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 243.168014][ T5996] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 243.168176][ T7509] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 243.168875][ T7509] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 243.171934][ T7509] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 243.192648][ T7509] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 243.194241][ T7509] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 243.242925][ T5996] stv0680 2-1:4.0: last error: 208, command = 0xf8 [ 243.448103][ T6064] usb 2-1: USB disconnect, device number 24 [ 243.767432][ T6064] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 244.360590][ T6064] usb 4-1: Using ep0 maxpacket: 16 [ 244.364657][ T6064] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 244.364715][ T6064] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 244.364742][ T6064] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 244.364763][ T6064] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 244.364784][ T6064] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 244.572755][ T6064] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 244.572774][ T6064] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 244.572784][ T6064] usb 4-1: Manufacturer: syz [ 244.617023][ T6064] usb 4-1: config 0 descriptor?? [ 244.767654][ T6667] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 244.917885][ T6667] usb 1-1: Using ep0 maxpacket: 8 [ 244.920262][ T6667] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 244.920294][ T6667] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 244.920312][ T6667] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 244.920329][ T6667] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 49 [ 244.920351][ T6667] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 244.920363][ T6667] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.930824][ T6667] usb 1-1: config 0 descriptor?? [ 244.932237][ T7534] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 244.998246][ T5798] Bluetooth: hci1: command 0x0c1a tx timeout [ 245.057278][ T6064] rc_core: IR keymap rc-hauppauge not found [ 245.057299][ T6064] Registered IR keymap rc-empty [ 245.057455][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.077508][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.100035][ T6064] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 245.106264][ T6064] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input42 [ 245.134339][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.157878][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.187474][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.207513][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.227447][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.247416][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.267390][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.297523][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.319513][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.319662][ T5114] Bluetooth: hci3: command 0x0c1a tx timeout [ 245.319683][ T61] Bluetooth: hci2: command 0x0c1a tx timeout [ 245.319761][ T5802] Bluetooth: hci0: command 0x0c1a tx timeout [ 245.319805][ T5798] Bluetooth: hci4: command 0x0c1a tx timeout [ 245.323266][ T7534] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 245.334173][ T7534] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 245.381470][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.383160][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.385273][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.385418][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.385544][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.385614][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.385745][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.387732][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.389794][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.389931][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.390007][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.401704][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.401883][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.401928][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.402216][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.402336][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.402398][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.402535][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.402654][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.402722][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.406945][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.407079][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.407151][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 245.513491][ T6064] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 245.568399][ T6064] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 245.568416][ T6064] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 245.573196][ T6064] usb 4-1: USB disconnect, device number 25 [ 245.592538][ T5947] usb 1-1: USB disconnect, device number 24 [ 245.601390][ T5801] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 246.007344][ T6667] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 246.157963][ T6667] usb 5-1: Using ep0 maxpacket: 16 [ 246.177291][ T6667] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 246.177352][ T6667] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 246.177379][ T6667] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 246.177399][ T6667] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 246.177421][ T6667] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 246.179226][ T6667] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 246.179254][ T6667] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 246.179272][ T6667] usb 5-1: Manufacturer: syz [ 246.184220][ T6667] usb 5-1: config 0 descriptor?? [ 246.571178][ T6667] rc_core: IR keymap rc-hauppauge not found [ 246.571199][ T6667] Registered IR keymap rc-empty [ 246.571344][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.588594][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.602447][ T6064] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 246.623203][ T6667] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 246.638963][ T6667] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input43 [ 246.687522][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.707966][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.727472][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.757484][ T6064] usb 1-1: Using ep0 maxpacket: 8 [ 246.825952][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.837577][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.857439][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.877454][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.897514][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.917628][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.937623][ T6667] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 246.975051][ T7567] netlink: 300 bytes leftover after parsing attributes in process `syz.2.514'. [ 247.121639][ T6667] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 247.121664][ T6667] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 247.122780][ T6064] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 247.122811][ T6064] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 247.122830][ T6064] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 247.122851][ T6064] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 49 [ 247.122884][ T6064] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 247.122905][ T6064] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.148014][ T6667] usb 5-1: USB disconnect, device number 23 [ 247.212194][ T6064] usb 1-1: config 0 descriptor?? [ 247.224223][ T7560] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 247.495574][ T7560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 247.496457][ T7560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 247.504956][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505032][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505098][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505169][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505234][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505303][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505375][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505441][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505505][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505570][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505640][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505716][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505783][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505850][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505923][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.505985][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.506052][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.506118][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.506184][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.506249][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.506312][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.506378][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.506443][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 247.737866][ T5947] usb 1-1: USB disconnect, device number 25 [ 247.745438][ T5801] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 249.487422][ T5947] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 249.661911][ T5947] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 249.661969][ T5947] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 249.661993][ T5947] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 249.701420][ T7583] overlayfs: missing 'lowerdir' [ 249.737126][ T5947] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 250.187327][ T6324] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 250.341567][ T6324] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 250.341604][ T6324] usb 2-1: New USB device found, idVendor=18d1, idProduct=503c, bcdDevice= 0.00 [ 250.341616][ T6324] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.355995][ T6324] usb 2-1: config 0 descriptor?? [ 251.769310][ T6667] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 251.771450][ T5947] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 251.771471][ T5947] stv0680 1-1:4.0: STV(e): camera ping failed!! [ 251.774150][ T5947] stv0680 1-1:4.0: last error: 208, command = 0xf8 [ 252.056455][ T7003] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 252.077360][ T6667] usb 5-1: Using ep0 maxpacket: 8 [ 252.098417][ T5947] usb 1-1: USB disconnect, device number 26 [ 252.100110][ T6667] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 252.100136][ T6667] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 252.100148][ T6667] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 252.100200][ T6667] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 49 [ 252.100229][ T6667] usb 5-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 252.100242][ T6667] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.227418][ T7003] usb 3-1: device descriptor read/64, error -71 [ 252.236720][ T6667] usb 5-1: config 0 descriptor?? [ 252.252202][ T7592] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 252.479784][ T7003] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 252.489044][ T7592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 252.500165][ T7592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 252.502860][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.502937][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503006][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503078][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503150][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503221][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503289][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503365][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503432][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503504][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503572][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503646][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503714][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503786][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.503859][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.504460][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.504540][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.504611][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.504683][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.504754][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.504823][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.504891][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.504962][ T5798] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 252.637379][ T7003] usb 3-1: device descriptor read/64, error -71 [ 252.713890][ T6667] usb 5-1: USB disconnect, device number 24 [ 252.730389][ T5801] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 252.748414][ T7003] usb usb3-port1: attempt power cycle [ 252.759723][ T6324] hid (null): bogus close delimiter [ 252.778982][ T6324] hid-generic 0003:18D1:503C.000B: bogus close delimiter [ 252.779004][ T6324] hid-generic 0003:18D1:503C.000B: item 0 4 2 10 parsing failed [ 252.779790][ T6324] hid-generic 0003:18D1:503C.000B: probe with driver hid-generic failed with error -22 [ 252.994088][ T7603] netlink: 300 bytes leftover after parsing attributes in process `syz.0.526'. [ 253.247727][ T7003] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 253.268170][ T7003] usb 3-1: device descriptor read/8, error -71 [ 253.508544][ T7003] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 253.528097][ T7003] usb 3-1: device descriptor read/8, error -71 [ 253.637863][ T7003] usb usb3-port1: unable to enumerate USB device [ 254.059683][ T7616] overlayfs: missing 'workdir' [ 254.925660][ T6667] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 255.427307][ T6667] usb 1-1: Using ep0 maxpacket: 32 [ 255.430726][ T6667] usb 1-1: config 42 has an invalid interface number: 199 but max is 0 [ 255.430754][ T6667] usb 1-1: config 42 has an invalid descriptor of length 36, skipping remainder of the config [ 255.430773][ T6667] usb 1-1: config 42 has no interface number 0 [ 255.430841][ T6667] usb 1-1: config 42 interface 199 altsetting 15 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 255.430874][ T6667] usb 1-1: config 42 interface 199 has no altsetting 0 [ 255.523176][ T6667] usb 1-1: New USB device found, idVendor=1a86, idProduct=752d, bcdDevice=19.cb [ 255.523206][ T6667] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.523224][ T6667] usb 1-1: Product: syz [ 255.523238][ T6667] usb 1-1: Manufacturer: syz [ 255.523252][ T6667] usb 1-1: SerialNumber: syz [ 255.807674][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.807757][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.862037][ T6667] usb 1-1: USB disconnect, device number 27 [ 255.864169][ T43] usb 2-1: USB disconnect, device number 25 [ 255.968097][ T7194] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 256.130905][ T7642] vxcan0: tx drop: invalid da for name 0x0000000000000015 [ 256.219171][ T7640] netlink: 300 bytes leftover after parsing attributes in process `syz.3.538'. [ 256.308012][ T7194] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 256.308074][ T7194] usb 3-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 256.308097][ T7194] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 256.323634][ T7194] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 256.636495][ T7651] overlayfs: missing 'workdir' [ 257.017394][ T6734] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 257.230020][ T5801] Bluetooth: hci4: unexpected event for opcode 0x1405 [ 257.783966][ T7194] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 257.783990][ T7194] stv0680 3-1:4.0: STV(e): camera ping failed!! [ 257.784393][ T7194] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 257.784409][ T7194] stv0680 3-1:4.0: last error: 0, command = 0x0 [ 257.834784][ T7194] usb 3-1: USB disconnect, device number 31 [ 257.843509][ T6734] usb 4-1: device descriptor read/64, error -71 [ 258.087383][ T6734] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 258.217396][ T6734] usb 4-1: device descriptor read/64, error -71 [ 258.328017][ T6734] usb usb4-port1: attempt power cycle [ 258.667338][ T6734] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 258.700307][ T6734] usb 4-1: device descriptor read/8, error -71 [ 258.937458][ T6734] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 258.939672][ T7683] overlayfs: missing 'workdir' [ 258.962510][ T6734] usb 4-1: device descriptor read/8, error -71 [ 259.068746][ T6734] usb usb4-port1: unable to enumerate USB device [ 259.093199][ T7686] vxcan0: tx drop: invalid da for name 0x0000000000000015 [ 261.240733][ T5801] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 261.240997][ T5801] Bluetooth: hci4: Injecting HCI hardware error event [ 261.243206][ T5798] Bluetooth: hci4: hardware error 0x00 [ 262.794904][ T7735] FAULT_INJECTION: forcing a failure. [ 262.794904][ T7735] name failslab, interval 1, probability 0, space 0, times 0 [ 262.795058][ T7735] CPU: 1 UID: 0 PID: 7735 Comm: syz.1.576 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 262.795081][ T7735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 262.795094][ T7735] Call Trace: [ 262.795102][ T7735] [ 262.795110][ T7735] dump_stack_lvl+0xe8/0x150 [ 262.795142][ T7735] should_fail_ex+0x46c/0x600 [ 262.795172][ T7735] should_failslab+0xa8/0x100 [ 262.795193][ T7735] __kmalloc_noprof+0xe0/0x7e0 [ 262.795218][ T7735] ? kfree+0x4d/0x900 [ 262.795239][ T7735] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 262.795268][ T7735] tomoyo_realpath_from_path+0xe3/0x5d0 [ 262.795290][ T7735] ? tomoyo_domain+0xd9/0x130 [ 262.795314][ T7735] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 262.795339][ T7735] tomoyo_path_number_perm+0x1e8/0x5a0 [ 262.795367][ T7735] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 262.795402][ T7735] ? do_raw_spin_lock+0x121/0x290 [ 262.795435][ T7735] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 262.795476][ T7735] ? __rcu_read_unlock+0x84/0xe0 [ 262.795501][ T7735] ? __fget_files+0x2a/0x420 [ 262.795521][ T7735] ? __fget_files+0x3a6/0x420 [ 262.795539][ T7735] ? __fget_files+0x2a/0x420 [ 262.795563][ T7735] security_file_ioctl+0xcb/0x2d0 [ 262.795590][ T7735] __se_sys_ioctl+0x47/0x170 [ 262.795618][ T7735] do_syscall_64+0xec/0xf80 [ 262.795636][ T7735] ? rcu_is_watching+0x15/0xb0 [ 262.795652][ T7735] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.795671][ T7735] ? clear_bhb_loop+0x60/0xb0 [ 262.795694][ T7735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.795713][ T7735] RIP: 0033:0x7f3f0792f749 [ 262.795730][ T7735] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 262.795747][ T7735] RSP: 002b:00007f3f05b54038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 262.795768][ T7735] RAX: ffffffffffffffda RBX: 00007f3f07b86180 RCX: 00007f3f0792f749 [ 262.795783][ T7735] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000007 [ 262.795795][ T7735] RBP: 00007f3f05b54090 R08: 0000000000000000 R09: 0000000000000000 [ 262.795807][ T7735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 262.795819][ T7735] R13: 00007f3f07b86218 R14: 00007f3f07b86180 R15: 00007ffe4a8fdaf8 [ 262.795851][ T7735] [ 262.795981][ T7735] ERROR: Out of memory at tomoyo_realpath_from_path. [ 263.317317][ T5798] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 265.281386][ T7767] netlink: 56 bytes leftover after parsing attributes in process `syz.0.587'. [ 265.547396][ T5996] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 265.707372][ T5996] usb 1-1: Using ep0 maxpacket: 16 [ 265.708879][ T6064] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 265.709369][ T5996] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 265.709397][ T5996] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 265.709471][ T5996] usb 1-1: config 0 interface 0 has no altsetting 0 [ 265.709493][ T5996] usb 1-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 265.709505][ T5996] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.720614][ T5996] usb 1-1: config 0 descriptor?? [ 265.837585][ T6064] usb 2-1: device descriptor read/64, error -71 [ 266.018194][ T842] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 266.107403][ T6064] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 266.125707][ T5996] usbhid 1-1:0.0: can't add hid device: -71 [ 266.125825][ T5996] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 266.141337][ T5996] usb 1-1: USB disconnect, device number 28 [ 266.167324][ T842] usb 4-1: Using ep0 maxpacket: 16 [ 266.169850][ T842] usb 4-1: config 0 interface 0 altsetting 235 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 266.169882][ T842] usb 4-1: config 0 interface 0 altsetting 235 endpoint 0x81 has invalid wMaxPacketSize 0 [ 266.169905][ T842] usb 4-1: config 0 interface 0 has no altsetting 0 [ 266.169937][ T842] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 266.169959][ T842] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.190568][ T842] usb 4-1: config 0 descriptor?? [ 266.250984][ T6064] usb 2-1: device descriptor read/64, error -71 [ 266.368203][ T6064] usb usb2-port1: attempt power cycle [ 266.483620][ T7773] overlayfs: failed to resolve './file0': -2 [ 267.372628][ T842] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x0 [ 267.372667][ T842] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x0 [ 267.372744][ T842] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x1 [ 267.372767][ T842] mcp2221 0003:04D8:00DD.000C: unknown main item tag 0x0 [ 267.373712][ T842] mcp2221 0003:04D8:00DD.000C: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 267.430057][ T6064] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 267.438172][ T7786] netlink: 'syz.0.595': attribute type 1 has an invalid length. [ 267.438192][ T7786] netlink: 244 bytes leftover after parsing attributes in process `syz.0.595'. [ 267.450189][ T6064] usb 2-1: device descriptor read/8, error -71 [ 267.699315][ T6064] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 267.848719][ T6064] usb 2-1: device descriptor read/8, error -71 [ 267.968599][ T6064] usb usb2-port1: unable to enumerate USB device [ 268.574367][ T7786] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 268.657043][ T7786] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 268.657520][ T7786] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 268.657785][ T7786] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 268.838644][ T6734] usb 4-1: reset high-speed USB device number 30 using dummy_hcd [ 268.956431][ T7798] netlink: 'syz.4.599': attribute type 1 has an invalid length. [ 268.956452][ T7798] netlink: 244 bytes leftover after parsing attributes in process `syz.4.599'. [ 269.460543][ T7817] netlink: 56 bytes leftover after parsing attributes in process `syz.3.605'. [ 269.675185][ T6064] usb 4-1: USB disconnect, device number 30 [ 269.686914][ T7798] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 269.687165][ T7798] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 269.689364][ T7798] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 269.689518][ T7798] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 271.251591][ T5801] Bluetooth: hci1: command 0x0c1a tx timeout [ 271.318065][ T6064] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 271.567314][ T6064] usb 4-1: Using ep0 maxpacket: 16 [ 271.569133][ T6064] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 271.569163][ T6064] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 271.569205][ T6064] usb 4-1: config 0 interface 0 has no altsetting 0 [ 271.569238][ T6064] usb 4-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 271.569260][ T6064] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.574647][ T6064] usb 4-1: config 0 descriptor?? [ 271.717467][ T5802] Bluetooth: hci3: command 0x0c1a tx timeout [ 271.717522][ T5801] Bluetooth: hci2: command 0x0c1a tx timeout [ 271.729651][ T5801] Bluetooth: hci0: command 0x0c1a tx timeout [ 272.001636][ T6064] usbhid 4-1:0.0: can't add hid device: -71 [ 272.001760][ T6064] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 272.042029][ T6064] usb 4-1: USB disconnect, device number 31 [ 272.786201][ T7861] netlink: 'syz.4.617': attribute type 1 has an invalid length. [ 272.786222][ T7861] netlink: 244 bytes leftover after parsing attributes in process `syz.4.617'. [ 273.975604][ T7861] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 273.975826][ T7861] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 273.976080][ T7861] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 273.976247][ T7861] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 274.437412][ T6064] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 275.285316][ T5801] Bluetooth: hci1: command 0x0c1a tx timeout [ 275.319866][ T6064] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 275.319916][ T6064] usb 5-1: New USB device found, idVendor=054c, idProduct=0268, bcdDevice= 0.00 [ 275.319939][ T6064] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 275.371438][ T6064] usb 5-1: config 0 descriptor?? [ 275.547583][ T7895] netlink: 56 bytes leftover after parsing attributes in process `syz.2.629'. [ 275.586230][ T7878] netlink: 36 bytes leftover after parsing attributes in process `syz.4.624'. [ 275.787351][ T6324] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 276.041289][ T5798] Bluetooth: hci2: command 0x0c1a tx timeout [ 276.041343][ T5802] Bluetooth: hci3: command 0x0c1a tx timeout [ 276.041429][ T5801] Bluetooth: hci0: command 0x0c1a tx timeout [ 276.857617][ T6324] usb 3-1: Using ep0 maxpacket: 16 [ 276.864454][ T6324] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 276.864487][ T6324] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 276.864508][ T6324] usb 3-1: config 0 interface 0 has no altsetting 0 [ 276.864540][ T6324] usb 3-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 276.864563][ T6324] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.931651][ T6324] usb 3-1: config 0 descriptor?? [ 277.462232][ T6324] usbhid 3-1:0.0: can't add hid device: -71 [ 277.462357][ T6324] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 277.494220][ T6324] usb 3-1: USB disconnect, device number 32 [ 277.746481][ T6064] usbhid 5-1:0.0: can't add hid device: -71 [ 277.746556][ T6064] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 277.773005][ T6064] usb 5-1: USB disconnect, device number 25 [ 277.792028][ T7909] netlink: 'syz.1.634': attribute type 1 has an invalid length. [ 277.792043][ T7909] netlink: 244 bytes leftover after parsing attributes in process `syz.1.634'. [ 277.955682][ T842] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 278.099761][ T842] usb 1-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 278.099819][ T842] usb 1-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 278.099841][ T842] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.112580][ T842] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 278.588758][ T7909] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 278.595722][ T7909] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 278.595921][ T7909] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 278.596071][ T7909] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 279.171084][ T842] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 279.171099][ T842] stv0680 1-1:4.0: STV(e): camera ping failed!! [ 279.171595][ T842] stv0680 1-1:4.0: last error: 208, command = 0xf8 [ 279.327370][ T5947] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 279.377014][ T6324] usb 1-1: USB disconnect, device number 29 [ 279.477314][ T5947] usb 5-1: Using ep0 maxpacket: 16 [ 279.479026][ T5947] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 279.479080][ T5947] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 279.479106][ T5947] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 279.479121][ T5947] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 279.479132][ T5947] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 279.480201][ T5947] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 279.480227][ T5947] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 279.480246][ T5947] usb 5-1: Manufacturer: syz [ 279.507340][ T6064] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 279.579452][ T5947] usb 5-1: config 0 descriptor?? [ 279.667792][ T6064] usb 2-1: Using ep0 maxpacket: 8 [ 279.670244][ T6064] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 279.670279][ T6064] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 279.670301][ T6064] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 279.670323][ T6064] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 49 [ 279.670354][ T6064] usb 2-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 279.670366][ T6064] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.686250][ T6064] usb 2-1: config 0 descriptor?? [ 279.709490][ T7937] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 279.857337][ T5947] rc_core: IR keymap rc-hauppauge not found [ 279.857356][ T5947] Registered IR keymap rc-empty [ 279.857542][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 279.895362][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 279.913499][ T5947] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 279.937616][ T5947] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input47 [ 279.941180][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 279.957434][ T5798] Bluetooth: hci1: command 0x0c1a tx timeout [ 279.965995][ T7937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 279.970945][ T7937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 279.981119][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 279.992920][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 279.994011][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 279.994137][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 279.994267][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 279.994334][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 279.994447][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 279.997360][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 280.000548][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.000730][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.000859][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.000978][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.001048][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.001167][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.001322][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.001391][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.001539][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.001660][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.001731][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.001871][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.002008][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.002124][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.002193][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.002310][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.002380][ T5798] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 280.017415][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 280.050783][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 280.067364][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 280.087352][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 280.111905][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 280.230301][ T5801] Bluetooth: hci6: Opcode 0x0c03 failed: -71 [ 280.232235][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 280.251389][ T5947] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 280.281157][ T5947] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 280.281183][ T5947] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 280.284269][ T6064] usb 2-1: USB disconnect, device number 30 [ 280.601132][ T842] usb 5-1: USB disconnect, device number 26 [ 280.801515][ T7952] syz_tun: entered allmulticast mode [ 281.159745][ T5801] Bluetooth: hci5: command 0x1003 tx timeout [ 281.477369][ T5802] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 282.473213][ T5802] Bluetooth: hci3: command 0x0c1a tx timeout [ 282.475175][ T5802] Bluetooth: hci2: command 0x0c1a tx timeout [ 282.476978][ T5802] Bluetooth: hci0: command 0x0c1a tx timeout [ 286.268744][ T7975] netlink: 'syz.2.650': attribute type 1 has an invalid length. [ 286.268770][ T7975] netlink: 244 bytes leftover after parsing attributes in process `syz.2.650'. [ 286.358998][ T7948] syz.3.646 (7948) used greatest stack depth: 17952 bytes left [ 286.908760][ T7975] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 286.909121][ T7975] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 286.909284][ T7975] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 286.914521][ T7975] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 287.442458][ T7988] lo speed is unknown, defaulting to 1000 [ 287.577309][ T6324] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 287.598295][ T8002] sctp: [Deprecated]: syz.3.661 (pid 8002) Use of struct sctp_assoc_value in delayed_ack socket option. [ 287.598295][ T8002] Use struct sctp_sack_info instead [ 287.917323][ T6324] usb 1-1: Using ep0 maxpacket: 8 [ 287.919941][ T6324] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 287.919976][ T6324] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 287.919997][ T6324] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 287.920020][ T6324] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 49 [ 287.920058][ T6324] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 287.920080][ T6324] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 288.074368][ T6324] usb 1-1: config 0 descriptor?? [ 288.075845][ T7993] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 288.177426][ T9] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 288.300326][ T7993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 288.301164][ T7993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 288.314217][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.314277][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.314352][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.314395][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.314446][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.314512][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.314571][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.314638][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.314700][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.316900][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.318126][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.318202][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.329088][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.329167][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.329276][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.329333][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.329391][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.329447][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.329497][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.329549][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.329599][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.329654][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.329707][ T5802] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 288.370077][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 288.517271][ T5802] Bluetooth: hci1: command 0x0c1a tx timeout [ 288.539217][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 288.539271][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 288.539297][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 288.539315][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 288.539334][ T9] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 288.553196][ T6324] usb 1-1: USB disconnect, device number 30 [ 288.555444][ T5801] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 288.569926][ T9] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 288.569951][ T9] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 288.569968][ T9] usb 2-1: Manufacturer: syz [ 288.677027][ T9] usb 2-1: config 0 descriptor?? [ 288.919664][ T5801] Bluetooth: hci3: command 0x0c1a tx timeout [ 288.919711][ T5801] Bluetooth: hci0: command 0x0c1a tx timeout [ 288.919728][ T5802] Bluetooth: hci2: command 0x0c1a tx timeout [ 288.947364][ T9] rc_core: IR keymap rc-hauppauge not found [ 288.947385][ T9] Registered IR keymap rc-empty [ 288.948655][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 288.979514][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 289.000092][ T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 289.002783][ T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input48 [ 289.057143][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 289.077881][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 289.107392][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 289.127365][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 289.148155][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 289.177439][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 289.197397][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 289.237381][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 289.257398][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 289.287516][ T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 289.617687][ T9] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 289.617704][ T9] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 289.666061][ T9] usb 2-1: USB disconnect, device number 31 [ 291.847378][ T6064] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 291.977343][ T6064] usb 5-1: device descriptor read/64, error -71 [ 292.218514][ T6064] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 292.488594][ T6064] usb 5-1: device descriptor read/64, error -71 [ 292.607547][ T6064] usb usb5-port1: attempt power cycle [ 294.017443][ T6064] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 294.038165][ T6064] usb 5-1: device descriptor read/8, error -71 [ 295.077700][ T6064] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 295.287298][ T6064] usb 5-1: device not accepting address 30, error -71 [ 295.287659][ T6064] usb usb5-port1: unable to enumerate USB device [ 295.422928][ T8077] gfs2: not a GFS2 filesystem [ 295.425714][ T8077] tipc: Started in network mode [ 295.425735][ T8077] tipc: Node identity 84e, cluster identity 4711 [ 295.425743][ T8077] tipc: Node number set to 2126 [ 297.318514][ T842] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 297.378757][ T8100] netlink: 104 bytes leftover after parsing attributes in process `syz.2.692'. [ 297.972859][ T6087] Bluetooth: hci5: Frame reassembly failed (-84) [ 297.974287][ T6087] Bluetooth: hci5: Frame reassembly failed (-84) [ 297.975132][ T6087] Bluetooth: hci5: Frame reassembly failed (-84) [ 297.975753][ T6087] Bluetooth: hci5: Frame reassembly failed (-84) [ 298.100477][ T1043] Bluetooth: hci5: Frame reassembly failed (-84) [ 298.596000][ T842] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 298.596061][ T842] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 298.596084][ T842] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.636817][ T842] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 298.994834][ T5801] Bluetooth: hci2: unexpected event for opcode 0x1405 [ 299.681805][ T8117] Bluetooth: hci0: invalid length 0, exp 2 for type 20 [ 299.687123][ T842] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -71 [ 299.687146][ T842] stv0680 2-1:4.0: STV(e): camera ping failed!! [ 299.687915][ T842] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 299.687933][ T842] stv0680 2-1:4.0: last error: 0, command = 0x0 [ 299.693672][ T842] usb 2-1: USB disconnect, device number 32 [ 299.696046][ T37] kauditd_printk_skb: 159 callbacks suppressed [ 299.696062][ T37] audit: type=1326 audit(1767597534.938:243): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8116 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b18d0f749 code=0x7ffc0000 [ 299.696113][ T37] audit: type=1326 audit(1767597534.938:244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8116 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=264 compat=0 ip=0x7f0b18d0f749 code=0x7ffc0000 [ 299.696154][ T37] audit: type=1326 audit(1767597534.938:245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8116 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b18d0f749 code=0x7ffc0000 [ 299.696194][ T37] audit: type=1326 audit(1767597534.938:246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8116 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f0b18d0e1ff code=0x7ffc0000 [ 299.696235][ T37] audit: type=1326 audit(1767597534.938:247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8116 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b18d0f749 code=0x7ffc0000 [ 299.696276][ T37] audit: type=1326 audit(1767597534.948:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8116 comm="syz.3.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0b18d0f749 code=0x7ffc0000 [ 299.877390][ T5802] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 303.559399][ T8161] syz.0.710 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 303.560463][ T8161] netlink: 16 bytes leftover after parsing attributes in process `syz.0.710'. [ 303.847386][ T5802] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 303.847911][ T5802] Bluetooth: hci2: Injecting HCI hardware error event [ 303.851202][ T5802] Bluetooth: hci2: hardware error 0x00 [ 304.014077][ T8167] netlink: 8 bytes leftover after parsing attributes in process `syz.2.711'. [ 304.014100][ T8167] netlink: 24 bytes leftover after parsing attributes in process `syz.2.711'. [ 304.170417][ T6155] Bluetooth: hci5: Frame reassembly failed (-84) [ 304.845541][ T8196] netlink: 'syz.4.722': attribute type 1 has an invalid length. [ 304.845556][ T8196] netlink: 244 bytes leftover after parsing attributes in process `syz.4.722'. [ 305.577899][ T8196] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 305.578234][ T8196] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 305.578678][ T8196] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 305.820535][ T6324] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 305.878843][ T5802] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 305.997965][ T6324] usb 1-1: Using ep0 maxpacket: 32 [ 306.000104][ T6324] usb 1-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 306.000138][ T6324] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.031181][ T6324] usb 1-1: config 0 descriptor?? [ 306.036570][ T6324] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 306.197492][ T5801] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 306.214470][ C0] vxcan0: j1939_tp_rxtimer: 0xffff88805d1d1c00: rx timeout, send abort [ 306.221384][ C0] vxcan0: j1939_xtp_rx_abort_one: 0xffff88805d1d1c00: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 306.671997][ T6324] gspca_vc032x: reg_w err -71 [ 306.672033][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672044][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672052][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672060][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672068][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672076][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672084][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672092][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672099][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672108][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672116][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672124][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672132][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672139][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672147][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672154][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672162][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672169][ T6324] gspca_vc032x: I2c Bus Busy Wait 00 [ 306.672178][ T6324] gspca_vc032x: Unknown sensor... [ 306.672255][ T6324] vc032x 1-1:0.0: probe with driver vc032x failed with error -22 [ 306.697473][ T6324] usb 1-1: USB disconnect, device number 31 [ 307.010068][ T5802] Bluetooth: hci1: command 0x0c1a tx timeout [ 307.448087][ T8218] veth0_to_team: entered promiscuous mode [ 307.641172][ T5801] Bluetooth: hci0: command 0x0c1a tx timeout [ 307.641223][ T5802] Bluetooth: hci3: command 0x0c1a tx timeout [ 307.721817][ T8229] dvmrp0: entered allmulticast mode [ 307.967387][ T6029] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 308.099943][ T6324] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 308.123506][ T6029] usb 3-1: Using ep0 maxpacket: 8 [ 308.139247][ T6029] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 308.139282][ T6029] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 308.139304][ T6029] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 308.139326][ T6029] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 49 [ 308.139364][ T6029] usb 3-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 308.139386][ T6029] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 308.153607][ T6029] usb 3-1: config 0 descriptor?? [ 308.157382][ T8242] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 308.508687][ T6324] usb 2-1: Using ep0 maxpacket: 16 [ 308.648901][ T5801] Bluetooth: hci0: unexpected event for opcode 0x1405 [ 309.270460][ C1] vxcan0: j1939_tp_rxtimer: 0xffff888028903400: rx timeout, send abort [ 309.270718][ C1] vxcan0: j1939_xtp_rx_abort_one: 0xffff888028903400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 309.392353][ T8242] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 309.401205][ T8242] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 309.437787][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438208][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438288][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438355][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438424][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438493][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438572][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438635][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438701][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438769][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438835][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438904][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.438974][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.439044][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.439134][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.439205][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.439274][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.439346][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.439415][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.439476][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.439544][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.439608][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.439673][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 309.563986][ T6324] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 309.564044][ T6324] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 309.564071][ T6324] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 309.564090][ T6324] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 309.564112][ T6324] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 309.625507][ T6324] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 309.625538][ T6324] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 309.625557][ T6324] usb 2-1: Manufacturer: syz [ 309.702529][ T5802] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 309.705366][ T6667] usb 3-1: USB disconnect, device number 33 [ 309.725790][ T6324] usb 2-1: config 0 descriptor?? [ 309.853470][ T8267] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 310.910200][ T6324] rc_core: IR keymap rc-hauppauge not found [ 310.910223][ T6324] Registered IR keymap rc-empty [ 310.910396][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 310.929033][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 311.037487][ T6324] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 311.039277][ T6324] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input49 [ 311.078010][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 311.108944][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 311.127409][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 311.159191][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 311.187407][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 311.207395][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 311.228081][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 311.247434][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 311.277514][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 311.297424][ T6324] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 311.333099][ T6324] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 311.333124][ T6324] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 311.372694][ T6324] usb 2-1: USB disconnect, device number 33 [ 312.267837][ T8307] overlayfs: missing 'lowerdir' [ 312.677391][ T5802] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 312.677692][ T5802] Bluetooth: hci0: Injecting HCI hardware error event [ 312.681244][ T5802] Bluetooth: hci0: hardware error 0x00 [ 314.242690][ T8318] FAULT_INJECTION: forcing a failure. [ 314.242690][ T8318] name failslab, interval 1, probability 0, space 0, times 0 [ 314.242714][ T8318] CPU: 0 UID: 0 PID: 8318 Comm: syz.0.759 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 314.242726][ T8318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 314.242733][ T8318] Call Trace: [ 314.242738][ T8318] [ 314.242743][ T8318] dump_stack_lvl+0xe8/0x150 [ 314.242762][ T8318] should_fail_ex+0x46c/0x600 [ 314.242779][ T8318] ? __alloc_skb+0x1dc/0x3a0 [ 314.242791][ T8318] should_failslab+0xa8/0x100 [ 314.242801][ T8318] ? __alloc_skb+0x1dc/0x3a0 [ 314.242811][ T8318] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 314.242826][ T8318] ? lockdep_hardirqs_on+0x7b/0x110 [ 314.242837][ T8318] ? __alloc_skb+0x198/0x3a0 [ 314.242848][ T8318] __alloc_skb+0x1dc/0x3a0 [ 314.242861][ T8318] netlink_sendmsg+0x5c6/0xb30 [ 314.242881][ T8318] ? __pfx_netlink_sendmsg+0x10/0x10 [ 314.242898][ T8318] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 314.242912][ T8318] ? __pfx_netlink_sendmsg+0x10/0x10 [ 314.242926][ T8318] __sock_sendmsg+0x21c/0x270 [ 314.242944][ T8318] ____sys_sendmsg+0x508/0x810 [ 314.242959][ T8318] ? __pfx_____sys_sendmsg+0x10/0x10 [ 314.242976][ T8318] ? import_iovec+0x74/0xa0 [ 314.242988][ T8318] ___sys_sendmsg+0x21f/0x2a0 [ 314.243001][ T8318] ? __pfx____sys_sendmsg+0x10/0x10 [ 314.243034][ T8318] ? __fget_files+0x2a/0x420 [ 314.243052][ T8318] ? __fget_files+0x3a6/0x420 [ 314.243067][ T8318] __x64_sys_sendmsg+0x1a1/0x260 [ 314.243085][ T8318] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 314.243102][ T8318] ? __pfx_ksys_write+0x10/0x10 [ 314.243122][ T8318] do_syscall_64+0xec/0xf80 [ 314.243131][ T8318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.243146][ T8318] ? trace_irq_disable+0x37/0x100 [ 314.243156][ T8318] ? clear_bhb_loop+0x60/0xb0 [ 314.243173][ T8318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 314.243190][ T8318] RIP: 0033:0x7f4d2f6cf749 [ 314.243200][ T8318] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 314.243209][ T8318] RSP: 002b:00007f4d2d92e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 314.243221][ T8318] RAX: ffffffffffffffda RBX: 00007f4d2f925fa0 RCX: 00007f4d2f6cf749 [ 314.243229][ T8318] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 314.243236][ T8318] RBP: 00007f4d2d92e090 R08: 0000000000000000 R09: 0000000000000000 [ 314.243242][ T8318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 314.243248][ T8318] R13: 00007f4d2f926038 R14: 00007f4d2f925fa0 R15: 00007fffec877878 [ 314.243271][ T8318] [ 314.397628][ T6324] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 314.559614][ T6324] usb 5-1: config 5 has an invalid interface number: 76 but max is 0 [ 314.559641][ T6324] usb 5-1: config 5 has an invalid interface number: 33 but max is 0 [ 314.559661][ T6324] usb 5-1: config 5 has an invalid descriptor of length 202, skipping remainder of the config [ 314.559678][ T6324] usb 5-1: config 5 has 2 interfaces, different from the descriptor's value: 1 [ 314.559698][ T6324] usb 5-1: config 5 has no interface number 0 [ 314.559713][ T6324] usb 5-1: config 5 has no interface number 1 [ 314.559769][ T6324] usb 5-1: config 5 interface 76 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 314.559791][ T6324] usb 5-1: config 5 interface 76 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 15 [ 314.559832][ T6324] usb 5-1: config 5 interface 33 altsetting 200 bulk endpoint 0x5 has invalid maxpacket 8 [ 314.559854][ T6324] usb 5-1: config 5 interface 33 altsetting 200 has 3 endpoint descriptors, different from the interface descriptor's value: 20 [ 314.559879][ T6324] usb 5-1: config 5 interface 33 has no altsetting 0 [ 314.559911][ T6324] usb 5-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice=40.44 [ 314.559932][ T6324] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 314.570917][ T8314] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 314.757499][ T5802] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 314.776813][ T6324] usb 5-1: string descriptor 0 read error: -71 [ 314.846483][ T8322] netlink: 'syz.2.762': attribute type 4 has an invalid length. [ 314.878254][ T6324] usb 5-1: USB disconnect, device number 31 [ 316.049557][ T6667] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 316.197571][ T6667] usb 1-1: Using ep0 maxpacket: 8 [ 316.200167][ T6667] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 316.200203][ T6667] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 316.200224][ T6667] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 316.200246][ T6667] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 49 [ 316.200284][ T6667] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 316.200306][ T6667] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 316.207551][ T5947] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 316.211775][ T6667] usb 1-1: config 0 descriptor?? [ 316.213107][ T8345] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 316.281930][ T8357] capability: warning: `syz.3.774' uses 32-bit capabilities (legacy support in use) [ 316.372788][ T5947] usb 3-1: Using ep0 maxpacket: 32 [ 316.386781][ T5947] usb 3-1: config 23 has an invalid descriptor of length 0, skipping remainder of the config [ 316.386808][ T5947] usb 3-1: config 23 has 0 interfaces, different from the descriptor's value: 1 [ 316.390270][ T5947] usb 3-1: New USB device found, idVendor=0789, idProduct=7560, bcdDevice=2c.d1 [ 316.390297][ T5947] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.390316][ T5947] usb 3-1: Product: syz [ 316.390329][ T5947] usb 3-1: Manufacturer: syz [ 316.390343][ T5947] usb 3-1: SerialNumber: syz [ 316.507552][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.507685][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.508755][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.508893][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.509018][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.509146][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.509218][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.509347][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.509469][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.509544][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.509663][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.509783][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.509852][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.509982][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.510112][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.510186][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.510304][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.510422][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.510494][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.510611][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.510731][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.510971][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.516182][ T5801] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 316.736290][ T6029] usb 1-1: USB disconnect, device number 32 [ 316.740683][ T5802] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 316.812715][ T5947] usb 3-1: USB disconnect, device number 34 [ 318.023791][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 318.023861][ T1319] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.657319][ T6324] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 318.810809][ T6324] usb 4-1: Using ep0 maxpacket: 32 [ 318.825533][ T6324] usb 4-1: config 0 has an invalid interface number: 210 but max is 0 [ 318.825552][ T6324] usb 4-1: config 0 has no interface number 0 [ 318.825583][ T6324] usb 4-1: config 0 interface 210 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 318.825596][ T6324] usb 4-1: config 0 interface 210 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 318.825606][ T6324] usb 4-1: config 0 interface 210 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 318.825625][ T6324] usb 4-1: config 0 interface 210 has no altsetting 0 [ 318.895648][ T6324] usb 4-1: New USB device found, idVendor=0bfd, idProduct=000e, bcdDevice=52.6c [ 318.895680][ T6324] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.895699][ T6324] usb 4-1: Product: syz [ 318.895713][ T6324] usb 4-1: Manufacturer: syz [ 318.895726][ T6324] usb 4-1: SerialNumber: syz [ 318.971124][ T6324] usb 4-1: config 0 descriptor?? [ 318.991246][ T8373] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 319.017662][ T5996] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 319.172119][ T5996] usb 1-1: Using ep0 maxpacket: 8 [ 319.188863][ T5996] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 319.188890][ T5996] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 319.188924][ T5996] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 319.189038][ T5996] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 319.253191][ T5996] usb 1-1: config 0 descriptor?? [ 319.340123][ T8391] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 319.340123][ T8391] The task syz.4.783 (8391) triggered the difference, watch for misbehavior. [ 319.369316][ T5947] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 319.406257][ T8387] lo speed is unknown, defaulting to 1000 [ 319.487965][ T7968] usb 1-1: USB disconnect, device number 33 [ 319.527291][ T5947] usb 2-1: Using ep0 maxpacket: 8 [ 319.549796][ T5947] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 319.553638][ T5947] usb 2-1: New USB device found, idVendor=04e8, idProduct=ff30, bcdDevice=a6.d1 [ 319.553657][ T5947] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.553667][ T5947] usb 2-1: Product: syz [ 319.553674][ T5947] usb 2-1: Manufacturer: syz [ 319.553681][ T5947] usb 2-1: SerialNumber: syz [ 319.643286][ T5947] usb 2-1: config 0 descriptor?? [ 319.686114][ T5947] imon_raw 2-1:0.0: IR endpoint missing [ 319.905180][ T7968] usb 2-1: USB disconnect, device number 34 [ 321.558006][ T5947] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 321.768561][ T5947] usb 2-1: Using ep0 maxpacket: 8 [ 321.785563][ T5947] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 321.785594][ T5947] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 321.785630][ T5947] usb 2-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 321.785652][ T5947] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.840441][ T5947] usb 2-1: config 0 descriptor?? [ 321.844171][ T6324] kvaser_usb 4-1:0.210: error -EPROTO: Cannot get software info [ 321.845614][ T6324] kvaser_usb 4-1:0.210: probe with driver kvaser_usb failed with error -71 [ 322.232249][ T43] usb 2-1: USB disconnect, device number 35 [ 322.260423][ T6324] usb 4-1: USB disconnect, device number 32 [ 323.258468][ T8438] netlink: 300 bytes leftover after parsing attributes in process `syz.1.798'. [ 323.315042][ T8442] 9p: Bad value for 'wfdno' [ 328.295512][ T6667] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 328.392540][ T8483] netlink: 300 bytes leftover after parsing attributes in process `syz.1.810'. [ 328.429543][ T6026] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 328.447643][ T6667] usb 3-1: Using ep0 maxpacket: 8 [ 328.450470][ T6667] usb 3-1: config 1 has an invalid interface number: 228 but max is 6 [ 328.450497][ T6667] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 328.450515][ T6667] usb 3-1: config 1 has no interface number 0 [ 328.450544][ T6667] usb 3-1: too many endpoints for config 1 interface 228 altsetting 66: 167, using maximum allowed: 30 [ 328.450581][ T6667] usb 3-1: config 1 interface 228 altsetting 66 has 0 endpoint descriptors, different from the interface descriptor's value: 167 [ 328.450615][ T6667] usb 3-1: config 1 interface 228 has no altsetting 0 [ 328.454142][ T6667] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 328.454169][ T6667] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 328.454189][ T6667] usb 3-1: Product: syz [ 328.454202][ T6667] usb 3-1: Manufacturer: syz [ 328.454215][ T6667] usb 3-1: SerialNumber: syz [ 328.647519][ T6026] usb 5-1: Using ep0 maxpacket: 32 [ 328.675884][ T6026] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 328.675907][ T6026] usb 5-1: config 0 has no interface number 0 [ 328.675929][ T6026] usb 5-1: config 0 interface 184 has no altsetting 0 [ 328.710189][ T6026] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 328.710500][ T6026] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 328.710520][ T6026] usb 5-1: Product: syz [ 328.710533][ T6026] usb 5-1: Manufacturer: syz [ 328.710547][ T6026] usb 5-1: SerialNumber: syz [ 328.787457][ T6026] usb 5-1: config 0 descriptor?? [ 328.817409][ T6026] smsc75xx v1.0.0 [ 328.817718][ T6026] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 328.820315][ T6026] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -22 [ 328.914878][ T8487] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.915425][ T8487] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.916560][ T8488] FAULT_INJECTION: forcing a failure. [ 328.916560][ T8488] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 328.916590][ T8488] CPU: 0 UID: 0 PID: 8488 Comm: syz.0.812 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 328.916612][ T8488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 328.916622][ T8488] Call Trace: [ 328.916629][ T8488] [ 328.916637][ T8488] dump_stack_lvl+0xe8/0x150 [ 328.916666][ T8488] should_fail_ex+0x46c/0x600 [ 328.916696][ T8488] prepare_alloc_pages+0x22b/0x6c0 [ 328.916728][ T8488] __alloc_frozen_pages_noprof+0x123/0x370 [ 328.916751][ T8488] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 328.916781][ T8488] ? policy_nodemask+0x27c/0x720 [ 328.916812][ T8488] alloc_pages_bulk_noprof+0x5fa/0x7d0 [ 328.916836][ T8488] ? alloc_pages_noprof+0xe4/0x1e0 [ 328.916859][ T8488] __kasan_populate_vmalloc+0xc1/0x1d0 [ 328.916891][ T8488] ? rt_spin_unlock+0x161/0x200 [ 328.916919][ T8488] alloc_vmap_area+0xdc4/0x14e0 [ 328.916961][ T8488] ? __pfx_alloc_vmap_area+0x10/0x10 [ 328.916986][ T8488] ? __kmalloc_cache_node_noprof+0x2aa/0x700 [ 328.917013][ T8488] ? __get_vm_area_node+0x172/0x350 [ 328.917035][ T8488] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 328.917058][ T8488] __get_vm_area_node+0x227/0x350 [ 328.917089][ T8488] __vmalloc_node_range_noprof+0x371/0x16a0 [ 328.917115][ T8488] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 328.917154][ T8488] ? is_bpf_text_address+0x26/0x2b0 [ 328.917178][ T8488] ? kernel_text_address+0xa5/0xe0 [ 328.917207][ T8488] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 328.917235][ T8488] ? __lock_acquire+0x6b6/0x2cf0 [ 328.917266][ T8488] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 328.917284][ T8488] __vmalloc_noprof+0xd2/0x120 [ 328.917308][ T8488] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 328.917332][ T8488] bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 328.917357][ T8488] bpf_prog_alloc+0x3c/0x1a0 [ 328.917381][ T8488] bpf_prog_load+0x735/0x1a10 [ 328.917409][ T8488] ? get_pid_task+0x20/0x1f0 [ 328.917435][ T8488] ? __pfx_bpf_prog_load+0x10/0x10 [ 328.917455][ T8488] ? __might_fault+0xb0/0x130 [ 328.917500][ T8488] ? bpf_lsm_bpf+0x9/0x20 [ 328.917516][ T8488] ? security_bpf+0x7e/0x300 [ 328.917545][ T8488] __sys_bpf+0x507/0x860 [ 328.917567][ T8488] ? __pfx___sys_bpf+0x10/0x10 [ 328.917584][ T8488] ? rt_mutex_slowunlock+0x1be/0x2e0 [ 328.917622][ T8488] ? ksys_write+0x230/0x260 [ 328.917648][ T8488] ? __pfx_ksys_write+0x10/0x10 [ 328.917678][ T8488] __x64_sys_bpf+0x7c/0x90 [ 328.917696][ T8488] do_syscall_64+0xec/0xf80 [ 328.917714][ T8488] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.917731][ T8488] ? trace_irq_disable+0x37/0x100 [ 328.917750][ T8488] ? clear_bhb_loop+0x60/0xb0 [ 328.917772][ T8488] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.917790][ T8488] RIP: 0033:0x7f4d2f6cf749 [ 328.917808][ T8488] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 328.917824][ T8488] RSP: 002b:00007f4d2d92e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 328.917844][ T8488] RAX: ffffffffffffffda RBX: 00007f4d2f925fa0 RCX: 00007f4d2f6cf749 [ 328.917858][ T8488] RDX: 0000000000000080 RSI: 0000200000000600 RDI: 0000000000000005 [ 328.917875][ T8488] RBP: 00007f4d2d92e090 R08: 0000000000000000 R09: 0000000000000000 [ 328.917887][ T8488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 328.917897][ T8488] R13: 00007f4d2f926038 R14: 00007f4d2f925fa0 R15: 00007fffec877878 [ 328.917929][ T8488] [ 328.961031][ T8488] syz.0.812: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 328.965817][ T8488] CPU: 0 UID: 0 PID: 8488 Comm: syz.0.812 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 328.965840][ T8488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 328.965853][ T8488] Call Trace: [ 328.965860][ T8488] [ 328.965868][ T8488] dump_stack_lvl+0xe8/0x150 [ 328.965898][ T8488] warn_alloc+0x22e/0x3b0 [ 328.965929][ T8488] ? kasan_quarantine_put+0xbb/0x1f0 [ 328.965957][ T8488] ? __pfx_warn_alloc+0x10/0x10 [ 328.965984][ T8488] ? __get_vm_area_node+0x240/0x350 [ 328.966008][ T8488] ? __get_vm_area_node+0x172/0x350 [ 328.966032][ T8488] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 328.966055][ T8488] ? __get_vm_area_node+0x240/0x350 [ 328.966085][ T8488] __vmalloc_node_range_noprof+0x396/0x16a0 [ 328.966129][ T8488] ? is_bpf_text_address+0x26/0x2b0 [ 328.966155][ T8488] ? kernel_text_address+0xa5/0xe0 [ 328.966185][ T8488] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 328.966213][ T8488] ? __lock_acquire+0x6b6/0x2cf0 [ 328.966245][ T8488] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 328.966265][ T8488] __vmalloc_noprof+0xd2/0x120 [ 328.966289][ T8488] ? bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 328.966311][ T8488] bpf_prog_alloc_no_stats+0x4a/0x4d0 [ 328.966337][ T8488] bpf_prog_alloc+0x3c/0x1a0 [ 328.966361][ T8488] bpf_prog_load+0x735/0x1a10 [ 328.966389][ T8488] ? get_pid_task+0x20/0x1f0 [ 328.966417][ T8488] ? __pfx_bpf_prog_load+0x10/0x10 [ 328.966438][ T8488] ? __might_fault+0xb0/0x130 [ 328.966482][ T8488] ? bpf_lsm_bpf+0x9/0x20 [ 328.966497][ T8488] ? security_bpf+0x7e/0x300 [ 328.966525][ T8488] __sys_bpf+0x507/0x860 [ 328.966548][ T8488] ? __pfx___sys_bpf+0x10/0x10 [ 328.966565][ T8488] ? rt_mutex_slowunlock+0x1be/0x2e0 [ 328.966604][ T8488] ? ksys_write+0x230/0x260 [ 328.966630][ T8488] ? __pfx_ksys_write+0x10/0x10 [ 328.966660][ T8488] __x64_sys_bpf+0x7c/0x90 [ 328.966680][ T8488] do_syscall_64+0xec/0xf80 [ 328.966698][ T8488] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.966715][ T8488] ? trace_irq_disable+0x37/0x100 [ 328.966734][ T8488] ? clear_bhb_loop+0x60/0xb0 [ 328.966762][ T8488] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.966780][ T8488] RIP: 0033:0x7f4d2f6cf749 [ 328.966797][ T8488] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 328.966813][ T8488] RSP: 002b:00007f4d2d92e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 328.966833][ T8488] RAX: ffffffffffffffda RBX: 00007f4d2f925fa0 RCX: 00007f4d2f6cf749 [ 328.966847][ T8488] RDX: 0000000000000080 RSI: 0000200000000600 RDI: 0000000000000005 [ 328.966860][ T8488] RBP: 00007f4d2d92e090 R08: 0000000000000000 R09: 0000000000000000 [ 328.966871][ T8488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 328.966883][ T8488] R13: 00007f4d2f926038 R14: 00007f4d2f925fa0 R15: 00007fffec877878 [ 328.966913][ T8488] [ 328.978529][ T8488] Mem-Info: [ 328.978547][ T8488] active_anon:274 inactive_anon:19789 isolated_anon:0 [ 328.978547][ T8488] active_file:24223 inactive_file:37615 isolated_file:0 [ 328.978547][ T8488] unevictable:768 dirty:403 writeback:0 [ 328.978547][ T8488] slab_reclaimable:11831 slab_unreclaimable:100135 [ 328.978547][ T8488] mapped:34912 shmem:14061 pagetables:1259 [ 328.978547][ T8488] sec_pagetables:3 bounce:0 [ 328.978547][ T8488] kernel_misc_reclaimable:0 [ 328.978547][ T8488] free:1300171 free_pcp:3956 free_cma:0 [ 328.978599][ T8488] Node 0 active_anon:1096kB inactive_anon:79156kB active_file:96688kB inactive_file:150460kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:139648kB dirty:1612kB writeback:0kB shmem:54708kB kernel_stack:13600kB pagetables:4872kB sec_pagetables:12kB all_unreclaimable? no Balloon:0kB [ 328.978644][ T8488] Node 1 active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:32kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 328.978685][ T8488] Node 0 DMA free:15356kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 328.978746][ T8488] lowmem_reserve[]: 0 2514 2515 2515 2515 [ 328.978784][ T8488] Node 0 DMA32 free:1281888kB boost:0kB min:3944kB low:6492kB high:9040kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1096kB inactive_anon:79156kB active_file:96688kB inactive_file:150460kB unevictable:1536kB writepending:1612kB zspages:0kB present:3129332kB managed:2574692kB mlocked:0kB bounce:0kB free_pcp:15824kB local_pcp:7956kB free_cma:0kB [ 328.978843][ T8488] lowmem_reserve[]: 0 0 1 1 1 [ 328.978872][ T8488] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 328.978925][ T8488] lowmem_reserve[]: 0 0 0 0 0 [ 328.978954][ T8488] Node 1 Normal free:3903440kB boost:0kB min:6360kB low:10468kB high:14576kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:204kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 328.979010][ T8488] lowmem_reserve[]: 0 0 0 0 0 [ 328.979038][ T8488] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB [ 328.979173][ T8488] Node 0 DMA32: 1660*4kB (UME) 1100*8kB (UME) 889*16kB (UME) 413*32kB (UME) 252*64kB (UM) 159*128kB (UME) 65*256kB (UME) 24*512kB (UM) 14*1024kB (UM) 0*2048kB 283*4096kB (UM) = 1281792kB [ 328.979311][ T8488] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 328.984601][ T8488] Node 1 Normal: 194*4kB (UME) 39*8kB (UME) 27*16kB (UME) 215*32kB (UME) 90*64kB (UME) 31*128kB (UME) 11*256kB (UM) 5*512kB (UM) 3*1024kB (UME) 3*2048kB (ME) 945*4096kB (M) = 3903440kB [ 328.984752][ T8488] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 328.988399][ T8488] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 328.988421][ T8488] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 328.988437][ T8488] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 328.988451][ T8488] 75903 total pagecache pages [ 328.988471][ T8488] 0 pages in swap cache [ 328.988478][ T8488] Free swap = 124996kB [ 328.988485][ T8488] Total swap = 124996kB [ 328.988493][ T8488] 2097051 pages RAM [ 328.988500][ T8488] 0 pages HighMem/MovableOnly [ 328.988506][ T8488] 421352 pages reserved [ 328.988511][ T8488] 0 pages cma reserved [ 329.127588][ T8478] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.129334][ T8478] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 329.155486][ T8478] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.155985][ T8478] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 329.168360][ T8478] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 329.168869][ T8478] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 330.584890][ T6667] usb 3-1: palm_os_3_probe - error -71 getting connection information [ 330.584988][ T6667] visor 3-1:1.228: probe with driver visor failed with error -71 [ 330.619442][ T6667] usb 3-1: USB disconnect, device number 35 [ 330.797354][ T7968] usb 2-1: new full-speed USB device number 36 using dummy_hcd [ 330.927330][ T7968] usb 2-1: device descriptor read/64, error -71 [ 331.103329][ T5876] usb 5-1: USB disconnect, device number 32 [ 331.137994][ T5996] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 331.167690][ T7968] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 331.427316][ T5996] usb 1-1: Using ep0 maxpacket: 8 [ 331.430262][ T5996] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 331.430317][ T5996] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 331.430340][ T5996] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 331.430380][ T5996] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 331.430402][ T5996] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.463754][ T5996] usb 1-1: config 0 descriptor?? [ 331.479280][ T7968] usb 2-1: device descriptor read/64, error -71 [ 332.297706][ T7968] usb usb2-port1: attempt power cycle [ 332.516743][ T5876] usb 1-1: USB disconnect, device number 34 [ 339.166194][ T9] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 339.176754][ T6026] ------------[ cut here ]------------ [ 339.176769][ T6026] faux_driver vkms: [drm] vblank wait timed out on crtc 0 [ 339.176792][ T6026] WARNING: drivers/gpu/drm/drm_vblank.c:1318 at drm_wait_one_vblank+0x39a/0x5c0, CPU#1: kworker/1:9/6026 [ 339.176829][ T6026] Modules linked in: [ 339.176847][ T6026] CPU: 1 UID: 0 PID: 6026 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 339.176870][ T6026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 339.176884][ T6026] Workqueue: events drm_fb_helper_damage_work [ 339.176907][ T6026] RIP: 0010:drm_wait_one_vblank+0x587/0x5c0 [ 339.176929][ T6026] Code: 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ef e8 ba d4 f6 fc 4d 8b 7d 00 48 89 df 4c 89 e6 4c 89 fa 8b 4c 24 04 <67> 48 0f b9 3a e9 d5 fc ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f [ 339.176947][ T6026] RSP: 0018:ffffc90005aff860 EFLAGS: 00010246 [ 339.176963][ T6026] RAX: 1ffff1100481b600 RBX: ffffffff8ee5b070 RCX: 0000000000000000 [ 339.176978][ T6026] RDX: ffffffff8b569b80 RSI: ffffffff8b584ca0 RDI: ffffffff8ee5b070 [ 339.176993][ T6026] RBP: ffffc90005aff948 R08: 0000000000000000 R09: 0000000000000000 [ 339.177007][ T6026] R10: dffffc0000000000 R11: fffffbfff1db66ef R12: ffffffff8b584ca0 [ 339.177022][ T6026] R13: ffff8880240db000 R14: 1ffff92000b5ff10 R15: ffffffff8b569b80 [ 339.177038][ T6026] FS: 0000000000000000(0000) GS:ffff888126def000(0000) knlGS:0000000000000000 [ 339.177055][ T6026] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 339.177069][ T6026] CR2: 00007f3d554556c0 CR3: 0000000037762000 CR4: 00000000003526f0 [ 339.177086][ T6026] Call Trace: [ 339.177094][ T6026] [ 339.177109][ T6026] ? __pfx_drm_wait_one_vblank+0x10/0x10 [ 339.177128][ T6026] ? rt_spin_unlock+0x150/0x200 [ 339.177153][ T6026] ? __pfx_autoremove_wake_function+0x10/0x10 [ 339.177215][ T6026] ? rt_spin_unlock+0x161/0x200 [ 339.177260][ T6026] ? drm_vblank_get+0x147/0x260 [ 339.177284][ T6026] drm_client_modeset_wait_for_vblank+0xc5/0xf0 [ 339.177315][ T6026] drm_fb_helper_damage_work+0xc9/0x650 [ 339.177339][ T6026] ? process_scheduled_works+0x9ef/0x1770 [ 339.177366][ T6026] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 339.177392][ T6026] ? process_scheduled_works+0x9ef/0x1770 [ 339.177411][ T6026] ? process_scheduled_works+0x9ef/0x1770 [ 339.177434][ T6026] process_scheduled_works+0xad1/0x1770 [ 339.177485][ T6026] ? __pfx_process_scheduled_works+0x10/0x10 [ 339.177502][ T6026] ? do_raw_spin_lock+0x121/0x290 [ 339.177549][ T6026] worker_thread+0x8a0/0xda0 [ 339.177587][ T6026] ? __kthread_parkme+0x7b/0x200 [ 339.177621][ T6026] kthread+0x711/0x8a0 [ 339.177649][ T6026] ? __pfx_worker_thread+0x10/0x10 [ 339.177671][ T6026] ? __pfx_kthread+0x10/0x10 [ 339.177693][ T6026] ? rt_spin_unlock+0x150/0x200 [ 339.177722][ T6026] ? rt_spin_unlock+0x161/0x200 [ 339.177744][ T6026] ? __pfx_kthread+0x10/0x10 [ 339.177771][ T6026] ret_from_fork+0x510/0xa50 [ 339.177795][ T6026] ? __pfx_ret_from_fork+0x10/0x10 [ 339.177813][ T6026] ? __switch_to+0xc9e/0x1480 [ 339.177844][ T6026] ? __pfx_kthread+0x10/0x10 [ 339.177871][ T6026] ret_from_fork_asm+0x1a/0x30 [ 339.177915][ T6026] [ 339.177932][ T6026] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 339.177947][ T6026] CPU: 1 UID: 0 PID: 6026 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 339.177969][ T6026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 339.177982][ T6026] Workqueue: events drm_fb_helper_damage_work [ 339.178002][ T6026] Call Trace: [ 339.178010][ T6026] [ 339.178017][ T6026] vpanic+0x1e0/0x670 [ 339.178047][ T6026] panic+0xb9/0xc0 [ 339.178070][ T6026] ? __pfx_panic+0x10/0x10 [ 339.178106][ T6026] ? ret_from_fork_asm+0x1a/0x30 [ 339.178138][ T6026] __warn+0x317/0x4b0 [ 339.178161][ T6026] ? drm_wait_one_vblank+0x39a/0x5c0 [ 339.178185][ T6026] ? drm_wait_one_vblank+0x39a/0x5c0 [ 339.178205][ T6026] __report_bug+0x288/0x500 [ 339.178233][ T6026] ? drm_wait_one_vblank+0x39a/0x5c0 [ 339.178260][ T6026] ? __pfx___report_bug+0x10/0x10 [ 339.178308][ T6026] report_bug_entry+0x19a/0x290 [ 339.178336][ T6026] ? drm_wait_one_vblank+0x587/0x5c0 [ 339.178354][ T6026] ? drm_wait_one_vblank+0x58c/0x5c0 [ 339.178373][ T6026] handle_bug+0xca/0x200 [ 339.178395][ T6026] exc_invalid_op+0x1a/0x50 [ 339.178415][ T6026] asm_exc_invalid_op+0x1a/0x20 [ 339.178434][ T6026] RIP: 0010:drm_wait_one_vblank+0x587/0x5c0 [ 339.178455][ T6026] Code: 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ef e8 ba d4 f6 fc 4d 8b 7d 00 48 89 df 4c 89 e6 4c 89 fa 8b 4c 24 04 <67> 48 0f b9 3a e9 d5 fc ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f [ 339.178473][ T6026] RSP: 0018:ffffc90005aff860 EFLAGS: 00010246 [ 339.178489][ T6026] RAX: 1ffff1100481b600 RBX: ffffffff8ee5b070 RCX: 0000000000000000 [ 339.178504][ T6026] RDX: ffffffff8b569b80 RSI: ffffffff8b584ca0 RDI: ffffffff8ee5b070 [ 339.178519][ T6026] RBP: ffffc90005aff948 R08: 0000000000000000 R09: 0000000000000000 [ 339.178541][ T6026] R10: dffffc0000000000 R11: fffffbfff1db66ef R12: ffffffff8b584ca0 [ 339.178556][ T6026] R13: ffff8880240db000 R14: 1ffff92000b5ff10 R15: ffffffff8b569b80 [ 339.178594][ T6026] ? __pfx_drm_wait_one_vblank+0x10/0x10 [ 339.178614][ T6026] ? rt_spin_unlock+0x150/0x200 [ 339.178638][ T6026] ? __pfx_autoremove_wake_function+0x10/0x10 [ 339.178663][ T6026] ? rt_spin_unlock+0x161/0x200 [ 339.178690][ T6026] ? drm_vblank_get+0x147/0x260 [ 339.178712][ T6026] drm_client_modeset_wait_for_vblank+0xc5/0xf0 [ 339.178742][ T6026] drm_fb_helper_damage_work+0xc9/0x650 [ 339.178767][ T6026] ? process_scheduled_works+0x9ef/0x1770 [ 339.178793][ T6026] ? __pfx_drm_fb_helper_damage_work+0x10/0x10 [ 339.178820][ T6026] ? process_scheduled_works+0x9ef/0x1770 [ 339.178839][ T6026] ? process_scheduled_works+0x9ef/0x1770 [ 339.178862][ T6026] process_scheduled_works+0xad1/0x1770 [ 339.178913][ T6026] ? __pfx_process_scheduled_works+0x10/0x10 [ 339.178932][ T6026] ? do_raw_spin_lock+0x121/0x290 [ 339.178970][ T6026] worker_thread+0x8a0/0xda0 [ 339.179006][ T6026] ? __kthread_parkme+0x7b/0x200 [ 339.179039][ T6026] kthread+0x711/0x8a0 [ 339.179069][ T6026] ? __pfx_worker_thread+0x10/0x10 [ 339.179090][ T6026] ? __pfx_kthread+0x10/0x10 [ 339.179112][ T6026] ? rt_spin_unlock+0x150/0x200 [ 339.179140][ T6026] ? rt_spin_unlock+0x161/0x200 [ 339.179162][ T6026] ? __pfx_kthread+0x10/0x10 [ 339.179187][ T6026] ret_from_fork+0x510/0xa50 [ 339.179211][ T6026] ? __pfx_ret_from_fork+0x10/0x10 [ 339.179229][ T6026] ? __switch_to+0xc9e/0x1480 [ 339.179261][ T6026] ? __pfx_kthread+0x10/0x10 [ 339.179287][ T6026] ret_from_fork_asm+0x1a/0x30 [ 339.179333][ T6026] [ 339.179720][ T6026] Kernel Offset: disabled