last executing test programs: 10.265201466s ago: executing program 4 (id=1733): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, 0x0, 0x1000, 0x0) r3 = syz_io_uring_setup(0x9f7, &(0x7f0000000180)={0x0, 0x992a, 0x10, 0x4, 0x1a6}, &(0x7f0000000040)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r6 = socket$inet_sctp(0x2, 0x1, 0x84) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r6, 0x80, &(0x7f00000000c0)=@in6={0xa, 0x4e21, 0x200052, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x8}}) (async) io_uring_enter(r3, 0x3514, 0x9141, 0x69, 0x0, 0x0) (async) openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x60, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x37c13, 0x51a23}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x14, 0x6, @loopback}, @IFLA_GRE_REMOTE={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x41}}]}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000001}, 0x8000014) (async) unshare(0x6a040000) (async) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@ipv6_newnexthop={0x1c, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}]}, 0x1c}}, 0x0) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x10, 0x0, 0x0, 0x4, 0x0, 0x1, 0x20000000}, [@RTA_NH_ID={0x8, 0x1e, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4a044}, 0x4010) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@ipv6_newnexthop={0x4c, 0x68, 0x309, 0x0, 0x1, {}, [@NHA_RES_GROUP={0x2c, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_UNBALANCED_TIMER={0x8, 0x3, 0xc3e4}, @NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0xe7b}, @NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x4}, @NHA_RES_GROUP_UNBALANCED_TIMER={0x8, 0x3, 0x6}, @NHA_RES_GROUP_IDLE_TIMER={0x8, 0x2, 0xc31}]}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x4c}}, 0x4040005) (async) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)}], 0x1, 0x40800) (async) bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, &(0x7f0000000040)=0x8, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) (async) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 8.112530358s ago: executing program 4 (id=1738): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256\x00'}, 0x58) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)) close_range(r1, 0xffffffffffffffff, 0x0) 7.96770678s ago: executing program 4 (id=1739): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@can_newroute={0x2c, 0x18, 0x1, 0x70bd26, 0x0, {}, [@CGW_MOD_AND={0x15, 0x1, {{{0x3, 0x1, 0x0, 0x1}, 0x0, 0x2, 0x0, 0x0, "32ba630f60057a49"}, 0x7}}]}, 0x2c}}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="12000000120001000200000000000000100000000c00001700000000000000000f"], 0x30}], 0x1, 0x0, 0x0, 0x20004801}, 0x1) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) (fail_nth: 5) 7.291737497s ago: executing program 4 (id=1741): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x1000}, 0x4) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x73220c8b}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x20, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000580)=ANY=[], 0x94}, 0x1, 0x0, 0x0, 0x48014}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$x86(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$x86(r7, &(0x7f0000000080)={0x0, &(0x7f0000000f40)=[@wrmsr={0x65, 0x20, {0xc001103b, 0xfffffffffffffffd}}], 0x20}) ioctl$KVM_SET_CPUID2(r8, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r8, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x12, 0x4, @tid=r9}, &(0x7f0000000380)=0x0) timer_settime(r10, 0x1, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) timer_settime(r10, 0x0, &(0x7f0000000300)={{0x0, 0x989680}, {r11, r12+10000000}}, 0x0) r13 = socket(0x2a, 0x2, 0x0) getsockname$packet(r13, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r14, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x3c, 0x2, [@TCA_FLOWER_ACT={0x38, 0x3, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x6c}}, 0x24000000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000100)={'syztnl1\x00', &(0x7f0000000040)={'syztnl2\x00', r14, 0x700, 0x7800, 0x5, 0x550, {{0x1f, 0x4, 0x0, 0x21, 0x7c, 0x64, 0x0, 0x0, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@timestamp_prespec={0x44, 0x34, 0x88, 0x3, 0x5, [{@private=0xa010102, 0xff}, {@private=0xa010102, 0x29}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x42c}, {@multicast1, 0xfffffff8}, {@remote, 0xba6}, {@multicast2, 0x8}]}, @ra={0x94, 0x4}, @lsrr={0x83, 0x1b, 0xc8, [@rand_addr=0x64010101, @local, @rand_addr=0x64010100, @private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @local]}, @cipso={0x86, 0x13, 0x3, [{0x6, 0xd, "982e8cac896b17b2ff7365"}]}, @noop]}}}}}) r15 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000280), 0x40100, 0x0) poll(&(0x7f0000002300)=[{r15, 0x80}], 0x1, 0x5) 6.379803195s ago: executing program 1 (id=1744): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='veth1_virt_wifi\x00', 0x10) r1 = dup(r0) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r2, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f00000004c0)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f0000000600)={0x28, 0x2, r3, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000580)}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000000206010100000000000000000000000005000400000000000900020073797a30000000000500010007000000050005000a00000014000780080011401100239b48f40d120000ffff16000300686173683a6e65742c706f72742c6e6574000000"], 0x64}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'veth0_to_batadv\x00', 0x0}) sendmsg$can_raw(r2, &(0x7f0000000400)={&(0x7f0000000000)={0x1d, r6}, 0x10, &(0x7f00000005c0)={&(0x7f0000000440)=@canfd={{0x1, 0x0, 0x1, 0x1}, 0x17, 0x2, 0x0, 0x0, "e1f56c17f67f533aefbabe5cd2c2c8c6ea8662721300943f00281c6e124f30aecd1295898fabec36c87c2e46c80cafa556008cc9c091c31b766d2a24e9687309"}, 0x5dc}, 0x118}, 0x81) sendmsg$inet(r1, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000001600)=[{&(0x7f0000000000)="be39", 0x2}], 0x1, &(0x7f0000000140)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @local, @private}}}, @ip_ttl={{0x14}}], 0x38}, 0x0) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x40, &(0x7f00000000c0)=0x3, 0x4) ioctl$sock_ifreq(r5, 0x8910, &(0x7f0000000380)={'dvmrp0\x00', @ifru_mtu=0xfffffff7}) sendmsg$NFT_BATCH(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a28000000180a010300000000000000000700000814000380080002400000007f080002400000027e540000000b0a0101000000000500000508000a400000000108000a400000000108000f40000000050900020073797a300000000008000540000000280900020073797a310000000008000a4000000002148100000000000000000000000000000700000a"], 0xa4}, 0x1, 0x0, 0x0, 0x20000890}, 0x40000) recvmsg$unix(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000001640)=""/4096, 0x1000}], 0x1}, 0x40000000) ioctl$PPPIOCGIDLE(r1, 0x8010743f, &(0x7f0000000080)) 6.236434266s ago: executing program 4 (id=1745): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2c00000015000100fdffffff0000000002100000", @ANYBLOB="140003007665746830000000000000001791cb46"], 0x2c}}, 0x0) 6.151242135s ago: executing program 4 (id=1747): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000096d5c4004233e0269d7010203010902120001000000000904"], 0x0) r1 = creat(0x0, 0x80) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b0f, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000, &(0x7f00002fe000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r9 = dup(r8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r9, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r7, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x14040012}, 0x4000084) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000600)={0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="800001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r11 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) read(r11, &(0x7f0000000180)=""/252, 0xfc) 5.938622728s ago: executing program 3 (id=1749): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256\x00'}, 0x58) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)) close_range(r1, 0xffffffffffffffff, 0x0) 5.843883546s ago: executing program 3 (id=1750): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) (async) r0 = syz_open_dev$vbi(&(0x7f0000000100), 0x3, 0x2) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f0000000000)={0x8, [0x204, 0x2, 0x3, 0x0, 0xfff, 0x8000, 0x5, 0xc7, 0x3, 0x1, 0x4, 0xd20, 0x7, 0xfff8, 0x4, 0x8, 0x7867, 0x7e27, 0xac, 0x0, 0x4, 0x5109, 0x81, 0x7, 0x0, 0xfff, 0x6, 0x2, 0x400, 0xcad, 0x6, 0x9, 0x7ff, 0x0, 0x1, 0x12, 0x7, 0x63, 0x7, 0xb5, 0x5, 0xd, 0x1000, 0x9, 0x3ff, 0x0, 0x4, 0xc8], 0x2}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000007000000324900000000000001000000", @ANYRES32=0x1, @ANYBLOB="208be65d2fc69d7734cdfbc269f34cd2e8", @ANYRES32=0x0, @ANYRES32], 0x50) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) (async, rerun: 64) listen(r1, 0x2) (async, rerun: 64) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) (async) r3 = syz_io_uring_setup(0x74d, &(0x7f0000000100)={0x0, 0x59c4, 0x8, 0x1000, 0x5cc}, &(0x7f0000000300)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000740)=[{&(0x7f00000003c0)=""/201, 0xc9}], 0x1) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_ACCEPT={0xd, 0xc, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x81800, 0x1}) io_uring_enter(r3, 0x749f, 0x4, 0x0, 0x0, 0xfffffffffffffef5) (async) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r6 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) r7 = socket(0x2, 0x80805, 0x0) (async) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r8, 0x0) (async) close(0x3) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r8, 0x84, 0x7a, &(0x7f0000000340)={r9, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) (async) sendmmsg$inet_sctp(r7, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(r7, 0x84, 0xe, &(0x7f0000000240)={r10, 0x9, 0x1, 0x5, 0x7, 0x3, 0x1005, 0x9, {r10, @in6={{0xa, 0x4e24, 0x81, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000}}, 0xc9dfc363, 0x5, 0x1, 0x4, 0x5}}, &(0x7f0000000300)=0xb0) (async) syz_emit_ethernet(0x1d4, &(0x7f0000000bc0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd60088000019e0601fe8000000000000000000000000000aafe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a0020800907800001e1270fec1ca894e15cb000005207f830efd000050db17e875410c47e31ce236e5ac069a5c53bf11b3c2cbb2e7ecf22242abf29fb64b18bc6e16cfc375aea64a32c76fca7db899de54f7cacf9810e2b612f7bf197b2edf8bccf07030eb86ff61e4b016aad9938c293d95e208a43596aa9d20c5a4dd5207c12ca6ffd0eee623a342772ec6b5d604f845736e4bf89f2675d8a2fefa8b1d94964d5faf092649e1997081006eed4eca9cccac3014fac15ed60ac80a898b6169ba7e493b59c3ba03b6cd9dc48757f6a73a17e0b41af0a5494c797da8c4b0d6135f8b7c2b81c60dbdd23eaddfb4f8ffffffffffffffcad7e9640cff80d1fc933eba27c43739904bb4bcb544002724d494f33877e97582fd4e87b5ba35776375e9d8e8dc566faaa5407f5d706edac70a90abf3fe08baf387901af61bcdc65ec54876421e3726a6e3d1c8008da4cd73180ae5ec2c99540246454f3e9ed59ba63aefa19ac9ba0b345c9597b002fa8a0aaeb996416f62174f031f6a218ccd9dedf80ba7f6dffdd12e2cb809d87cc39ebc1b0cb4ff431d68b368e6fcd4a1da60692fce01c43c1c7ec31c068747d05468871ba74a732d00239cfb5ed3acd786c4acae66da6e7dab"], 0x0) (async) syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000693c1e10cd060202043e010203010902240001000000000904230002722f680009057a43ff0346090509050e"], 0x0) 5.656423254s ago: executing program 2 (id=1753): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000000300)={0x5, 0x0, 0x3, 0x3ff, 0x1, [0x3, 0x101, 0x9, 0xc756]}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_emit_ethernet(0xfef3, &(0x7f0000000200)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x64, 0x11, 0x0, @remote, @local, {[], {0x4e20, 0xe22, 0x64, 0x0, @wg=@response={0x2, 0x1, 0x100004, "628e0960f6d6d3f6ee6d6b84b345dccac643e7df3e526ff07833b291322d4a74", "882ed6741e7632daeaec0c95f2ad1cd6", {"8fb3d9fd3efe8e4ea8b5ec7448ddd6a3", "215990e1b896120966af96b22cf049f0"}}}}}}}}, 0x0) setitimer(0x0, &(0x7f0000000280)={{0x0, 0x2710}, {0x77359400}}, &(0x7f00000002c0)) ioctl$KVM_GET_ONE_REG(r6, 0x4018aee3, 0x0) select(0x40, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffff2}, &(0x7f00000000c0)={0x4}, 0x0, &(0x7f0000000100)={0x7fffffffffffffff}) r7 = openat$sysfs(0xffffff9c, &(0x7f0000000240)='/sys/power/mem_sleep', 0x0, 0x44) r8 = syz_io_uring_setup(0xbdf, &(0x7f0000000000)={0x0, 0x6d0a, 0x80, 0xfffffffd, 0x40000331, 0x0, r7}, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r7, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r8, 0x847ba, 0x2000, 0xe, 0x0, 0x0) getsockname$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) semtimedop(0x0, &(0x7f0000000200)=[{0x0, 0xffff, 0x2000}, {0x4, 0x3, 0x1800}], 0x2, 0x0) semop(0x0, &(0x7f0000000180)=[{0x4, 0xa7dd, 0x3000}], 0x1) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000030a20000000000a01010000000000000000050000000900010073797a30000000005c000000030a010300004887608d0000050000000900010073797a30000000000900030073797a300000000008000a4000000003280004800800024000000012080001400000000014000300776c616e30000000000000000000000014000000110001"], 0xa4}, 0x1, 0x1000000}, 0x0) semctl$GETZCNT(0x0, 0x4, 0xf, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newlink={0x118, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r11, 0xb}, [@IFLA_AF_SPEC={0xf8, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @local}]}, @AF_INET={0x30, 0x2, 0x0, 0x1, {0x2c, 0x1, 0x0, 0x1, [{0x8}, {0x8, 0x16}, {0x8}, {0x8}, {0x8}]}}, @AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}, @AF_INET={0x28, 0x2, 0x0, 0x1, {0x24, 0x1, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}}, @AF_MPLS={0x4}, @AF_INET6={0x74, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @multicast1}}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00'}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_ADDR_GEN_MODE={0x5}]}, @AF_MPLS={0x4}]}]}, 0x118}}, 0x0) 5.503964737s ago: executing program 1 (id=1754): r0 = syz_open_dev$media(0x0, 0x2, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r0, 0xc0487c04, 0x0) (async) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) (async) listen(r1, 0x6) (async) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) (async) r3 = syz_io_uring_setup(0x129, &(0x7f0000000380)={0x0, 0x0, 0x80, 0x0, 0x4000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x35451d7003000c0b, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) (async) ioctl$TUNSETGROUP(r6, 0x400454ce, 0x0) (async) ioctl$TUNSETOWNER(r6, 0x400454cc, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x9}) (async) epoll_create1(0x0) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) r7 = dup(r2) r8 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS_OLD(r8, 0xc1004111, 0x0) (async) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd2c) (async) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0xc0606610, &(0x7f0000000040)=0x60) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r9, 0xffffffffffffffff, 0x200000000000000) 5.43674042s ago: executing program 1 (id=1755): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@can_newroute={0x2c, 0x18, 0x1, 0x70bd26, 0x0, {}, [@CGW_MOD_AND={0x15, 0x1, {{{0x3, 0x1, 0x0, 0x1}, 0x0, 0x2, 0x0, 0x0, "32ba630f60057a49"}, 0x7}}]}, 0x2c}}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="12000000120001000200000000000000100000000c00001700000000000000000f"], 0x30}], 0x1, 0x0, 0x0, 0x20004801}, 0x1) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELRULE={0x2c, 0x8, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 5.15641303s ago: executing program 1 (id=1756): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000740)=@file={0x0, './file0\x00'}, 0x6e) eventfd2(0x10000, 0x80000) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, 0x0) r2 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x900f, 0x100, 0x4, 0x162}, &(0x7f0000000400)=0x0, &(0x7f0000000280)) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="38000000190001202bbd7000000000000a000000000000000000000008001e0000000000140005"], 0x38}}, 0x0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x2) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000000000)) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) poll(0x0, 0x0, 0x5) syz_io_uring_setup(0x6e2a, &(0x7f00000002c0)={0x0, 0xf4dd, 0x80, 0x3, 0x201, 0x0, r2}, &(0x7f0000000180)=0x0, &(0x7f0000000340)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x80, &(0x7f0000000380)=0x177, 0x0, 0x4) io_uring_enter(r2, 0x3517, 0x173d, 0x42, 0x0, 0x0) 4.624637455s ago: executing program 2 (id=1757): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv6_delrule={0x30, 0x18, 0x301, 0x0, 0x0, {0xa, 0x20, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7}, [@FRA_DST={0x14, 0x1, @mcast1={0xff, 0x6}}]}, 0x30}, 0x1, 0x0, 0x0, 0x804}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000004e00010000007ca0100000002303000008000100"], 0x1c}}, 0x0) 4.547644137s ago: executing program 2 (id=1758): r0 = socket$inet6(0xa, 0x3, 0x8) sendmmsg$inet6(r0, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='$\x00'], 0x28}}], 0x1, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2, 0x9, 0x4000000) accept4(r0, &(0x7f00000000c0)=@can, &(0x7f00000001c0)=0x80, 0x800) madvise(&(0x7f000042f000/0x800000)=nil, 0x80fd00, 0x66) r1 = open(&(0x7f0000000000)='./bus\x00', 0x1a1043, 0xc5) mmap(&(0x7f000029a000/0x1000)=nil, 0x1000, 0xc, 0x4002011, r1, 0x0) r2 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f000085a000/0x2000)=nil, &(0x7f0000f96000/0x1000)=nil, 0x7ffffffa, 0x0, 0x0, 0xffffffffffffffff, 0x40, 0xc, 0x0, 0x18}) recvfrom$inet6(r0, 0x0, 0x0, 0x10000, 0x0, 0x0) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000040)) 3.983139579s ago: executing program 1 (id=1759): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=@newqdisc={0x180, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x150, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x7f, 0x81, 0x9, 0xa, 0xab, 0xe, 0xb, 0x5, 0x6, 0xfffffff9, 0xe, 0x19, 0x18, 0x10, 0x4a, 0x2}}, @TCA_GRED_DPS={0x10, 0x3, {0xe, 0xf, 0x1, 0x3}}, @TCA_GRED_STAB={0x104, 0x2, "ac6f895c6f6df4beb1a179acc52ef553ca603f57e6c31fd11681d95616639a10cf22a31925ad2e9398e600603df6600af0468efc4b6ef300692eaef5955c0c4dfeb704ebf9d0f3563d37d553cad054de78e15ca2c4023bd8b12b3d02a8f9761972d6af4d172bd3180d774ce0dc0020bf2b8558c4b0e2d726b1e6d707709a15f2cb238eba7b84be12fe76d1555bb2c616a691475aa7a672902053373632a3e9434c4424712584a5e7eb792a7bfd6a9daab1cdbd92d2e6aca2f75ef82ccf2aab1bfc976ae99149dea58be89f792610fd8f4c1076e9f154d48e6b545ddf1d011bb8394f367a22b6b6162008108b6ae15e29520c526b45d890a5d2e59d66ed49ceb8"}]}}]}, 0x180}, 0x1, 0x0, 0x0, 0x40098}, 0x8044) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000400010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 3.619055438s ago: executing program 1 (id=1762): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x541b, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001380), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f0000001500)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000001400)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010829bd7000fbdbdf25140000001c0007800c0004000800000000edffff0b000300"], 0x30}, 0x1, 0x0, 0x0, 0x8085}, 0x4000) sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x18800018}, 0xc, &(0x7f00000001c0)={&(0x7f0000000600)={0xf4, r2, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}]}, @TIPC_NLA_MEDIA={0x1c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_BEARER={0x28, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}]}, @TIPC_NLA_BEARER_NAME={0x17, 0x1, @l2={'ib', 0x3a, 'veth1_to_bridge\x00'}}]}, @TIPC_NLA_MEDIA={0x68, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x0, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}]}, 0xcc}}, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000200)={&(0x7f0000001480)=[{0x9, 0x8001, 0x0, 0x0}, {0x8, 0x11, 0x0, 0x0}], 0x2}) r5 = syz_open_dev$sg(0x0, 0xffff0000, 0x40) lchown(&(0x7f0000000040)='./cgroup.cpu/cgroup.procs\x00', 0xee01, 0x0) syz_open_dev$loop(&(0x7f0000000140), 0x81000000000000, 0x400040) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000005c0)=ANY=[@ANYBLOB="00000000040000"]) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) setsockopt$MRT6_INIT(0xffffffffffffffff, 0x29, 0xc8, &(0x7f00000011c0), 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000300)) r6 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x8000, 0x0) socket$caif_stream(0x25, 0x1, 0x0) getdents64(r6, &(0x7f0000001f00)=""/4093, 0xffd) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 3.572620509s ago: executing program 2 (id=1763): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000c40), 0x0, 0x8014) socket$kcm(0x29, 0x2, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x20008800) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140), 0x801, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f00000003c0)={0x48, 0x2, r1}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x2, r1, 0x0, &(0x7f0000c00000/0x400000)=nil, 0x400000, 0x51e}) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) 3.148043851s ago: executing program 2 (id=1765): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfe, 0x2ffffffff}, 0xc) (async) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r5, 0x8008551d, &(0x7f0000000140)={0x9ad2, 0x1c, [{}, {0x4}, {0x1, 0x1}, {0xb}, {0xc}, {0x2}, {0xe}, {0x3}, {0xc}, {0x3}, {0x0, 0x1}, {0x5, 0x1}, {0x9}, {0xa, 0x1}, {0x7, 0x1}, {0xf}, {0x5, 0x1}, {0x7}, {0x4, 0x1}, {0x7, 0x1}, {0x5}, {0x3}, {0x1}, {0x0, 0x1}, {0xb}, {0x3}, {0xa}, {0x7}]}) (async, rerun: 64) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x200, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x6, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x101, 0x3}}}]}, 0x38}}, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x3}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_IPV6_SRC={0x14, 0xe, @empty}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x50}, 0x0) 2.980184846s ago: executing program 2 (id=1766): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) timer_create(0x0, 0x0, 0xffffffffffffffff) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) getrandom(0x0, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) ioctl$VFAT_IOCTL_READDIR_SHORT(0xffffffffffffffff, 0x82307202, &(0x7f0000000a80)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r2 = fcntl$getown(r0, 0x9) ptrace$ARCH_MAP_VDSO_32(0x1e, r2, 0x2, 0x2002) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001480)={0x6, 0x4, 0x0, 0x0, 0x1, 0xd3, &(0x7f0000001380)=""/211, 0x100, 0x10, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000140)={0xa, 0x5}, 0x8, 0x10, &(0x7f00000001c0)={0x2, 0x0, 0x3, 0x9}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x10, 0x8c}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001600)={@cgroup, 0x24, 0x0, 0x2, 0x0, 0x55, 0x0, &(0x7f0000000980), 0x0, 0x0}, 0x40) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x17, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70200001f000000850000008600000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7020000005900008500000086000000bf91000000000000b702000000000000850000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x3f, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) syz_usb_connect(0x5, 0x24, &(0x7f0000000200)={{0x12, 0x1, 0x300, 0x16, 0x24, 0xc1, 0x8, 0x45e, 0x775, 0xdd6d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7, 0x8, 0xe0, 0x42, [{{0x9, 0x4, 0x8e, 0x0, 0x0, 0xff, 0xf2, 0x1e, 0x6}}]}}]}}, &(0x7f0000000f00)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect$cdc_ncm(0x0, 0x7a, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x68, 0x2, 0x1, 0x2, 0x0, 0x5, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "b0546fbce5"}, {0x5, 0x24, 0x0, 0xfffd}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x4, 0x5, 0x75}, {0x6, 0x24, 0x1a, 0x400, 0x20}, [@network_terminal={0x7, 0x24, 0xa, 0x8, 0x8, 0xc, 0x6}]}, {{0x9, 0x5, 0x81, 0x3, 0x3f7, 0x9, 0x0, 0xff}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x40, 0x8, 0x7, 0x59}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x9, 0x1, 0xf6}}}}}}}]}}, &(0x7f00000007c0)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x201, 0x50, 0x2, 0x4, 0x40, 0xc}, 0x5, &(0x7f00000000c0)={0x5, 0xf, 0x5}, 0x9, [{0xaa, &(0x7f0000000100)=@string={0xaa, 0x3, "06e95e4c3d24fabf4b0d2e394729219c706e193a589056e5cdb2fc1fb06e149428722ef400786dd4bde4199acf2c3e6da595969c05ed213e7c018a43457b050ee2ca3fce85e8623931fd037cbe438b8121b7bea48a8bc4d141176c9d2e0380b05b3c5c69fb307a3fac3cb81b39763015a4457637e2b6c106535775fdffc7c0d7499a76533d0343d7402e6a5ab84f2ef1fd092a96479f11e7df47004034470f8110d24e3cf2aa71d7"}}, {0xa9, &(0x7f0000000880)=ANY=[@ANYBLOB="a903a77ca005db9811b8d2f4692944317e6904a56a8b5ee56767b8ab67606efb1012bcd3aa95b744ccc34e590c3bc1e39bd8647e9a47dd76dc66fc42ff000000000000003c2ecb420130b7e053fb8c7586ad99d36f09b8c52e13d984dd5aec859fe7405181352454ed6b9d8aa484493229531985f18c66194e3bb059dc070538e60d459426d30bd708a34d29750d69fa0100eb8ba53139c135cc2b85d5446e2fa870d3d4dead0f8cdea713126c2cd1d11e1cd3047b1c76d7a9d00b0f3f5cb1d3a48294024b3098e570a702839eb74d4f94362ead7e378e064870d080937eacf3c8a10e5bca2a21a514dda855b1730d32aaae13b20fa69c53"]}, {0x8c, &(0x7f0000000300)=@string={0x8c, 0x3, "d34f7bc8bf26d98a67e1285b2a5308623c53ce66dcdb51c76fa30dadbb06a3cee1ce500b8109e2c1a23ba79c3f4a8db5fea47b2ce155e0f0c303855f0f9f5b3d4bdfbec97534e49a808de1a64e487aa23ffea917ffaa5137c368dfbf1f2a5bf86c9bb7bad1cc59fa6bdad5008a4b1b3f552d2a263a8607563fef2601f39198a457021f0d64ade06fb444"}}, {0x9a, &(0x7f00000003c0)=@string={0x9a, 0x3, "511ee9a536adcf6556b185464410fc29111f74a2b45bd66a9c16b733e5dd3ba357ccf1b8c3decf559a71f6b7fa61b4494d5004f6718ac729ea475741aa9bf0adb61b66d44c5b3ada3c3241cd6cb75d8a70a4c18e93937543b8d8c58c7cee8460a9391daadb8d70f4dbf6aac6d21d09fb0b2a33d4589601e4976ed81b55db9cd8c6d40c97a4ea5b9747a3a23ab9b11020ba5e5b033d7a7104"}}, {0xc7, &(0x7f0000000980)=ANY=[@ANYBLOB="c7031a90c487e87b9d7d4aeeaf78573f4095be7dc78e3f42eaf631f037aa024f38cc513f83ae40c89d0155f6569b5923186c6b1f8a920fdd2dac97af068e932c64103a5ed6bc8bc2909e72b4532df1e712d0a1cc922d2a44cbd1c60eb1bb6e3b55abea9a4a8ca251a77222525f1dec462ee037a5ed77f0b6e720547b6d744a30fcdc46356fab04276f05d94765e8884b5abc69495bb480d95d70a5c814b8496016b244185de02f131b8f04a7b19152f3cf52e7a2185119993d102ff1aaa6192d8dbaf616401dbaba60e529d6b242d9c805f62fe543274b412c836e61b746e42ceaf9a74737c10603fb1f7a1db5057081d13b32a9f8711ab195ba"]}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0xc09}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x3c01}}, {0xf6, &(0x7f00000005c0)=@string={0xf6, 0x3, "b67d4b9629ba0a0a844ab078f680aa117426dacc263884d976a6f95fe60af028261c9576c1b096de529395b81559a16ba198634d7cdccc98b2cdfb28f9be6f986729227c2870ad246ac66a02ecf737b016bfd4de00c388607365fb7cefa4a9bb905d282e81be7d817f42bf7381c6e6dd430a88e9777632a1d91f17dd2db86701945638cda713da193ffcd64f469d17307f0f46c80294a452f23cc9a0081da5cd7a30a320f02b777bf1daeacc49b121fc771d979866a3a084ad971a12e08df03328451689f647200a28fa51f586bb16b3729543709f9aa4a6da51023e6c6bbb686e7b6024a412253153da22dff9d07af82a78224c"}}, {0xdf, &(0x7f00000006c0)=@string={0xdf, 0x3, "4e0d5802c91abc1874f43a5e573cedee5aa97341dec7e8ab944da1319ab0c204e5fff9c64685a182feee03b76d90c6841196a7160171c47481576fb3f4f1644b0af11f29b91a30ff340da60655a15915a1525bd133db1973f49a17581f1b73f688d0650d162b0c08acc0b8766e9ca4b64f02d342c4b040607bb8bf762460b73a3053e02ee021e91bbe7b8dae6cdbd627f4b0db651533057fde44e745ff521aaefd7a9ede85e00226b0ff7d7232262dc1b4869afa49e543cfcf26fabb49508fe85cf9745f588e4ea80fcd9e26fad00495e8f6f1aa9116c561132b862768"}}]}) 2.97210159s ago: executing program 0 (id=1767): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r1, 0x40309410, &(0x7f0000000300)={0x5, 0x0, 0x3, 0x3ff, 0x1, [0x3, 0x101, 0x9, 0xc756]}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_emit_ethernet(0xfef3, &(0x7f0000000200)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x64, 0x11, 0x0, @remote, @local, {[], {0x4e20, 0xe22, 0x64, 0x0, @wg=@response={0x2, 0x1, 0x100004, "628e0960f6d6d3f6ee6d6b84b345dccac643e7df3e526ff07833b291322d4a74", "882ed6741e7632daeaec0c95f2ad1cd6", {"8fb3d9fd3efe8e4ea8b5ec7448ddd6a3", "215990e1b896120966af96b22cf049f0"}}}}}}}}, 0x0) setitimer(0x0, &(0x7f0000000280)={{0x0, 0x2710}, {0x77359400}}, &(0x7f00000002c0)) ioctl$KVM_GET_ONE_REG(r6, 0x4018aee3, 0x0) select(0x40, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffff2}, &(0x7f00000000c0)={0x4}, 0x0, &(0x7f0000000100)={0x7fffffffffffffff}) r7 = openat$sysfs(0xffffff9c, &(0x7f0000000240)='/sys/power/mem_sleep', 0x0, 0x44) r8 = syz_io_uring_setup(0xbdf, &(0x7f0000000000)={0x0, 0x6d0a, 0x80, 0xfffffffd, 0x40000331, 0x0, r7}, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r7, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r8, 0x847ba, 0x2000, 0xe, 0x0, 0x0) getsockname$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) semtimedop(0x0, &(0x7f0000000200)=[{0x0, 0xffff, 0x2000}, {0x4, 0x3, 0x1800}], 0x2, 0x0) semop(0x0, &(0x7f0000000180)=[{0x4, 0xa7dd, 0x3000}], 0x1) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000050a20000000000a01010000000000000000050000000900010073797a30000000005c000000030a010300004887608d0000050000000900010073797a30000000000900030073797a300000000008000a4000000003280004800800024000000012080001400000000014000300776c616e30000000000000000000000014000000110001"], 0xa4}, 0x1, 0x1000000}, 0x0) semctl$GETZCNT(0x0, 0x4, 0xf, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newlink={0x118, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r11, 0xb}, [@IFLA_AF_SPEC={0xf8, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @local}]}, @AF_INET={0x30, 0x2, 0x0, 0x1, {0x2c, 0x1, 0x0, 0x1, [{0x8}, {0x8, 0x16}, {0x8}, {0x8}, {0x8}]}}, @AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}, @AF_INET={0x28, 0x2, 0x0, 0x1, {0x24, 0x1, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}}, @AF_MPLS={0x4}, @AF_INET6={0x74, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @ipv4={'\x00', '\xff\xff', @multicast1}}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00'}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_ADDR_GEN_MODE={0x5}]}, @AF_MPLS={0x4}]}]}, 0x118}}, 0x0) 2.651353487s ago: executing program 3 (id=1768): socket$nl_route(0x10, 0x3, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x3000)=nil, 0x930, 0x6000002, 0x4018831, 0xffffffffffffffff, 0x0) userfaultfd(0x80801) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000680)=""/81, 0x51}, {&(0x7f0000000540)=""/83, 0x53}], 0x2}, 0x0) keyctl$KEYCTL_MOVE(0x1e, 0x0, 0x0, 0x0, 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, 0xffffffffffffffff, 0x0) 2.219838768s ago: executing program 3 (id=1769): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000500)=@ready={0x0, 0x0, 0x8, "72918f72", {0x1, 0x1, 0x1000, 0x2, 0x5}}) mbind(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, &(0x7f0000000100)=0x8, 0x9, 0x6) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000023c0)=ANY=[@ANYBLOB="380000000200000002000000752f02801400018018000100f000000186ff0200e00000010c000280050001000000000000ffff0000000000c8a1c341140f3668917cb5f662b0f47cfad32d6b8f9bdf84fe842a66620de663533d98dd472708e3141fb8f0260432611ae47cf93b73c47ce68b1795bd0bf01ddd6d1a3d4f0367cf0298700d1c600491ea61201e20f7912024f53a67c10e5c11442e76506457901cd68f73180f5ca00fdb011c3693044d0b832c41e3bb"], 0x38}}, 0x0) r2 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000080)={0x8, 0x2, 0x2}, 0x10) write(r2, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) r3 = syz_open_dev$sndpcmc(&(0x7f0000002480), 0x9, 0xc080) read$snddsp(r3, &(0x7f00000024c0)=""/120, 0x78) recvmmsg(r2, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@loopback, @in6=@local, 0x4e23, 0xfffc, 0x4e23, 0x3, 0xa, 0x80, 0x30}, {0x100000000, 0x2, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff, 0x6, 0x8, 0x800000000001}, {0x9, 0xfffffffffffffffe, 0x0, 0x81}, 0xd6, 0x0, 0x1, 0x0, 0x0, 0x1}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x210000, 0x33}, 0x0, @in6=@private2={0xfc, 0x2, '\x00', 0x3}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x400, 0xfffffffb}}, 0xe8) r4 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ipv6_route\x00') r5 = socket(0x2, 0x80805, 0x0) close(r5) sendmsg$IPSET_CMD_LIST(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x14, 0x7, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_DYING(r5, &(0x7f0000002380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x1, 0x0, 0x6}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4008000) read$FUSE(r4, &(0x7f0000000240)={0x2020, 0x0, 0x0, 0x0}, 0x2020) pread64(r4, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x2e, &(0x7f00000001c0)=0xfffffffffffffffe, 0x4) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002280)={{{@in=@broadcast, @in=@multicast2, 0x4e24, 0x2, 0x4e20, 0x3, 0xa, 0x20, 0xa0, 0x1, 0x0, r6}, {0x100, 0xedd, 0x4, 0xe7, 0x5, 0x8, 0xfffffffffffffffc, 0xffffffffffffffff}, {0x5, 0x6, 0x6765, 0x8}, 0x4, 0x0, 0x2, 0x1, 0x1, 0x1}, {{@in6=@remote, 0x4d2, 0xff}, 0xa, @in=@empty, 0x3501, 0x0, 0x0, 0x3, 0x7, 0x101, 0x31c}}, 0xe8) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x1f, &(0x7f0000000380)=ANY=[@ANYBLOB="0c00004e1560254722cb66187f3b68d00c08004e15"]) 1.977248728s ago: executing program 0 (id=1770): preadv(0xffffffffffffffff, 0x0, 0x0, 0xe9b4, 0x1002) r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x440000, 0x0) r1 = inotify_init1(0x0) r2 = inotify_add_watch(r1, &(0x7f0000000200)='.\x00', 0x10000a0) r3 = dup(r1) inotify_rm_watch(r3, r2) inotify_rm_watch(r0, r2) socketpair$unix(0x1, 0x3, 0x0, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000040000701feffffff00000000017c0000040042801c00018006002000800a0000100004002524298d275c232f262d2b00040002"], 0x38}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x6}]}, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r1, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000030000000000000000000000000000000200000000000000fdffffffffffffff000000000000000000000000000000000008000000000000060000000000000000000000000000d47e0ac4000000000001000200000000"], 0xb8}, 0x1, 0x0, 0x0, 0x24008040}, 0x8000) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) r8 = userfaultfd(0x80801) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) landlock_create_ruleset(&(0x7f0000000040)={0x6110, 0x3, 0x3}, 0x18, 0x3) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r9, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x1, 0x10}]}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) write$P9_RUNLINKAT(r7, &(0x7f0000000080)={0x7, 0x4d, 0x1}, 0x7) r10 = socket$kcm(0x2, 0x922000000001, 0x106) setsockopt$sock_attach_bpf(r10, 0x1, 0x46, 0x0, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000400)={@local, @random="df00004000", @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x11}, {[@ssrr={0x89, 0x7, 0xa2, [@broadcast]}, @cipso={0x86, 0x6, 0x1}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) 849.635657ms ago: executing program 0 (id=1771): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256\x00'}, 0x58) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 689.17155ms ago: executing program 0 (id=1772): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256\x00'}, 0x58) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r1, 0xffffffffffffffff, 0x0) (fail_nth: 1) 551.975364ms ago: executing program 0 (id=1773): bind$alg(0xffffffffffffffff, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256\x00'}, 0x58) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'sit0\x00'}) r2 = add_key(&(0x7f0000000100)='dns_resolver\x00', 0x0, &(0x7f00000001c0)='\x00\x00\x00\x00\x00\x00', 0x6, 0xfffffffffffffffb) sendmsg$nl_route(r1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="28000000680001000000000000000000020000000000000008000600f200000008000500", @ANYRESDEC=r2], 0x28}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, 0x140e, 0x400, 0x70bd28, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x5}, @RDMA_NLDEV_ATTR_RES_PDN={0x8}, @RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x4}, @RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x5}, @RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x806}, 0x48001) 473.684755ms ago: executing program 0 (id=1774): syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e010203010902"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async, rerun: 64) r3 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@ipv6_newrule={0x40, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfe, {0xa, 0x34, 0x0, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FRA_DST={0x14, 0x1, @mcast2}, @FIB_RULE_POLICY=@FRA_PROTOCOL={0x5, 0x15, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008081}, 0x0) (async) r4 = syz_open_dev$evdev(&(0x7f0000000100), 0xe, 0x10080) ioctl$EVIOCSFF(r4, 0x40304580, &(0x7f00000000c0)={0x54, 0x7, 0x9, {0x43, 0x3}, {0x4, 0xfff3}, @const={0x40, {0x100, 0x9, 0x6, 0x35bf}}}) (async) r5 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r5, &(0x7f00000032c0)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)="03", 0x1}], 0x1}], 0x1, 0x0) (async) sendmmsg$inet_sctp(r5, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000140)="3efd9d32", 0x4}], 0x1, &(0x7f0000000000)=[@sndrcv={0x30, 0x84, 0x1, {0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x101}}], 0x30, 0x4004011}], 0x1, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, 0x0}], 0x1, 0x2f, 0x0, 0x0) (async) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) (async) syz_open_dev$video(0x0, 0x80, 0x68c02) (async) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 32) socket$netlink(0x10, 0x3, 0xf) (rerun: 32) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) r8 = socket$key(0xf, 0x3, 0x2) (async, rerun: 32) capset(0x0, 0x0) (async, rerun: 32) r9 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r9, 0x1, 0x8, 0x0, 0x0) (async) sendmsg$key(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) (async, rerun: 64) sendmsg$key(r8, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) (rerun: 64) 128.788201ms ago: executing program 3 (id=1775): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000c40), 0x0, 0x8014) socket$kcm(0x29, 0x2, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x20008800) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140), 0x801, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f00000003c0)={0x48, 0x2, r0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000100)={0x28, 0x2, r0, 0x0, &(0x7f0000c00000/0x400000)=nil, 0x400000, 0x51e}) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) 0s ago: executing program 3 (id=1776): sendmmsg(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001480)=[{0x28, 0x104, 0xe87, "bc9bbf5b1b8529bfcddce84f30f0496a87e1d650bc"}, {0xb60, 0x10e, 0x19b2, "2b0363bbc6ee5203627c1e79e94077e1c216b6a3bc713932cbce5d4a14f99528f4232e904d18dc69a94a870a00d7cb30c9542f9c486511d080b35f1d7d70db55286ee4f371000aec939471e281edb712c61a04b02be3aaede54fe775ddd2d72f2d904feb2e591e4ed957d927210a23e309626dc88862d2a96bb6adda9721d8a1feff04c2d1c87db0570a876408e2659df8d6743582f0e5b47b2a94a0c01d4b787f123b7807f6246872be6ad75db1399eb0167f99f9f76362526ea5c43b1ecb53d466f687d7e1059596de0e93259e4bc0ea04cd48c74908d18b250230d9d8a645fe22fed3477e5a5a540441afb703e9fbae97fe01954c65f097b13207b2624a114e0705f0417c3b815123082d95b4055ad03193a7f341d5faf79ae78250642804da6866b5e605cf8981f65014273881869485dfd3e5170260356de4f7633f85bbae33aeaa31ab666976b75bd7cab21dedf552f823aa63c6a9e96275eb299217b600b69935555b5013a8f81a26fbe6ee4e87e2ee7cefbff06b484fd3a140222e890ccfcf9987e5ed2c9174ac73b36078152af16f125eae35c1694a62af42ca600db8392513a6a40c257975675c309b0591692a8a65c8682d75cd90ce4ab0a33537b047d4b8e704e2c6f6900233b032f9db223ffc1477959a8767b2e074d2543cd0cbd7b3ab249bbb4d22f1ab084c44daa7ad81c487c52c737b232e5157e8548e7e19aebbb6853426c66be63f09253118dbfec4c10eace9a1248cead68175965675c4215b7dd80c2c7c0edcae21bcbb323aff08ec038d4e3d93529f0c0db0e7949d0cbd45acafcd6632507fd86cd93a8f41d61359864bbcef8b5b51fb4864613d49f0590ebe11fd67292507dc5e2ca173daccb75956a78f8d1be205432e20900ee371b5733c94cb2999b5cf59d4780b52f8dd3b6c17ff99b56edff09129e48fb6a1830fe5e013689bc956da2de39cfadd2727bce950f75192f27560ea442e08ca3222b916b8bee7b607cda6b7f055d4863e9a1d0f5d1ab9ad4e7ca36a995489d4f7da2701cdddf546f292ee17e95737f234a63f0c369b09503677b6916c2698bc59bae8facc7de995e63a8d05ae0922f33e959948b5ade996783410ab7a27f184ec41f54b99f0b17f38039b7dfb1fc0574079916923c7e1deb8a1100c88fa6200305dfddb3482e7a99197944fc41199e342350abfdbf914befde383868ace244cde49db039a02873e41ae637e90fc6abb0e7a83000100e6f85fc30d8a2dc254a64e42336c405b77180e11331a6b67a217a26950895953962b5e079ac7bd14fdc6012b8ce59dc265022b263bc85bdc017dabf37b329044da12852bcbc65675b4b0ddddc1f23fab47653aeb8f86e62a1d56521510350578ae53fe56a148f813835d930e69b6974208e53fc228171efacd9efee9493a5f7c13b7af3cf49d59b4b745aa6dcb52b3daa82fc9acdf13c2082b292584444ec334ab5f627709d8b6513e5aa38669512fba90af8d0936435bad20cca72c3d0ac32f8a39e6eae310504f5c9122182c3d8ebf832f00a94d1959ccd409aeb22285a060f563ccc0e8ec37199f18fcf0f0c1450f1fda29e3238cacbbe6ff4ba20aeaaf84a3abcb2b84e4f42652df802fd601d90e2c63063b722f46e8f58fa5562e37f98e990a6bae1e40cb52fb402360aefd3826b9c97bdee006a0f8a43f9c158512315ab2f05d7c21832dbd194b6d04023a448dac03388c072af2f8e98e7d9437179ace396247402ebda7763900c708894dcad0a14808ceb075c103667b3bce7a81b531f876c5305452fcaeb06e210dcf2a4ec818dc0d8a69d73a5391df6c67571c49056d9aa429972341cad35e4bdf9afc0caaebb22c092ef92d8bd87df4c195c66ce968df2b3173cf98e48117a6cf2d0be7b8757ccbd401cc6787419037612462d9970fb9a7b73bba3ff2882dc397acee0389f6dc9e59c696f5590cdead9638a66f2ea6970f3a8f9eb39d40d34040eda3da6103dcae67a87f04b47d93581298fac9baece4051648fa29a8e926eca23163b9e1382ba2fffde25164353e752e208af64de5b6adff646bd4c444828978182014b899f39fc1fbb180977827c6f105033b2a850bc7451734ed469e37d1b001787311e748747a5b9925498edc691891e2a060fc0050a3966e89beca67a7c7b318441b34239c00f9b02efd2b5c629d405f6e28da9d07d950c04dee046ebd2e5996c8906aa88533b07d4d5f2025735c14a075bbfdea09ce52260db0e96b8b5e772d0875cfa7a1544892ca65828001f0098d88fa6f24b9bf725b801fccebfe03b4d83d81c6d96686cafdc36a1caeb208e57023aee95853a7327ce733b3af6417e8686000de33a1467dea4bd369e8ff7e4bb1d2659be9c69278f9cf60459fab854f27ba4ce9ed8e532fa2c6fdb297d80e28d1c3af4504eb8aeb35fbf17d322e66ef659915280e9ad08b1127bac48f249363c8a4b864641e23a6efd7d376f9569cf3de12688e8b4739745d1de2d5438d00e7fa070c1c52f692bb26ec2089b13d1815c9085a2a78de31a936662efe677d2dd9e472f60b91a0bd84266d4749996164d884ec1a2c122a0f0342b8377d8102f446f46501f3b2e8b3f157f4875fe82dfca9de71170406b9b943132a732c243906df2d5e00eb94d7f6a644407bd4a48ed01b5755a0d67dae2397adaf12ff39525520feddaa1c6b02fda90cc897c9688d4d05f11b0e61166282a15f08bfb1a871fadd5551c8df0964141615cecdeb10b72d89326947e266bec85ee08110f17d01d0e828beca0691a4ca0e6f944e2b762e85fd2b5bb98be35eb121e08e08cf2bc9670c5f933fad3748296e3fae678e04d012373d2aa89412cbc7a3aba45566cf0bef97bd99ff4d93a28f339e060608c2e6bf63a1dc3f37be51f4750c8b225effdf5da20b17ee10d777439c7dfbabb087e0964dee9d0be9aa539c6f04bee66e0f8b676813af7226f3584144f089576e4e32036cb9054c4a672d444d16a18263c900bfdf4a3f6d1754a94f28cdd1f5dbd4ebed1e244892248894d1a6d5426cd73642ce2f8980303ede56fee4e59cb380bc68acece88e4852a19eb37af76be8bd3dc4a1ed7aad18f96ae4b4a9ae10f12b3c06e828e6ca2070815eada7e07b514dec01c1ba122dd96c9b263123dfff4efcf081b6a925aa85a36c176fc8d1dab0fcdd7e14f520da4412de8a902e091442b73442b1cf6d5f72724e7ec613ba1318508e831bc30aa3c5915ba444c0720ceaf512545a16510983ecdbe6d231fa9bb89ee1d00e902750214323493d2971fd08558d65cfc23c203ffcaba70354c338c03ad41b435ef2a6017008cefa8b47d734dfc5ac7e457a7b3dfe6d2dcd9e62d35f9afc4e1afe73c6219f40f9e86a39362b33a0e11689e7a469e6f68552868efbd05d5801c4d2911b5424c54619f7131c8c05399b1a521ca4ad4368ed59419d1c193583b0aea052ea81fb3b558f0b6f7ecad0eb3a6e805e91b11fb22328c7d3213d156443e51686e6b5b5487705f2e85b4ff6dbbd1c1910b203561bbebeded3f1fe874f46a1b487d0c6f0a66ac07b9068a319892b8306102f3b5b75612bf036c9c5ea292e1f0721363e7cd76294dce287fe2908bc0d4e2d52852c502303244182fd68f7e33c83d51b101491a5f441c649c72fcd66cd39ece1db04a1d46a1eb779cd341ef5722e567ccd7745d41642032bc6c40ae65280899a3b143ccf71a5309c3e03eab4433bdf79c8d0a0fd616ba568db2180bbb1bbdbb2fee0f1346ff5f65b952a13fd8421a0d5b5415e3922d08239ac573dee4fb36f9c04ff7862b51db5f98b9b90a1042d018ecba19ba9324acaf48b6767871d67a69e34e8287fa3a5adf1e194d1aa19b9c0cca905c9024bf699c9fc110151610a5f190b3e4a191dda3554338638a9eca69940f1e2ad1aa2a37a8672baf0fb328a43d023688f59e5b7e77826e0de2b19feb32928a53f2a0ada0128f402f0125605d142a6bfda840a745734d5eb2ac9761f7b06be20538247e2238f7fede9ad8c622e5bbe7d2b006dc61c7745a5ade15cee1431f3ba8f32027432fa310176d0c5df8ec8ef1bf50ce8d0551c7c5548"}], 0xb88}}], 0x1, 0x20000000) r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r1, 0xc01064c8, &(0x7f00000002c0)={0x1, 0x0, &(0x7f0000000280)=[0x0]}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r1, 0xc04064aa, &(0x7f00000003c0)={0x0, 0x0, r2}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r0, 0xc0385720, &(0x7f0000000200)) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x121605) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000200)="bf180ffdbd9a3f4229832212a6d9dd3034fdaf36550f0d9a99f6d8fa", 0x1c}], 0x1) r4 = socket$can_raw(0x1d, 0x3, 0x1) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_RMFB(r5, 0xc00464af, &(0x7f0000000080)) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_raw(r4, &(0x7f0000000000), 0x10) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x4581, 0x0) ioctl$PPPIOCSFLAGS1(r7, 0x40047459, &(0x7f0000000180)) read(r4, &(0x7f00000027c0)=""/4095, 0xfff) r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="00220f0000000b2e2b5aa40b"], 0x0}, 0x0) r9 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCSFLAG(r9, 0x4004480f, &(0x7f0000000040)=0x2) ioctl$SG_BLKTRACETEARDOWN(r9, 0x1276, 0x0) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r10, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x1000}, 0x4) setsockopt$packet_tx_ring(r10, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f00000002c0)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f0000000380)=0xc) syz_open_procfs(r11, &(0x7f00000003c0)='stack\x00') setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f0000000340)=0x1, 0x4) sendmsg$can_raw(r4, &(0x7f0000000240)={&(0x7f0000000780)={0x1d, r6}, 0x10, &(0x7f0000000200)={&(0x7f0000000140)=@can={{0x3, 0x0, 0x1, 0x1}, 0x0, 0x0, 0x0, 0x0, "e5631d6f20af6daa"}, 0x10}}, 0x0) kernel console output (not intermixed with test programs): ID (merge) [ 361.353788][T10665] vhci_hcd vhci_hcd.0: pdev(0) rhport(4) sockfd(18) [ 361.360393][T10665] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 361.412593][T10665] vhci_hcd vhci_hcd.0: Device attached [ 361.509103][T10651] vhci_hcd vhci_hcd.0: pdev(0) rhport(5) sockfd(14) [ 361.515749][T10651] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 361.581153][ T7629] usb 5-1: USB disconnect, device number 68 [ 361.609802][T10651] vhci_hcd vhci_hcd.0: Device attached [ 361.791493][T10657] vhci_hcd: connection closed [ 361.791738][T10653] vhci_hcd: connection reset by peer [ 361.791760][ T13] vhci_hcd: stop threads [ 361.796683][T10675] vhci_hcd: connection closed [ 361.803540][ T13] vhci_hcd: release socket [ 361.818828][T10677] vhci_hcd: connection closed [ 361.819350][T10668] vhci_hcd: connection closed [ 361.824109][T10672] vhci_hcd: connection closed [ 361.836029][ T13] vhci_hcd: disconnect device [ 361.847584][ T13] vhci_hcd: stop threads [ 361.851933][ T13] vhci_hcd: release socket [ 361.858190][ T13] vhci_hcd: disconnect device [ 361.864235][ T13] vhci_hcd: stop threads [ 361.870680][ T13] vhci_hcd: release socket [ 361.875192][ T13] vhci_hcd: disconnect device [ 361.880393][ T13] vhci_hcd: stop threads [ 361.884706][ T13] vhci_hcd: release socket [ 361.897062][T10685] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1348'. [ 361.908908][ T13] vhci_hcd: disconnect device [ 361.931205][ T13] vhci_hcd: stop threads [ 361.959425][ T13] vhci_hcd: release socket [ 361.990286][ T13] vhci_hcd: disconnect device [ 362.016655][ T13] vhci_hcd: stop threads [ 362.021117][ T13] vhci_hcd: release socket [ 362.037511][ T13] vhci_hcd: disconnect device [ 362.101807][T10687] geneve2: entered promiscuous mode [ 362.115442][T10687] geneve2: entered allmulticast mode [ 362.132394][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.147594][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.201156][T10689] bond1: option ad_user_port_key: mode dependency failed, not supported in mode active-backup(1) [ 362.280640][T10689] bond1 (unregistering): Released all slaves [ 362.417180][ T8608] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.456485][ T8608] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.717145][T10707] loop5: detected capacity change from 0 to 7 [ 362.726754][ T5983] Dev loop5: unable to read RDB block 7 [ 362.734826][ T5983] loop5: unable to read partition table [ 362.741366][ T5983] loop5: partition table beyond EOD, truncated [ 362.758808][T10707] Dev loop5: unable to read RDB block 7 [ 362.772582][T10707] loop5: unable to read partition table [ 362.798335][T10707] loop5: partition table beyond EOD, truncated [ 362.822493][T10707] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 362.988278][T10712] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1358'. [ 363.151989][T10716] ipvlan2: entered promiscuous mode [ 363.180037][T10716] bridge0: port 1(ipvlan2) entered blocking state [ 363.215638][T10716] bridge0: port 1(ipvlan2) entered disabled state [ 363.228674][T10716] ipvlan2: entered allmulticast mode [ 363.236024][T10716] bridge0: entered allmulticast mode [ 363.251884][T10716] ipvlan2: left allmulticast mode [ 363.272861][T10716] bridge0: left allmulticast mode [ 363.659848][T10736] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 363.675455][ T5973] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 363.845642][ T5973] usb 1-1: Using ep0 maxpacket: 8 [ 363.863525][ T5973] usb 1-1: config 0 has an invalid interface number: 186 but max is 0 [ 363.886941][ T5973] usb 1-1: config 0 has no interface number 0 [ 363.902739][ T5973] usb 1-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 363.917024][ T5973] usb 1-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 363.928434][ T6009] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 363.939776][ T5973] usb 1-1: New USB device found, idVendor=07c0, idProduct=1500, bcdDevice=b8.c5 [ 363.949524][ T5973] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.967875][ T5973] usb 1-1: Product: syz [ 363.978906][ T5973] usb 1-1: Manufacturer: syz [ 363.999934][ T5973] usb 1-1: SerialNumber: syz [ 364.040089][ T5973] usb 1-1: config 0 descriptor?? [ 364.105525][ T6009] usb 4-1: Using ep0 maxpacket: 8 [ 364.117244][ T6009] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 364.146156][ T6009] usb 4-1: config 0 has no interface number 0 [ 364.179790][ T6009] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 364.205546][ T6009] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.213686][ T6009] usb 4-1: Product: syz [ 364.223805][ T6009] usb 4-1: Manufacturer: syz [ 364.229102][ T6009] usb 4-1: SerialNumber: syz [ 364.252472][ T6009] usb 4-1: config 0 descriptor?? [ 364.256024][ T5973] iowarrior 1-1:0.186: IOWarrior product=0x1500, serial=42424242 interface=186 now attached to iowarrior0 [ 364.464706][ T6009] uvcvideo 4-1:0.31: probe with driver uvcvideo failed with error -22 [ 364.535591][ T7629] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 364.673175][ T5926] usb 4-1: USB disconnect, device number 55 [ 364.695662][ T7629] usb 3-1: device descriptor read/64, error -71 [ 364.765654][ T5973] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 364.900701][ T5836] usb 1-1: USB disconnect, device number 67 [ 364.945570][ T7629] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 364.955214][ T5973] usb 5-1: Using ep0 maxpacket: 8 [ 364.990291][ T5973] usb 5-1: unable to get BOS descriptor or descriptor too short [ 365.064637][ T5973] usb 5-1: config 7 has an invalid interface number: 142 but max is 0 [ 365.092400][ T5973] usb 5-1: config 7 has no interface number 0 [ 365.109795][ T5973] usb 5-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice=dd.6d [ 365.115521][ T7629] usb 3-1: device descriptor read/64, error -71 [ 365.119133][ T5973] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 365.170635][ T5973] usb 5-1: Product: syz [ 365.217277][ T5973] usb 5-1: Manufacturer: syz [ 365.225562][ T5973] usb 5-1: SerialNumber: syz [ 365.284060][ T7629] usb usb3-port1: attempt power cycle [ 365.441525][T10765] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 365.638863][T10752] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 365.648704][T10752] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 365.663409][ T7629] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 365.706738][ T7629] usb 3-1: device descriptor read/8, error -71 [ 365.965490][ T7629] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 365.996425][ T7629] usb 3-1: device descriptor read/8, error -71 [ 366.210703][ T799] vhci_hcd: vhci_device speed not set [ 366.211083][ T7629] usb usb3-port1: unable to enumerate USB device [ 368.630598][ T5973] usb 5-1: USB disconnect, device number 69 [ 369.062682][T10823] ======================================================= [ 369.062682][T10823] WARNING: The mand mount option has been deprecated and [ 369.062682][T10823] and is ignored by this kernel. Remove the mand [ 369.062682][T10823] option from the mount to silence this warning. [ 369.062682][T10823] ======================================================= [ 369.279257][ T986] usb 1-1: new full-speed USB device number 68 using dummy_hcd [ 369.435437][ T986] usb 1-1: device descriptor read/64, error -71 [ 369.485543][ T7629] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 369.485749][T10837] binder: 10834:10837 ioctl c018620c 200000000000 returned -22 [ 369.645551][ T7629] usb 5-1: Using ep0 maxpacket: 8 [ 369.652428][ T7629] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 369.664843][ T7629] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 369.677433][ T7629] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.688282][ T7629] usb 5-1: config 0 descriptor?? [ 369.695884][ T986] usb 1-1: new full-speed USB device number 69 using dummy_hcd [ 369.716391][ T5973] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 369.775472][ T799] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 369.835537][ T986] usb 1-1: device descriptor read/64, error -71 [ 369.865541][ T5973] usb 2-1: Using ep0 maxpacket: 32 [ 369.872270][ T5973] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 369.885328][ T5973] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 369.897785][ T5973] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 369.911924][ T799] usb 4-1: device descriptor read/64, error -71 [ 369.919076][ T5973] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 369.920046][ T7629] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 369.928332][ T5973] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.930843][ T5973] usb 2-1: config 0 descriptor?? [ 369.942552][ T7480] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 369.952574][ T986] usb usb1-port1: attempt power cycle [ 369.973351][T10836] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 369.983400][ T5973] hub 2-1:0.0: USB hub found [ 370.107275][ T7480] usb 3-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice=c9.98 [ 370.116750][ T7480] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.131058][ T7480] usb 3-1: config 0 descriptor?? [ 370.142689][ T7480] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 370.143892][ T5836] usb 5-1: USB disconnect, device number 70 [ 370.151558][ T7480] ftdi_sio ttyUSB0: unknown device type: 0xc998 [ 370.165690][ T799] usb 4-1: new full-speed USB device number 57 using dummy_hcd [ 370.259908][ T5973] hub 2-1:0.0: config failed, hub has too many ports! (err -19) [ 370.325494][ T799] usb 4-1: device descriptor read/64, error -71 [ 370.332133][ T986] usb 1-1: new full-speed USB device number 70 using dummy_hcd [ 370.348642][ T7480] usb 3-1: USB disconnect, device number 87 [ 370.356314][ T986] usb 1-1: device descriptor read/8, error -71 [ 370.363998][ T7480] ftdi_sio 3-1:0.0: device disconnected [ 370.435753][ T799] usb usb4-port1: attempt power cycle [ 370.528325][ T5973] usbhid 2-1:0.0: can't add hid device: -71 [ 370.534389][ T5973] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 370.567512][ T5973] usb 2-1: USB disconnect, device number 80 [ 370.595562][ T986] usb 1-1: new full-speed USB device number 71 using dummy_hcd [ 370.617450][ T986] usb 1-1: device descriptor read/8, error -71 [ 370.726060][ T986] usb usb1-port1: unable to enumerate USB device [ 370.785455][ T799] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 370.806256][ T799] usb 4-1: device descriptor read/8, error -71 [ 370.978510][T10848] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1396'. [ 371.011786][T10847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 371.020157][T10847] 8021q: adding VLAN 0 to HW filter on device team0 [ 371.032212][T10847] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 371.055568][ T799] usb 4-1: new full-speed USB device number 59 using dummy_hcd [ 371.057910][ T7629] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 371.167446][ T799] usb 4-1: device descriptor read/8, error -71 [ 371.176985][T10848] syz_tun (unregistering): left promiscuous mode [ 371.285495][ T7629] usb 5-1: Using ep0 maxpacket: 8 [ 371.295767][ T799] usb usb4-port1: unable to enumerate USB device [ 371.311372][ T7629] usb 5-1: unable to get BOS descriptor or descriptor too short [ 371.330290][ T7629] usb 5-1: config 7 has an invalid interface number: 142 but max is 0 [ 371.339319][ T7629] usb 5-1: config 7 has no interface number 0 [ 371.353416][ T7629] usb 5-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice=dd.6d [ 371.363407][ T7629] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.371837][ T7629] usb 5-1: Product: syz [ 371.376521][ T7629] usb 5-1: Manufacturer: syz [ 371.381211][ T7629] usb 5-1: SerialNumber: syz [ 371.441880][T10853] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 371.664621][T10845] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 371.677058][T10845] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 371.815453][ T5973] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 371.998013][ T5973] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 372.009393][ T5973] usb 3-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 372.021420][ T5973] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.040352][ T5973] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 372.600840][T10877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 372.621100][T10877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 372.643560][T10878] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 372.671709][T10877] pim6reg: left allmulticast mode [ 373.098857][ T5973] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -71 [ 373.121387][ T5973] stv0680 3-1:4.0: STV(e): camera ping failed!! [ 373.131352][ T5973] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 373.332289][ T5973] stv0680 3-1:4.0: last error: 0, command = 0x0 [ 373.352293][ T5973] usb 3-1: USB disconnect, device number 88 [ 373.561907][T10888] Cannot find map_set index 65532 as target [ 373.765922][ T7629] usb 5-1: USB disconnect, device number 71 [ 374.147728][T10911] netlink: 'syz.3.1415': attribute type 21 has an invalid length. [ 374.177532][T10911] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1415'. [ 374.223532][T10911] tipc: Enabling of bearer rejected, failed to enable media [ 374.505501][ T7480] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 374.658280][ T7480] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 374.661054][T10931] Cannot find map_set index 65532 as target [ 374.673031][ T7480] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 374.823738][ T7480] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 374.835920][ T7480] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 374.859645][T10914] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 374.898683][ T7480] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 375.288032][T10939] bridge1: entered promiscuous mode [ 375.305450][ T7629] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 375.324480][T10914] trusted_key: encrypted_key: insufficient parameters specified [ 375.366562][ T5973] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 375.425496][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 375.493466][ T7629] usb 1-1: New USB device found, idVendor=08fd, idProduct=0002, bcdDevice=ca.fd [ 375.525485][ T5973] usb 2-1: Using ep0 maxpacket: 8 [ 375.547491][ T7629] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.556474][ T986] usb 5-1: USB disconnect, device number 72 [ 375.592373][ T5973] usb 2-1: unable to get BOS descriptor or descriptor too short [ 375.605449][ T5973] usb 2-1: config 7 has an invalid interface number: 142 but max is 0 [ 375.615135][ T5973] usb 2-1: config 7 has no interface number 0 [ 375.624091][ T7629] usb 1-1: Product: syz [ 375.652042][ T7629] usb 1-1: Manufacturer: syz [ 375.667641][ T7629] usb 1-1: SerialNumber: syz [ 375.694695][ T5973] usb 2-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice=dd.6d [ 375.708802][ T7629] usb 1-1: config 0 descriptor?? [ 375.738593][ T5973] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.766165][ T5842] Bluetooth: hci5: urb ffff88814cb0e300 submission failed (2) [ 375.775917][ T5973] usb 2-1: Product: syz [ 375.785992][ T5973] usb 2-1: Manufacturer: syz [ 375.790625][ T5973] usb 2-1: SerialNumber: syz [ 375.926180][ T7629] usb 4-1: new low-speed USB device number 60 using dummy_hcd [ 375.934397][ T5926] usb 1-1: USB disconnect, device number 72 [ 376.052312][T10937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 376.064051][T10937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 376.159661][ T7629] usb 4-1: config 36 has an invalid interface number: 65 but max is 0 [ 376.178657][ T7629] usb 4-1: config 36 has no interface number 0 [ 376.189346][ T7629] usb 4-1: config 36 interface 65 has no altsetting 0 [ 376.672335][T10960] loop5: detected capacity change from 0 to 7 [ 376.693953][T10960] Dev loop5: unable to read RDB block 7 [ 376.712348][T10960] loop5: unable to read partition table [ 376.726803][T10960] loop5: partition table beyond EOD, truncated [ 376.766102][T10960] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 376.875651][ T7480] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 376.941970][T10966] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1432'. [ 377.045462][ T7480] usb 1-1: Using ep0 maxpacket: 8 [ 377.072609][ T7480] usb 1-1: config 0 has an invalid interface number: 31 but max is 0 [ 377.089468][ T7480] usb 1-1: config 0 has no interface number 0 [ 377.130216][ T7480] usb 1-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 377.140818][ T7480] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.158525][ T7480] usb 1-1: Product: syz [ 377.168149][ T7480] usb 1-1: Manufacturer: syz [ 377.184821][ T7480] usb 1-1: SerialNumber: syz [ 377.219033][ T7480] usb 1-1: config 0 descriptor?? [ 377.527458][ T7480] uvcvideo 1-1:0.31: probe with driver uvcvideo failed with error -22 [ 377.552326][ T7480] usb 1-1: USB disconnect, device number 73 [ 378.012942][T10970] tipc: Enabling of bearer rejected, already enabled [ 378.501597][ T7629] usb 4-1: New USB device found, idVendor=0846, idProduct=1001, bcdDevice=26.de [ 378.520601][ T7629] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.533782][ T7629] usb 4-1: can't set config #36, error -71 [ 378.603601][T10988] xt_TCPMSS: Only works on TCP SYN packets [ 378.688601][ T5973] usb 2-1: USB disconnect, device number 81 [ 378.705106][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.725420][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.738358][ T7629] usb 4-1: USB disconnect, device number 60 [ 378.751331][T10984] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1437'. [ 379.240631][T11000] loop5: detected capacity change from 0 to 7 [ 379.269244][T11000] Dev loop5: unable to read RDB block 7 [ 379.330443][T11000] loop5: unable to read partition table [ 379.340700][T11000] loop5: partition table beyond EOD, truncated [ 379.392567][T11000] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 379.591977][T11007] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1445'. [ 379.613748][T11007] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1445'. [ 379.694561][T11007] bridge2: the hash_elasticity option has been deprecated and is always 16 [ 380.202322][T11034] Cannot find map_set index 65532 as target [ 380.276086][ T5973] usb 5-1: new full-speed USB device number 73 using dummy_hcd [ 380.309542][T11039] loop5: detected capacity change from 0 to 7 [ 380.338850][ T5983] Dev loop5: unable to read RDB block 7 [ 380.358084][ T5983] loop5: unable to read partition table [ 380.510196][ T5973] usb 5-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 380.520182][ T5983] loop5: partition table beyond EOD, truncated [ 380.529267][ T5973] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.539804][T11039] Dev loop5: unable to read RDB block 7 [ 380.553048][ T5973] usb 5-1: Product: syz [ 380.563039][T11039] loop5: unable to read partition table [ 380.568861][ T5973] usb 5-1: Manufacturer: syz [ 380.646347][ T5973] usb 5-1: SerialNumber: syz [ 380.659184][T11042] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1456'. [ 380.675588][T11039] loop5: partition table beyond EOD, truncated [ 380.689700][ T5973] usb 5-1: config 0 descriptor?? [ 380.715781][T11039] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 380.728662][ T5973] gspca_main: sq930x-2.14.0 probing 2770:930c [ 380.985558][ T5926] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 381.115446][ T5926] usb 1-1: device descriptor read/64, error -71 [ 381.368357][ T5926] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 381.515911][ T5926] usb 1-1: device descriptor read/64, error -71 [ 381.638731][ T5926] usb usb1-port1: attempt power cycle [ 381.985692][ T5926] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 382.017480][ T5926] usb 1-1: device descriptor read/8, error -71 [ 382.255465][ T5926] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 382.276325][ T5926] usb 1-1: device descriptor read/8, error -71 [ 382.388080][ T5926] usb usb1-port1: unable to enumerate USB device [ 382.658161][ T5926] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 382.795463][ T5926] usb 4-1: device descriptor read/64, error -71 [ 382.998372][ T7629] usb 5-1: USB disconnect, device number 73 [ 383.035462][ T5926] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 383.176850][ T5926] usb 4-1: device descriptor read/64, error -71 [ 383.286268][ T5926] usb usb4-port1: attempt power cycle [ 383.402785][T11083] loop5: detected capacity change from 0 to 7 [ 383.412306][T11083] Dev loop5: unable to read RDB block 7 [ 383.420073][T11083] loop5: unable to read partition table [ 383.426210][T11083] loop5: partition table beyond EOD, truncated [ 383.432385][T11083] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 383.625628][ T5926] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 383.646122][ T5926] usb 4-1: device descriptor read/8, error -71 [ 383.822473][T11092] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 383.885542][ T5926] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 383.926231][ T5926] usb 4-1: device descriptor read/8, error -71 [ 384.036494][ T5926] usb usb4-port1: unable to enumerate USB device [ 385.067471][T11117] loop5: detected capacity change from 0 to 7 [ 385.086667][ T5983] Dev loop5: unable to read RDB block 7 [ 385.092296][ T5983] loop5: unable to read partition table [ 385.115672][ T5983] loop5: partition table beyond EOD, truncated [ 385.129810][T11117] Dev loop5: unable to read RDB block 7 [ 385.145246][T11117] loop5: unable to read partition table [ 385.155479][ T5926] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 385.173579][T11117] loop5: partition table beyond EOD, truncated [ 385.188781][T11117] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 385.315434][ T5926] usb 1-1: Using ep0 maxpacket: 16 [ 385.324049][ T5926] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 385.356696][ T5926] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 385.373564][ T5926] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 385.408783][ T5926] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 385.439882][ T5926] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 385.483222][ T5926] usb 1-1: config 0 descriptor?? [ 385.636961][ T7629] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 385.644730][T11126] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1484'. [ 385.727166][T11134] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 385.742049][T11134] faux_driver vgem: [drm] Unknown color mode 13; guessing buffer size. [ 385.742222][T11132] syzkaller0: entered promiscuous mode [ 385.781202][T11132] syzkaller0: entered allmulticast mode [ 385.826058][ T7629] usb 5-1: Using ep0 maxpacket: 16 [ 385.833356][ T7629] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 385.848429][ T7629] usb 5-1: config 0 has no interface number 0 [ 385.871936][ T7629] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 385.878581][T11132] tipc: Enabled bearer , priority 0 [ 385.890811][ T7629] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 385.903459][ T7629] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 385.917842][ T7629] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 385.927197][ T7629] usb 5-1: Product: syz [ 385.931524][ T7629] usb 5-1: SerialNumber: syz [ 385.959579][ T7629] usb 5-1: config 0 descriptor?? [ 385.972505][T11131] tipc: Resetting bearer [ 385.983849][ T7629] cm109 5-1:0.8: invalid payload size 0, expected 4 [ 386.018715][ T7629] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input51 [ 386.046790][T11131] tipc: Disabling bearer [ 386.095684][ T6009] usb 3-1: new full-speed USB device number 89 using dummy_hcd [ 386.107812][ T5926] usbhid 1-1:0.0: can't add hid device: -71 [ 386.113845][ T5926] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 386.156328][ T5926] usb 1-1: USB disconnect, device number 78 [ 386.214830][T11121] loop4: detected capacity change from 0 to 2559 [ 386.238041][ T5983] buffer_io_error: 14 callbacks suppressed [ 386.238060][ T5983] Buffer I/O error on dev loop4, logical block 0, async page read [ 386.256008][ T6009] usb 3-1: config 0 has an invalid interface number: 113 but max is 0 [ 386.268814][ T6009] usb 3-1: config 0 has no interface number 0 [ 386.275502][ T6009] usb 3-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 386.289875][ T6009] usb 3-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 386.314770][T11142] Buffer I/O error on dev loop4, logical block 0, lost async page write [ 386.315459][ T6009] usb 3-1: config 0 interface 113 has no altsetting 0 [ 386.364507][T11144] fuse: Bad value for 'fd' [ 386.371133][ T6009] usb 3-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 386.392249][ T5983] Buffer I/O error on dev loop4, logical block 1, async page read [ 386.398008][ T6009] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.409293][ T6009] usb 3-1: Product: syz [ 386.413502][ T6009] usb 3-1: Manufacturer: syz [ 386.433193][ T6009] usb 3-1: SerialNumber: syz [ 386.435765][ T5983] Dev loop4: unable to read RDB block 8 [ 386.441311][ T6009] usb 3-1: config 0 descriptor?? [ 386.469106][ T5983] Buffer I/O error on dev loop4, logical block 3, async page read [ 386.471340][ C0] usb 3-1: NFC: Urb failure (status -71) [ 386.502931][ T5983] loop4: unable to read partition table [ 386.505149][ T6009] usb 3-1: NFC: Unable to get FW version [ 386.525238][ T6009] pn533_usb 3-1:0.113: probe with driver pn533_usb failed with error -90 [ 386.547788][T11121] Buffer I/O error on dev loop4, logical block 0, async page read [ 386.588948][T11121] Buffer I/O error on dev loop4, logical block 0, async page read [ 386.625717][T11121] Buffer I/O error on dev loop4, logical block 0, async page read [ 386.665813][T11121] Buffer I/O error on dev loop4, logical block 0, async page read [ 386.694768][T11121] Buffer I/O error on dev loop4, logical block 0, async page read [ 386.727419][T11121] Buffer I/O error on dev loop4, logical block 0, async page read [ 386.769592][T11121] ldm_validate_partition_table(): Disk read failed. [ 386.809022][T11121] Dev loop4: unable to read RDB block 0 [ 386.821946][T11155] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 386.843943][T11121] loop4: unable to read partition table [ 386.891736][T11121] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾¢·˜) failed (rc=-5) [ 386.985272][ C0] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 386.985455][ T5973] usb 5-1: USB disconnect, device number 74 [ 386.992581][ C0] cm109 5-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 387.087339][ T5973] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 387.105424][ T5926] usb 1-1: new full-speed USB device number 79 using dummy_hcd [ 387.277190][ T5926] usb 1-1: not running at top speed; connect to a high speed hub [ 387.299987][ T5926] usb 1-1: config 1 has an invalid interface number: 78 but max is 0 [ 387.310397][ T5926] usb 1-1: config 1 has no interface number 0 [ 387.325132][ T5926] usb 1-1: config 1 interface 78 has no altsetting 0 [ 387.338237][ T5926] usb 1-1: New USB device found, idVendor=11ba, idProduct=1001, bcdDevice=ec.57 [ 387.347993][ T5926] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.359921][ T5926] usb 1-1: Product: syz [ 387.364212][ T5926] usb 1-1: Manufacturer: ч [ 387.369043][ T5926] usb 1-1: SerialNumber: syz [ 387.617865][ T5926] pvrusb2: Hardware description: OnAir USB2 Hybrid USB tuner [ 387.647782][ T5926] usb 1-1: selecting invalid altsetting 0 [ 387.658595][ T2349] pvrusb2: Invalid write control endpoint [ 387.668618][ T5926] usb 1-1: USB disconnect, device number 79 [ 387.767280][ T2349] pvrusb2: Invalid write control endpoint [ 387.773236][ T2349] pvrusb2: Invalid write control endpoint [ 387.782280][ T2349] pvrusb2: Invalid write control endpoint [ 387.789745][ T2349] pvrusb2: Invalid write control endpoint [ 387.798764][ T2349] pvrusb2: Invalid write control endpoint [ 387.804642][ T2349] pvrusb2: Invalid write control endpoint [ 387.810834][ T2349] pvrusb2: Invalid write control endpoint [ 387.817665][ T2349] pvrusb2: Invalid write control endpoint [ 387.823587][ T2349] pvrusb2: Invalid write control endpoint [ 387.859494][ T2349] pvrusb2: Invalid write control endpoint [ 387.866103][ T2349] pvrusb2: Invalid write control endpoint [ 387.872538][ T2349] pvrusb2: Invalid write control endpoint [ 387.878483][ T2349] pvrusb2: Invalid write control endpoint [ 387.885568][ T2349] pvrusb2: Invalid write control endpoint [ 387.954997][ T2349] pvrusb2: Invalid write control endpoint [ 387.985291][ T2349] pvrusb2: Invalid write control endpoint [ 388.017626][ T2349] pvrusb2: Invalid write control endpoint [ 388.023446][ T2349] pvrusb2: Invalid write control endpoint [ 388.039135][ T2349] pvrusb2: Invalid write control endpoint [ 388.055165][ T2349] pvrusb2: Invalid write control endpoint [ 388.074198][ T2349] pvrusb2: Invalid write control endpoint [ 388.089455][ T2349] pvrusb2: Invalid write control endpoint [ 388.097843][ T5973] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 388.160834][ T2349] pvrusb2: Invalid write control endpoint [ 388.167458][ T2349] pvrusb2: Invalid write control endpoint [ 388.173499][ T2349] pvrusb2: Invalid write control endpoint [ 388.179332][ T2349] pvrusb2: Invalid write control endpoint [ 388.185307][ T2349] pvrusb2: Invalid write control endpoint [ 388.205102][ T2349] pvrusb2: Invalid write control endpoint [ 388.211595][ T2349] pvrusb2: Invalid write control endpoint [ 388.234367][ T2349] pvrusb2: Invalid write control endpoint [ 388.246073][ T2349] pvrusb2: Invalid write control endpoint [ 388.251848][ T2349] pvrusb2: Invalid write control endpoint [ 388.255635][ T5973] usb 4-1: Using ep0 maxpacket: 8 [ 388.290523][ T2349] pvrusb2: Module ID 3 (saa7115) for device OnAir USB2 Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 388.316231][ T5973] usb 4-1: config 127 has an invalid interface number: 171 but max is 1 [ 388.321555][T11175] syzkaller0: entered promiscuous mode [ 388.324665][ T5973] usb 4-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 388.330443][T11175] syzkaller0: entered allmulticast mode [ 388.405825][ T5973] usb 4-1: config 127 has no interface number 1 [ 388.420171][T11175] tipc: Enabled bearer , priority 0 [ 388.430100][ T5973] usb 4-1: config 127 interface 171 has no altsetting 0 [ 388.456771][ T5973] usb 4-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 388.477958][T11174] tipc: Resetting bearer [ 388.503492][ T5973] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 388.518053][ T5973] usb 4-1: Product: syz [ 388.529132][ T5973] usb 4-1: Manufacturer: syz [ 388.537582][ T5973] usb 4-1: SerialNumber: syz [ 388.589849][ T2349] cs53l32a 1-0011: chip found @ 0x22 (pvrusb2_b) [ 388.598793][ T2349] pvrusb2: Invalid write control endpoint [ 388.617933][ T2349] pvrusb2: Invalid write control endpoint [ 388.632584][T11174] tipc: Disabling bearer [ 388.639745][ T2349] pvrusb2: Invalid write control endpoint [ 388.677869][ T2349] pvrusb2: Invalid write control endpoint [ 388.698020][ T2349] pvrusb2: Invalid write control endpoint [ 388.722205][ T2349] pvrusb2: Invalid write control endpoint [ 388.757871][ T6009] usb 3-1: USB disconnect, device number 89 [ 388.771876][ T2349] pvrusb2: Invalid write control endpoint [ 388.799740][ T2349] pvrusb2: Invalid write control endpoint [ 388.835434][ T2349] pvrusb2: Invalid write control endpoint [ 388.858220][ T2349] pvrusb2: Invalid write control endpoint [ 388.928473][ T2349] pvrusb2: Invalid write control endpoint [ 388.938116][ T2349] pvrusb2: Invalid write control endpoint [ 388.944119][ T2349] pvrusb2: Invalid write control endpoint [ 388.973547][ T2349] pvrusb2: Invalid write control endpoint [ 388.991345][ T2349] pvrusb2: Invalid write control endpoint [ 389.009763][ T2349] pvrusb2: Invalid write control endpoint [ 389.029118][ T2349] pvrusb2: Invalid write control endpoint [ 389.039804][ T2349] pvrusb2: Invalid write control endpoint [ 389.046126][ T2349] pvrusb2: Invalid write control endpoint [ 389.056504][ T2349] pvrusb2: Invalid write control endpoint [ 389.062561][ T2349] pvrusb2: Invalid write control endpoint [ 389.071125][ T2349] pvrusb2: Attached sub-driver cs53l32a [ 389.219189][ T2349] pvrusb2: Invalid write control endpoint [ 389.233686][ T2349] pvrusb2: Invalid write control endpoint [ 389.240127][ T2349] pvrusb2: Invalid write control endpoint [ 389.248863][ T2349] pvrusb2: Invalid write control endpoint [ 389.254980][ T2349] pvrusb2: Module ID 4 (tuner) for device OnAir USB2 Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 389.274651][ T799] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 389.321416][ T2349] pvrusb2: Device being rendered inoperable [ 389.333577][ T2349] pvrusb2: ***WARNING*** pvrusb2 driver initialization failed due to the failure of one or more sub-device kernel modules. [ 389.435449][ T799] usb 2-1: Using ep0 maxpacket: 8 [ 389.442869][ T799] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 389.452371][ T799] usb 2-1: config 0 has no interface number 0 [ 389.487988][ T2349] pvrusb2: You need to resolve the failing condition before this driver can function. There should be some earlier messages giving more information about the problem. [ 389.510802][ T799] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 389.531609][ T799] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 389.580590][ T799] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 389.871899][ T799] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 389.923672][ T799] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 389.952738][ T799] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.989261][ T799] usb 2-1: config 0 descriptor?? [ 390.042227][ T799] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 390.185669][ T5926] usb 1-1: new full-speed USB device number 80 using dummy_hcd [ 390.348570][ T5926] usb 1-1: config 7 has an invalid interface number: 101 but max is 0 [ 390.352201][T11204] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.362418][ T5926] usb 1-1: config 7 has no interface number 0 [ 390.380672][ T5926] usb 1-1: New USB device found, idVendor=0fd9, idProduct=002c, bcdDevice= 6.6b [ 390.390009][ T5926] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.417087][ T5926] usb 1-1: Product: syz [ 390.421345][ T5926] usb 1-1: Manufacturer: syz [ 390.426760][T11204] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.445592][ T5926] usb 1-1: SerialNumber: syz [ 391.126944][T11210] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 391.253200][ T5973] xr_serial 4-1:127.171: xr_serial converter detected [ 391.309004][ T5973] xr_serial ttyUSB0: Failed to set reg 0x1a: -71 [ 391.322343][ T5973] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 391.366029][ T5973] usb 4-1: USB disconnect, device number 65 [ 391.373036][ T5926] as10x_usb: device has been detected [ 391.396205][ T5926] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT Deluxe) [ 391.405940][ T5973] xr_serial 4-1:127.171: device disconnected [ 391.471819][ T5926] usb 1-1: DVB: registering adapter 1 frontend 0 (Elgato EyeTV DTT Deluxe)... [ 391.499000][ T5926] as10x_usb: error during firmware upload part1 [ 391.509263][ T5926] Registered device Elgato EyeTV DTT Deluxe [ 391.559111][T11197] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1501'. [ 391.587832][ T5926] usb 1-1: USB disconnect, device number 80 [ 391.661529][ T5926] Unregistered device Elgato EyeTV DTT Deluxe [ 391.694300][ T5926] as10x_usb: device has been disconnected [ 392.069786][ T5926] usb 2-1: USB disconnect, device number 82 [ 392.086581][ T5926] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 392.162162][T11223] syzkaller0: entered promiscuous mode [ 392.170338][T11223] syzkaller0: entered allmulticast mode [ 392.206808][T11226] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1508'. [ 392.272369][T11223] tipc: Enabled bearer , priority 0 [ 392.385758][T11222] tipc: Resetting bearer [ 392.457882][T11222] tipc: Disabling bearer [ 392.639186][T11220] pim6reg: entered allmulticast mode [ 392.645636][T11220] pim6reg: left allmulticast mode [ 392.805441][ T7629] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 392.975493][ T7629] usb 5-1: Using ep0 maxpacket: 32 [ 392.985328][ T7629] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 393.129830][ T7629] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 393.159247][ T7629] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 393.181787][ T7629] usb 5-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 393.202869][ T7629] usb 5-1: Product: syz [ 393.212541][ T7629] usb 5-1: Manufacturer: syz [ 393.244560][ T7629] hub 5-1:4.0: USB hub found [ 393.335699][ T8612] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 393.445081][ T7629] hub 5-1:4.0: 5 ports detected [ 393.465825][ T7629] hub 5-1:4.0: insufficient power available to use all downstream ports [ 393.653120][T11239] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 393.664284][T11239] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 393.677038][ T7629] hub 5-1:4.0: hub_hub_status failed (err = -71) [ 393.685687][ T5926] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 393.685705][ T7629] hub 5-1:4.0: config failed, can't get hub status (err -71) [ 393.709639][ T7629] usb 5-1: USB disconnect, device number 75 [ 394.006447][ T5926] usb 4-1: too many configurations: 33, using maximum allowed: 8 [ 394.027797][ T5926] usb 4-1: New USB device found, idVendor=0eb1, idProduct=6668, bcdDevice=57.b8 [ 394.037523][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 394.062827][ T5926] usb 4-1: Product: syz [ 394.069508][ T5926] usb 4-1: Manufacturer: syz [ 394.075428][ T5926] usb 4-1: SerialNumber: syz [ 394.081804][ T5926] usb 4-1: config 0 descriptor?? [ 394.096278][ T5926] go7007-loader 4-1:0.0: can't handle multiple config [ 394.103775][ T5926] go7007-loader 4-1:0.0: probe failed [ 394.613244][T11273] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 394.850098][T11284] tipc: Enabling of bearer rejected, already enabled [ 394.944443][ T5926] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 394.982815][T11288] loop5: detected capacity change from 0 to 7 [ 394.997977][ T5983] Dev loop5: unable to read RDB block 7 [ 395.003821][ T5983] loop5: unable to read partition table [ 395.014204][ T5983] loop5: partition table beyond EOD, truncated [ 395.038829][ T799] usb 4-1: USB disconnect, device number 66 [ 395.068571][T11288] Dev loop5: unable to read RDB block 7 [ 395.100004][T11288] loop5: unable to read partition table [ 395.108676][T11288] loop5: partition table beyond EOD, truncated [ 395.124369][T11288] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 395.134169][ T5926] usb 5-1: Using ep0 maxpacket: 32 [ 395.148951][ T5926] usb 5-1: config 0 has an invalid interface number: 126 but max is 0 [ 395.157760][ T5926] usb 5-1: config 0 has no interface number 0 [ 395.163882][ T5926] usb 5-1: config 0 interface 126 altsetting 16 bulk endpoint 0x6 has invalid maxpacket 1023 [ 395.176602][ T5926] usb 5-1: config 0 interface 126 altsetting 16 bulk endpoint 0x82 has invalid maxpacket 8 [ 395.215485][ T7629] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 395.235500][ T5926] usb 5-1: config 0 interface 126 has no altsetting 0 [ 395.288279][ T5926] usb 5-1: New USB device found, idVendor=09c4, idProduct=0011, bcdDevice=b0.1c [ 395.315434][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.325496][ T5926] usb 5-1: Product: syz [ 395.343630][ T5926] usb 5-1: Manufacturer: syz [ 395.355946][ T5926] usb 5-1: SerialNumber: syz [ 395.385285][ T5926] usb 5-1: config 0 descriptor?? [ 395.406208][T11277] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 395.414464][T11277] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 395.445492][ T7629] usb 3-1: Using ep0 maxpacket: 16 [ 395.459506][ T7629] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 395.493731][ T7629] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 395.524002][ T7629] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 395.555479][ T7629] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 395.564597][ T7629] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 395.588147][ T7629] usb 3-1: config 0 descriptor?? [ 395.814377][T11287] netlink: 280 bytes leftover after parsing attributes in process `syz.2.1526'. [ 395.824944][T11287] netlink: 280 bytes leftover after parsing attributes in process `syz.2.1526'. [ 395.851003][ T5926] ir_usb 5-1:0.126: IR Dongle converter detected [ 395.867673][T11301] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 396.055189][ T5926] usb 5-1: IR Dongle converter now attached to ttyUSB0 [ 396.259165][ T10] usb 5-1: USB disconnect, device number 76 [ 396.294025][ T10] ir-usb ttyUSB0: IR Dongle converter now disconnected from ttyUSB0 [ 396.306851][ T10] ir_usb 5-1:0.126: device disconnected [ 396.534611][T11315] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 396.553937][T11315] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 396.768285][ T5926] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 396.946299][ T5926] usb 1-1: Using ep0 maxpacket: 32 [ 396.958363][ T5926] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 396.976883][ T5926] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 396.995867][ T5926] usb 1-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 397.014309][ T5926] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.039071][ T5926] usb 1-1: config 0 descriptor?? [ 397.254460][ T5926] usbhid 1-1:0.0: can't add hid device: -71 [ 397.267804][ T5926] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 397.280642][ T5926] usb 1-1: USB disconnect, device number 81 [ 397.675530][ T5926] usb 2-1: new full-speed USB device number 83 using dummy_hcd [ 397.830707][ T5926] usb 2-1: unable to get BOS descriptor or descriptor too short [ 397.861225][ T5926] usb 2-1: not running at top speed; connect to a high speed hub [ 397.876588][T11336] Cannot find map_set index 65532 as target [ 397.877391][ T5926] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 397.915314][ T5926] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 397.951599][ T5926] usb 2-1: string descriptor 0 read error: -22 [ 397.957946][ T5926] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 397.977653][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.015231][ T5926] usb 2-1: 0:2 : does not exist [ 398.154405][T11341] loop8: detected capacity change from 0 to 7 [ 398.165249][T11341] Dev loop8: unable to read RDB block 7 [ 398.171448][T11341] loop8: unable to read partition table [ 398.185078][ T799] usb 3-1: USB disconnect, device number 90 [ 398.200200][T11341] loop8: partition table beyond EOD, truncated [ 398.236371][T11341] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 398.348479][ T5926] usb 2-1: 5:0: cannot get min/max values for control 2 (id 5) [ 398.381424][ T5926] usb 2-1: 5:0: cannot get min/max values for control 3 (id 5) [ 398.424326][ T5926] usb 2-1: 5:0: failed to get current value for ch 1 (-22) [ 398.544286][ T5926] usb 2-1: 5:0: cannot get min/max values for control 3 (id 5) [ 398.588933][ T5926] usb 2-1: 5:0: cannot get min/max values for control 2 (id 5) [ 398.619661][T11350] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1543'. [ 398.642723][ T5926] usb 2-1: USB disconnect, device number 83 [ 398.967780][T11356] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 399.165460][ T7629] usb 4-1: new low-speed USB device number 67 using dummy_hcd [ 399.240703][ T10] usb 1-1: new full-speed USB device number 82 using dummy_hcd [ 399.325587][ T7629] usb 4-1: Invalid ep0 maxpacket: 64 [ 399.331001][ T6009] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 399.348872][T11375] loop5: detected capacity change from 0 to 7 [ 399.356205][T11375] Dev loop5: unable to read RDB block 7 [ 399.364864][T11375] loop5: unable to read partition table [ 399.379368][T11375] loop5: partition table beyond EOD, truncated [ 399.392246][T11375] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 399.413380][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 399.442879][ T10] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 399.468493][ T10] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 399.486558][ T7629] usb 4-1: new low-speed USB device number 68 using dummy_hcd [ 399.502745][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 399.515312][ T6009] usb 2-1: unable to get BOS descriptor or descriptor too short [ 399.526308][ T6009] usb 2-1: config 25 has an invalid interface number: 105 but max is 0 [ 399.534594][ T6009] usb 2-1: config 25 has no interface number 0 [ 399.543337][ T10] usb 1-1: config 0 descriptor?? [ 399.551974][T11379] syzkaller0: entered promiscuous mode [ 399.565722][ T6009] usb 2-1: config 25 interface 105 has no altsetting 0 [ 399.566167][T11379] syzkaller0: entered allmulticast mode [ 399.576871][ T6009] usb 2-1: New USB device found, idVendor=1f4d, idProduct=a115, bcdDevice=c5.ca [ 399.589745][ T10] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 399.605187][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 399.611188][ T6009] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.621772][ T6009] usb 2-1: Product: syz [ 399.626774][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 399.640350][T11379] tipc: Enabled bearer , priority 0 [ 399.643524][ T6009] usb 2-1: Manufacturer: syz [ 399.652492][ T6009] usb 2-1: SerialNumber: syz [ 399.657577][T11378] tipc: Resetting bearer [ 399.658171][ T10] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 399.673912][ T10] usb 1-1: media controller created [ 399.682414][ T7629] usb 4-1: Invalid ep0 maxpacket: 64 [ 399.690098][ T7629] usb usb4-port1: attempt power cycle [ 399.697846][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 399.737921][T11378] tipc: Disabling bearer [ 399.744084][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 399.751801][ T10] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 399.765874][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input52 [ 399.784675][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 399.792675][ T10] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 399.825214][ T799] usb 1-1: USB disconnect, device number 82 [ 399.866804][ T799] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 399.909551][ T6009] usb 2-1: USB disconnect, device number 84 [ 400.045515][ T7629] usb 4-1: new low-speed USB device number 69 using dummy_hcd [ 400.066046][ T7629] usb 4-1: Invalid ep0 maxpacket: 64 [ 400.166157][ T10] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 400.205552][ T7629] usb 4-1: new low-speed USB device number 70 using dummy_hcd [ 400.226158][ T7629] usb 4-1: Invalid ep0 maxpacket: 64 [ 400.231944][ T7629] usb usb4-port1: unable to enumerate USB device [ 400.325459][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 400.332614][ T10] usb 5-1: config 0 has an invalid interface number: 122 but max is 0 [ 400.341169][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 400.351492][ T10] usb 5-1: config 0 has no interface number 0 [ 400.357890][ T10] usb 5-1: config 0 interface 122 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 400.369250][ T10] usb 5-1: config 0 interface 122 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 8 [ 400.379731][ T10] usb 5-1: config 0 interface 122 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 8 [ 400.397404][ T799] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 400.412589][ T10] usb 5-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 5.b7 [ 400.425898][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.442744][ T10] usb 5-1: Product: syz [ 400.448063][ T10] usb 5-1: Manufacturer: syz [ 400.452741][ T10] usb 5-1: SerialNumber: syz [ 400.466109][ T10] usb 5-1: config 0 descriptor?? [ 400.474667][T11382] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 400.567210][ T799] usb 3-1: Using ep0 maxpacket: 16 [ 400.575704][ T799] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 400.587857][ T799] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 400.599753][ T799] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 400.609396][ T799] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.623773][ T799] usb 3-1: config 0 descriptor?? [ 400.795472][ T5926] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 400.958204][ T5926] usb 1-1: Using ep0 maxpacket: 16 [ 400.965087][ T5926] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 400.977170][ T5926] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 400.986330][ T5926] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.997785][ T5926] usb 1-1: config 0 descriptor?? [ 401.036391][ T5973] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 401.056858][ T799] corsair 0003:1B1C:1B02.0014: hidraw0: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.2-1/input0 [ 401.197760][ T5973] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 401.210250][ T5973] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 401.221073][ T5973] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 401.234896][ T5973] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 401.237001][T11384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 401.245549][ T5973] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.257719][T11384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 401.261227][ T799] corsair 0003:1B1C:1B02.0014: Failed to get K90 initial state (error -32). [ 401.281781][ T5973] usb 2-1: config 0 descriptor?? [ 401.437212][T11390] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 401.446279][T11390] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 401.501734][ T5926] mcp2221 0003:04D8:00DD.0015: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 401.542903][ T5973] usbhid 2-1:0.0: can't add hid device: -71 [ 401.551147][ T5973] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 401.563418][ T5973] usb 2-1: USB disconnect, device number 85 [ 401.711731][ T30] kauditd_printk_skb: 252 callbacks suppressed [ 401.711749][ T30] audit: type=1326 audit(1764924128.643:1140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11389 comm="syz.0.1558" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd308f8f749 code=0x0 [ 401.777302][T11406] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1560'. [ 401.786324][T11406] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1560'. [ 402.275662][ T5926] usb 4-1: new full-speed USB device number 71 using dummy_hcd [ 402.445784][ T5926] usb 4-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 402.458160][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.474538][ T5926] usb 4-1: Product: syz [ 402.481351][ T5926] usb 4-1: Manufacturer: syz [ 402.488390][ T5926] usb 4-1: SerialNumber: syz [ 402.501645][ T5926] usb 4-1: config 0 descriptor?? [ 402.521134][ T5926] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 402.539904][ T5926] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 402.561129][ T5926] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) error while loading driver (-19) [ 402.719690][T11409] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.734514][T11409] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 402.752866][T11409] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.771059][T11414] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.773472][T11409] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 402.781514][T11414] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 402.808254][ T5926] usb 4-1: USB disconnect, device number 71 [ 403.017924][ T10] usb 5-1: NFC: intf ffff88807edce000 id ffffffff8e930a00 [ 403.040504][ T10] usb 5-1: USB disconnect, device number 77 [ 403.139018][T11420] syzkaller0: entered promiscuous mode [ 403.144780][T11420] syzkaller0: entered allmulticast mode [ 403.151276][ T7629] usb 3-1: USB disconnect, device number 91 [ 403.250314][T11420] tipc: Enabled bearer , priority 0 [ 403.265894][T11419] tipc: Resetting bearer [ 403.299562][T11419] tipc: Disabling bearer [ 403.385052][T11429] xt_recent: hitcount (16777216) is larger than allowed maximum (65535) [ 403.543709][T11436] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1568'. [ 403.572657][T11436] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1568'. [ 403.594915][ T799] usb 1-1: USB disconnect, device number 83 [ 403.694981][T11440] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1571'. [ 403.714922][T11440] erspan0: entered promiscuous mode [ 403.725249][T11440] erspan0: left promiscuous mode [ 403.895822][ T5973] usb 2-1: new low-speed USB device number 86 using dummy_hcd [ 403.938648][T11449] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 404.035430][ T5973] usb 2-1: device descriptor read/64, error -71 [ 404.196380][ T7629] usb 5-1: new low-speed USB device number 78 using dummy_hcd [ 404.286730][ T5973] usb 2-1: new low-speed USB device number 87 using dummy_hcd [ 404.326103][ T7629] usb 5-1: device descriptor read/64, error -71 [ 404.425856][ T5973] usb 2-1: device descriptor read/64, error -71 [ 404.552576][ T5973] usb usb2-port1: attempt power cycle [ 404.565458][ T7629] usb 5-1: new low-speed USB device number 79 using dummy_hcd [ 404.603394][T11461] overlayfs: missing 'lowerdir' [ 404.626421][T11461] fuse: Bad value for 'fd' [ 404.715949][ T7629] usb 5-1: device descriptor read/64, error -71 [ 404.825865][ T7629] usb usb5-port1: attempt power cycle [ 404.895460][ T5973] usb 2-1: new low-speed USB device number 88 using dummy_hcd [ 404.925900][ T5973] usb 2-1: device descriptor read/8, error -71 [ 405.175890][ T5973] usb 2-1: new low-speed USB device number 89 using dummy_hcd [ 405.176214][ T7629] usb 5-1: new low-speed USB device number 80 using dummy_hcd [ 405.206615][ T5973] usb 2-1: device descriptor read/8, error -71 [ 405.209785][ T7629] usb 5-1: device descriptor read/8, error -71 [ 405.319547][ T5973] usb usb2-port1: unable to enumerate USB device [ 405.396477][T11466] vivid-004: disconnect [ 405.449178][T11466] vivid-004: reconnect [ 405.457001][ T7629] usb 5-1: new low-speed USB device number 81 using dummy_hcd [ 405.498916][ T7629] usb 5-1: device descriptor read/8, error -71 [ 405.506225][T11474] syzkaller0: entered promiscuous mode [ 405.512422][T11474] syzkaller0: entered allmulticast mode [ 405.540390][T11474] tipc: Enabled bearer , priority 0 [ 405.554395][T11473] tipc: Resetting bearer [ 405.586639][T11473] tipc: Disabling bearer [ 405.607938][ T7629] usb usb5-port1: unable to enumerate USB device [ 405.634022][T11478] loop5: detected capacity change from 0 to 7 [ 405.641380][T11478] Dev loop5: unable to read RDB block 7 [ 405.675561][T11478] loop5: unable to read partition table [ 405.685737][T11478] loop5: partition table beyond EOD, truncated [ 405.693373][T11478] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 405.770826][T11482] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 405.935610][ T5973] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 406.099067][ T5973] usb 1-1: config 22 has an invalid interface number: 54 but max is 2 [ 406.107474][ T5973] usb 1-1: config 22 has an invalid interface number: 185 but max is 2 [ 406.115879][ T5973] usb 1-1: config 22 contains an unexpected descriptor of type 0x1, skipping [ 406.126217][ T5973] usb 1-1: config 22 has an invalid interface number: 218 but max is 2 [ 406.134705][ T5973] usb 1-1: config 22 has an invalid interface number: 64 but max is 2 [ 406.144790][ T5973] usb 1-1: config 22 has an invalid descriptor of length 0, skipping remainder of the config [ 406.156595][ T5973] usb 1-1: config 22 has 4 interfaces, different from the descriptor's value: 3 [ 406.165721][ T5973] usb 1-1: config 22 has no interface number 0 [ 406.172168][ T5973] usb 1-1: config 22 has no interface number 1 [ 406.178464][ T5973] usb 1-1: config 22 has no interface number 2 [ 406.184932][ T5973] usb 1-1: config 22 has no interface number 3 [ 406.191222][ T5973] usb 1-1: config 22 interface 54 altsetting 128 has an invalid descriptor for endpoint zero, skipping [ 406.202567][ T5973] usb 1-1: config 22 interface 54 altsetting 128 endpoint 0xA has an invalid bInterval 151, changing to 7 [ 406.214104][ T5973] usb 1-1: config 22 interface 185 altsetting 192 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 406.228917][ T5973] usb 1-1: config 22 interface 185 altsetting 192 bulk endpoint 0x1 has invalid maxpacket 64 [ 406.239480][ T5973] usb 1-1: config 22 interface 218 altsetting 93 has 0 endpoint descriptors, different from the interface descriptor's value: 20 [ 406.253034][ T5973] usb 1-1: config 22 interface 64 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 15 [ 406.267063][ T5973] usb 1-1: config 22 interface 54 has no altsetting 0 [ 406.273953][ T5973] usb 1-1: config 22 interface 185 has no altsetting 0 [ 406.281028][ T5973] usb 1-1: config 22 interface 218 has no altsetting 0 [ 406.288101][ T5973] usb 1-1: config 22 interface 64 has no altsetting 0 [ 406.297478][ T5973] usb 1-1: New USB device found, idVendor=0dcd, idProduct=0001, bcdDevice=3d.cb [ 406.306623][ T5973] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.314643][ T5973] usb 1-1: Product: syz [ 406.318985][ T5973] usb 1-1: Manufacturer: á„ [ 406.323716][ T5973] usb 1-1: SerialNumber: syz [ 406.546801][ T5973] ftdi_sio 1-1:22.54: FTDI USB Serial Device converter detected [ 406.563712][ T5973] ftdi_sio ttyUSB0: unknown device type: 0x3dcb [ 406.580537][ T5973] ftdi_sio 1-1:22.185: FTDI USB Serial Device converter detected [ 406.590301][ T5973] ftdi_sio ttyUSB1: unknown device type: 0x3dcb [ 406.603723][ T5973] ftdi_sio 1-1:22.218: FTDI USB Serial Device converter detected [ 406.613551][ T5973] ftdi_sio ttyUSB2: unknown device type: 0x3dcb [ 406.626620][T11495] xt_l2tp: v2 doesn't support IP mode [ 406.640528][ T5973] ftdi_sio 1-1:22.64: FTDI USB Serial Device converter detected [ 406.650008][ T5973] ftdi_sio ttyUSB3: unknown device type: 0x3dcb [ 406.661703][ T5973] usb 1-1: USB disconnect, device number 84 [ 406.671853][ T5973] ftdi_sio 1-1:22.54: device disconnected [ 406.691212][ T5973] ftdi_sio 1-1:22.185: device disconnected [ 406.748708][ T5973] ftdi_sio 1-1:22.218: device disconnected [ 406.784045][ T5973] ftdi_sio 1-1:22.64: device disconnected [ 406.831627][T11499] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1590'. [ 406.865963][T11499] openvswitch: netlink: Flow actions attr not present in new flow. [ 407.148080][T11507] loop5: detected capacity change from 0 to 7 [ 407.181433][T11507] Dev loop5: unable to read RDB block 7 [ 407.194979][T11507] loop5: unable to read partition table [ 407.202401][T11507] loop5: partition table beyond EOD, truncated [ 407.202724][T11510] syzkaller0: entered promiscuous mode [ 407.208783][T11507] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 407.255465][T11510] syzkaller0: entered allmulticast mode [ 407.297791][T11510] tipc: Enabled bearer , priority 0 [ 407.346926][T11509] tipc: Resetting bearer [ 407.408716][T11509] tipc: Disabling bearer [ 407.445880][ T5842] Bluetooth: hci0: unexpected event for opcode 0x2003 [ 407.695458][ T7629] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 407.715616][ T10] usb 1-1: new full-speed USB device number 85 using dummy_hcd [ 407.736367][ T6009] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 407.785707][ T7480] usb 5-1: new low-speed USB device number 82 using dummy_hcd [ 407.855467][ T7629] usb 2-1: Using ep0 maxpacket: 8 [ 407.862324][ T7629] usb 2-1: config 0 has an invalid interface number: 52 but max is 0 [ 407.871565][ T7629] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 407.883390][ T7629] usb 2-1: config 0 has no interface number 0 [ 407.889660][ T6009] usb 4-1: Using ep0 maxpacket: 16 [ 407.895270][ T7629] usb 2-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 407.907236][ T7629] usb 2-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 407.920510][ T10] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 407.931815][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 407.938627][ T7480] usb 5-1: device descriptor read/64, error -71 [ 407.945085][ T6009] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 407.955580][ T6009] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 407.966784][ T7629] usb 2-1: config 0 interface 52 has no altsetting 0 [ 407.974369][ T10] usb 1-1: New USB device found, idVendor=0419, idProduct=0600, bcdDevice= 0.00 [ 407.984985][ T6009] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 407.995133][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.003593][ T7629] usb 2-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 408.018358][ T6009] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 408.029274][ T10] usb 1-1: config 0 descriptor?? [ 408.035004][ T7629] usb 2-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 408.035474][T11522] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 408.043227][ T6009] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 408.069811][ T7629] usb 2-1: Manufacturer: syz [ 408.080811][ T7629] usb 2-1: config 0 descriptor?? [ 408.089075][ T6009] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 408.098830][ T7629] hub 2-1:0.52: bad descriptor, ignoring hub [ 408.105042][ T7629] hub 2-1:0.52: probe with driver hub failed with error -5 [ 408.112637][ T6009] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 408.123186][ T6009] usb 4-1: Manufacturer: syz [ 408.130920][ T6009] usb 4-1: config 0 descriptor?? [ 408.225638][ T7480] usb 5-1: new low-speed USB device number 83 using dummy_hcd [ 408.286516][T11522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 408.297463][T11522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 408.317954][ T7629] input: syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.52/input/input53 [ 408.356833][ T7480] usb 5-1: device descriptor read/64, error -71 [ 408.435924][ T6009] rc_core: IR keymap rc-hauppauge not found [ 408.445047][ T6009] Registered IR keymap rc-empty [ 408.451126][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.476014][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.484680][ T7480] usb usb5-port1: attempt power cycle [ 408.506967][ T6009] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 408.526788][ T6009] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input54 [ 408.541643][T11523] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1596'. [ 408.556112][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.570422][T11523] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1596'. [ 408.606815][ T10] usbhid 1-1:0.0: can't add hid device: -71 [ 408.612830][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 408.644661][ T10] usb 1-1: USB disconnect, device number 85 [ 408.650829][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.693684][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.740306][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.785850][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.815968][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.835645][ T7480] usb 5-1: new low-speed USB device number 84 using dummy_hcd [ 408.845495][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.865612][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.874687][T11537] IPv6: NLM_F_REPLACE set, but no existing node found! [ 408.903684][ T7480] usb 5-1: device descriptor read/8, error -71 [ 408.912441][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.946065][ T6009] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 408.967798][ T6009] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 408.976995][ T6009] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 408.990715][ T6009] usb 4-1: USB disconnect, device number 72 [ 409.165499][ T7480] usb 5-1: new low-speed USB device number 85 using dummy_hcd [ 409.189133][ T7480] usb 5-1: device descriptor read/8, error -71 [ 409.307781][ T7480] usb usb5-port1: unable to enumerate USB device [ 409.354327][T11549] loop5: detected capacity change from 0 to 7 [ 409.371453][T11549] Dev loop5: unable to read RDB block 7 [ 409.381418][T11549] loop5: unable to read partition table [ 409.388639][T11549] loop5: partition table beyond EOD, truncated [ 409.401578][T11549] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 409.621711][T11559] syzkaller0: entered promiscuous mode [ 409.627903][T11559] syzkaller0: entered allmulticast mode [ 409.654275][T11559] tipc: Enabled bearer , priority 0 [ 409.670619][T11558] tipc: Resetting bearer [ 409.718072][T11558] tipc: Disabling bearer [ 410.056260][T11571] sctp: [Deprecated]: syz.2.1612 (pid 11571) Use of struct sctp_assoc_value in delayed_ack socket option. [ 410.056260][T11571] Use struct sctp_sack_info instead [ 410.477207][ T6009] usb 2-1: USB disconnect, device number 90 [ 410.522294][T11582] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1616'. [ 410.659775][T11583] ip6gretap0: left promiscuous mode [ 410.744309][ T6009] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 410.768701][T11583] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 410.786026][T11587] loop5: detected capacity change from 0 to 7 [ 410.812184][T11590] vim2m vim2m.0: vidioc_s_fmt queue busy [ 410.828508][T11587] Dev loop5: unable to read RDB block 7 [ 410.853509][T11587] loop5: unable to read partition table [ 410.859982][T11587] loop5: partition table beyond EOD, truncated [ 410.867288][T11585] tc_dump_action: action bad kind [ 410.867900][T11587] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 410.925465][ T6009] usb 4-1: Using ep0 maxpacket: 32 [ 410.951850][ T6009] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 410.978106][ T6009] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 410.994361][ T6009] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 411.008390][ T6009] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 411.021925][ T6009] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.088744][ T6009] usb 4-1: config 0 descriptor?? [ 411.094558][T11578] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 411.123650][ T6009] hub 4-1:0.0: USB hub found [ 411.373357][ T6009] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 411.405582][ T799] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 411.420307][T11578] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 411.432584][T11578] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 411.483558][ T6009] usbhid 4-1:0.0: can't add hid device: -71 [ 411.500528][ T6009] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 411.555510][ T799] usb 1-1: Using ep0 maxpacket: 8 [ 411.563662][ T799] usb 1-1: unable to get BOS descriptor or descriptor too short [ 411.575577][ T7480] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 411.576468][ T799] usb 1-1: config 7 has an invalid interface number: 142 but max is 0 [ 411.606593][ T6009] usb 4-1: USB disconnect, device number 73 [ 411.612447][ T799] usb 1-1: config 7 has no interface number 0 [ 411.673686][ T799] usb 1-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice=dd.6d [ 411.707975][ T799] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.727121][T11606] syzkaller0: entered promiscuous mode [ 411.732645][T11606] syzkaller0: entered allmulticast mode [ 411.755779][ T7480] usb 3-1: Using ep0 maxpacket: 16 [ 411.765296][T11606] tipc: Enabled bearer , priority 0 [ 411.773416][T11605] tipc: Resetting bearer [ 411.778192][ T7480] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 411.808297][ T7480] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.825128][ T799] usb 1-1: Product: syz [ 411.827544][ T7480] usb 3-1: Product: syz [ 411.833853][ T7480] usb 3-1: Manufacturer: syz [ 411.841688][ T7480] usb 3-1: SerialNumber: syz [ 411.844426][ T799] usb 1-1: Manufacturer: syz [ 411.860735][ T7480] usb 3-1: config 0 descriptor?? [ 411.869238][T11605] tipc: Disabling bearer [ 411.878716][ T799] usb 1-1: SerialNumber: syz [ 412.037704][T11608] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1624'. [ 412.053618][T11608] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1624'. [ 412.152059][T11600] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.162931][T11600] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.272349][ T7480] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 412.325160][ T7480] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 412.351150][ T7480] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 412.360451][ T7480] usb 3-1: media controller created [ 412.422367][ T7480] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 412.480117][ T7480] zl10353_read_register: readreg error (reg=127, ret==0) [ 412.487481][ T7480] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 412.496442][ T7480] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 412.536501][T11615] vivid-000: disconnect [ 412.598433][ T10] usb 3-1: USB disconnect, device number 92 [ 412.605951][T11615] vivid-000: reconnect [ 412.625458][ T6009] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 412.698150][ T7480] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 412.722730][ T10] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 412.755748][ T6009] usb 4-1: device descriptor read/64, error -71 [ 412.886170][ T7480] usb 2-1: Using ep0 maxpacket: 8 [ 412.902078][ T7480] usb 2-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 412.916814][ T7480] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.931621][ T7480] usb 2-1: Product: syz [ 412.939818][ T7480] usb 2-1: Manufacturer: syz [ 412.948079][ T7480] usb 2-1: SerialNumber: syz [ 412.960764][ T7480] usb 2-1: config 0 descriptor?? [ 412.975311][ T7480] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 412.985521][ T7629] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 413.015552][ T6009] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 413.147361][ T7629] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 413.157423][ T6009] usb 4-1: device descriptor read/64, error -71 [ 413.163807][ T7629] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 413.174353][ T7629] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 413.185113][ T7629] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 413.197030][ T7629] usb 5-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 413.206231][ T7629] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.217395][ T7629] usb 5-1: config 0 descriptor?? [ 413.276340][ T6009] usb usb4-port1: attempt power cycle [ 413.431747][ T7629] hdpvr 5-1:0.0: firmware version 0x0 dated [ 413.439561][ T7629] hdpvr 5-1:0.0: untested firmware, the driver might not work. [ 413.616196][ T6009] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 413.625552][ T7480] gspca_sonixj: i2c_w8 err -71 [ 413.656500][ T6009] usb 4-1: device descriptor read/8, error -71 [ 413.677172][T11622] Cannot find map_set index 65532 as target [ 413.714257][ T7629] hdpvr 5-1:0.0: device init failed [ 413.723348][ T7480] sonixj 2-1:0.0: probe with driver sonixj failed with error -71 [ 413.732815][ T7629] hdpvr 5-1:0.0: probe with driver hdpvr failed with error -12 [ 413.753532][ T7480] usb 2-1: USB disconnect, device number 91 [ 413.764261][ T7629] usb 5-1: USB disconnect, device number 86 [ 413.782362][T11625] loop5: detected capacity change from 0 to 7 [ 413.797951][T11625] Dev loop5: unable to read RDB block 7 [ 413.805064][T11625] loop5: unable to read partition table [ 413.813694][T11625] loop5: partition table beyond EOD, truncated [ 413.837908][T11625] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 413.896204][ T6009] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 413.926704][ T6009] usb 4-1: device descriptor read/8, error -71 [ 414.036273][ T6009] usb usb4-port1: unable to enumerate USB device [ 414.123405][T11633] syzkaller0: entered promiscuous mode [ 414.130720][T11633] syzkaller0: entered allmulticast mode [ 414.159793][ T799] usb 1-1: USB disconnect, device number 86 [ 414.161702][T11633] tipc: Enabled bearer , priority 0 [ 414.187292][T11632] tipc: Resetting bearer [ 414.223728][T11632] tipc: Disabling bearer [ 414.337888][T11639] loop9: detected capacity change from 0 to 7 [ 414.348366][T11639] Dev loop9: unable to read RDB block 7 [ 414.353983][T11639] loop9: AHDI p4 [ 414.364590][T11639] loop9: partition table partially beyond EOD, truncated [ 414.406722][ T6009] IPVS: starting estimator thread 0... [ 414.413738][T11639] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 414.525429][T11647] IPVS: using max 34 ests per chain, 81600 per kthread [ 414.546449][ T799] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 414.705825][ T799] usb 1-1: Using ep0 maxpacket: 8 [ 414.727417][ T799] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 414.738324][ T799] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.758739][ T799] pvrusb2: Hardware description: Terratec Grabster AV400 [ 414.767758][T11657] Cannot find map_set index 65532 as target [ 414.771834][ T799] pvrusb2: ********** [ 414.782376][ T799] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 414.792919][ T799] pvrusb2: Important functionality might not be entirely working. [ 414.804831][ T799] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 414.818257][ T799] pvrusb2: ********** [ 414.934698][T11659] loop5: detected capacity change from 0 to 7 [ 414.943609][ T5983] Dev loop5: unable to read RDB block 7 [ 414.949703][ T5983] loop5: unable to read partition table [ 414.957310][ T2349] pvrusb2: Invalid write control endpoint [ 414.969252][ T5983] loop5: partition table beyond EOD, truncated [ 414.990188][T11659] Dev loop5: unable to read RDB block 7 [ 415.010534][T11659] loop5: unable to read partition table [ 415.029253][T11659] loop5: partition table beyond EOD, truncated [ 415.062151][T11659] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 415.062985][ T2349] pvrusb2: Invalid write control endpoint [ 415.110668][ T2349] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 415.145435][ T2349] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 415.164689][ T2349] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 415.189307][ T2349] pvrusb2: Device being rendered inoperable [ 415.197974][T11635] pvrusb2: Attempted to execute control transfer when device not ok [ 415.209311][ T2349] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 415.220729][T11662] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.230492][ T2349] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 415.234328][T11662] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.249314][ T5926] usb 1-1: USB disconnect, device number 87 [ 415.250377][ T2349] pvrusb2: Attached sub-driver cx25840 [ 415.282490][ T2349] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 415.297634][ T2349] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 415.621794][T11677] syzkaller0: entered promiscuous mode [ 415.627749][T11677] syzkaller0: entered allmulticast mode [ 415.669684][T11677] tipc: Enabled bearer , priority 0 [ 415.677538][T11675] tipc: Resetting bearer [ 415.713906][T11675] tipc: Disabling bearer [ 416.017056][T11688] Cannot find map_set index 65532 as target [ 416.178436][ T6009] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 416.465762][ T6009] usb 2-1: Using ep0 maxpacket: 8 [ 416.516197][ T6009] usb 2-1: unable to get BOS descriptor or descriptor too short [ 416.724766][ T6009] usb 2-1: config 7 has an invalid interface number: 142 but max is 0 [ 416.733549][ T6009] usb 2-1: config 7 has no interface number 0 [ 416.750725][ T6009] usb 2-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice=dd.6d [ 416.760417][ T6009] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.785856][ T6009] usb 2-1: Product: syz [ 416.790204][ T6009] usb 2-1: Manufacturer: syz [ 416.809751][ T6009] usb 2-1: SerialNumber: syz [ 417.071760][T11678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 417.083978][T11678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 418.906891][ T6009] usb 2-1: USB disconnect, device number 92 [ 419.058254][T11712] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1660'. [ 419.200999][T11719] Cannot find map_set index 65532 as target [ 421.901640][T11771] FAULT_INJECTION: forcing a failure. [ 421.901640][T11771] name failslab, interval 1, probability 0, space 0, times 0 [ 421.988253][T11771] CPU: 0 UID: 0 PID: 11771 Comm: syz.3.1675 Tainted: G L syzkaller #0 PREEMPT(full) [ 421.988286][T11771] Tainted: [L]=SOFTLOCKUP [ 421.988294][T11771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 421.988314][T11771] Call Trace: [ 421.988323][T11771] [ 421.988332][T11771] dump_stack_lvl+0x189/0x250 [ 421.988360][T11771] ? __pfx____ratelimit+0x10/0x10 [ 421.988386][T11771] ? __pfx_dump_stack_lvl+0x10/0x10 [ 421.988409][T11771] ? __pfx__printk+0x10/0x10 [ 421.988442][T11771] ? __pfx___might_resched+0x10/0x10 [ 421.988469][T11771] should_fail_ex+0x414/0x560 [ 421.988502][T11771] should_failslab+0xa8/0x100 [ 421.988523][T11771] __kmalloc_noprof+0xcb/0x800 [ 421.988552][T11771] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 421.988583][T11771] tomoyo_realpath_from_path+0xe3/0x5d0 [ 421.988606][T11771] ? tomoyo_domain+0xd8/0x130 [ 421.988633][T11771] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 421.988650][T11771] tomoyo_path_number_perm+0x1e8/0x5a0 [ 421.988671][T11771] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 421.988705][T11771] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 421.988750][T11771] ? __fget_files+0x2a/0x420 [ 421.988774][T11771] ? __fget_files+0x3a0/0x420 [ 421.988790][T11771] ? __fget_files+0x2a/0x420 [ 421.988809][T11771] security_file_ioctl+0xcb/0x2d0 [ 421.988842][T11771] __se_sys_ioctl+0x47/0x170 [ 421.988866][T11771] do_syscall_64+0xfa/0xf80 [ 421.988890][T11771] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.988906][T11771] ? clear_bhb_loop+0x60/0xb0 [ 421.988925][T11771] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.988943][T11771] RIP: 0033:0x7fb91cf8f749 [ 421.988959][T11771] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 421.988976][T11771] RSP: 002b:00007fb91de71038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 421.988994][T11771] RAX: ffffffffffffffda RBX: 00007fb91d1e6090 RCX: 00007fb91cf8f749 [ 421.989006][T11771] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 421.989016][T11771] RBP: 00007fb91de71090 R08: 0000000000000000 R09: 0000000000000000 [ 421.989027][T11771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 421.989037][T11771] R13: 00007fb91d1e6128 R14: 00007fb91d1e6090 R15: 00007fb91d30fa28 [ 421.989063][T11771] [ 421.989100][T11771] ERROR: Out of memory at tomoyo_realpath_from_path. [ 422.343704][T11780] Cannot find map_set index 65532 as target [ 422.707194][T11792] netlink: 'syz.4.1683': attribute type 4 has an invalid length. [ 422.882848][T11802] input: syz0 as /devices/virtual/input/input55 [ 423.185514][ T7480] usb 2-1: new full-speed USB device number 93 using dummy_hcd [ 423.195436][ T799] usb 4-1: new full-speed USB device number 78 using dummy_hcd [ 423.285480][ T6009] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 423.337052][ T7480] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 423.350987][ T7480] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 423.355766][ T799] usb 4-1: device descriptor read/64, error -71 [ 423.405075][ T7480] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 423.425424][ T7480] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.445716][ T6009] usb 5-1: Using ep0 maxpacket: 16 [ 423.453788][ T6009] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 423.540261][ T7480] usb 2-1: config 0 descriptor?? [ 423.609240][ T6009] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 423.631539][ T7480] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 423.648082][ T6009] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 423.661572][ T7480] dvb-usb: bulk message failed: -22 (3/0) [ 423.675555][ T799] usb 4-1: new full-speed USB device number 79 using dummy_hcd [ 423.684441][ T6009] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.696226][ T7480] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 423.721187][ T6009] usb 5-1: Product: syz [ 423.731172][ T7480] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 423.741707][ T6009] usb 5-1: Manufacturer: syz [ 423.752425][ T6009] usb 5-1: SerialNumber: syz [ 423.762553][ T7480] usb 2-1: media controller created [ 423.784225][ T7480] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 423.805553][ T799] usb 4-1: device descriptor read/64, error -71 [ 423.888825][ T7480] dvb-usb: bulk message failed: -22 (6/0) [ 423.929420][ T7480] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 423.944495][ T7480] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input56 [ 423.982647][ T6009] usb 5-1: 0:2 : does not exist [ 423.997189][ T7480] dvb-usb: schedule remote query interval to 150 msecs. [ 423.998064][ T799] usb usb4-port1: attempt power cycle [ 424.025752][ T6009] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 424.033025][ T7480] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 424.084744][ T7480] usb 2-1: USB disconnect, device number 93 [ 424.092741][ T6009] usb 5-1: USB disconnect, device number 87 [ 424.154108][T11832] loop5: detected capacity change from 0 to 7 [ 424.166138][T11832] Dev loop5: unable to read RDB block 7 [ 424.171807][T11832] loop5: unable to read partition table [ 424.189314][ T7480] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 424.195933][ T5983] udevd[5983]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 424.256904][T11832] loop5: partition table beyond EOD, truncated [ 424.286540][T11832] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 424.386995][ T799] usb 4-1: new full-speed USB device number 80 using dummy_hcd [ 424.436210][ T799] usb 4-1: device descriptor read/8, error -71 [ 424.636701][T11841] FAULT_INJECTION: forcing a failure. [ 424.636701][T11841] name failslab, interval 1, probability 0, space 0, times 0 [ 424.655984][T11841] CPU: 1 UID: 0 PID: 11841 Comm: syz.1.1696 Tainted: G L syzkaller #0 PREEMPT(full) [ 424.656016][T11841] Tainted: [L]=SOFTLOCKUP [ 424.656024][T11841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 424.656036][T11841] Call Trace: [ 424.656044][T11841] [ 424.656052][T11841] dump_stack_lvl+0x189/0x250 [ 424.656079][T11841] ? __pfx____ratelimit+0x10/0x10 [ 424.656106][T11841] ? __pfx_dump_stack_lvl+0x10/0x10 [ 424.656130][T11841] ? __pfx__printk+0x10/0x10 [ 424.656163][T11841] ? __pfx___might_resched+0x10/0x10 [ 424.656184][T11841] ? fs_reclaim_acquire+0x7d/0x100 [ 424.656218][T11841] should_fail_ex+0x414/0x560 [ 424.656252][T11841] should_failslab+0xa8/0x100 [ 424.656273][T11841] __kmalloc_noprof+0xcb/0x800 [ 424.656299][T11841] ? tomoyo_encode+0x28b/0x550 [ 424.656330][T11841] tomoyo_encode+0x28b/0x550 [ 424.656359][T11841] tomoyo_realpath_from_path+0x58d/0x5d0 [ 424.656385][T11841] ? tomoyo_domain+0xd8/0x130 [ 424.656415][T11841] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 424.656440][T11841] tomoyo_path_number_perm+0x1e8/0x5a0 [ 424.656460][T11841] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 424.656494][T11841] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 424.656548][T11841] ? __fget_files+0x2a/0x420 [ 424.656573][T11841] ? __fget_files+0x3a0/0x420 [ 424.656590][T11841] ? __fget_files+0x2a/0x420 [ 424.656614][T11841] security_file_ioctl+0xcb/0x2d0 [ 424.656645][T11841] __se_sys_ioctl+0x47/0x170 [ 424.656674][T11841] do_syscall_64+0xfa/0xf80 [ 424.656703][T11841] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.656724][T11841] ? clear_bhb_loop+0x60/0xb0 [ 424.656747][T11841] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.656767][T11841] RIP: 0033:0x7f0eb718f749 [ 424.656784][T11841] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 424.656801][T11841] RSP: 002b:00007f0eb8009038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 424.656823][T11841] RAX: ffffffffffffffda RBX: 00007f0eb73e6090 RCX: 00007f0eb718f749 [ 424.656838][T11841] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 424.656851][T11841] RBP: 00007f0eb8009090 R08: 0000000000000000 R09: 0000000000000000 [ 424.656864][T11841] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 424.656876][T11841] R13: 00007f0eb73e6128 R14: 00007f0eb73e6090 R15: 00007f0eb750fa28 [ 424.656909][T11841] [ 424.910558][T11841] ERROR: Out of memory at tomoyo_realpath_from_path. [ 424.920354][ T799] usb 4-1: new full-speed USB device number 81 using dummy_hcd [ 424.937371][T11845] x_tables: duplicate entry at hook 2 [ 424.943218][T11845] netlink: 277 bytes leftover after parsing attributes in process `syz.4.1698'. [ 425.006661][ T799] usb 4-1: device descriptor read/8, error -71 [ 425.075528][ T7480] usb 3-1: new low-speed USB device number 93 using dummy_hcd [ 425.115803][ T799] usb usb4-port1: unable to enumerate USB device [ 425.241720][ T7480] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 425.253725][T11852] xt_bpf: check failed: parse error [ 425.268145][ T7480] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x82 is Bulk; changing to Interrupt [ 425.280432][ T7480] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 425.290500][ T7480] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x3 is Bulk; changing to Interrupt [ 425.304252][ T7480] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 425.313593][ T7480] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.322703][ T7480] usb 3-1: Product: à ‡ [ 425.327110][ T7480] usb 3-1: SerialNumber: І [ 425.335614][ T13] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 425.357078][T11842] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 425.536122][T11856] vlan2: entered promiscuous mode [ 425.546068][T11856] bridge0: entered promiscuous mode [ 425.605023][ T7480] cdc_ncm 3-1:1.0: bind() failure [ 425.647301][ T7480] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 425.678523][ T7480] cdc_ncm 3-1:1.1: bind() failure [ 425.717699][ T7480] usb 3-1: USB disconnect, device number 93 [ 425.776932][ T5842] Bluetooth: hci4: connection err: -111 [ 425.791702][ T5842] Bluetooth: hci4: unexpected Set CIG Parameters response data [ 425.800852][ T5842] Bluetooth: hci4: unexpected event for opcode 0x2062 [ 425.898222][T11866] veth3: entered promiscuous mode [ 425.924251][T11872] Cannot find map_set index 65532 as target [ 426.076541][T11876] loop5: detected capacity change from 0 to 7 [ 426.097529][T11876] Dev loop5: unable to read RDB block 7 [ 426.175819][T11876] loop5: unable to read partition table [ 426.181689][T11876] loop5: partition table beyond EOD, truncated [ 426.232175][T11876] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 426.483403][ T5836] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 426.492097][ T799] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 426.645407][ T5836] usb 1-1: Using ep0 maxpacket: 8 [ 426.653765][ T5836] usb 1-1: config 162 has an invalid interface number: 166 but max is 0 [ 426.662491][ T5836] usb 1-1: config 162 has no interface number 0 [ 426.673763][ T5836] usb 1-1: config 162 interface 166 has no altsetting 0 [ 426.680903][ T799] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 426.681704][T11897] FAULT_INJECTION: forcing a failure. [ 426.681704][T11897] name failslab, interval 1, probability 0, space 0, times 0 [ 426.692033][ T799] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 426.737912][ T5836] usb 1-1: New USB device found, idVendor=05b1, idProduct=921d, bcdDevice=d3.ea [ 426.748613][T11897] CPU: 0 UID: 0 PID: 11897 Comm: syz.3.1711 Tainted: G L syzkaller #0 PREEMPT(full) [ 426.748644][T11897] Tainted: [L]=SOFTLOCKUP [ 426.748651][T11897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 426.748664][T11897] Call Trace: [ 426.748672][T11897] [ 426.748680][T11897] dump_stack_lvl+0x189/0x250 [ 426.748708][T11897] ? __pfx____ratelimit+0x10/0x10 [ 426.748732][T11897] ? __pfx_dump_stack_lvl+0x10/0x10 [ 426.748740][ T5836] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.748755][T11897] ? __pfx__printk+0x10/0x10 [ 426.748783][T11897] ? __pfx___might_resched+0x10/0x10 [ 426.748801][T11897] ? fs_reclaim_acquire+0x7d/0x100 [ 426.748834][T11897] should_fail_ex+0x414/0x560 [ 426.748867][T11897] should_failslab+0xa8/0x100 [ 426.748889][T11897] __kmalloc_cache_noprof+0x6f/0x6f0 [ 426.748915][T11897] ? trace_contention_end+0x39/0x100 [ 426.748937][T11897] ? vhost_task_create+0xf8/0x320 [ 426.748968][T11897] vhost_task_create+0xf8/0x320 [ 426.748992][T11897] ? unwind_get_return_address+0x4d/0x90 [ 426.749015][T11897] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 426.749040][T11897] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 426.749064][T11897] ? __pfx_vhost_task_create+0x10/0x10 [ 426.749098][T11897] ? __pfx_vhost_task_fn+0x10/0x10 [ 426.749128][T11897] ? __lock_acquire+0x6b6/0x2cf0 [ 426.749159][T11897] kvm_mmu_post_init_vm+0x14c/0x300 [ 426.749188][T11897] kvm_arch_vcpu_ioctl_run+0xdc/0x1c90 [ 426.749245][T11897] ? register_lock_class+0x51/0x320 [ 426.749266][T11897] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 426.749295][T11897] ? __lock_acquire+0x6b6/0x2cf0 [ 426.749316][T11897] ? __mutex_lock+0x335/0x1350 [ 426.749353][T11897] ? kasan_quarantine_put+0xdd/0x220 [ 426.749379][T11897] ? lockdep_hardirqs_on+0x98/0x140 [ 426.749436][T11897] kvm_vcpu_ioctl+0x95c/0xe90 [ 426.749467][T11897] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 426.749492][T11897] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 426.749539][T11897] ? __fget_files+0x2a/0x420 [ 426.749571][T11897] ? __fget_files+0x3a0/0x420 [ 426.749590][T11897] ? __fget_files+0x2a/0x420 [ 426.749612][T11897] ? bpf_lsm_file_ioctl+0x9/0x20 [ 426.749633][T11897] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 426.749658][T11897] __se_sys_ioctl+0xfc/0x170 [ 426.749686][T11897] do_syscall_64+0xfa/0xf80 [ 426.749714][T11897] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.749734][T11897] ? clear_bhb_loop+0x60/0xb0 [ 426.749757][T11897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.749775][T11897] RIP: 0033:0x7fb91cf8f749 [ 426.749794][T11897] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 426.749812][T11897] RSP: 002b:00007fb91de71038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 426.749834][T11897] RAX: ffffffffffffffda RBX: 00007fb91d1e6090 RCX: 00007fb91cf8f749 [ 426.749849][T11897] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 426.749861][T11897] RBP: 00007fb91de71090 R08: 0000000000000000 R09: 0000000000000000 [ 426.749874][T11897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 426.749886][T11897] R13: 00007fb91d1e6128 R14: 00007fb91d1e6090 R15: 00007fb91d30fa28 [ 426.749918][T11897] [ 427.068071][ T799] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.136463][ T799] usb 5-1: config 0 descriptor?? [ 427.156594][ T799] pwc: Askey VC010 type 2 USB webcam detected. [ 427.181070][ T5836] usb 1-1: Product: syz [ 427.195411][ T5836] usb 1-1: Manufacturer: syz [ 427.200190][ T5836] usb 1-1: SerialNumber: syz [ 427.353246][T11882] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 427.389422][T11882] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 427.515943][ T5836] usb 1-1: USB disconnect, device number 88 [ 427.571020][ T799] pwc: recv_control_msg error -71 req 02 val 2700 [ 427.578136][ T799] pwc: recv_control_msg error -71 req 02 val 2c00 [ 427.715431][ T799] pwc: recv_control_msg error -71 req 04 val 1000 [ 427.726395][ T799] pwc: recv_control_msg error -71 req 04 val 1300 [ 427.760323][ T799] pwc: recv_control_msg error -71 req 04 val 1400 [ 427.779439][ T799] pwc: recv_control_msg error -71 req 02 val 2000 [ 427.799376][T11909] Cannot find map_set index 65532 as target [ 427.821900][ T799] pwc: recv_control_msg error -71 req 02 val 2100 [ 427.840403][ T799] pwc: recv_control_msg error -71 req 04 val 1500 [ 427.856095][ T799] pwc: recv_control_msg error -71 req 02 val 2500 [ 427.881996][ T799] pwc: recv_control_msg error -71 req 02 val 2400 [ 427.907628][ T799] pwc: recv_control_msg error -71 req 02 val 2600 [ 427.933119][ T799] pwc: recv_control_msg error -71 req 02 val 2900 [ 427.943673][ T799] pwc: recv_control_msg error -71 req 02 val 2800 [ 427.963099][ T799] pwc: recv_control_msg error -71 req 04 val 1100 [ 427.974015][ T799] pwc: recv_control_msg error -71 req 04 val 1200 [ 428.079931][ T799] pwc: Registered as video103. [ 428.148229][ T799] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input57 [ 428.201577][ T799] usb 5-1: USB disconnect, device number 88 [ 428.339245][T11926] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1719'. [ 428.529933][T11920] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 428.924275][ T799] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 429.236772][ T799] usb 4-1: Using ep0 maxpacket: 32 [ 429.245835][ T799] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=67.fe [ 429.255049][ T799] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.280987][ T799] usb 4-1: Product: syz [ 429.309669][ T799] usb 4-1: Manufacturer: syz [ 429.351462][ T799] usb 4-1: SerialNumber: syz [ 429.402707][ T799] usb 4-1: config 0 descriptor?? [ 429.616568][T11942] FAULT_INJECTION: forcing a failure. [ 429.616568][T11942] name failslab, interval 1, probability 0, space 0, times 0 [ 429.640799][ T799] snd-usb-6fire 4-1:0.0: unable to receive device firmware state. [ 429.685369][ T799] snd-usb-6fire 4-1:0.0: probe with driver snd-usb-6fire failed with error -121 [ 429.706541][T11942] CPU: 1 UID: 0 PID: 11942 Comm: syz.0.1724 Tainted: G L syzkaller #0 PREEMPT(full) [ 429.706574][T11942] Tainted: [L]=SOFTLOCKUP [ 429.706582][T11942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 429.706594][T11942] Call Trace: [ 429.706602][T11942] [ 429.706612][T11942] dump_stack_lvl+0x189/0x250 [ 429.706640][T11942] ? __pfx____ratelimit+0x10/0x10 [ 429.706667][T11942] ? __pfx_dump_stack_lvl+0x10/0x10 [ 429.706689][T11942] ? __pfx__printk+0x10/0x10 [ 429.706722][T11942] ? __pfx___might_resched+0x10/0x10 [ 429.706742][T11942] ? fs_reclaim_acquire+0x7d/0x100 [ 429.706775][T11942] should_fail_ex+0x414/0x560 [ 429.706809][T11942] should_failslab+0xa8/0x100 [ 429.706830][T11942] kmem_cache_alloc_node_noprof+0x77/0x710 [ 429.706857][T11942] ? dup_task_struct+0x52/0x7b0 [ 429.706893][T11942] dup_task_struct+0x52/0x7b0 [ 429.706915][T11942] ? lockdep_hardirqs_on+0x98/0x140 [ 429.706946][T11942] copy_process+0x4ea/0x3950 [ 429.706993][T11942] ? __pfx_copy_process+0x10/0x10 [ 429.707022][T11942] ? mutex_init_lockep+0xf9/0x130 [ 429.707050][T11942] vhost_task_create+0x1ce/0x320 [ 429.707075][T11942] ? unwind_get_return_address+0x4d/0x90 [ 429.707097][T11942] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 429.707122][T11942] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 429.707145][T11942] ? __pfx_vhost_task_create+0x10/0x10 [ 429.707178][T11942] ? __pfx_vhost_task_fn+0x10/0x10 [ 429.707208][T11942] ? __lock_acquire+0x6b6/0x2cf0 [ 429.707240][T11942] kvm_mmu_post_init_vm+0x14c/0x300 [ 429.707268][T11942] kvm_arch_vcpu_ioctl_run+0xdc/0x1c90 [ 429.707309][T11942] ? register_lock_class+0x51/0x320 [ 429.707330][T11942] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 429.707360][T11942] ? __lock_acquire+0x6b6/0x2cf0 [ 429.707382][T11942] ? __mutex_lock+0x335/0x1350 [ 429.707419][T11942] ? kasan_quarantine_put+0xdd/0x220 [ 429.707443][T11942] ? lockdep_hardirqs_on+0x98/0x140 [ 429.707498][T11942] kvm_vcpu_ioctl+0x95c/0xe90 [ 429.707530][T11942] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 429.707556][T11942] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 429.707604][T11942] ? __fget_files+0x2a/0x420 [ 429.707629][T11942] ? __fget_files+0x3a0/0x420 [ 429.707648][T11942] ? __fget_files+0x2a/0x420 [ 429.707671][T11942] ? bpf_lsm_file_ioctl+0x9/0x20 [ 429.707692][T11942] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 429.707716][T11942] __se_sys_ioctl+0xfc/0x170 [ 429.707744][T11942] do_syscall_64+0xfa/0xf80 [ 429.707772][T11942] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.707792][T11942] ? clear_bhb_loop+0x60/0xb0 [ 429.707817][T11942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.707835][T11942] RIP: 0033:0x7fd308f8f749 [ 429.707852][T11942] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 429.707870][T11942] RSP: 002b:00007fd309d98038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 429.707899][T11942] RAX: ffffffffffffffda RBX: 00007fd3091e6090 RCX: 00007fd308f8f749 [ 429.707914][T11942] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 429.707927][T11942] RBP: 00007fd309d98090 R08: 0000000000000000 R09: 0000000000000000 [ 429.707939][T11942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 429.707951][T11942] R13: 00007fd3091e6128 R14: 00007fd3091e6090 R15: 00007fd30930fa28 [ 429.707985][T11942] [ 430.047219][ T52] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 430.057525][ T52] Bluetooth: hci4: Injecting HCI hardware error event [ 430.066539][T11944] netlink: 180 bytes leftover after parsing attributes in process `syz.2.1725'. [ 430.068105][ T52] Bluetooth: hci4: hardware error 0x00 [ 430.077843][T11944] batadv_slave_1: entered promiscuous mode [ 430.090698][T11944] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1725'. [ 430.104674][T11944] bridge2: the hash_elasticity option has been deprecated and is always 16 [ 430.270197][ T799] usb 4-1: USB disconnect, device number 82 [ 430.353591][T11945] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1725'. [ 430.514049][T11953] Cannot find map_set index 65532 as target [ 430.527448][T11943] batadv_slave_1: left promiscuous mode [ 430.961638][T11976] tipc: Enabling of bearer rejected, already enabled [ 430.985780][ T7629] usb 2-1: new full-speed USB device number 94 using dummy_hcd [ 431.075930][ T799] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 431.178110][ T7629] usb 2-1: config 0 interface 0 altsetting 251 has an endpoint descriptor with address 0x93, changing to 0x83 [ 431.209252][ T7629] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x83 has invalid maxpacket 64602, setting to 64 [ 431.239791][ T7629] usb 2-1: config 0 interface 0 has no altsetting 0 [ 431.277082][ T799] usb 1-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 431.287936][ T799] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.313665][ T799] usb 1-1: Product: syz [ 431.319753][ T7629] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 431.325395][ T799] usb 1-1: Manufacturer: syz [ 431.893896][ T7629] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 431.904152][ T7629] usb 2-1: Product: syz [ 431.908488][ T7629] usb 2-1: Manufacturer: syz [ 431.915400][ T7629] usb 2-1: SerialNumber: syz [ 431.983523][ T799] usb 1-1: SerialNumber: syz [ 432.000555][ T799] usb 1-1: config 0 descriptor?? [ 432.000555][ T7629] usb 2-1: config 0 descriptor?? [ 432.022468][ T799] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 432.070812][T11961] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 432.099379][ T7629] usb 2-1: selecting invalid altsetting 0 [ 432.142722][ T52] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 432.307939][T11961] usb 2-1: cannot submit urb 0, error -2: endpoint not enabled [ 432.387552][T11961] usb 2-1: cannot submit urb 0, error -2: endpoint not enabled [ 432.441516][ T30] audit: type=1326 audit(1764924159.373:1141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11989 comm="syz.3.1737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb91cf8f749 code=0x7ffc0000 [ 432.487980][T11961] usb 2-1: cannot submit urb 0, error -2: endpoint not enabled [ 432.526134][ T30] audit: type=1326 audit(1764924159.403:1142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11989 comm="syz.3.1737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=78 compat=0 ip=0x7fb91cf8f749 code=0x7ffc0000 [ 432.526410][T11961] usb 2-1: cannot submit urb 0, error -2: endpoint not enabled [ 432.559732][ T7629] usb 2-1: USB disconnect, device number 94 [ 432.622103][ T30] audit: type=1326 audit(1764924159.403:1143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11989 comm="syz.3.1737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb91cf8f749 code=0x7ffc0000 [ 432.676799][ T30] audit: type=1326 audit(1764924159.403:1144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11989 comm="syz.3.1737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb91cf8f749 code=0x7ffc0000 [ 432.720298][ T30] audit: type=1326 audit(1764924159.403:1145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11989 comm="syz.3.1737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb91cf8f749 code=0x7ffc0000 [ 432.775515][ T5836] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 432.813720][ T30] audit: type=1326 audit(1764924159.403:1146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11989 comm="syz.3.1737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb91cf8f749 code=0x7ffc0000 [ 432.856754][ T30] audit: type=1326 audit(1764924159.403:1147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11989 comm="syz.3.1737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fb91cf8f749 code=0x7ffc0000 [ 432.912878][ T30] audit: type=1326 audit(1764924159.403:1148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11989 comm="syz.3.1737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fb91cf8f749 code=0x7ffc0000 [ 432.945982][ T30] audit: type=1326 audit(1764924159.403:1149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11989 comm="syz.3.1737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb91cf8f749 code=0x7ffc0000 [ 432.980283][ T5836] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 432.994910][ T5836] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.995298][ T30] audit: type=1326 audit(1764924159.403:1150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11989 comm="syz.3.1737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb91cf8f749 code=0x7ffc0000 [ 433.031811][ T5836] usb 4-1: config 0 descriptor?? [ 433.058335][ T5836] cp210x 4-1:0.0: cp210x converter detected [ 433.194241][T12004] FAULT_INJECTION: forcing a failure. [ 433.194241][T12004] name failslab, interval 1, probability 0, space 0, times 0 [ 433.232343][T12004] CPU: 0 UID: 0 PID: 12004 Comm: syz.4.1739 Tainted: G L syzkaller #0 PREEMPT(full) [ 433.232373][T12004] Tainted: [L]=SOFTLOCKUP [ 433.232380][T12004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 433.232392][T12004] Call Trace: [ 433.232400][T12004] [ 433.232409][T12004] dump_stack_lvl+0x189/0x250 [ 433.232438][T12004] ? __pfx____ratelimit+0x10/0x10 [ 433.232465][T12004] ? __pfx_dump_stack_lvl+0x10/0x10 [ 433.232488][T12004] ? __pfx__printk+0x10/0x10 [ 433.232574][T12004] ? __pfx___might_resched+0x10/0x10 [ 433.232594][T12004] ? fs_reclaim_acquire+0x7d/0x100 [ 433.232624][T12004] should_fail_ex+0x414/0x560 [ 433.232653][T12004] should_failslab+0xa8/0x100 [ 433.232673][T12004] __kmalloc_noprof+0xcb/0x800 [ 433.232698][T12004] ? security_task_alloc+0x4d/0x360 [ 433.232717][T12004] ? perf_event_init_task+0x12d/0x4b0 [ 433.232738][T12004] security_task_alloc+0x4d/0x360 [ 433.232759][T12004] copy_process+0x1493/0x3950 [ 433.232792][T12004] ? copy_process+0x915/0x3950 [ 433.232820][T12004] ? __pfx_copy_process+0x10/0x10 [ 433.232849][T12004] ? mutex_init_lockep+0xf9/0x130 [ 433.232874][T12004] vhost_task_create+0x1ce/0x320 [ 433.232897][T12004] ? unwind_get_return_address+0x4d/0x90 [ 433.232920][T12004] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 433.232945][T12004] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 433.232967][T12004] ? __pfx_vhost_task_create+0x10/0x10 [ 433.233001][T12004] ? __pfx_vhost_task_fn+0x10/0x10 [ 433.233029][T12004] ? __lock_acquire+0x6b6/0x2cf0 [ 433.233059][T12004] kvm_mmu_post_init_vm+0x14c/0x300 [ 433.233088][T12004] kvm_arch_vcpu_ioctl_run+0xdc/0x1c90 [ 433.233128][T12004] ? register_lock_class+0x51/0x320 [ 433.233149][T12004] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 433.233180][T12004] ? __lock_acquire+0x6b6/0x2cf0 [ 433.233202][T12004] ? __mutex_lock+0x335/0x1350 [ 433.233237][T12004] ? kasan_quarantine_put+0xdd/0x220 [ 433.233263][T12004] ? lockdep_hardirqs_on+0x98/0x140 [ 433.233317][T12004] kvm_vcpu_ioctl+0x95c/0xe90 [ 433.233348][T12004] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 433.233372][T12004] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 433.233417][T12004] ? __fget_files+0x2a/0x420 [ 433.233442][T12004] ? __fget_files+0x3a0/0x420 [ 433.233460][T12004] ? __fget_files+0x2a/0x420 [ 433.233483][T12004] ? bpf_lsm_file_ioctl+0x9/0x20 [ 433.233504][T12004] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 433.233538][T12004] __se_sys_ioctl+0xfc/0x170 [ 433.233567][T12004] do_syscall_64+0xfa/0xf80 [ 433.233597][T12004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.233616][T12004] ? clear_bhb_loop+0x60/0xb0 [ 433.233640][T12004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.233659][T12004] RIP: 0033:0x7f80aa98f749 [ 433.233677][T12004] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 433.233696][T12004] RSP: 002b:00007f80ab847038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 433.233718][T12004] RAX: ffffffffffffffda RBX: 00007f80aabe5fa0 RCX: 00007f80aa98f749 [ 433.233734][T12004] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 433.233746][T12004] RBP: 00007f80ab847090 R08: 0000000000000000 R09: 0000000000000000 [ 433.233759][T12004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 433.233771][T12004] R13: 00007f80aabe6038 R14: 00007f80aabe5fa0 R15: 00007f80aad0fa28 [ 433.233803][T12004] [ 433.774460][ T5836] cp210x 4-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 433.784506][T11965] loop0: detected capacity change from 0 to 16384 [ 433.803132][ T5836] cp210x 4-1:0.0: failed to get vendor val 0x000e size 678: -32 [ 433.831534][ T5836] cp210x 4-1:0.0: GPIO initialisation failed: -32 [ 433.887581][ T5836] usb 4-1: cp210x converter now attached to ttyUSB0 [ 434.096159][ T799] gspca_sunplus: reg_r err -110 [ 434.101106][ T799] sunplus 1-1:0.0: probe with driver sunplus failed with error -110 [ 434.199539][ T799] usb 4-1: USB disconnect, device number 83 [ 434.214033][ T799] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 434.234615][ T799] cp210x 4-1:0.0: device disconnected [ 434.650690][T12028] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1744'. [ 434.804627][T12031] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1745'. [ 434.864085][T12033] syzkaller0: entered promiscuous mode [ 434.877679][T12033] syzkaller0: entered allmulticast mode [ 434.926841][T12033] tipc: Enabled bearer , priority 0 [ 434.945579][T12032] tipc: Resetting bearer [ 434.956529][ T7629] usb 1-1: USB disconnect, device number 89 [ 434.989845][T12032] tipc: Disabling bearer [ 435.058558][T12037] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 435.157935][ T799] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 435.238833][T12043] Cannot find map_set index 65532 as target [ 435.330440][ T799] usb 5-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 435.341602][ T799] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.352761][ T799] usb 5-1: Product: syz [ 435.357889][ T799] usb 5-1: Manufacturer: syz [ 435.362619][ T799] usb 5-1: SerialNumber: syz [ 435.370074][ T799] usb 5-1: config 0 descriptor?? [ 435.376709][ T799] hub 5-1:0.0: bad descriptor, ignoring hub [ 435.382627][ T799] hub 5-1:0.0: probe with driver hub failed with error -5 [ 435.515614][ T5836] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 435.546806][ T7629] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 435.675472][ T5836] usb 4-1: device descriptor read/64, error -71 [ 435.709783][ T799] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 435.717915][ T7629] usb 1-1: Using ep0 maxpacket: 32 [ 435.720257][ T7629] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 435.738085][ T7629] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 435.738717][ T799] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 435.752751][ T7629] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 435.759518][ T799] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 435.767357][ T7629] usb 1-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 435.776167][ T799] usb 5-1: media controller created [ 435.793032][ T7629] usb 1-1: Product: syz [ 435.797895][ T7629] usb 1-1: Manufacturer: syz [ 435.814613][ T7629] hub 1-1:4.0: USB hub found [ 435.835193][ T799] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 435.915643][ T799] DVB: Unable to find symbol dib7000p_attach() [ 435.923281][ T799] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 435.936252][ T5836] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 436.005549][ T799] rc_core: IR keymap rc-dib0700-rc5 not found [ 436.079829][ T7629] hub 1-1:4.0: 7 ports detected [ 436.085054][ T799] Registered IR keymap rc-empty [ 436.085111][ T7629] hub 1-1:4.0: insufficient power available to use all downstream ports [ 436.090950][ T799] dvb-usb: could not initialize remote control. [ 436.121718][ T799] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 436.190185][ T5836] usb 4-1: device descriptor read/64, error -71 [ 436.281181][T12049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.293237][T12049] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.307987][ T5836] usb usb4-port1: attempt power cycle [ 436.422527][T12076] IPv6: Can't replace route, no match found [ 436.448160][ T7629] hub 1-1:4.0: hub_hub_status failed (err = -71) [ 436.454687][ T7629] hub 1-1:4.0: config failed, can't get hub status (err -71) [ 436.508118][ T7629] usb 1-1: USB disconnect, device number 90 [ 436.701194][ T5836] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 436.738862][ T5836] usb 4-1: device descriptor read/8, error -71 [ 436.987043][ T5836] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 437.037941][ T5836] usb 4-1: device descriptor read/8, error -71 [ 437.165876][ T5836] usb usb4-port1: unable to enumerate USB device [ 437.204405][T12082] syzkaller0: entered promiscuous mode [ 437.212483][T12082] syzkaller0: entered allmulticast mode [ 437.266402][T12082] tipc: Enabled bearer , priority 0 [ 437.283070][T12080] tipc: Resetting bearer [ 437.321087][T12080] tipc: Disabling bearer [ 437.452079][T12090] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 437.548536][T12092] netlink: 'syz.1.1762': attribute type 3 has an invalid length. [ 437.897819][ T6009] usb 2-1: new full-speed USB device number 95 using dummy_hcd [ 438.061348][ T6009] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 438.073192][ T6009] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 438.084079][ T6009] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 438.103527][ T6009] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.130939][ T6009] usb 2-1: config 0 descriptor?? [ 438.389969][ T6009] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 438.416771][ T7629] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 438.425977][ T6009] dvb-usb: bulk message failed: -22 (3/0) [ 438.462359][ T6009] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 438.488864][ T6009] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 438.513484][ T6009] usb 2-1: media controller created [ 438.568754][ T6009] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 438.595544][ T7629] usb 3-1: Using ep0 maxpacket: 8 [ 438.685844][ T7629] usb 3-1: unable to get BOS descriptor or descriptor too short [ 438.695007][ T6009] dvb-usb: bulk message failed: -22 (6/0) [ 438.709003][ T6009] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 438.717901][ T7629] usb 3-1: config 7 has an invalid interface number: 142 but max is 0 [ 438.769515][ T7629] usb 3-1: config 7 has no interface number 0 [ 438.789189][ T6009] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input59 [ 438.819924][ T7629] usb 3-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice=dd.6d [ 438.868059][ T6009] dvb-usb: schedule remote query interval to 150 msecs. [ 438.875496][ T7629] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.883530][ T6009] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 438.892538][ T7629] usb 3-1: Product: syz [ 438.898772][ T7629] usb 3-1: Manufacturer: syz [ 438.903603][ T7629] usb 3-1: SerialNumber: syz [ 439.036116][ T6009] dvb-usb: bulk message failed: -22 (1/0) [ 439.046509][ T6009] dvb-usb: error while querying for an remote control event. [ 439.162964][T12108] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.215487][ T5926] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 439.218496][ T6009] dvb-usb: bulk message failed: -22 (1/0) [ 439.229285][ T6009] dvb-usb: error while querying for an remote control event. [ 439.238191][T12108] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.382024][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 439.382042][ T30] audit: type=1326 audit(1764924166.273:1208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12116 comm="syz.0.1770" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd308f8f749 code=0x0 [ 439.456826][ T6009] dvb-usb: bulk message failed: -22 (1/0) [ 439.456880][ T5926] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 439.462768][ T6009] dvb-usb: error while querying for an remote control event. [ 439.471757][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.471783][ T5926] usb 4-1: Product: syz [ 439.471797][ T5926] usb 4-1: Manufacturer: syz [ 439.471812][ T5926] usb 4-1: SerialNumber: syz [ 439.541737][ T5926] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 439.614910][ T5836] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 439.688829][ T6009] dvb-usb: bulk message failed: -22 (1/0) [ 439.694658][ T6009] dvb-usb: error while querying for an remote control event. [ 439.865497][ T6009] dvb-usb: bulk message failed: -22 (1/0) [ 439.872712][ T6009] dvb-usb: error while querying for an remote control event. [ 440.035491][ T6009] dvb-usb: bulk message failed: -22 (1/0) [ 440.041320][ T6009] dvb-usb: error while querying for an remote control event. [ 440.058992][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 440.067921][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.074332][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.226688][ T6009] dvb-usb: bulk message failed: -22 (1/0) [ 440.253133][ T6009] dvb-usb: error while querying for an remote control event. [ 440.333676][ T6009] usb 4-1: USB disconnect, device number 88 [ 440.435832][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 440.442055][ T10] dvb-usb: error while querying for an remote control event. [ 440.490702][T12125] dns_resolver: Unsupported server list version (0) [ 440.605535][ T7480] dvb-usb: bulk message failed: -22 (1/0) [ 440.611491][ T7480] dvb-usb: error while querying for an remote control event. [ 440.775608][ T7480] dvb-usb: bulk message failed: -22 (1/0) [ 440.781432][ T7480] dvb-usb: error while querying for an remote control event. [ 440.815450][ T5926] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 440.863857][ T5836] usb 4-1: Service connection timeout for: 256 [ 440.872561][ T5836] ath9k_htc 4-1:1.0: ath9k_htc: Unable to initialize HTC services [ 440.887750][ T5836] ath9k_htc: Failed to initialize the device [ 440.897363][ T6009] usb 4-1: ath9k_htc: USB layer deinitialized [ 440.945660][ T7480] dvb-usb: bulk message failed: -22 (1/0) [ 440.951608][ T7480] dvb-usb: error while querying for an remote control event. [ 440.966087][ T5926] usb 1-1: Using ep0 maxpacket: 16 [ 440.973694][ T5926] usb 1-1: config 0 has no interfaces? [ 440.984063][ T5926] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 440.994115][ T5926] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.005002][ T5926] usb 1-1: Product: syz [ 441.011538][ T5926] usb 1-1: Manufacturer: syz [ 441.019898][ T5926] usb 1-1: SerialNumber: syz [ 441.029089][ T5926] usb 1-1: config 0 descriptor?? [ 441.115672][ T7480] dvb-usb: bulk message failed: -22 (1/0) [ 441.121919][ T7480] dvb-usb: error while querying for an remote control event. [ 441.285499][ T7480] dvb-usb: bulk message failed: -22 (1/0) [ 441.298304][ T7480] dvb-usb: error while querying for an remote control event. [ 441.343586][T12092] ------------[ cut here ]------------ [ 441.350153][T12092] usb 5-1: BOGUS control dir, pipe 80005980 doesn't match bRequestType c0 [ 441.359163][T12092] WARNING: drivers/usb/core/urb.c:414 at 0x0, CPU#1: syz.1.1762/12092 [ 441.365562][ T6009] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 441.367450][T12092] Modules linked in: [ 441.379370][T12092] CPU: 1 UID: 0 PID: 12092 Comm: syz.1.1762 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.390349][T12092] Tainted: [L]=SOFTLOCKUP [ 441.394684][T12092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 441.405621][T12092] RIP: 0010:usb_submit_urb+0x112e/0x1890 [ 441.411304][T12092] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 99 f2 ff ff 89 e9 [ 441.431204][T12092] RSP: 0018:ffffc9001d377820 EFLAGS: 00010246 [ 441.437433][T12092] RAX: 0000000000000000 RBX: ffff88804b396700 RCX: 0000000080005980 [ 441.445560][T12092] RDX: ffff88804f99a760 RSI: ffffffff8c137ee0 RDI: ffffffff8f8dc5e0 [ 441.454164][T12092] RBP: 1ffff110042de13c R08: 00000000000000c0 R09: 0000000000000000 [ 441.462881][T12092] R10: ffffc9001d377920 R11: fffff52003a6ef30 R12: ffff888076125100 [ 441.465456][ T7480] dvb-usb: bulk message failed: -22 (1/0) [ 441.471056][T12092] R13: ffff8880216f09e0 R14: 0000000080005980 R15: ffff88804f99a760 [ 441.477382][ T7480] dvb-usb: error while querying for an remote control event. [ 441.484657][T12092] FS: 00007f0eb7fe86c0(0000) GS:ffff888126192000(0000) knlGS:0000000000000000 [ 441.484682][T12092] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 441.508161][T12092] CR2: 0000000000000000 CR3: 000000007708e000 CR4: 00000000003526f0 [ 441.516168][T12092] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 000000000300002a [ 441.524167][T12092] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 441.532177][T12092] Call Trace: [ 441.535504][T12092] [ 441.538458][T12092] ? __init_swait_queue_head+0xa9/0x150 [ 441.544122][T12092] usb_start_wait_urb+0x114/0x4c0 [ 441.549247][T12092] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 441.555383][T12092] usb_control_msg+0x232/0x3e0 [ 441.560614][T12092] dib0700_i2c_xfer+0xba7/0xf70 [ 441.565645][T12092] __i2c_transfer+0x871/0x20e0 [ 441.570443][T12092] ? i2c_transfer+0x120/0x3a0 [ 441.575185][T12092] ? __pfx___i2c_transfer+0x10/0x10 [ 441.580815][T12092] ? rt_mutex_lock_nested+0x172/0x1e0 [ 441.586398][T12092] ? i2c_transfer+0x120/0x3a0 [ 441.591077][T12092] i2c_transfer+0x25b/0x3a0 [ 441.595633][T12092] ? __pfx_i2c_transfer+0x10/0x10 [ 441.600686][T12092] ? _copy_from_user+0x94/0xb0 [ 441.605510][T12092] i2cdev_ioctl_rdwr+0x460/0x740 [ 441.610832][T12092] i2cdev_ioctl+0x64b/0x7f0 [ 441.615369][T12092] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 441.620400][T12092] ? __fget_files+0x3a0/0x420 [ 441.625080][T12092] ? __fget_files+0x2a/0x420 [ 441.629772][T12092] ? bpf_lsm_file_ioctl+0x9/0x20 [ 441.634716][T12092] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 441.639840][T12092] __se_sys_ioctl+0xfc/0x170 [ 441.644442][T12092] do_syscall_64+0xfa/0xf80 [ 441.648985][T12092] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.655609][T12092] ? clear_bhb_loop+0x60/0xb0 [ 441.660359][T12092] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.666756][T12092] RIP: 0033:0x7f0eb718f749 [ 441.671188][T12092] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 441.690954][T12092] RSP: 002b:00007f0eb7fe8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 441.699401][T12092] RAX: ffffffffffffffda RBX: 00007f0eb73e6180 RCX: 00007f0eb718f749 [ 441.707440][T12092] RDX: 0000200000000200 RSI: 0000000000000707 RDI: 0000000000000007 [ 441.715440][T12092] RBP: 00007f0eb7213f91 R08: 0000000000000000 R09: 0000000000000000 [ 441.723414][T12092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 441.731433][T12092] R13: 00007f0eb73e6218 R14: 00007f0eb73e6180 R15: 00007f0eb750fa28 [ 441.739463][T12092] [ 441.742503][T12092] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 441.749816][T12092] CPU: 1 UID: 0 PID: 12092 Comm: syz.1.1762 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.760750][T12092] Tainted: [L]=SOFTLOCKUP [ 441.765070][T12092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 441.775207][T12092] Call Trace: [ 441.778583][T12092] [ 441.781511][T12092] dump_stack_lvl+0x99/0x250 [ 441.786113][T12092] ? __asan_memcpy+0x40/0x70 [ 441.790729][T12092] ? __pfx_dump_stack_lvl+0x10/0x10 [ 441.795934][T12092] ? __pfx__printk+0x10/0x10 [ 441.800530][T12092] vpanic+0x237/0x6d0 [ 441.804507][T12092] ? __pfx_vpanic+0x10/0x10 [ 441.809000][T12092] ? is_bpf_text_address+0x292/0x2b0 [ 441.814289][T12092] ? is_bpf_text_address+0x26/0x2b0 [ 441.819505][T12092] panic+0xb9/0xc0 [ 441.823224][T12092] ? __pfx_panic+0x10/0x10 [ 441.827664][T12092] __warn+0x317/0x4b0 [ 441.831658][T12092] __report_bug+0x288/0x500 [ 441.836160][T12092] ? __pfx___report_bug+0x10/0x10 [ 441.841215][T12092] ? stack_depot_save_flags+0x422/0x850 [ 441.846782][T12092] report_bug_entry+0x16a/0x220 [ 441.851668][T12092] ? usb_submit_urb+0x112e/0x1890 [ 441.856717][T12092] ? usb_submit_urb+0x1133/0x1890 [ 441.861747][T12092] handle_bug+0xca/0x200 [ 441.865993][T12092] exc_invalid_op+0x1a/0x50 [ 441.870493][T12092] asm_exc_invalid_op+0x1a/0x20 [ 441.875339][T12092] RIP: 0010:usb_submit_urb+0x112e/0x1890 [ 441.880986][T12092] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 99 f2 ff ff 89 e9 [ 441.900592][T12092] RSP: 0018:ffffc9001d377820 EFLAGS: 00010246 [ 441.906694][T12092] RAX: 0000000000000000 RBX: ffff88804b396700 RCX: 0000000080005980 [ 441.914667][T12092] RDX: ffff88804f99a760 RSI: ffffffff8c137ee0 RDI: ffffffff8f8dc5e0 [ 441.922735][T12092] RBP: 1ffff110042de13c R08: 00000000000000c0 R09: 0000000000000000 [ 441.930738][T12092] R10: ffffc9001d377920 R11: fffff52003a6ef30 R12: ffff888076125100 [ 441.938901][T12092] R13: ffff8880216f09e0 R14: 0000000080005980 R15: ffff88804f99a760 [ 441.946908][T12092] ? __init_swait_queue_head+0xa9/0x150 [ 441.952465][T12092] usb_start_wait_urb+0x114/0x4c0 [ 441.957504][T12092] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 441.963083][T12092] usb_control_msg+0x232/0x3e0 [ 441.967854][T12092] dib0700_i2c_xfer+0xba7/0xf70 [ 441.972733][T12092] __i2c_transfer+0x871/0x20e0 [ 441.977537][T12092] ? i2c_transfer+0x120/0x3a0 [ 441.982225][T12092] ? __pfx___i2c_transfer+0x10/0x10 [ 441.987413][T12092] ? rt_mutex_lock_nested+0x172/0x1e0 [ 441.992772][T12092] ? i2c_transfer+0x120/0x3a0 [ 441.997532][T12092] i2c_transfer+0x25b/0x3a0 [ 442.002030][T12092] ? __pfx_i2c_transfer+0x10/0x10 [ 442.007051][T12092] ? _copy_from_user+0x94/0xb0 [ 442.011826][T12092] i2cdev_ioctl_rdwr+0x460/0x740 [ 442.016810][T12092] i2cdev_ioctl+0x64b/0x7f0 [ 442.021300][T12092] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 442.026330][T12092] ? __fget_files+0x3a0/0x420 [ 442.031035][T12092] ? __fget_files+0x2a/0x420 [ 442.035651][T12092] ? bpf_lsm_file_ioctl+0x9/0x20 [ 442.040588][T12092] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 442.045618][T12092] __se_sys_ioctl+0xfc/0x170 [ 442.050221][T12092] do_syscall_64+0xfa/0xf80 [ 442.054739][T12092] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.060800][T12092] ? clear_bhb_loop+0x60/0xb0 [ 442.065495][T12092] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.071401][T12092] RIP: 0033:0x7f0eb718f749 [ 442.075811][T12092] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 442.095540][T12092] RSP: 002b:00007f0eb7fe8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 442.103980][T12092] RAX: ffffffffffffffda RBX: 00007f0eb73e6180 RCX: 00007f0eb718f749 [ 442.111952][T12092] RDX: 0000200000000200 RSI: 0000000000000707 RDI: 0000000000000007 [ 442.119919][T12092] RBP: 00007f0eb7213f91 R08: 0000000000000000 R09: 0000000000000000 [ 442.127905][T12092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 442.135878][T12092] R13: 00007f0eb73e6218 R14: 00007f0eb73e6180 R15: 00007f0eb750fa28 [ 442.143863][T12092] [ 442.147252][T12092] Kernel Offset: disabled [ 442.151584][T12092] Rebooting in 86400 seconds..