last executing test programs: 2m6.371680033s ago: executing program 1 (id=2483): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000040) futex(0x0, 0xb, 0x0, 0x0, &(0x7f0000000140)=0x2, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x800448d2, &(0x7f0000000400)="533847996d1f3c93695f181075d2c5a8ab1287b127dc5d30956728ae22e68b788d7ecc9e0c8083c1105c77ffce910ba51b34df5ca09f5227a5202008e2cba367906b2aa448867232462f31fc0dc5353b721f9040423b776f6d188935708a31714db9536a4bc8c52215966dd92ad3eba99ff92f1de8812553c6d154abd33a0c9b2878b50b6c2bdfe472faf48e50235cf505b6c38478e698a822b564001129239a5a2fb00e984fed5dd4ffdc58428005c17b0f4a6b12ecf00438722a3698bb1f9ce441e2cf3f5b50da9466f282411568eb70c114d7c02deadf1cc5d1076b6e4fd849ec09f8") r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x86, 0x81, &(0x7f0000000280)="1a0000000212a277", 0x8) r3 = userfaultfd(0x801) r4 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="20cf00004900010026bd7000fcff46eb3a84e188a9bfd1469ba372ffff0a001c6e0800000000000000040001807a4950e61f98c989847479ac415ba449c29d00bfb0bda8fb7b8c7ce913cefa88a404b67a6fee0b530835fce076df8de70ebf0cd1e3af78eb193f7d01027685a169e77de32e7f6d10857d75b8c123668a11c97ac3f4248ee409b8d73463a968070240a60bdec8c2999357a10cd74a7cafd49b910bd48cafebbb41018c4cb59e9f303380cced6fb7a5d894a9b159827f69e95010a1bed4eb29902f9b436a51a9bb70937ae9b13a6230e10a6f460c8794051094ea59fa1a6585d75f416826ef7d1abceb8600b657597f23f009b3770a0b378a1139dcffc7e1eaf355041cc844a935521f1f80b1be52d380"], 0x20}}, 0x20048800) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x726}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) ioctl$UFFDIO_MOVE(r3, 0xc028aa05, 0x0) ioctl$UFFDIO_COPY(r3, 0xc028aa03, 0xfffffffffffffffe) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, 0x0, 0x0) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x60002, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000f, 0x13, r5, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='cpuacct.usage_percpu\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r6, 0x0) syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x180380) r7 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0) fstat(r7, 0x0) r8 = userfaultfd(0x801) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x380}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) 2m2.634853347s ago: executing program 1 (id=2489): bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) r0 = msgget$private(0x0, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000600)={0x0, 0x7f390004, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="60000000020605020000200000000000000000001400078008001340040000000800124000060000050001000700000013000300686173683a6e65742c6966616365000005000440000000000900020073797a3100000000050005000a"], 0x60}}, 0x0) r2 = open(0x0, 0x400, 0x2c) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x100, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x17) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r2, 0x40405514, 0x0) r4 = syz_open_dev$loop(&(0x7f0000003ac0), 0x6, 0x454181) ioctl$IOC_PR_CLEAR(r4, 0x401070cd, 0x0) r5 = open(&(0x7f0000000080)='./file0\x00', 0x20802, 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r5, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x20, 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) r7 = socket$inet6(0xa, 0x3, 0x84) setsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in6=@empty, 0x4e23, 0x56, 0x2, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x2, 0xfffffffffffffff6, 0x2000000, 0x1}, {0x7, 0x0, 0x4}, 0x3, 0x0, 0x1}, {{@in6=@private2, 0x4d4, 0x6c}, 0xa, @in=@loopback, 0x3507, 0x4, 0x0, 0x0, 0xffffffff, 0x8, 0x4}}, 0xe8) timer_settime(r6, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) msgrcv(r0, 0x0, 0x0, 0x3, 0x3000) 8.621470398s ago: executing program 3 (id=2798): r0 = syz_open_dev$I2C(&(0x7f0000000180), 0x0, 0x0) (async) keyctl$set_reqkey_keyring(0xe, 0x1) (async) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) (async) fchdir(0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8001, 0x5, @empty, 0x8}, 0x1c) (async, rerun: 64) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) (rerun: 64) setsockopt$inet_int(r2, 0x0, 0x22, &(0x7f0000000000)=0x5, 0x4) (async) listen(r2, 0x2) (async) syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000280)=ANY=[], 0x0) r3 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) (async, rerun: 32) r4 = fsmount(r3, 0x0, 0x0) (rerun: 32) r5 = openat$cgroup_subtree(r4, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000340)=ANY=[@ANYRESDEC=r0, @ANYRESOCT], 0xb) (async) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x3d, 0x1, @thr={0x0, 0x0}}, &(0x7f0000000300)) (async, rerun: 64) fcntl$lock(0xffffffffffffffff, 0x1, &(0x7f0000000100)={0x1, 0x2, 0x2, 0x80003ff}) (async, rerun: 64) mprotect(&(0x7f00007fc000/0x2000)=nil, 0x2000, 0x11) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x8180, 0x0) (async) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, &(0x7f0000000080)=0x7f, 0x4) openat$sequencer(0xffffffffffffff9c, 0x0, 0x4780, 0x0) (async, rerun: 32) openat$sequencer(0xffffffffffffff9c, 0x0, 0x20001, 0x0) (async, rerun: 32) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async, rerun: 64) r6 = syz_open_dev$audion(0x0, 0x8000038ff, 0x410480) (rerun: 64) syz_open_dev$usbfs(0x0, 0x76, 0x101a01) openat$cgroup_ro(r6, 0x0, 0x275a, 0x0) (async, rerun: 64) r7 = syz_open_dev$video4linux(0x0, 0x800, 0x40100) (rerun: 64) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r7, 0xc0305602, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) 8.10929087s ago: executing program 3 (id=2800): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000005c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x60, r2, 0x2e8849031eb20c68, 0xe89, 0x25dfdbfe, {}, [@NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x7}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x7}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x60}, 0x1, 0x0, 0x0, 0x44001}, 0x800) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r4, &(0x7f0000002200)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="370626bd7000fcdbdf252000000008000300", @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4008041}, 0x4000000) 7.788154544s ago: executing program 0 (id=2801): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, &(0x7f0000000000)='\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, &(0x7f0000000080)='-\x00') r1 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0xe82) ioctl$FE_SET_VOLTAGE(r1, 0x6f43, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000000)=0x4320, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) timer_settime(0x0, 0x0, &(0x7f0000000300)={{}, {0x77359400}}, &(0x7f0000000340)) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000280)=@gcm_256={{0x304}, "48a91af4b4472d0c", "f5e06150009e1c9a7de902e9fc4a207891d92c8f7e0072da53f3e77b0b7e9d08", '\rHwC', "d6f3419e9f033463"}, 0x38) r2 = socket$l2tp6(0xa, 0x2, 0x73) writev(r2, &(0x7f0000000240)=[{&(0x7f0000000140)="425b242501537e63e58efbf866b2c420ccb44a066063239a8ef23d32500aaf01094ca7a6dd32c82568cb00a9ca93ff10e3a5d427c6979d1bfee468c0b428725dd91c7b2177bd1811b90ec5544a20012703b78a485e297d42ac9eaa7a59e0182807ea6e9e31b7c5fd9b30b943aaa8986366b281bae8c19c5b8bd280bdda94a7d4eabffbe1ec87db07a8439033202ded18a654262d98a26dd1be4a4d0288cffffd07e6f2ff0b0b0aaf3851b82136b58990320666858cccb6e30f76cae5d1cec52b57dd3d36a19e5e9ddc49", 0xca}], 0x1) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x10000) readv(r0, &(0x7f00000006c0)=[{&(0x7f0000001980)=""/4099, 0x1003}], 0x1) 7.443167296s ago: executing program 3 (id=2803): r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x400000001ff, 0x101301) r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'comedi_bond\x00', [0x8, 0x4, 0x7fffffff, 0xb, 0x2f, 0x2006, 0x4000f1, 0x8, 0xa28, 0x2, 0x0, 0x8500, 0x1003, 0x1000004, 0xf, 0x10000, 0xffffffa5, 0x7ffffffd, 0x1ff, 0x9ea, 0xd, 0x40000, 0x8, 0x5, 0x746f, 0x4, 0x5, 0x8, 0x0, 0x4, 0x7ffd]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000900), r4) ioctl$FITHAW(r2, 0xc0045878) write$cgroup_pressure(r1, &(0x7f0000000440)={'full', 0x20, 0x987, 0x20, 0xd1c8}, 0x2f) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000007c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r4, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000b40)=ANY=[@ANYBLOB="60f86081", @ANYRES16=r5, @ANYBLOB="19062cbd7000ffdbdf2518000000080030800400018008000300", @ANYRES32=r6, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) faccessat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r4, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, 0x0, 0x300, 0x70bd28, 0x25dfdbff, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x24004004}, 0x20008000) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000010c0)=ANY=[@ANYRES8, @ANYBLOB="e50014801aed64fc7e00f2665d5302e587a9532d57f555dcb4eb57f1689ba0ab04a4d3b9cb8cef86c3ac5db2219d175a805d3833e82afda186f9cf8f16d5b719643206c0b5423289ae911aa2", @ANYBLOB="77e3409a384f25b11405a1257bfb7b731415f60e1f426b4fc7bd423b56ef63ce0ec81c0b284421a70b5ca1f466e053d08ba0f36dfdc61fdf47dcf9d7c43fcf8570d14a5995eab1495c5dd62516ebf23ce5b504b4f00d5899d760804ab6720ad6e0b54ba02d0c10fa4368b17901fe1c4a93ea7e58453fb9580921d9588f46cb9acd512cd795c2b9799983ed4317da28efb3c20d5a11", @ANYRESDEC=r6, @ANYRES32], 0x14}}, 0x4000800) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000280)=@urb_type_control={0x2, {}, 0xfffffff8, 0x40, &(0x7f0000000000)={0x20, 0x3, 0x14, 0xfffd}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x20007, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) memfd_create(&(0x7f0000000480)='\xd1\xbd\x01\x9b\xd4\n\xa6\xb7\xa9kE\x10Bx\xd0\x05\xe9\xd57\xc9\xc3\tC8\xa0F\x91\x9e\x98\x17\xa9\xb7\xc5\xac\xafv\xff\x81/\x00\x98\x89\xeb\xb1Ot\xc5h\xc4f\xdf\x832\xc3\x9bW\x89<7\xf9\xfc\xf8\x89\x1e\xe5\xf6.\xa0\xfc\xc7\xf3\x01,\x17\xd4\xec3\x17\xe8x\xca?H\x813\xc0o57d\x82 \x89K\x14Dr\xe4\xc0K2\xd7\x12bu\x9ao\xf8H\xa6\xbf\xea\x11T\xcf*\x10\x9d', 0x4) r7 = socket$inet6(0xa, 0x1, 0x3) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r7, 0x29, 0x37, &(0x7f0000000080)=ANY=[@ANYBLOB="0206e7001000000401"], 0x40) setsockopt$inet6_buf(r7, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r7, &(0x7f0000001940)={0xa, 0x0, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xffffffff}, 0x1c) sendmmsg$inet6(r7, &(0x7f0000001840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) close(r3) close_range(r1, 0xffffffffffffffff, 0x0) r8 = socket$inet6(0xa, 0x805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1}]}, &(0x7f00000002c0)=0x10) getsockopt$bt_hci(r8, 0x84, 0x82, &(0x7f0000000080)=""/4076, &(0x7f0000000040)=0xfec) fstatfs(r3, &(0x7f00000002c0)=""/185) socket$nl_sock_diag(0x10, 0x3, 0x4) 6.539180571s ago: executing program 0 (id=2805): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x200, 0x0, 0x25dfdbfb, {{@in=@loopback, @in6=@local, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x0, 0x40, 0xfffffffffffffffd, 0x2}, {0xfffffffffffffffe}, 0x9, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {}, {0x0, 0x9}}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in=@empty}}, 0xe8) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001100e9"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) 6.166962772s ago: executing program 3 (id=2807): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)={0x2c, 0xb, 0x6, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x40800) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000440)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff, 0xee01}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000013c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000001480)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x3c, r2, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x400}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x8004) syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000087f2bb4024042c017e22010203010902640001020000000904ae0002c39c2a0009059e02ff03000000090582"], 0x0) 5.9795131s ago: executing program 0 (id=2808): mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6000, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = dup2(r0, r0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0xa, 0x3, 0x40000000, 0x10}) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53048dc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000000206011800000000000000000000fffd1c00078005001500020000000800114000000000050015000c0000000500010006000000050005000a00000005000400000000000900020073797a3000000000120003"], 0x68}}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) close(r2) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r4, 0x1, 0xa, &(0x7f0000000100)=0x7, 0x4) execve(&(0x7f0000000180)='./file1\x00', 0x0, &(0x7f0000000580)) 3.726921324s ago: executing program 2 (id=2813): memfd_create(&(0x7f0000000000)='\xff\x00l\x1e\xa0,\xc1\x8d\\Rxt\'\xb6\xbf\xc8*\n\xaf\x1b\xec\xfd\xbbY\x99\xb3\x06c\xd6\xf6\xb0\xcd=\xf3\x03`\x93\xff\x05e\xaa$\x00\xeaw\xd9\x10\x0f\x1d\x888\x8cS\x12?R\x99\xda7\xce)\x8f\xcc\x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd32J\xd7\x9f\xea:=\xcc\x17(|L\xda\xc3\x1ca\xe8s\xb6\xebw\xc7\xabS\xd7pJ\xd2\xa1\xcf\xae\x1f2\x9f\x98\xa80\r\x85\xb4\x86\xbc\xd0\xea\xbf\xb1Z\xb7e$\xcf<\ra\x9b\xa5\xdc\v\x1e\xfd\xc7\x91\xf22\xcf\x96\x99\xc1\xbb\xa1j\xe5\xa8\x7f\a\xa9\xa7G\xad\xa3\x8b\xf1\xdb\\]R\x8cf\xac1\xd7V\xaf\xb5\x8e\x10\x95\x9f=2\xd0-\xe1K:\xc3b\x89\x15OS\xa5\x98Ky\x12\xe7Qt#\xeb\x99\a\x10\x1c\xb3N\x85\xeb\x80\x05\x82_\x15\xdc\xbc\xf93\xdd\xf5g\x98\xd4\x8az\xe4`\xa5\x00\x00\x00\x00\xcd\x13\xfc+\xac\xe5\x8bI\f\xd6\x89\xc7HY\xcf\x00O\x88\xe6\x8b\x8bF/\x82u\xffCnG\x02\x82\xfc\xe9Od\x92\x06\xdeg@y\xa6=4\xb1}\xa8Yr\xad9\xb9b)\xec}\x87=\x91:IV\xab\xdf\xa2\xba+6D\x1fuf\xdeJYw$L\xa1\x83NH\xe3\xf2\x91\x8cW\xb7\b\x04\x12\x8b\x8bV\x19\xf1\r\xcb\x94\xa3\xf4\xe4\x97$\x99c\rG\xd7#\xe2\xfd\x80\xadR\x83\xdc\xb8d\x15|\xac\xb8g$\x0f@\xca3\x9f\xb1\xea\xc6vQ\x1b\xdb#\xa3\"\x9f\x9e\xd8\xba\x13d\x9bx\x9a\xbf\xee\xf2kQ\xe0\xc4/~7\xcd\xd1\x06\xe5\x17\x9b\bW|\xbc\x86D\x05\xaf<\xdfy,I2f\xa7G\xe3Qp<\'6 x\n\x94f\xf8\xa2\xea\xf4\xa5\x9eY\xf80C\x91\x7f\x16u\x8c(Xl\x90\xd2\x9f\xa9\xb9kJy[\x93\xfe{\xe5\x1a\xe9\xb7T\x19;\xb9\t\xe7\x0ei\xfaZ\xfbS:\x9b\xc1r\xcbM.\xf8\xb8wR\xb3p~b\xcb\v1-\a-\x8a#\xaa1\xa9\x9a\x88\a\xc5\xb9*\xd3?\xac\n\x9c\xcd\xe2\xc9\xbd\xeb\xb3\xf65\xbdaP\t\xd6\x06\x1c\xeeNg\x92>\x92>\xaf\b3\x05\xfdM\xd2F\v\xbd\xeb\x83 \x9d\x90S\x11w\xefg\\\xca\xe2\xfc~w\xbe\xefh#\x96\xa5h\xec\xbfr\xc8Bi\x90\"(\xf2\xc6\xcc\xfbX\x14{\x9e5\x87\x91\xe2\x9b\xd4\xc6\xc2whk+\x0f\x82\xca\xc1@\xcb~P\xe4\x18\xf9E\'\xab\xc7z\xd7\x05V{\xa1X\xa3\x10\x13.]tlz\x12\xde\xf2\xa43\xee#\x92J~\xda \x9b\xc4\xc0V\xb3\x9dCO\x1fu\x1c4\x1d\v}\x1b\xe5>w\xfbsm\xa3\fI|\x96-p\x86\xd3O\xfa\x9a\x8f\xb2\x8e\x88qGEG', 0x6) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$IEEE802154_ADD_IFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB], 0x28}}, 0x0) 3.63085668s ago: executing program 3 (id=2814): ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000387000/0x2000)=nil, 0x2000}, 0x5}) r0 = memfd_create(&(0x7f0000000580)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc5\x1d\xe7jDf\x87@\x8fg\x15RJw\x82\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7g\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x18) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f00000002c0)=0x20) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa07, &(0x7f0000000100)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x2, 0x12, r0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000100), 0x0) r2 = socket$alg(0x26, 0x5, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000300)={{0x0, 0x3, 0x3}}) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x5, 0x0, 'queue1\x00', 0x200000}) bind$alg(r2, &(0x7f0000002480)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x4000000086a82, 0x0) r8 = dup(r7) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYRES32=r7], 0x238}, 0x1, 0x0, 0x0, 0x40090}, 0x60000005) r9 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r9, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) listen(r9, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a01020000000000000000020000000900010073797a30000000000900030073797a32000000006b00030091abc12404d0c4c731b168d80d1f7f1d"], 0xfc}, 0x1, 0x0, 0x0, 0x40010}, 0x4000914) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r8, 0x3554000) fadvise64(r8, 0x85f5, 0x4000000005, 0x4) 3.26755922s ago: executing program 3 (id=2815): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x16c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in6=@dev={0xfe, 0x80, '\x00', 0x1a}, 0x0, 0x0, 0x4e21, 0x2, 0x2, 0x0, 0x0, 0x6c, 0x0, 0xee00}, {@in6=@private1, 0xfe, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @remote}, {0x0, 0x0, 0xf63, 0x8, 0x0, 0x0, 0x0, 0x543}, {0x4, 0x7fffffffffffffff}, {}, 0x70bd2c, 0x3500, 0xa, 0x1, 0x0, 0x50}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x40, "210466d38547aa140db9a200000000c538c7cb7a"}}, @encap={0x1c, 0x4, {0xfffffffffffffffd, 0x4e24, 0x4e24, @in6=@dev={0xfe, 0x80, '\x00', 0x2e}}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0xe29c41792e00708e) r1 = socket$inet6(0xa, 0x3, 0x7) r2 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x4, 0x0, 0x2000, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '|^b!'}, 0x0, 0x1, {0x0}}) ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000340)=@mmap={0x0, 0x2, 0x4, 0xe000, 0x0, {0x77359400}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "186856f3"}}) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="18000000071401000000000000000000050060"], 0x18}}, 0x0) r4 = syz_usb_connect(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$lan78xx(r4, 0x0, 0x0) syz_usb_control_io$sierra_net(r4, 0x0, &(0x7f00000010c0)={0x1c, &(0x7f00000001c0)={0x20, 0xf, 0x41, "91aa578a3022d8659838132382d48bd0fcfa31fdfde11aff36f23303cc447f1d40881d25035bc25644e46ed1f02ea79b47e621d60024731afb11555ccb8d9ec8d2"}, 0x0, 0x0}) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x1d, &(0x7f0000000040)={0xd, 0x8, 0x8, 0x3, 0x7}, 0x14) syz_usb_ep_write(r4, 0x5, 0x59, &(0x7f0000000240)="4dd6f5b8827f656c6b121b21c52b4e94c40f0b9586fe4a8e4349c369cfaf3e9a6b3cc8f69a72e690b9bf2b69b8c28e126bb0537a8d2b86141e501e235d17c4e16f06057e409f3526a2c77f4bd4b40160027c56576d9916b3c6") r7 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r7, 0x89e1, &(0x7f0000000000)={r5}) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000100)=0x2) sendmsg$netlink(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1400000076001f"], 0x14}], 0x1, 0x0, 0x0, 0x4004000}, 0x0) 2.507567505s ago: executing program 2 (id=2816): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0), 0x8042, 0x0) write$vga_arbiter(r5, &(0x7f0000000080)=@other={'lock', ' ', 'io'}, 0x8) bind$packet(r2, &(0x7f00000000c0)={0x11, 0x18, r4, 0x1, 0x81}, 0x14) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000ac0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000080)={0x9f4, r1, 0x8, 0x70bd25, 0x25dfdbff, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r4}, @WGDEVICE_A_PEERS={0x9c8, 0x8, 0x0, 0x1, [{0x6c, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "03dfc8333b8a2d036d8001374cf7d41357064f69a482c8a31d4422e73cda25be"}, @WGPEER_A_FLAGS={0x8, 0x3, 0x6}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "de22c94007849ccfcfdd6950573203bb125c7080224001a5e896ec17f7ac48df"}]}, {0x28, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "a18806fbffb70f41c1a741f63b8a229b266e533fc0c323caad243bdad13db3a4"}]}, {0x1e0, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e21, @empty}}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x1, @mcast1, 0x7}}, @WGPEER_A_ALLOWEDIPS={0x154, 0x9, 0x0, 0x1, [{0x7c, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010101}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x3d}}, {0x5, 0x3, 0x1}}]}, {0x40, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x3}}]}, {0x94, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00'}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x22}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x1}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x7}, @WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e23, 0x7, @private2, 0x100}}]}, {0x730, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8, 0x3, 0x3}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "fa825290d20e6e03a1e694c28f8f72ca7dbca63f7db6403951e6c72851ca95cb"}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "482e12336c9e07cd5eb419efda03d206ee643bed59e710335010e8b6f32541aa"}, @WGPEER_A_ALLOWEDIPS={0x254, 0x9, 0x0, 0x1, [{0x4c, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x11}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x5, 0x3, 0x1}}]}, {0x100, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x3e}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private1}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00'}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x1}}]}, {0x40, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x2}}]}, {0xc4, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x2}}]}]}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_FLAGS={0x8, 0x3, 0xc}, @WGPEER_A_FLAGS={0x8, 0x3, 0x6}, @WGPEER_A_ALLOWEDIPS={0x470, 0x9, 0x0, 0x1, [{0xd0, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5}}]}, {0x64, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x5, 0x3, 0x2}}]}, {0xac, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5}}]}, {0x7c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @private1}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010100}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x2}}]}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x2}}]}, {0x100, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @empty}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010100}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x3}}]}, {0xe8, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010101}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}}, {0x5, 0x3, 0x2}}]}]}]}, {0x20, 0x0, 0x0, 0x1, [@WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}]}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x7}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e20}]}, 0x9f4}}, 0x0) 2.050724434s ago: executing program 1 (id=2491): r0 = socket(0x840000000002, 0x3, 0x10100) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @remote}, 0x61) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$sock_ifreq(r1, 0x89f1, &(0x7f0000000000)={'bond0\x00', @ifru_names='wlan1\x00'}) sendmmsg$inet(r0, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x5, [0x800, 0x4], 0x9}, 0x10) 1.843368766s ago: executing program 1 (id=2817): r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r0, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x1) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={0xb0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @local}}}]}, @CTA_TIMEOUT={0x8}, @CTA_SEQ_ADJ_ORIG={0x1c, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x5}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0xe}]}]}, 0xb0}}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0x4640}, 0x2}, 0x0) 1.84299873s ago: executing program 2 (id=2818): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0xa82, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x2) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000000)={0x0, 0x4, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) exit(0xfffffffffffff694) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/dev\x00') pread64(r2, &(0x7f000001a240)=""/102400, 0x19000, 0x4041e) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x9) mremap(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000009000/0x4000)=nil) shmget(0x1, 0x2000, 0x800, &(0x7f0000ffc000/0x2000)=nil) 1.510886999s ago: executing program 0 (id=2819): bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x3) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0), 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.455878415s ago: executing program 1 (id=2820): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000800)=[{{&(0x7f0000000080)={0xa, 0x0, 0x10001, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7}, 0x1c, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x400c0c4) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001140)=ANY=[], 0x48}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CAP_X86_DISABLE_EXITS(0xffffffffffffffff, 0x4068aea3, &(0x7f00000065c0)={0x8f, 0x0, 0x4}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$NFNL_MSG_ACCT_DEL(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x38, 0x3, 0x7, 0x201, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x3}, @NFACCT_FLAGS={0x8}, @NFACCT_FLAGS={0x8}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x8011) syz_kvm_setup_cpu$x86(r1, r0, &(0x7f00003a1000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="9a01000000f800b8d58800000f23d00f21f8351000000d0f23f864640f79ea66baf80cb8c85f5480ef66bafc0cecc4c2adac17b9550200000f320f2860c7c4e11751df0f2e2d00000080b9800000c00f3235008000000f30", 0x58}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000080)={0xe0003, 0x0, {[0xffffffffffffffff, 0x1f8, 0x83, 0xffffffffefffff15, 0x3, 0x4, 0x1, 0x4]}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_GET(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000f8f79036d62f67170b90cd4bb1e567e4f10cdeec1f5195b2e865b57b1b022a15fe93ea7537499a4d20ac6f402a9d", @ANYRES16=r4, @ANYBLOB="010029bd7000000000001b000000"], 0x14}, 0x1, 0x0, 0x0, 0x4008080}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) prctl$PR_SET_MM(0x23, 0xb, &(0x7f00002d6000/0x1000)=nil) 683.683448ms ago: executing program 2 (id=2821): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x1, 0x40000032, r0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000e40), 0x40080, 0x0) ioctl$TIOCPKT(r2, 0x5420, &(0x7f00000000c0)=0x1) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r3, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r4 = syz_open_dev$sndpcmc(&(0x7f0000000480), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(r4, 0xc0884123, &(0x7f0000000000)={0x3}) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000000, 0x0, "fe94b89fc43c3328eae0cae1f5eba329e6f216"}) splice(r2, 0x0, r0, 0x0, 0x7ffff000, 0x1) unshare(0x40200) r5 = semget(0x3, 0x6, 0x79d) semop(r5, &(0x7f0000000080)=[{0x1, 0x8001, 0x1000}], 0x1) semop(r5, &(0x7f0000000000)=[{0x3, 0xbbdd, 0x1000}], 0x1) semctl$SETVAL(r5, 0x1, 0x10, 0x0) readv(r1, 0x0, 0x0) 438.852311ms ago: executing program 1 (id=2822): syz_usb_connect(0x2, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = accept$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) shutdown(r0, 0x1) 306.628823ms ago: executing program 2 (id=2823): memfd_create(&(0x7f0000000000)='\xff\x00l\x1e\xa0,\xc1\x8d\\Rxt\'\xb6\xbf\xc8*\n\xaf\x1b\xec\xfd\xbbY\x99\xb3\x06c\xd6\xf6\xb0\xcd=\xf3\x03`\x93\xff\x05e\xaa$\x00\xeaw\xd9\x10\x0f\x1d\x888\x8cS\x12?R\x99\xda7\xce)\x8f\xcc\x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd32J\xd7\x9f\xea:=\xcc\x17(|L\xda\xc3\x1ca\xe8s\xb6\xebw\xc7\xabS\xd7pJ\xd2\xa1\xcf\xae\x1f2\x9f\x98\xa80\r\x85\xb4\x86\xbc\xd0\xea\xbf\xb1Z\xb7e$\xcf<\ra\x9b\xa5\xdc\v\x1e\xfd\xc7\x91\xf22\xcf\x96\x99\xc1\xbb\xa1j\xe5\xa8\x7f\a\xa9\xa7G\xad\xa3\x8b\xf1\xdb\\]R\x8cf\xac1\xd7V\xaf\xb5\x8e\x10\x95\x9f=2\xd0-\xe1K:\xc3b\x89\x15OS\xa5\x98Ky\x12\xe7Qt#\xeb\x99\a\x10\x1c\xb3N\x85\xeb\x80\x05\x82_\x15\xdc\xbc\xf93\xdd\xf5g\x98\xd4\x8az\xe4`\xa5\x00\x00\x00\x00\xcd\x13\xfc+\xac\xe5\x8bI\f\xd6\x89\xc7HY\xcf\x00O\x88\xe6\x8b\x8bF/\x82u\xffCnG\x02\x82\xfc\xe9Od\x92\x06\xdeg@y\xa6=4\xb1}\xa8Yr\xad9\xb9b)\xec}\x87=\x91:IV\xab\xdf\xa2\xba+6D\x1fuf\xdeJYw$L\xa1\x83NH\xe3\xf2\x91\x8cW\xb7\b\x04\x12\x8b\x8bV\x19\xf1\r\xcb\x94\xa3\xf4\xe4\x97$\x99c\rG\xd7#\xe2\xfd\x80\xadR\x83\xdc\xb8d\x15|\xac\xb8g$\x0f@\xca3\x9f\xb1\xea\xc6vQ\x1b\xdb#\xa3\"\x9f\x9e\xd8\xba\x13d\x9bx\x9a\xbf\xee\xf2kQ\xe0\xc4/~7\xcd\xd1\x06\xe5\x17\x9b\bW|\xbc\x86D\x05\xaf<\xdfy,I2f\xa7G\xe3Qp<\'6 x\n\x94f\xf8\xa2\xea\xf4\xa5\x9eY\xf80C\x91\x7f\x16u\x8c(Xl\x90\xd2\x9f\xa9\xb9kJy[\x93\xfe{\xe5\x1a\xe9\xb7T\x19;\xb9\t\xe7\x0ei\xfaZ\xfbS:\x9b\xc1r\xcbM.\xf8\xb8wR\xb3p~b\xcb\v1-\a-\x8a#\xaa1\xa9\x9a\x88\a\xc5\xb9*\xd3?\xac\n\x9c\xcd\xe2\xc9\xbd\xeb\xb3\xf65\xbdaP\t\xd6\x06\x1c\xeeNg\x92>\x92>\xaf\b3\x05\xfdM\xd2F\v\xbd\xeb\x83 \x9d\x90S\x11w\xefg\\\xca\xe2\xfc~w\xbe\xefh#\x96\xa5h\xec\xbfr\xc8Bi\x90\"(\xf2\xc6\xcc\xfbX\x14{\x9e5\x87\x91\xe2\x9b\xd4\xc6\xc2whk+\x0f\x82\xca\xc1@\xcb~P\xe4\x18\xf9E\'\xab\xc7z\xd7\x05V{\xa1X\xa3\x10\x13.]tlz\x12\xde\xf2\xa43\xee#\x92J~\xda \x9b\xc4\xc0V\xb3\x9dCO\x1fu\x1c4\x1d\v}\x1b\xe5>w\xfbsm\xa3\fI|\x96-p\x86\xd3O\xfa\x9a\x8f\xb2\x8e\x88qGEG', 0x6) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$IEEE802154_ADD_IFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB], 0x28}}, 0x0) 244.374755ms ago: executing program 0 (id=2824): ioctl$CEC_RECEIVE(0xffffffffffffffff, 0xc0386106, &(0x7f0000000180)={0xc9, 0x1, 0xfffffffc, 0x6, 0x4, 0x0, "5debca561a5fbf61048955f6f876b2ff"}) r0 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000800)={r0, r0, r0}, 0x0, 0x4000, &(0x7f0000000280)={&(0x7f00000000c0)={'sha384\x00'}}) 11.641794ms ago: executing program 2 (id=2825): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x41, &(0x7f0000000040)=0x7f, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) recvmmsg(r0, &(0x7f0000003040)=[{{0x0, 0x0, &(0x7f00000027c0)=[{&(0x7f0000002580)=""/241, 0xf1}], 0x1, 0x0, 0x0, 0xf100}, 0x8001}], 0x1, 0x40014102, 0x0) 0s ago: executing program 0 (id=2826): munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) sendto$inet6(r0, &(0x7f0000000240)='\x00', 0x1, 0x0, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) dup(r0) kernel console output (not intermixed with test programs): il, usb_gadget_register_driver returned -16 [ 524.517426][T12358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.539360][T12358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 524.566761][T12358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.567422][T12358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 524.590719][ T60] Bluetooth: hci4: command tx timeout [ 524.953469][T12372] comedi comedi1: 8255: I/O port conflict (0xfffffffc,4) [ 524.975765][T12373] RDS: rds_bind could not find a transport for ::ffff:10.1.1.1, load rds_tcp or rds_rdma? [ 525.283656][ T9] usb 3-1: new full-speed USB device number 116 using dummy_hcd [ 525.450046][ T9] usb 3-1: config index 0 descriptor too short (expected 39, got 27) [ 525.450255][ T9] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 525.450284][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 525.507990][ T9] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 525.508147][ T9] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 525.508172][ T9] usb 3-1: Product: syz [ 525.508189][ T9] usb 3-1: Manufacturer: syz [ 525.508207][ T9] usb 3-1: SerialNumber: syz [ 525.579790][ T9] usb 3-1: config 0 descriptor?? [ 525.585723][ T9] hub 3-1:0.0: bad descriptor, ignoring hub [ 525.585761][ T9] hub 3-1:0.0: probe with driver hub failed with error -5 [ 525.638613][ T9] usb 3-1: selecting invalid altsetting 0 [ 525.788762][T12375] netlink: 'syz.2.2329': attribute type 1 has an invalid length. [ 526.332862][ T92] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 526.659702][ T60] Bluetooth: hci4: command tx timeout [ 527.015260][T12398] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 527.015872][T12398] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 527.725704][ T92] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 528.398646][ T9] usb 3-1: USB disconnect, device number 116 [ 528.749547][ T60] Bluetooth: hci4: command tx timeout [ 528.983621][ T9068] udevd[9068]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 529.053724][ T92] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.274174][ T9] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 529.426232][ T9] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 529.426273][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 529.492978][ T9] usb 3-1: config 0 descriptor?? [ 529.515284][ T9] cp210x 3-1:0.0: cp210x converter detected [ 529.727176][ T9] cp210x 3-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 529.727453][ T9] cp210x 3-1:0.0: querying part number failed [ 529.857938][ T9] usb 3-1: cp210x converter now attached to ttyUSB0 [ 529.890334][T12433] 9p: Bad value for 'rfdno' [ 529.948545][T12433] atomic_op ffff888060221218 conn xmit_atomic 0000000000000000 [ 530.148502][ T9] usb 3-1: USB disconnect, device number 117 [ 530.228085][ T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 530.254354][ T9] cp210x 3-1:0.0: device disconnected [ 530.264597][ T92] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.544079][T12436] netlink: 'syz.2.2351': attribute type 2 has an invalid length. [ 530.582067][T12441] netlink: 184 bytes leftover after parsing attributes in process `syz.0.2353'. [ 530.582779][T12441] xt_socket: unknown flags 0xd0 [ 530.686735][T12439] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2351'. [ 531.655898][T12461] netlink: 436 bytes leftover after parsing attributes in process `syz.2.2358'. [ 531.656096][T12461] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2358'. [ 531.974416][T12464] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2359'. [ 532.263451][T12465] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 532.783622][T12299] bridge0: port 1(bridge_slave_0) entered blocking state [ 532.784197][T12299] bridge0: port 1(bridge_slave_0) entered disabled state [ 532.784562][T12299] bridge_slave_0: entered allmulticast mode [ 532.842363][T12299] bridge_slave_0: entered promiscuous mode [ 533.214464][T12299] bridge0: port 2(bridge_slave_1) entered blocking state [ 533.218545][T12299] bridge0: port 2(bridge_slave_1) entered disabled state [ 533.237653][T12299] bridge_slave_1: entered allmulticast mode [ 533.368310][T12299] bridge_slave_1: entered promiscuous mode [ 533.420056][ T935] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 533.579531][ T935] usb 3-1: Using ep0 maxpacket: 32 [ 533.587325][ T935] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 533.626666][ T935] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 533.627007][ T935] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 533.627031][ T935] usb 3-1: Product: syz [ 533.627046][ T935] usb 3-1: Manufacturer: syz [ 533.627061][ T935] usb 3-1: SerialNumber: syz [ 533.748701][ T935] usb 3-1: config 0 descriptor?? [ 533.980999][T12299] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 534.004539][ T32] usb 3-1: USB disconnect, device number 118 [ 534.101738][T12299] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 534.835276][ T92] bridge_slave_1: left allmulticast mode [ 534.835321][ T92] bridge_slave_1: left promiscuous mode [ 534.835658][ T92] bridge0: port 2(bridge_slave_1) entered disabled state [ 534.921459][ T92] bridge_slave_0: left allmulticast mode [ 534.921503][ T92] bridge_slave_0: left promiscuous mode [ 534.926669][ T92] bridge0: port 1(bridge_slave_0) entered disabled state [ 535.251398][ T935] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 535.432682][ T935] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 535.432730][ T935] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 535.432837][ T935] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 535.497027][ T935] usb 3-1: config 0 descriptor?? [ 535.555254][ T935] pwc: Askey VC010 type 2 USB webcam detected. [ 535.943259][ T935] pwc: recv_control_msg error -32 req 02 val 2b00 [ 535.944333][ T935] pwc: recv_control_msg error -32 req 02 val 2700 [ 535.945355][ T935] pwc: recv_control_msg error -32 req 02 val 2c00 [ 535.946215][ T935] pwc: recv_control_msg error -32 req 04 val 1000 [ 535.947284][ T935] pwc: recv_control_msg error -32 req 04 val 1300 [ 535.948324][ T935] pwc: recv_control_msg error -32 req 04 val 1400 [ 535.963176][ T935] pwc: recv_control_msg error -32 req 02 val 2000 [ 536.003977][ T935] pwc: recv_control_msg error -32 req 02 val 2100 [ 536.005000][ T935] pwc: recv_control_msg error -32 req 04 val 1500 [ 536.006080][ T935] pwc: recv_control_msg error -32 req 02 val 2500 [ 536.006938][ T935] pwc: recv_control_msg error -32 req 02 val 2400 [ 536.298008][ T935] pwc: recv_control_msg error -71 req 02 val 2900 [ 536.298954][ T935] pwc: recv_control_msg error -71 req 02 val 2800 [ 536.316187][ T935] pwc: recv_control_msg error -71 req 04 val 1100 [ 536.317494][ T935] pwc: recv_control_msg error -71 req 04 val 1200 [ 536.387081][ T935] pwc: Registered as video103. [ 536.427779][ T935] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input26 [ 536.689585][ T935] usb 3-1: USB disconnect, device number 119 [ 536.991376][ T92] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 537.080535][ T92] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 537.126026][ T92] bond0 (unregistering): Released all slaves [ 537.168931][T12299] team0: Port device team_slave_0 added [ 537.390024][ T935] usb 3-1: new full-speed USB device number 120 using dummy_hcd [ 537.422854][T12522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 537.423578][T12522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 537.453598][T12299] team0: Port device team_slave_1 added [ 537.528855][T12299] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 537.528887][T12299] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 537.528928][T12299] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 537.616856][ T935] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 537.616980][ T935] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.616998][ T935] usb 3-1: Product: syz [ 537.617011][ T935] usb 3-1: Manufacturer: syz [ 537.617024][ T935] usb 3-1: SerialNumber: syz [ 537.678869][T12299] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 537.678891][T12299] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 537.678925][T12299] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 537.759139][ T935] usb 3-1: config 0 descriptor?? [ 538.033021][T12299] hsr_slave_0: entered promiscuous mode [ 538.047235][T12299] hsr_slave_1: entered promiscuous mode [ 538.051823][T12299] debugfs: 'hsr0' already exists in 'hsr' [ 538.051862][T12299] Cannot create hsr debugfs directory [ 538.072266][ T935] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 539.158271][T12534] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 539.158917][T12534] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 539.543896][T12548] overlayfs: failed to clone upperpath [ 540.846526][ T935] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 540.884366][ T935] usb 3-1: USB disconnect, device number 120 [ 541.239943][T12568] 9pnet_fd: Insufficient options for proto=fd [ 542.545265][ T5271] 8021q: adding VLAN 0 to HW filter on device eth1 [ 543.299412][ T935] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 543.449483][ T935] usb 3-1: Using ep0 maxpacket: 32 [ 543.462619][ T935] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 543.462655][ T935] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 543.494561][ T935] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 543.495020][ T935] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 543.495050][ T935] usb 3-1: Product: syz [ 543.495271][ T935] usb 3-1: Manufacturer: syz [ 543.495434][ T935] usb 3-1: SerialNumber: syz [ 543.529249][T12589] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 543.616278][T12589] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 543.739569][ T935] usb 3-1: config 0 descriptor?? [ 543.870253][ T38] audit: type=1326 audit(1778688060.421:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12590 comm="syz.1.2400" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f661c90ce59 code=0x0 [ 543.979982][ T9] usb 3-1: USB disconnect, device number 121 [ 544.159687][ T92] : left promiscuous mode [ 544.209578][ T92] hsr_slave_1: left promiscuous mode [ 544.236838][ T92] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 544.237021][ T92] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 544.275056][ T92] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 544.275109][ T92] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 544.426248][ T92] veth1_macvtap: left promiscuous mode [ 544.436940][ T92] veth0_macvtap: left promiscuous mode [ 544.520487][ T92] veth1_vlan: left promiscuous mode [ 544.553249][ T92] veth0_vlan: left promiscuous mode [ 545.589541][T12606] xt_l2tp: missing protocol rule (udp|l2tpip) [ 547.797754][T12617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.798399][T12617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 549.435932][T12638] FAULT_INJECTION: forcing a failure. [ 549.435932][T12638] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 549.435977][T12638] CPU: 1 UID: 0 PID: 12638 Comm: syz.2.2414 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 549.436021][T12638] Tainted: [L]=SOFTLOCKUP [ 549.436031][T12638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 549.436048][T12638] Call Trace: [ 549.436059][T12638] [ 549.436070][T12638] dump_stack_lvl+0xe8/0x150 [ 549.436117][T12638] should_fail_ex+0x46b/0x600 [ 549.436154][T12638] _copy_to_user+0x31/0xb0 [ 549.436197][T12638] simple_read_from_buffer+0xe1/0x170 [ 549.436234][T12638] proc_fail_nth_read+0x1be/0x230 [ 549.436274][T12638] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 549.436311][T12638] ? rw_verify_area+0x2ac/0x4e0 [ 549.436345][T12638] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 549.436379][T12638] vfs_read+0x212/0xa80 [ 549.436423][T12638] ? __pfx_vfs_read+0x10/0x10 [ 549.436459][T12638] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 549.436499][T12638] ? lockdep_hardirqs_on+0x7a/0x110 [ 549.436539][T12638] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 549.436578][T12638] ? mutex_lock_nested+0x152/0x1d0 [ 549.436609][T12638] ? fdget_pos+0x252/0x320 [ 549.436648][T12638] ksys_read+0x156/0x270 [ 549.436685][T12638] ? __pfx_ksys_read+0x10/0x10 [ 549.436728][T12638] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.436757][T12638] do_syscall_64+0x15f/0xf80 [ 549.436781][T12638] ? trace_irq_disable+0x3b/0x140 [ 549.436817][T12638] ? clear_bhb_loop+0x40/0x90 [ 549.436848][T12638] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.436874][T12638] RIP: 0033:0x7f7fe504d68e [ 549.436898][T12638] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 549.436921][T12638] RSP: 002b:00007f7fe32e5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 549.436948][T12638] RAX: ffffffffffffffda RBX: 00007f7fe32e66c0 RCX: 00007f7fe504d68e [ 549.436982][T12638] RDX: 000000000000000f RSI: 00007f7fe32e60a0 RDI: 0000000000000003 [ 549.436999][T12638] RBP: 00007f7fe32e6090 R08: 0000000000000000 R09: 0000000000000000 [ 549.437021][T12638] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 549.437038][T12638] R13: 00007f7fe5306038 R14: 00007f7fe5305fa0 R15: 00007fff5539eb48 [ 549.437077][T12638] [ 551.400642][ T5271] 8021q: adding VLAN 0 to HW filter on device eth2 [ 552.054782][T12673] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=13 (208 ns) > initial count (96 ns). Using initial count to start timer. [ 553.866932][T12703] netlink: 'syz.1.2430': attribute type 46 has an invalid length. [ 553.866958][T12703] netlink: 'syz.1.2430': attribute type 28 has an invalid length. [ 554.126856][T12705] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2432'. [ 554.789545][ T5756] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 554.884039][T12725] ceph: No source [ 554.941479][ T5756] usb 3-1: device descriptor read/64, error -71 [ 555.199987][ T5756] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 555.369358][ T5756] usb 3-1: device descriptor read/64, error -71 [ 555.370033][T12731] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2439'. [ 555.493732][ T5756] usb usb3-port1: attempt power cycle [ 555.850248][ T5756] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 555.871331][ T5756] usb 3-1: device descriptor read/8, error -71 [ 556.129587][ T5756] usb 3-1: new high-speed USB device number 125 using dummy_hcd [ 556.155314][ T5756] usb 3-1: device descriptor read/8, error -71 [ 556.265135][ T5756] usb usb3-port1: unable to enumerate USB device [ 556.266683][T12746] netlink: 108 bytes leftover after parsing attributes in process `syz.0.2442'. [ 556.556024][T12299] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 556.666210][T12299] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 556.712486][T12299] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 556.736049][T12299] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 556.746464][T12299] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 556.785311][T12299] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 556.948603][T12299] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 557.194510][T12759] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 557.195316][T12759] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 557.218476][T12299] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 557.789968][T12773] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2447'. [ 557.904867][ T60] Bluetooth: hci0: unexpected event for opcode 0x2031 [ 558.557000][T12299] 8021q: adding VLAN 0 to HW filter on device bond0 [ 558.610843][ T5756] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 558.771839][ T5756] usb 3-1: Using ep0 maxpacket: 32 [ 558.781321][ T5756] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 558.781361][ T5756] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 558.781406][ T5756] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 558.781435][ T5756] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 558.836533][ T5756] usb 3-1: config 0 descriptor?? [ 559.344422][ T5756] usbhid 3-1:0.0: can't add hid device: -71 [ 559.344664][ T5756] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 559.395860][ T5756] usb 3-1: USB disconnect, device number 126 [ 559.397039][T12299] 8021q: adding VLAN 0 to HW filter on device team0 [ 559.527092][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 559.527385][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 559.547575][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 559.547753][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 559.982408][ T38] audit: type=1800 audit(1778688076.501:8): pid=12802 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2454" name="nullb0" dev="tmpfs" ino=1661 res=0 errno=0 [ 563.067432][ T1335] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.067546][ T1335] ieee802154 phy1 wpan1: encryption failed: -22 [ 565.154128][T12299] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 565.366073][T12893] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 565.366751][T12893] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 565.523792][T12299] veth0_vlan: entered promiscuous mode [ 565.661045][T12299] veth1_vlan: entered promiscuous mode [ 565.807615][T12299] veth0_macvtap: entered promiscuous mode [ 565.846366][T12299] veth1_macvtap: entered promiscuous mode [ 566.029005][T12299] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 566.330109][T12905] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 566.330674][T12905] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 566.359098][T12299] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 566.575067][ T3321] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.575133][ T3321] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.575169][ T3321] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.575202][ T3321] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 567.138050][T12908] FAULT_INJECTION: forcing a failure. [ 567.138050][T12908] name failslab, interval 1, probability 0, space 0, times 0 [ 567.138094][T12908] CPU: 1 UID: 0 PID: 12908 Comm: syz.2.2477 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 567.138128][T12908] Tainted: [L]=SOFTLOCKUP [ 567.138138][T12908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 567.138153][T12908] Call Trace: [ 567.138162][T12908] [ 567.138173][T12908] dump_stack_lvl+0xe8/0x150 [ 567.138211][T12908] should_fail_ex+0x46b/0x600 [ 567.138249][T12908] should_failslab+0xa8/0x100 [ 567.138291][T12908] __kmalloc_cache_noprof+0x84/0x690 [ 567.138328][T12908] ? dev_ethtool+0x132/0x1ae0 [ 567.138358][T12908] dev_ethtool+0x132/0x1ae0 [ 567.138392][T12908] ? kasan_quarantine_put+0xbb/0x1f0 [ 567.138427][T12908] ? __pfx_dev_ethtool+0x10/0x10 [ 567.138450][T12908] ? dev_load+0x21/0x1f0 [ 567.138492][T12908] ? dev_load+0x21/0x1f0 [ 567.138525][T12908] ? dev_load+0x21/0x1f0 [ 567.138558][T12908] dev_ioctl+0x392/0x1150 [ 567.138595][T12908] sock_do_ioctl+0x23e/0x320 [ 567.138626][T12908] ? __pfx_sock_do_ioctl+0x10/0x10 [ 567.138668][T12908] sock_ioctl+0x5c9/0x7f0 [ 567.138697][T12908] ? __pfx_sock_ioctl+0x10/0x10 [ 567.138725][T12908] ? __fget_files+0x2a/0x420 [ 567.138754][T12908] ? __fget_files+0x3a6/0x420 [ 567.138780][T12908] ? __fget_files+0x2a/0x420 [ 567.138813][T12908] ? bpf_lsm_file_ioctl+0x9/0x20 [ 567.138841][T12908] ? __pfx_sock_ioctl+0x10/0x10 [ 567.138869][T12908] __se_sys_ioctl+0xff/0x170 [ 567.138914][T12908] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.138940][T12908] do_syscall_64+0x15f/0xf80 [ 567.138964][T12908] ? trace_irq_disable+0x3b/0x140 [ 567.139002][T12908] ? clear_bhb_loop+0x40/0x90 [ 567.139033][T12908] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.139059][T12908] RIP: 0033:0x7f7fe508ce59 [ 567.139084][T12908] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 567.139107][T12908] RSP: 002b:00007f7fe32e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 567.139135][T12908] RAX: ffffffffffffffda RBX: 00007f7fe5305fa0 RCX: 00007f7fe508ce59 [ 567.139154][T12908] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 0000000000000004 [ 567.139170][T12908] RBP: 00007f7fe32e6090 R08: 0000000000000000 R09: 0000000000000000 [ 567.139185][T12908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 567.139199][T12908] R13: 00007f7fe5306038 R14: 00007f7fe5305fa0 R15: 00007fff5539eb48 [ 567.139235][T12908] [ 567.560902][T12910] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2478'. [ 567.619075][T12913] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 567.630574][T12913] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 567.638038][T12913] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 567.638626][T12913] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 569.254142][T12928] FAULT_INJECTION: forcing a failure. [ 569.254142][T12928] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 569.254183][T12928] CPU: 1 UID: 0 PID: 12928 Comm: syz.0.2484 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 569.254212][T12928] Tainted: [L]=SOFTLOCKUP [ 569.254219][T12928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 569.254232][T12928] Call Trace: [ 569.254240][T12928] [ 569.254250][T12928] dump_stack_lvl+0xe8/0x150 [ 569.254280][T12928] should_fail_ex+0x46b/0x600 [ 569.254311][T12928] _copy_from_user+0x2d/0xb0 [ 569.254343][T12928] comedi_unlocked_ioctl+0x7f8/0x1b00 [ 569.254389][T12928] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 569.254424][T12928] ? tomoyo_path_number_perm+0x219/0x630 [ 569.254455][T12928] ? tomoyo_path_number_perm+0x219/0x630 [ 569.254490][T12928] ? do_vfs_ioctl+0x117b/0x1540 [ 569.254528][T12928] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 569.254601][T12928] ? __fget_files+0x2a/0x420 [ 569.254642][T12928] ? __fget_files+0x2a/0x420 [ 569.254665][T12928] ? __fget_files+0x3a6/0x420 [ 569.254687][T12928] ? __fget_files+0x2a/0x420 [ 569.254714][T12928] ? bpf_lsm_file_ioctl+0x9/0x20 [ 569.254736][T12928] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 569.254767][T12928] __se_sys_ioctl+0xff/0x170 [ 569.254796][T12928] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.254823][T12928] do_syscall_64+0x15f/0xf80 [ 569.254844][T12928] ? trace_irq_disable+0x3b/0x140 [ 569.254874][T12928] ? clear_bhb_loop+0x40/0x90 [ 569.254900][T12928] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.254922][T12928] RIP: 0033:0x7fa4e4eace59 [ 569.254945][T12928] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 569.254965][T12928] RSP: 002b:00007fa4e3106028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 569.254990][T12928] RAX: ffffffffffffffda RBX: 00007fa4e5125fa0 RCX: 00007fa4e4eace59 [ 569.255008][T12928] RDX: 0000200000000180 RSI: 0000000080506409 RDI: 0000000000000003 [ 569.255022][T12928] RBP: 00007fa4e3106090 R08: 0000000000000000 R09: 0000000000000000 [ 569.255035][T12928] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 569.255047][T12928] R13: 00007fa4e5126038 R14: 00007fa4e5125fa0 R15: 00007ffce1b10da8 [ 569.255076][T12928] [ 569.889720][ T5800] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 570.067135][ T3321] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 570.067158][ T3321] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 570.109342][ T5800] usb 3-1: Using ep0 maxpacket: 32 [ 570.111765][ T5800] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 570.111797][ T5800] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 570.111834][ T5800] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 570.111858][ T5800] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 570.164560][ T5800] usb 3-1: config 0 descriptor?? [ 570.402427][T12932] 9p: Bad value for 'rfdno' [ 570.704917][ T5800] usbhid 3-1:0.0: can't add hid device: -71 [ 570.705073][ T5800] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 570.786938][ T5800] usb 3-1: USB disconnect, device number 127 [ 572.152308][ T2164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 572.152337][ T2164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 572.169437][ T5800] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 572.354439][ T5800] usb 3-1: Using ep0 maxpacket: 16 [ 572.356886][ T5800] usb 3-1: config 4 has an invalid interface number: 211 but max is 1 [ 572.356924][ T5800] usb 3-1: config 4 has an invalid interface number: 171 but max is 1 [ 572.356950][ T5800] usb 3-1: config 4 has no interface number 0 [ 572.356971][ T5800] usb 3-1: config 4 has no interface number 1 [ 572.357045][ T5800] usb 3-1: config 4 interface 211 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 572.357073][ T5800] usb 3-1: config 4 interface 211 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 572.357098][ T5800] usb 3-1: config 4 interface 211 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 572.357141][ T5800] usb 3-1: config 4 interface 211 has no altsetting 0 [ 572.357166][ T5800] usb 3-1: config 4 interface 171 has no altsetting 0 [ 572.470498][ T5800] usb 3-1: Dual-Role OTG device on HNP port [ 572.470952][ T5800] usb 3-1: New USB device found, idVendor=2f24, idProduct=bb74, bcdDevice=7f.1d [ 572.470984][ T5800] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.471010][ T5800] usb 3-1: Product: syz [ 572.471028][ T5800] usb 3-1: Manufacturer: 幀챤段瑤྾﨟㡑끾቉뢪ሴꪗ卛栅兿料꼟玫齦鵮葂児䒜踭鴢ත癛略㮬狊鹆ﬕ诃缎搾鉟齚ꈣ坾췿︿灃ͺ⬌촢評ɛ踫꽒쐒轓㠻筤鎉㯝즽勧늄㰺ᙑ쭾텒晪④횙僿螧䠹혰ᕜⲁ᠌啖일襜Ꙣ씾샶鉢帑ﮔ⥂젎讍 [ 572.471066][ T5800] usb 3-1: SerialNumber: syz [ 572.849044][T12939] netlink: 'syz.2.2486': attribute type 6 has an invalid length. [ 572.849073][T12939] netlink: 'syz.2.2486': attribute type 3 has an invalid length. [ 572.849090][T12939] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2486'. [ 573.061438][T12942] Bluetooth: MGMT ver 1.23 [ 573.106520][T12936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 573.107945][T12936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 573.409353][ T5800] usb 3-1: USB disconnect, device number 2 [ 574.099502][ T9] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 574.289350][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 574.295074][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 574.321704][ T9] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 574.321733][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.321839][ T9] usb 4-1: Product: syz [ 574.321852][ T9] usb 4-1: Manufacturer: syz [ 574.321866][ T9] usb 4-1: SerialNumber: syz [ 574.557958][ T9] usb 4-1: config 0 descriptor?? [ 574.622371][ T9] quatech2 4-1:0.0: Quatech 2nd gen USB to Serial Driver converter detected [ 575.144935][ T9] usb 4-1: qt2_attach - failed to power on unit: -71 [ 575.145474][ T9] quatech2 4-1:0.0: probe with driver quatech2 failed with error -71 [ 575.194188][ T9] usb 4-1: USB disconnect, device number 51 [ 575.819397][ T5775] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 576.014401][ T5617] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 576.079070][ T5617] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 576.079527][ T5775] usb 3-1: Using ep0 maxpacket: 32 [ 576.114239][ T5617] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 576.116512][ T5617] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 576.184738][ T5617] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 576.249570][ T5775] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 576.249726][ T5775] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 576.249769][ T5775] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 576.249804][ T5775] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 576.405526][ T5775] usb 3-1: config 0 descriptor?? [ 576.989036][ T5775] usbhid 3-1:0.0: can't add hid device: -71 [ 576.989359][ T5775] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 577.091523][ T5775] usb 3-1: USB disconnect, device number 3 [ 578.447381][ T5617] Bluetooth: hci2: command tx timeout [ 578.551340][T13006] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2499'. [ 578.780233][T13009] comedi: valid board names for 8255 driver are: [ 578.780253][T13009] 8255 [ 578.780261][T13009] comedi: valid board names for vmk80xx driver are: [ 578.780271][T13009] vmk80xx [ 578.780278][T13009] comedi: valid board names for usbduxsigma driver are: [ 578.780289][T13009] usbduxsigma [ 578.780297][T13009] comedi: valid board names for usbduxfast driver are: [ 578.780307][T13009] usbduxfast [ 578.780314][T13009] comedi: valid board names for usbdux driver are: [ 578.780324][T13009] usbdux [ 578.780330][T13009] comedi: valid board names for ni6501 driver are: [ 578.780340][T13009] ni6501 [ 578.780347][T13009] comedi: valid board names for dt9812 driver are: [ 578.780357][T13009] dt9812 [ 578.780364][T13009] comedi: valid board names for ni_labpc_cs driver are: [ 578.780374][T13009] ni_labpc_cs [ 578.780390][T13009] comedi: valid board names for ni_daq_700 driver are: [ 578.780399][T13009] ni_daq_700 [ 578.780407][T13009] comedi: valid board names for labpc_pci driver are: [ 578.780416][T13009] labpc_pci [ 578.780423][T13009] comedi: valid board names for adl_pci9118 driver are: [ 578.780433][T13009] pci9118dg [ 578.780441][T13009] pci9118hg [ 578.780448][T13009] pci9118hr [ 578.780455][T13009] comedi: valid board names for 8255_pci driver are: [ 578.780466][T13009] 8255_pci [ 578.780473][T13009] comedi: valid board names for s526 driver are: [ 578.780482][T13009] s526 [ 578.780489][T13009] comedi: valid board names for multiq3 driver are: [ 578.780498][T13009] multiq3 [ 578.780505][T13009] comedi: valid board names for pcmuio driver are: [ 578.780515][T13009] pcmuio48 [ 578.780522][T13009] pcmuio96 [ 578.780529][T13009] comedi: valid board names for pcmmio driver are: [ 578.780539][T13009] pcmmio [ 578.780548][T13009] comedi: valid board names for pcmda12 driver are: [ 578.780557][T13009] pcmda12 [ 578.780565][T13009] comedi: valid board names for pcmad driver are: [ 578.780574][T13009] pcmad12 [ 578.780581][T13009] pcmad16 [ 578.780588][T13009] comedi: valid board names for ni_labpc driver are: [ 578.780597][T13009] lab-pc-1200 [ 578.780604][T13009] lab-pc-1200ai [ 578.780612][T13009] lab-pc+ [ 578.780619][T13009] comedi: valid board names for atmio16 driver are: [ 578.780628][T13009] atmio16 [ 578.780635][T13009] atmio16d [ 578.780642][T13009] comedi: valid board names for ni_at_ao driver are: [ 578.780652][T13009] at-ao-6 [ 578.780659][T13009] at-ao-10 [ 578.780666][T13009] comedi: valid board names for ni_at_a2150 driver are: [ 578.780675][T13009] ni_at_a2150 [ 578.780683][T13009] comedi: valid board names for adq12b driver are: [ 578.780692][T13009] adq12b [ 578.780699][T13009] comedi: valid board names for mpc624 driver are: [ 578.780708][T13009] mpc624 [ 578.780714][T13009] comedi: valid board names for c6xdigio driver are: [ 578.780724][T13009] c6xdigio [ 578.780731][T13009] comedi: valid board names for aio_iiro_16 driver are: [ 578.780741][T13009] aio_iiro_16 [ 578.780748][T13009] comedi: valid board names for aio_aio12_8 driver are: [ 578.780757][T13009] aio_aio12_8 [ 578.780766][T13009] aio_ai12_8 [ 578.780773][T13009] aio_ao12_4 [ 578.780780][T13009] comedi: valid board names for fl512 driver are: [ 578.780790][T13009] fl512 [ 578.780798][T13009] comedi: valid board names for dmm32at driver are: [ 578.780808][T13009] dmm32at [ 578.780815][T13009] comedi: valid board names for dt282x driver are: [ 578.780825][T13009] dt2821 [ 578.780833][T13009] dt2821-f [ 578.780839][T13009] dt2821-g [ 578.780848][T13009] dt2823 [ 578.780855][T13009] dt2824-pgh [ 578.780862][T13009] dt2824-pgl [ 578.780870][T13009] dt2825 [ 578.780877][T13009] dt2827 [ 578.780885][T13009] dt2828 [ 578.780893][T13009] dt2829 [ 578.780900][T13009] dt21-ez [ 578.780909][T13009] dt23-ez [ 578.780917][T13009] dt24-ez [ 578.780924][T13009] dt24-ez-pgl [ 578.780932][T13009] comedi: valid board names for dt2817 driver are: [ 578.780943][T13009] dt2817 [ 578.780950][T13009] comedi: valid board names for dt2815 driver are: [ 578.780961][T13009] dt2815 [ 578.780968][T13009] comedi: valid board names for dt2814 driver are: [ 578.879372][ T5800] usb 4-1: new full-speed USB device number 52 using dummy_hcd [ 579.138388][ T5800] usb 4-1: unable to get BOS descriptor or descriptor too short [ 579.149796][T13009] dt2814 [ 579.149817][T13009] comedi: valid board names for dt2811 driver are: [ 579.149831][T13009] dt2811-pgh [ 579.150105][T13009] dt2811-pgl [ 579.150116][T13009] comedi: valid board names for dt2801 driver are: [ 579.150129][T13009] dt2801 [ 579.150139][T13009] comedi: valid board names for das6402 driver are: [ 579.150376][T13009] das6402-12 [ 579.150399][T13009] das6402-16 [ 579.150434][T13009] comedi: valid board names for das1800 driver are: [ 579.155426][T13009] das-1701st [ 579.155445][T13009] das-1701st-da [ 579.155456][T13009] das-1702st [ 579.157986][T13009] das-1702st-da [ 579.158026][T13009] das-1702hr [ 579.158049][T13009] das-1702hr-da [ 579.162602][T13009] das-1701ao [ 579.162619][T13009] das-1702ao [ 579.162630][T13009] das-1801st [ 579.162639][T13009] das-1801st-da [ 579.162650][T13009] das-1802st [ 579.162659][T13009] das-1802st-da [ 579.162669][T13009] das-1802hr [ 579.162679][T13009] das-1802hr-da [ 579.169628][T13009] das-1801hc [ 579.169646][T13009] das-1802hc [ 579.169656][T13009] das-1801ao [ 579.171913][T13009] das-1802ao [ 579.171930][T13009] comedi: valid board names for das800 driver are: [ 579.171944][T13009] das-800 [ 579.171972][T13009] cio-das800 [ 579.174722][ T5800] usb 4-1: not running at top speed; connect to a high speed hub [ 579.176722][T13009] das-801 [ 579.176745][T13009] cio-das801 [ 579.180781][T13009] das-802 [ 579.180798][T13009] cio-das802 [ 579.183246][T13009] cio-das802/16 [ 579.183264][T13009] comedi: valid board names for isa-das08 driver are: [ 579.186466][T13009] isa-das08 [ 579.186510][T13009] das08-pgm [ 579.186540][T13009] das08-pgh [ 579.191772][T13009] das08-pgl [ 579.191790][T13009] das08-aoh [ 579.191807][T13009] das08-aol [ 579.191828][T13009] das08-aom [ 579.191836][T13009] das08/jr-ao [ 579.195819][T13009] das08jr-16-ao [ 579.195870][T13009] pc104-das08 [ 579.199122][T13009] das08jr/16 [ 579.199159][T13009] comedi: valid board names for das16m1 driver are: [ 579.208213][T13009] das16m1 [ 579.208244][T13009] comedi: valid board names for dac02 driver are: [ 579.208276][T13009] dac02 [ 579.209409][T13009] comedi: valid board names for rti802 driver are: [ 579.209425][T13009] rti802 [ 579.209436][T13009] comedi: valid board names for rti800 driver are: [ 579.211683][T13009] rti800 [ 579.211698][T13009] rti815 [ 579.211707][T13009] comedi: valid board names for pcm3724 driver are: [ 579.211719][T13009] pcm3724 [ 579.211728][T13009] comedi: valid board names for pcl818 driver are: [ 579.211741][T13009] pcl818l [ 579.211750][T13009] pcl818h [ 579.211759][T13009] pcl818hd [ 579.214318][T13009] pcl818hg [ 579.214331][T13009] pcl818 [ 579.214348][T13009] pcl718 [ 579.217442][T13009] pcm3718 [ 579.218529][T13009] comedi: valid board names for pcl816 driver are: [ 579.218558][T13009] pcl816 [ 579.223081][T13009] pcl814b [ 579.225909][T13009] comedi: valid board names for pcl812 driver are: [ 579.225930][T13009] pcl812 [ 579.225941][T13009] pcl812pg [ 579.232775][T13009] acl8112pg [ 579.232795][T13009] acl8112dg [ 579.232805][T13009] acl8112hg [ 579.232814][T13009] a821pgl [ 579.232823][T13009] a821pglnda [ 579.244699][T13009] a821pgh [ 579.244742][T13009] a822pgl [ 579.244764][T13009] a822pgh [ 579.278438][T13009] a823pgl [ 579.278704][T13009] a823pgh [ 579.278716][T13009] pcl813 [ 579.278725][T13009] pcl813b [ 579.278735][T13009] acl8113 [ 579.278744][T13009] iso813 [ 579.278938][T13009] acl8216 [ 579.278949][T13009] a826pg [ 579.278967][T13009] comedi: valid board names for pcl730 driver are: [ 579.279015][T13009] pcl730 [ 579.279023][T13009] iso730 [ 579.279851][T13009] acl7130 [ 579.279894][T13009] pcm3730 [ 579.280171][T13009] pcl725 [ 579.280201][T13009] p8r8dio [ 579.280224][T13009] acl7225b [ 579.280247][T13009] p16r16dio [ 579.293696][ T5800] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 579.293729][ T5800] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 579.313984][T13009] pcl733 [ 579.314340][T13009] pcl734 [ 579.314353][T13009] opmm-1616-xt [ 579.314362][T13009] pearl-mm-p [ 579.314380][T13009] ir104-pbf [ 579.314434][T13009] comedi: valid board names for pcl726 driver are: [ 579.314666][T13009] pcl726 [ 579.314677][T13009] pcl727 [ 579.314695][T13009] pcl728 [ 579.314712][T13009] acl6126 [ 579.314910][T13009] acl6128 [ 579.314920][T13009] comedi: valid board names for pcl724 driver are: [ 579.314932][T13009] pcl724 [ 579.314941][T13009] pcl722 [ 579.314949][T13009] pcl731 [ 579.314958][T13009] acl7122 [ 579.314967][T13009] acl7124 [ 579.314976][T13009] pet48dio [ 579.314985][T13009] pcmio48 [ 579.314994][T13009] onyx-mm-dio [ 579.315138][T13009] comedi: valid board names for pcl711 driver are: [ 579.315153][T13009] pcl711 [ 579.315162][T13009] pcl711b [ 579.315172][T13009] acl8112hg [ 579.315181][T13009] acl8112dg [ 579.315201][T13009] comedi: valid board names for amplc_pc263 driver are: [ 579.315479][T13009] pc263 [ 579.315490][T13009] comedi: valid board names for amplc_pc236 driver are: [ 579.315503][T13009] pc36at [ 579.315512][T13009] comedi: valid board names for amplc_dio200 driver are: [ 579.315532][T13009] pc212e [ 579.315789][T13009] pc214e [ 579.315799][T13009] pc215e [ 579.315807][T13009] pc218e [ 579.315816][T13009] pc272e [ 579.316018][T13009] comedi: valid board names for comedi_parport driver are: [ 579.316048][T13009] comedi_parport [ 579.316066][T13009] comedi: valid board names for comedi_test driver are: [ 579.316077][T13009] comedi_test [ 579.316094][T13009] comedi: valid board names for comedi_bond driver are: [ 579.316321][T13009] comedi_bond [ 579.463019][ T5800] usb 4-1: string descriptor 0 read error: -22 [ 579.463192][ T5800] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 579.463222][ T5800] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.004852][ T5800] usb 4-1: 0:2 : does not exist [ 580.452774][T13013] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2502'. [ 580.499557][ T5617] Bluetooth: hci2: command tx timeout [ 580.626792][ T5800] usb 4-1: 5:0: cannot get min/max values for control 2 (id 5) [ 580.626866][ T5800] usb 4-1: Warning! Unlikely big volume step count (=14848), linear volume or wrong cval->res? [ 580.626891][ T5800] usb 4-1: [5] FU [Mic Capture Volume] ch = 1, val = 0/14848/1 [ 580.684831][ T5800] usb 4-1: 5:0: cannot get min/max values for control 3 (id 5) [ 580.755054][ T5800] usb 4-1: 5:0: failed to get current value for ch 1 (-22) [ 581.466027][ T5800] usb 4-1: 5:0: cannot get min/max values for control 3 (id 5) [ 581.547935][ T5800] usb 4-1: 5:0: cannot get min/max values for control 2 (id 5) [ 581.676463][ T5800] usb 4-1: USB disconnect, device number 52 [ 582.361926][ T5800] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 582.471081][T13024] netlink: 'syz.0.2504': attribute type 4 has an invalid length. [ 582.533417][ T5800] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 582.533453][ T5800] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 582.533473][ T5800] usb 4-1: Product: syz [ 582.533488][ T5800] usb 4-1: Manufacturer: syz [ 582.533503][ T5800] usb 4-1: SerialNumber: syz [ 582.583180][ T5617] Bluetooth: hci2: command tx timeout [ 583.680838][T13037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 583.735190][T13037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 583.899147][ T5800] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 583.902528][ T5800] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 583.916973][ T5800] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 583.962676][ T5800] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -32 [ 583.980293][T13037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 583.982028][T13037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 584.663779][ T5617] Bluetooth: hci2: command tx timeout [ 584.939399][T13046] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 584.940068][T13046] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 585.104794][ T3090] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.901517][ T5800] usb 4-1: USB disconnect, device number 53 [ 585.919988][ T5775] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 586.080471][ T5775] usb 3-1: Using ep0 maxpacket: 32 [ 586.113002][ T5775] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 586.172373][ T5775] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 586.172400][ T5775] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 586.172504][ T5775] usb 3-1: Product: syz [ 586.172518][ T5775] usb 3-1: Manufacturer: syz [ 586.172530][ T5775] usb 3-1: SerialNumber: syz [ 586.410327][ T5775] usb 3-1: config 0 descriptor?? [ 586.427202][T13052] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 586.440105][ T5775] hub 3-1:0.0: bad descriptor, ignoring hub [ 586.440287][ T5775] hub 3-1:0.0: probe with driver hub failed with error -5 [ 586.716078][ T5775] usb 3-1: USB disconnect, device number 4 [ 586.731333][ T3090] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.579453][ T5775] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 587.732295][ T5775] usb 3-1: Using ep0 maxpacket: 32 [ 587.773478][ T5775] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 587.807332][ T5775] usb 3-1: string descriptor 0 read error: -22 [ 587.807795][ T5775] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 587.807972][ T5775] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 587.877964][ T5775] usb 3-1: config 0 descriptor?? [ 587.987346][T13052] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 588.053627][ T5775] hub 3-1:0.0: bad descriptor, ignoring hub [ 588.053674][ T5775] hub 3-1:0.0: probe with driver hub failed with error -5 [ 588.423831][ T5617] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 588.423866][ T5617] CPU: 0 UID: 0 PID: 5617 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 588.423905][ T5617] Tainted: [L]=SOFTLOCKUP [ 588.423914][ T5617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 588.423930][ T5617] Workqueue: hci4 hci_rx_work [ 588.423971][ T5617] Call Trace: [ 588.423981][ T5617] [ 588.423991][ T5617] dump_stack_lvl+0xe8/0x150 [ 588.424023][ T5617] sysfs_create_dir_ns+0x271/0x2a0 [ 588.424052][ T5617] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 588.424084][ T5617] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 588.424116][ T5617] ? rt_spin_unlock+0x160/0x200 [ 588.424148][ T5617] kobject_add_internal+0x631/0xd10 [ 588.424198][ T5617] kobject_add+0x163/0x240 [ 588.424230][ T5617] ? __pfx_kobject_add+0x10/0x10 [ 588.424263][ T5617] ? get_device_parent+0x370/0x3a0 [ 588.424301][ T5617] device_add+0x408/0xb90 [ 588.424335][ T5617] hci_conn_add_sysfs+0xd5/0x210 [ 588.424372][ T5617] le_conn_complete_evt+0x10e6/0x16b0 [ 588.424412][ T5617] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 588.424439][ T5617] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 588.424476][ T5617] ? lockdep_hardirqs_on+0x7a/0x110 [ 588.424514][ T5617] ? skb_pull_data+0xfb/0x200 [ 588.424544][ T5617] hci_le_enh_conn_complete_evt+0x189/0x490 [ 588.424577][ T5617] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 588.424617][ T5617] hci_event_packet+0x659/0xef0 [ 588.424660][ T5617] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 588.424690][ T5617] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 588.424715][ T5617] ? __pfx_hci_event_packet+0x10/0x10 [ 588.424749][ T5617] ? rt_spin_unlock+0x14f/0x200 [ 588.424787][ T5617] ? hci_send_to_monitor+0xe2/0x590 [ 588.424821][ T5617] hci_rx_work+0x3ee/0x1040 [ 588.424868][ T5617] ? process_one_work+0x8be/0x1630 [ 588.424902][ T5617] process_one_work+0x98b/0x1630 [ 588.424958][ T5617] ? __pfx_process_one_work+0x10/0x10 [ 588.424985][ T5617] ? do_raw_spin_lock+0x12b/0x2f0 [ 588.425032][ T5617] worker_thread+0xb49/0x1140 [ 588.425073][ T5617] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 588.425122][ T5617] kthread+0x388/0x470 [ 588.425146][ T5617] ? __pfx_worker_thread+0x10/0x10 [ 588.425185][ T5617] ? __pfx_kthread+0x10/0x10 [ 588.425209][ T5617] ret_from_fork+0x514/0xb70 [ 588.425240][ T5617] ? __pfx_ret_from_fork+0x10/0x10 [ 588.425267][ T5617] ? __switch_to+0xc79/0x1410 [ 588.425307][ T5617] ? __pfx_kthread+0x10/0x10 [ 588.425332][ T5617] ret_from_fork_asm+0x1a/0x30 [ 588.425378][ T5617] [ 588.425604][ T5617] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 588.425762][ T5617] Bluetooth: hci4: failed to register connection device [ 588.440823][T13052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 588.441755][T13052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 588.490385][T13052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 588.491106][T13052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 588.909622][T13052] netlink: 'syz.2.2511': attribute type 10 has an invalid length. [ 588.909652][T13052] netlink: 55 bytes leftover after parsing attributes in process `syz.2.2511'. [ 589.360591][T13073] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 589.361363][T13073] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 589.607387][ T3090] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 590.130468][ T5775] usb 3-1: USB disconnect, device number 5 [ 590.153978][ T5800] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 590.327990][ T5800] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 590.328040][ T5800] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 590.328065][ T5800] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 590.328123][ T5800] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 590.328156][ T5800] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 590.406439][ T5800] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 590.406478][ T5800] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 590.406505][ T5800] usb 4-1: Product: syz [ 590.406524][ T5800] usb 4-1: Manufacturer: syz [ 590.541511][ T5800] cdc_wdm 4-1:1.0: skipping garbage [ 590.541536][ T5800] cdc_wdm 4-1:1.0: skipping garbage [ 590.543871][ T5800] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 590.543919][ T5800] cdc_wdm 4-1:1.0: Unknown control protocol [ 590.693472][T13083] NILFS (nullb0): couldn't find nilfs on the device [ 590.801858][ T3090] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 591.366677][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -EPIPE [ 591.426991][ T32] usb 4-1: USB disconnect, device number 54 [ 591.564768][T13092] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 591.565332][T13092] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 591.657096][T12973] bridge0: port 1(bridge_slave_0) entered blocking state [ 591.668814][T12973] bridge0: port 1(bridge_slave_0) entered disabled state [ 591.681297][T12973] bridge_slave_0: entered allmulticast mode [ 591.731363][T12973] bridge_slave_0: entered promiscuous mode [ 591.840828][T12973] bridge0: port 2(bridge_slave_1) entered blocking state [ 591.841457][T12973] bridge0: port 2(bridge_slave_1) entered disabled state [ 591.841895][T12973] bridge_slave_1: entered allmulticast mode [ 591.896687][T12973] bridge_slave_1: entered promiscuous mode [ 592.250788][T12973] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 592.292682][T12973] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 592.492863][T13096] set match dimension is over the limit! [ 592.512954][T12973] team0: Port device team_slave_0 added [ 592.663310][T12973] team0: Port device team_slave_1 added [ 593.036613][T13102] ucma_write: process 1168 (syz.2.2527) changed security contexts after opening file descriptor, this is not allowed. [ 593.495248][ T5782] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 593.679430][ T5782] usb 3-1: Using ep0 maxpacket: 32 [ 593.721906][ T5782] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 593.737361][ T5782] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 593.737546][ T5782] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 593.737584][ T5782] usb 3-1: Product: syz [ 593.737605][ T5782] usb 3-1: Manufacturer: syz [ 593.737767][ T5782] usb 3-1: SerialNumber: syz [ 593.801249][T13110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 593.804556][T13110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 593.874856][T12973] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 593.874881][T12973] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 593.874921][T12973] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 593.963916][T12973] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 593.963936][T12973] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 593.963972][T12973] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 594.114117][ T5782] usb 3-1: config 0 descriptor?? [ 594.116683][T13104] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 594.559742][ T5714] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 594.711533][ T5714] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 594.711597][ T5714] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 594.737484][ T5714] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 594.737525][ T5714] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.737550][ T5714] usb 4-1: Product: syz [ 594.737568][ T5714] usb 4-1: Manufacturer: syz [ 594.737586][ T5714] usb 4-1: SerialNumber: syz [ 595.262785][T13113] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 595.282675][T13113] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 595.289167][T12973] hsr_slave_0: entered promiscuous mode [ 595.331809][T12973] hsr_slave_1: entered promiscuous mode [ 595.502313][ T5714] cdc_ncm 4-1:1.0: failed GET_NTB_PARAMETERS [ 595.502458][ T5714] cdc_ncm 4-1:1.0: bind() failure [ 595.585899][ T5714] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 595.585962][ T5714] cdc_ncm 4-1:1.1: bind() failure [ 595.654180][ T5714] usb 4-1: USB disconnect, device number 55 [ 596.376900][ T5714] usb 3-1: USB disconnect, device number 6 [ 596.869509][ T5714] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 597.021984][ T5714] usb 3-1: Using ep0 maxpacket: 32 [ 597.042779][ T5714] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 597.042822][ T5714] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 597.042868][ T5714] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 597.042896][ T5714] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 597.101011][ T5714] usb 3-1: config 0 descriptor?? [ 597.155884][T13122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 597.156528][T13122] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 597.369110][T13127] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 597.382942][T13127] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 597.586686][ T5714] ft260 0003:0403:6030.001C: unknown main item tag 0x0 [ 597.586733][ T5714] ft260 0003:0403:6030.001C: unknown main item tag 0x0 [ 597.765111][ T5714] ft260 0003:0403:6030.001C: chip code: 0000 0000 [ 597.940985][ T5782] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 598.013959][ T5714] ft260 0003:0403:6030.001C: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.2-1/input0 [ 598.089624][ T5782] usb 4-1: Using ep0 maxpacket: 32 [ 598.094596][ T5782] usb 4-1: unable to get BOS descriptor or descriptor too short [ 598.097902][ T5782] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 1023 [ 598.133101][ T5782] usb 4-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 598.133309][ T5782] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.133430][ T5782] usb 4-1: Product: syz [ 598.133448][ T5782] usb 4-1: Manufacturer: syz [ 598.133464][ T5782] usb 4-1: SerialNumber: syz [ 598.206025][T13130] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 598.213533][ T5714] ft260 0003:0403:6030.001C: failed to retrieve status: -5, no wakeup [ 598.467414][ T5714] ft260 0003:0403:6030.001C: failed to retrieve status: -71 [ 598.467946][ T5714] ft260 0003:0403:6030.001C: failed to reset I2C controller: -71 [ 598.525894][T13133] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 598.526552][T13133] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 598.625160][T13134] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 598.632298][T13134] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 598.658458][T13130] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 598.659110][T13130] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 598.842684][ T3090] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 598.978161][ T3090] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 599.014176][ T3090] bond0 (unregistering): Released all slaves [ 599.167086][ T5782] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 599.167297][ T5782] usb 4-1: MIDIStreaming interface descriptor not found [ 599.561698][T13143] FAULT_INJECTION: forcing a failure. [ 599.561698][T13143] name failslab, interval 1, probability 0, space 0, times 0 [ 599.561756][T13143] CPU: 1 UID: 0 PID: 13143 Comm: syz.0.2541 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 599.561790][T13143] Tainted: [L]=SOFTLOCKUP [ 599.561800][T13143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 599.561816][T13143] Call Trace: [ 599.561825][T13143] [ 599.561835][T13143] dump_stack_lvl+0xe8/0x150 [ 599.561871][T13143] should_fail_ex+0x46b/0x600 [ 599.561909][T13143] should_failslab+0xa8/0x100 [ 599.561947][T13143] kmem_cache_alloc_noprof+0x87/0x680 [ 599.561982][T13143] ? skb_ext_add+0x148/0x8f0 [ 599.562023][T13143] skb_ext_add+0x148/0x8f0 [ 599.562064][T13143] j1939_sk_sendmsg+0x78e/0x1350 [ 599.562099][T13143] ? j1939_sk_sendmsg+0x51a/0x1350 [ 599.562138][T13143] ? __pfx_j1939_sk_sendmsg+0x10/0x10 [ 599.562177][T13143] ? aa_sock_msg_perm+0x122/0x200 [ 599.562214][T13143] ? __pfx_j1939_sk_sendmsg+0x10/0x10 [ 599.562246][T13143] sock_sendmsg_nosec+0x112/0x150 [ 599.562277][T13143] ____sys_sendmsg+0x55c/0x870 [ 599.562320][T13143] ? __pfx_____sys_sendmsg+0x10/0x10 [ 599.562366][T13143] ? import_iovec+0x73/0xa0 [ 599.562407][T13143] ___sys_sendmsg+0x2a5/0x360 [ 599.562441][T13143] ? __lock_acquire+0x6b5/0x2d10 [ 599.562472][T13143] ? __pfx____sys_sendmsg+0x10/0x10 [ 599.562550][T13143] ? __fget_files+0x2a/0x420 [ 599.562579][T13143] ? __fget_files+0x3a6/0x420 [ 599.562619][T13143] __x64_sys_sendmsg+0x1c3/0x2a0 [ 599.562658][T13143] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 599.562704][T13143] ? __pfx_ksys_write+0x10/0x10 [ 599.562759][T13143] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.562787][T13143] do_syscall_64+0x15f/0xf80 [ 599.562811][T13143] ? trace_irq_disable+0x3b/0x140 [ 599.562847][T13143] ? clear_bhb_loop+0x40/0x90 [ 599.562876][T13143] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 599.562902][T13143] RIP: 0033:0x7fa4e4eace59 [ 599.562926][T13143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 599.562949][T13143] RSP: 002b:00007fa4e3106028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 599.562977][T13143] RAX: ffffffffffffffda RBX: 00007fa4e5125fa0 RCX: 00007fa4e4eace59 [ 599.562996][T13143] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 599.563013][T13143] RBP: 00007fa4e3106090 R08: 0000000000000000 R09: 0000000000000000 [ 599.563030][T13143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 599.563046][T13143] R13: 00007fa4e5126038 R14: 00007fa4e5125fa0 R15: 00007ffce1b10da8 [ 599.563079][T13143] [ 599.633739][ T3090] tipc: Disabling bearer [ 599.985365][ T3090] tipc: Left network mode [ 600.211934][T13145] FAULT_INJECTION: forcing a failure. [ 600.211934][T13145] name failslab, interval 1, probability 0, space 0, times 0 [ 600.211979][T13145] CPU: 1 UID: 0 PID: 13145 Comm: syz.0.2542 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 600.212011][T13145] Tainted: [L]=SOFTLOCKUP [ 600.212021][T13145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 600.212039][T13145] Call Trace: [ 600.212049][T13145] [ 600.212060][T13145] dump_stack_lvl+0xe8/0x150 [ 600.212095][T13145] should_fail_ex+0x46b/0x600 [ 600.212140][T13145] should_failslab+0xa8/0x100 [ 600.212179][T13145] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 600.212214][T13145] ? __alloc_skb+0x1d0/0x7d0 [ 600.212245][T13145] ? lockdep_hardirqs_on+0x7a/0x110 [ 600.212295][T13145] __alloc_skb+0x1d0/0x7d0 [ 600.212326][T13145] ? netlink_ack_tlv_len+0x6c/0x210 [ 600.212365][T13145] netlink_ack+0x146/0xa50 [ 600.212396][T13145] ? __pfx_genl_rcv_msg+0x10/0x10 [ 600.212420][T13145] ? ref_tracker_free+0x673/0x820 [ 600.212449][T13145] ? __pfx_batadv_pre_doit+0x10/0x10 [ 600.212481][T13145] ? __pfx_batadv_post_doit+0x10/0x10 [ 600.212515][T13145] ? ____sys_sendmsg+0x55c/0x870 [ 600.212549][T13145] ? ___sys_sendmsg+0x2a5/0x360 [ 600.212583][T13145] ? __x64_sys_sendmsg+0x1c3/0x2a0 [ 600.212618][T13145] ? do_syscall_64+0x15f/0xf80 [ 600.212640][T13145] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.212676][T13145] netlink_rcv_skb+0x2b6/0x4b0 [ 600.212713][T13145] ? __pfx_genl_rcv_msg+0x10/0x10 [ 600.212743][T13145] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 600.212791][T13145] ? netlink_deliver_tap+0x2e/0x1b0 [ 600.212826][T13145] ? netlink_deliver_tap+0x2e/0x1b0 [ 600.212864][T13145] genl_rcv+0x28/0x40 [ 600.212887][T13145] netlink_unicast+0x780/0x920 [ 600.212931][T13145] netlink_sendmsg+0x813/0xb40 [ 600.212977][T13145] ? __pfx_netlink_sendmsg+0x10/0x10 [ 600.213016][T13145] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 600.213063][T13145] ? aa_sock_msg_perm+0x122/0x200 [ 600.213099][T13145] ? __pfx_netlink_sendmsg+0x10/0x10 [ 600.213143][T13145] sock_sendmsg_nosec+0x112/0x150 [ 600.213175][T13145] ____sys_sendmsg+0x55c/0x870 [ 600.213218][T13145] ? __pfx_____sys_sendmsg+0x10/0x10 [ 600.213265][T13145] ? import_iovec+0x73/0xa0 [ 600.213307][T13145] ___sys_sendmsg+0x2a5/0x360 [ 600.213342][T13145] ? __lock_acquire+0x6b5/0x2d10 [ 600.213372][T13145] ? __pfx____sys_sendmsg+0x10/0x10 [ 600.213449][T13145] ? __fget_files+0x2a/0x420 [ 600.213478][T13145] ? __fget_files+0x3a6/0x420 [ 600.213517][T13145] __x64_sys_sendmsg+0x1c3/0x2a0 [ 600.213556][T13145] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 600.213604][T13145] ? __pfx_ksys_write+0x10/0x10 [ 600.213650][T13145] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.213676][T13145] do_syscall_64+0x15f/0xf80 [ 600.213700][T13145] ? trace_irq_disable+0x3b/0x140 [ 600.213737][T13145] ? clear_bhb_loop+0x40/0x90 [ 600.213768][T13145] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.213793][T13145] RIP: 0033:0x7fa4e4eace59 [ 600.213817][T13145] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 600.213841][T13145] RSP: 002b:00007fa4e3106028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 600.213868][T13145] RAX: ffffffffffffffda RBX: 00007fa4e5125fa0 RCX: 00007fa4e4eace59 [ 600.213888][T13145] RDX: 0000000020040084 RSI: 0000200000003140 RDI: 0000000000000005 [ 600.213906][T13145] RBP: 00007fa4e3106090 R08: 0000000000000000 R09: 0000000000000000 [ 600.213923][T13145] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 600.213938][T13145] R13: 00007fa4e5126038 R14: 00007fa4e5125fa0 R15: 00007ffce1b10da8 [ 600.213976][T13145] [ 600.981863][ T5756] usb 3-1: reset high-speed USB device number 7 using dummy_hcd [ 601.467843][ T5782] usb 4-1: USB disconnect, device number 56 [ 601.560581][ T5756] usb 3-1: device firmware changed [ 601.648365][ T5714] usb 3-1: USB disconnect, device number 7 [ 601.855899][ T5714] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 602.029573][ T5714] usb 3-1: Using ep0 maxpacket: 32 [ 602.043354][ T5714] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 602.050458][ T5714] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 602.050495][ T5714] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 602.050521][ T5714] usb 3-1: Product: syz [ 602.050539][ T5714] usb 3-1: Manufacturer: syz [ 602.050556][ T5714] usb 3-1: SerialNumber: syz [ 602.265610][T13163] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 602.278461][ T5714] usb 3-1: config 0 descriptor?? [ 602.279051][T13163] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 602.327637][ T5714] usb 3-1: can't set config #0, error -71 [ 602.341847][ T5714] usb 3-1: USB disconnect, device number 8 [ 603.011576][T12897] udevd[12897]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 603.211624][ T5782] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 603.361101][ T5782] usb 4-1: Using ep0 maxpacket: 8 [ 603.381840][ T5782] usb 4-1: unable to get BOS descriptor or descriptor too short [ 603.411817][ T5782] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 603.411854][ T5782] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 603.411875][ T5782] usb 4-1: Manufacturer: syz [ 603.412001][ T5782] usb 4-1: SerialNumber: syz [ 603.485954][T13185] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 603.518007][T13185] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 603.580956][T13185] input: syz1 as /devices/virtual/input/input28 [ 603.625702][T13186] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 603.626359][T13186] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 604.024400][ T5782] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 604.107657][T13189] FAULT_INJECTION: forcing a failure. [ 604.107657][T13189] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 604.107699][T13189] CPU: 1 UID: 0 PID: 13189 Comm: syz.2.2552 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 604.107728][T13189] Tainted: [L]=SOFTLOCKUP [ 604.107736][T13189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 604.107748][T13189] Call Trace: [ 604.107756][T13189] [ 604.107766][T13189] dump_stack_lvl+0xe8/0x150 [ 604.107809][T13189] should_fail_ex+0x46b/0x600 [ 604.107839][T13189] copy_fpstate_to_sigframe+0xaab/0xd60 [ 604.107861][T13189] ? __kasan_slab_free+0x5c/0x80 [ 604.107887][T13189] ? kmem_cache_free+0x187/0x6c0 [ 604.107914][T13189] ? __dequeue_signal+0x487/0x5b0 [ 604.107943][T13189] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 604.107982][T13189] ? fpu__alloc_mathframe+0xac/0x130 [ 604.108010][T13189] get_sigframe+0x5f7/0x820 [ 604.108043][T13189] ? __pfx_get_sigframe+0x10/0x10 [ 604.108067][T13189] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 604.108101][T13189] ? reacquire_held_locks+0x104/0x190 [ 604.108142][T13189] x64_setup_rt_frame+0x160/0xcb0 [ 604.108167][T13189] ? rt_spin_unlock+0x14f/0x200 [ 604.108201][T13189] ? rt_spin_unlock+0x160/0x200 [ 604.108233][T13189] ? get_signal+0x114f/0x1330 [ 604.108275][T13189] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 604.108312][T13189] arch_do_signal_or_restart+0x442/0x840 [ 604.108341][T13189] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 604.108387][T13189] exit_to_user_mode_loop+0x8c/0x4d0 [ 604.108423][T13189] ? rcu_is_watching+0x15/0xb0 [ 604.108452][T13189] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.108480][T13189] do_syscall_64+0x33e/0xf80 [ 604.108504][T13189] ? trace_irq_disable+0x3b/0x140 [ 604.108540][T13189] ? clear_bhb_loop+0x40/0x90 [ 604.108571][T13189] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.108597][T13189] RIP: 0033:0x7f7fe508ce59 [ 604.108621][T13189] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 604.108641][T13189] RSP: 002b:00007f7fe32e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 604.108668][T13189] RAX: fffffffffffffffc RBX: 00007f7fe5305fa0 RCX: 00007f7fe508ce59 [ 604.108687][T13189] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 604.108704][T13189] RBP: 00007f7fe32e6090 R08: 0000000000000000 R09: 0000000000000000 [ 604.108721][T13189] R10: 0000000000080800 R11: 0000000000000246 R12: 0000000000000001 [ 604.108738][T13189] R13: 00007f7fe5306038 R14: 00007f7fe5305fa0 R15: 00007fff5539eb48 [ 604.108776][T13189] [ 604.463465][ T5271] 8021q: adding VLAN 0 to HW filter on device eth1 [ 604.791313][T13195] FAULT_INJECTION: forcing a failure. [ 604.791313][T13195] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 604.791358][T13195] CPU: 1 UID: 0 PID: 13195 Comm: syz.3.2554 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 604.791399][T13195] Tainted: [L]=SOFTLOCKUP [ 604.791406][T13195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 604.791418][T13195] Call Trace: [ 604.791427][T13195] [ 604.791436][T13195] dump_stack_lvl+0xe8/0x150 [ 604.791467][T13195] should_fail_ex+0x46b/0x600 [ 604.791497][T13195] _copy_to_user+0x31/0xb0 [ 604.791530][T13195] do_pagemap_cmd+0xbaf/0xc50 [ 604.791560][T13195] ? __pfx_do_pagemap_cmd+0x10/0x10 [ 604.791594][T13195] ? __fget_files+0x2a/0x420 [ 604.791621][T13195] ? __fget_files+0x3a6/0x420 [ 604.791643][T13195] ? __fget_files+0x2a/0x420 [ 604.791668][T13195] ? bpf_lsm_file_ioctl+0x9/0x20 [ 604.791690][T13195] ? __pfx_do_pagemap_cmd+0x10/0x10 [ 604.791711][T13195] __se_sys_ioctl+0xff/0x170 [ 604.791740][T13195] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.791763][T13195] do_syscall_64+0x15f/0xf80 [ 604.791783][T13195] ? trace_irq_disable+0x3b/0x140 [ 604.791812][T13195] ? clear_bhb_loop+0x40/0x90 [ 604.791837][T13195] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.791857][T13195] RIP: 0033:0x7f670707ce59 [ 604.791880][T13195] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 604.791898][T13195] RSP: 002b:00007f67052d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 604.791939][T13195] RAX: ffffffffffffffda RBX: 00007f67072f5fa0 RCX: 00007f670707ce59 [ 604.791954][T13195] RDX: 0000200000000100 RSI: 00000000c0606610 RDI: 0000000000000003 [ 604.791973][T13195] RBP: 00007f67052d6090 R08: 0000000000000000 R09: 0000000000000000 [ 604.791986][T13195] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 604.792002][T13195] R13: 00007f67072f6038 R14: 00007f67072f5fa0 R15: 00007fffc39356c8 [ 604.792038][T13195] [ 605.809121][ T5782] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 605.810507][ T5782] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 605.810746][ T5782] usb 4-1: media controller created [ 606.391406][ T5782] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 607.130301][ T5782] zl10353_read_register: readreg error (reg=127, ret==0) [ 608.088833][ T5782] usb 4-1: USB disconnect, device number 57 [ 609.513392][ T5271] 8021q: adding VLAN 0 to HW filter on device eth2 [ 609.649635][ T5756] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 609.718021][T13241] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2565'. [ 609.835186][ T5756] usb 4-1: Using ep0 maxpacket: 8 [ 609.848474][ T5756] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 609.848534][ T5756] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 609.848563][ T5756] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.890148][ T5756] usb 4-1: config 0 descriptor?? [ 610.137954][T13237] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 610.168155][T13237] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 610.231626][ T5756] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 610.314596][ T3090] hsr_slave_0: left promiscuous mode [ 610.369397][ T3090] hsr_slave_1: left promiscuous mode [ 610.378519][ T3090] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 610.378557][ T3090] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 610.389478][ T5756] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 610.476531][ T3090] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 610.485552][ T3090] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 610.510104][T13237] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2564'. [ 610.584691][ T5756] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 610.584793][ T5756] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 10450, setting to 1024 [ 610.584828][ T5756] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 610.627979][ T5756] usb 3-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 610.628079][ T5756] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.628106][ T5756] usb 3-1: Product: syz [ 610.628125][ T5756] usb 3-1: Manufacturer: syz [ 610.628142][ T5756] usb 3-1: SerialNumber: syz [ 610.680289][ T5756] usb 3-1: config 0 descriptor?? [ 610.687206][T13245] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 610.687649][T13245] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 610.925642][T13245] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 610.926053][T13245] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 611.000899][ T3090] veth1_macvtap: left promiscuous mode [ 611.006837][ T3090] veth0_macvtap: left promiscuous mode [ 611.013697][ T3090] veth1_vlan: left promiscuous mode [ 611.025619][ T3090] veth0_vlan: left promiscuous mode [ 611.174266][ T5782] usb 4-1: USB disconnect, device number 58 [ 611.191839][T13255] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 611.195070][T13255] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 611.351881][ T5756] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 611.593548][ T5756] dm9601 3-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 611.630616][ T5756] usb 3-1: USB disconnect, device number 9 [ 612.349343][ T5756] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 612.509751][ T5756] usb 4-1: Using ep0 maxpacket: 32 [ 612.520185][ T5756] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 612.524711][ T5756] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 612.524746][ T5756] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 612.524769][ T5756] usb 4-1: Product: syz [ 612.524786][ T5756] usb 4-1: Manufacturer: syz [ 612.524802][ T5756] usb 4-1: SerialNumber: syz [ 612.573593][ T5756] usb 4-1: config 0 descriptor?? [ 612.574998][T13264] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 613.512969][T13278] FAULT_INJECTION: forcing a failure. [ 613.512969][T13278] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 613.513027][T13278] CPU: 1 UID: 0 PID: 13278 Comm: syz.2.2574 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 613.513052][T13278] Tainted: [L]=SOFTLOCKUP [ 613.513074][T13278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 613.513090][T13278] Call Trace: [ 613.513100][T13278] [ 613.513112][T13278] dump_stack_lvl+0xe8/0x150 [ 613.513150][T13278] should_fail_ex+0x46b/0x600 [ 613.513191][T13278] _copy_to_user+0x31/0xb0 [ 613.513231][T13278] simple_read_from_buffer+0xe1/0x170 [ 613.513269][T13278] proc_fail_nth_read+0x1be/0x230 [ 613.513307][T13278] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 613.513343][T13278] ? rw_verify_area+0x2ac/0x4e0 [ 613.513378][T13278] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 613.513411][T13278] vfs_read+0x212/0xa80 [ 613.513454][T13278] ? __pfx_vfs_read+0x10/0x10 [ 613.513493][T13278] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 613.513536][T13278] ? lockdep_hardirqs_on+0x7a/0x110 [ 613.513574][T13278] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 613.513613][T13278] ? mutex_lock_nested+0x152/0x1d0 [ 613.513643][T13278] ? fdget_pos+0x252/0x320 [ 613.513681][T13278] ksys_read+0x156/0x270 [ 613.513718][T13278] ? __pfx_ksys_read+0x10/0x10 [ 613.513759][T13278] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 613.513788][T13278] do_syscall_64+0x15f/0xf80 [ 613.513812][T13278] ? trace_irq_disable+0x3b/0x140 [ 613.513849][T13278] ? clear_bhb_loop+0x40/0x90 [ 613.513880][T13278] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 613.513905][T13278] RIP: 0033:0x7f7fe504d68e [ 613.513928][T13278] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 613.513952][T13278] RSP: 002b:00007f7fe32e5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 613.513971][T13278] RAX: ffffffffffffffda RBX: 00007f7fe32e66c0 RCX: 00007f7fe504d68e [ 613.514009][T13278] RDX: 000000000000000f RSI: 00007f7fe32e60a0 RDI: 0000000000000004 [ 613.514026][T13278] RBP: 00007f7fe32e6090 R08: 0000000000000000 R09: 0000000000000000 [ 613.514043][T13278] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 613.514059][T13278] R13: 00007f7fe5306038 R14: 00007f7fe5305fa0 R15: 00007fff5539eb48 [ 613.514097][T13278] [ 614.280412][ T3090] team0 (unregistering): Port device team_slave_1 removed [ 614.340370][ T3090] team0 (unregistering): Port device team_slave_0 removed [ 614.792997][T13284] netlink: 'syz.2.2577': attribute type 1 has an invalid length. [ 614.793026][T13284] netlink: 'syz.2.2577': attribute type 3 has an invalid length. [ 614.793045][T13284] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2577'. [ 614.807551][ T5271] 8021q: adding VLAN 0 to HW filter on device eth3 [ 615.260963][ T5802] usb 4-1: USB disconnect, device number 59 [ 615.423460][T13290] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.2579'. [ 616.783492][T13300] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 616.784154][T13300] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 617.162202][T13305] binder: 13302:13305 ioctl 4040534e 200000000180 returned -22 [ 617.162875][T13305] binder: 13302:13305 ioctl c038586a 200000000580 returned -22 [ 617.163692][T13305] binder: 13302:13305 unknown command 0 [ 617.163811][T13305] binder: 13302:13305 ioctl c0306201 200000004a40 returned -22 [ 617.830749][T13316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 617.832551][T13316] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 618.623387][T13325] fuse: Unknown parameter '' [ 618.814367][ T5756] usb 4-1: new full-speed USB device number 60 using dummy_hcd [ 619.035669][ T5756] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 80, setting to 64 [ 619.035732][ T5756] usb 4-1: New USB device found, idVendor=05ac, idProduct=0231, bcdDevice= 0.00 [ 619.035762][ T5756] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 619.320278][ T5756] usb 4-1: config 0 descriptor?? [ 619.334380][T13321] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 619.437150][ T5756] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input29 [ 619.681742][ T4961] bcm5974 4-1:0.0: could not read from device [ 619.751363][ T5756] usb 4-1: USB disconnect, device number 60 [ 620.422173][T13348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 620.422695][T13348] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 622.930133][T13395] netlink: 14 bytes leftover after parsing attributes in process `syz.2.2603'. [ 623.583262][T13395] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 623.751411][T13395] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 623.821910][T13395] bond0 (unregistering): Released all slaves [ 623.909525][ T5775] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 624.089502][ T5775] usb 4-1: device descriptor read/64, error -71 [ 624.196403][T12973] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 624.342946][ T5775] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 624.470377][ T5775] usb 4-1: device descriptor read/64, error -71 [ 624.506764][ T1335] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.506881][ T1335] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.582930][ T5775] usb usb4-port1: attempt power cycle [ 624.746295][T12973] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 624.840545][T12973] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 624.944052][ T5775] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 624.961225][ T5775] usb 4-1: device descriptor read/8, error -71 [ 625.453871][ T5775] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 625.501179][ T5775] usb 4-1: device descriptor read/8, error -71 [ 625.613497][ T5775] usb usb4-port1: unable to enumerate USB device [ 625.757050][T12973] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 625.774710][T12973] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 626.060829][T13448] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 626.061386][T13448] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.064418][T13448] netlink: 88 bytes leftover after parsing attributes in process `syz.0.2609'. [ 626.182167][T12973] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 626.242700][T13448] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 626.273032][T13448] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.496859][T13449] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2609'. [ 626.554362][T13449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 626.581047][T13449] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.695944][T12973] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 626.949942][T12973] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 627.005471][T13464] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2611'. [ 627.182061][T13465] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2611'. [ 628.143333][T12973] 8021q: adding VLAN 0 to HW filter on device bond0 [ 628.417633][T12973] 8021q: adding VLAN 0 to HW filter on device team0 [ 628.510996][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 628.515889][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 628.605674][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 628.605971][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 629.849330][ T5714] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 629.999642][ T5714] usb 4-1: device descriptor read/64, error -71 [ 630.165336][T13513] syzkaller1: entered allmulticast mode [ 630.239407][ T5714] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 630.372172][ T5714] usb 4-1: device descriptor read/64, error -71 [ 630.479856][ T5714] usb usb4-port1: attempt power cycle [ 630.788545][T12973] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 630.820941][ T5714] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 630.841055][ T5714] usb 4-1: device descriptor read/8, error -71 [ 631.105473][ T5714] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 631.120136][ T5714] usb 4-1: device descriptor read/8, error -71 [ 631.307256][ T5714] usb usb4-port1: unable to enumerate USB device [ 631.470304][T12973] veth0_vlan: entered promiscuous mode [ 631.505098][T12973] veth1_vlan: entered promiscuous mode [ 631.806112][T12973] veth0_macvtap: entered promiscuous mode [ 631.846776][T12973] veth1_macvtap: entered promiscuous mode [ 631.897510][T12973] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 631.957885][T12973] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 632.008487][ T44] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.008806][ T44] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.008853][ T44] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.008897][ T44] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 633.241062][T13544] overlayfs: failed to clone upperpath [ 634.013840][ T44] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 634.013867][ T44] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 635.327776][T13567] netlink: 264 bytes leftover after parsing attributes in process `syz.0.2639'. [ 635.393939][T13567] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2639'. [ 635.497027][T13569] FAULT_INJECTION: forcing a failure. [ 635.497027][T13569] name failslab, interval 1, probability 0, space 0, times 0 [ 635.497292][T13569] CPU: 0 UID: 0 PID: 13569 Comm: syz.3.2640 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 635.497328][T13569] Tainted: [L]=SOFTLOCKUP [ 635.497338][T13569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 635.497357][T13569] Call Trace: [ 635.497367][T13569] [ 635.497379][T13569] dump_stack_lvl+0xe8/0x150 [ 635.497416][T13569] should_fail_ex+0x46b/0x600 [ 635.497453][T13569] should_failslab+0xa8/0x100 [ 635.497492][T13569] __kmalloc_noprof+0xdf/0x7b0 [ 635.497526][T13569] ? kfree+0x4d/0x6c0 [ 635.497556][T13569] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 635.497601][T13569] tomoyo_realpath_from_path+0xe3/0x5d0 [ 635.497639][T13569] ? tomoyo_domain+0xd7/0x130 [ 635.497668][T13569] ? tomoyo_path_number_perm+0x219/0x630 [ 635.497700][T13569] tomoyo_path_number_perm+0x246/0x630 [ 635.497734][T13569] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 635.497763][T13569] ? __lock_acquire+0x6b5/0x2d10 [ 635.497790][T13569] ? do_raw_spin_lock+0x12b/0x2f0 [ 635.497846][T13569] ? __fget_files+0x2a/0x420 [ 635.497879][T13569] ? __fget_files+0x2a/0x420 [ 635.497906][T13569] ? __fget_files+0x3a6/0x420 [ 635.497934][T13569] ? __fget_files+0x2a/0x420 [ 635.497967][T13569] security_file_ioctl+0xc3/0x2a0 [ 635.498000][T13569] __se_sys_ioctl+0x47/0x170 [ 635.498037][T13569] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.498065][T13569] do_syscall_64+0x15f/0xf80 [ 635.498092][T13569] ? clear_bhb_loop+0x40/0x90 [ 635.498123][T13569] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.498158][T13569] RIP: 0033:0x7f670707ce59 [ 635.498182][T13569] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 635.498205][T13569] RSP: 002b:00007f67052d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 635.498233][T13569] RAX: ffffffffffffffda RBX: 00007f67072f5fa0 RCX: 00007f670707ce59 [ 635.498253][T13569] RDX: 0000200000000140 RSI: 0000000000005423 RDI: 0000000000000003 [ 635.498270][T13569] RBP: 00007f67052d6090 R08: 0000000000000000 R09: 0000000000000000 [ 635.498288][T13569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 635.498303][T13569] R13: 00007f67072f6038 R14: 00007f67072f5fa0 R15: 00007fffc39356c8 [ 635.498342][T13569] [ 635.498534][T13569] ERROR: Out of memory at tomoyo_realpath_from_path. [ 636.145417][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 636.238695][ T60] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 636.250293][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 636.311923][ T60] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 636.387979][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 638.465928][T13612] netlink: set zone limit has 8 unknown bytes [ 638.659531][ T60] Bluetooth: hci0: command tx timeout [ 639.273882][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 639.334155][ T5715] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 639.492014][ T5715] usb 4-1: Using ep0 maxpacket: 32 [ 639.516273][ T5715] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 639.538014][ T5715] usb 4-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=bf.99 [ 639.538056][ T5715] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 639.538081][ T5715] usb 4-1: Product: syz [ 639.538100][ T5715] usb 4-1: SerialNumber: syz [ 639.581549][ T5715] usb 4-1: config 0 descriptor?? [ 639.837375][T13621] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2656'. [ 639.841659][ T32] usb 4-1: USB disconnect, device number 69 [ 640.268422][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.663249][T13632] overlayfs: missing 'lowerdir' [ 640.739602][ T60] Bluetooth: hci0: command tx timeout [ 641.802470][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.879645][T13650] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2664'. [ 641.879675][T13650] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2664'. [ 641.881922][T13650] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2664'. [ 642.321186][T13653] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2666'. [ 642.819628][ T60] Bluetooth: hci0: command tx timeout [ 642.917860][T13666] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2671'. [ 642.952375][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.979954][T13664] netlink: 'syz.3.2670': attribute type 21 has an invalid length. [ 642.990893][T13664] netlink: 'syz.3.2670': attribute type 6 has an invalid length. [ 642.991112][T13664] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2670'. [ 643.241449][T13670] ieee802154 phy0 wpan0: encryption failed: -22 [ 643.456503][T13673] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2672'. [ 643.544982][T13572] bridge0: port 1(bridge_slave_0) entered blocking state [ 643.545430][T13572] bridge0: port 1(bridge_slave_0) entered disabled state [ 643.545773][T13572] bridge_slave_0: entered allmulticast mode [ 643.548956][T13572] bridge_slave_0: entered promiscuous mode [ 643.553079][T13572] bridge0: port 2(bridge_slave_1) entered blocking state [ 643.553477][T13572] bridge0: port 2(bridge_slave_1) entered disabled state [ 643.553741][T13572] bridge_slave_1: entered allmulticast mode [ 643.556764][T13572] bridge_slave_1: entered promiscuous mode [ 643.660255][T13572] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 643.667774][T13572] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 643.908019][T13572] team0: Port device team_slave_0 added [ 643.927004][T13572] team0: Port device team_slave_1 added [ 644.174695][T13683] nvme_fabrics: missing parameter 'transport=%s' [ 644.174716][T13683] nvme_fabrics: missing parameter 'nqn=%s' [ 644.232368][T13686] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 644.233045][T13686] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 644.406779][T13572] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 644.406798][T13572] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 644.406826][T13572] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 644.497038][T13572] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 644.497060][T13572] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 644.497099][T13572] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 644.761630][T13695] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2676'. [ 644.899577][ T60] Bluetooth: hci0: command tx timeout [ 645.062829][T13691] IPv4: Oversized IP packet from 172.20.20.24 [ 645.165592][ C1] IPv4: Oversized IP packet from 172.20.20.24 [ 645.687811][T13706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 645.688383][T13706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 645.714419][T13706] netlink: 88 bytes leftover after parsing attributes in process `syz.0.2681'. [ 645.749897][ T5714] usb 4-1: new low-speed USB device number 70 using dummy_hcd [ 645.773692][T13706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 645.775764][T13706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 645.860487][T13706] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2681'. [ 645.867879][T13706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 645.889925][T13706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 645.922946][ T5714] usb 4-1: config 216 has an invalid interface number: 207 but max is 0 [ 645.922981][ T5714] usb 4-1: config 216 has no interface number 0 [ 645.923033][ T5714] usb 4-1: config 216 interface 207 altsetting 0 endpoint 0x88 is Bulk; changing to Interrupt [ 645.923063][ T5714] usb 4-1: config 216 interface 207 altsetting 0 has a duplicate endpoint with address 0x8, skipping [ 645.923092][ T5714] usb 4-1: config 216 interface 207 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 645.923132][ T5714] usb 4-1: New USB device found, idVendor=0c52, idProduct=2871, bcdDevice= 0.a4 [ 645.923159][ T5714] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.938468][T13703] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 646.204392][T13572] hsr_slave_0: entered promiscuous mode [ 646.220051][T13572] hsr_slave_1: entered promiscuous mode [ 646.229074][T13572] debugfs: 'hsr0' already exists in 'hsr' [ 646.241169][T13572] Cannot create hsr debugfs directory [ 646.489845][ T5714] usb 4-1: string descriptor 0 read error: -71 [ 646.537737][ T5714] ftdi_sio 4-1:216.207: FTDI USB Serial Device converter detected [ 646.543223][ T5714] usb 4-1: Detected SIO [ 646.543300][ T5714] ftdi_sio ttyUSB0: Overriding wMaxPacketSize on endpoint 3 [ 646.597296][ T5714] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 646.635627][ T5714] usb 4-1: USB disconnect, device number 70 [ 646.730414][ T5714] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 646.740711][ T5714] ftdi_sio 4-1:216.207: device disconnected [ 646.952437][T13712] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2683'. [ 646.952500][T13712] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2683'. [ 647.229288][ T5617] Bluetooth: hci4: command 0x0406 tx timeout [ 647.534863][T13724] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2687'. [ 647.820668][ T5715] usb 4-1: new full-speed USB device number 71 using dummy_hcd [ 647.984004][ T5715] usb 4-1: config 0 has an invalid interface number: 107 but max is 0 [ 647.984039][ T5715] usb 4-1: config 0 has no interface number 0 [ 647.984086][ T5715] usb 4-1: config 0 interface 107 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 647.984132][ T5715] usb 4-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 647.987950][ T5715] usb 4-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 647.987988][ T5715] usb 4-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 647.988014][ T5715] usb 4-1: Product: syz [ 647.988032][ T5715] usb 4-1: Manufacturer: syz [ 647.988050][ T5715] usb 4-1: SerialNumber: syz [ 648.095476][ T5715] usb 4-1: config 0 descriptor?? [ 648.120081][ T5715] keyspan 4-1:0.107: Keyspan 4 port adapter converter detected [ 648.120442][ T5715] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 81 [ 648.144544][ T5715] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 1 [ 648.159121][ T5715] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 648.220509][ T5715] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 2 [ 648.231180][ T5715] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 648.260204][ T5715] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 4 [ 648.323309][ T5715] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 648.338320][ T5715] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 6 [ 648.369773][ T5715] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 648.458195][T13725] dvmrp0: entered allmulticast mode [ 648.973477][ T935] usb 4-1: USB disconnect, device number 71 [ 649.250276][T13743] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2691'. [ 649.292890][ T935] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 649.345484][ T935] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 649.394377][T13746] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2691'. [ 649.425283][T13748] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 649.466597][T13748] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 649.496323][T13748] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 649.517824][T13748] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 649.544374][ T935] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 649.593235][ T935] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 649.597431][ T935] keyspan 4-1:0.107: device disconnected [ 649.827529][ T12] bridge_slave_1: left allmulticast mode [ 649.827816][ T12] bridge_slave_1: left promiscuous mode [ 649.841804][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 649.942260][ T12] bridge_slave_0: left allmulticast mode [ 649.942296][ T12] bridge_slave_0: left promiscuous mode [ 649.948241][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 650.415613][T13762] overlayfs: failed to clone upperpath [ 650.827920][T13774] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2699'. [ 651.062543][T13782] FAULT_INJECTION: forcing a failure. [ 651.062543][T13782] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 651.062736][T13782] CPU: 0 UID: 0 PID: 13782 Comm: syz.3.2700 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 651.062777][T13782] Tainted: [L]=SOFTLOCKUP [ 651.062788][T13782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 651.062820][T13782] Call Trace: [ 651.062831][T13782] [ 651.062844][T13782] dump_stack_lvl+0xe8/0x150 [ 651.062884][T13782] should_fail_ex+0x46b/0x600 [ 651.062928][T13782] _copy_to_user+0x31/0xb0 [ 651.062973][T13782] simple_read_from_buffer+0xe1/0x170 [ 651.063014][T13782] proc_fail_nth_read+0x1be/0x230 [ 651.063055][T13782] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 651.063095][T13782] ? rw_verify_area+0x2ac/0x4e0 [ 651.063132][T13782] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 651.063169][T13782] vfs_read+0x212/0xa80 [ 651.063218][T13782] ? __pfx_vfs_read+0x10/0x10 [ 651.063259][T13782] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 651.063305][T13782] ? lockdep_hardirqs_on+0x7a/0x110 [ 651.063347][T13782] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 651.063390][T13782] ? mutex_lock_nested+0x152/0x1d0 [ 651.063424][T13782] ? fdget_pos+0x252/0x320 [ 651.063468][T13782] ksys_read+0x156/0x270 [ 651.063510][T13782] ? __pfx_ksys_read+0x10/0x10 [ 651.063559][T13782] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.063592][T13782] do_syscall_64+0x15f/0xf80 [ 651.063622][T13782] ? clear_bhb_loop+0x40/0x90 [ 651.063657][T13782] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.063685][T13782] RIP: 0033:0x7f670703d68e [ 651.063713][T13782] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 651.063737][T13782] RSP: 002b:00007f6705293fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 651.063767][T13782] RAX: ffffffffffffffda RBX: 00007f67052946c0 RCX: 00007f670703d68e [ 651.063788][T13782] RDX: 000000000000000f RSI: 00007f67052940a0 RDI: 0000000000000007 [ 651.063814][T13782] RBP: 00007f6705294090 R08: 0000000000000000 R09: 0000000000000000 [ 651.063833][T13782] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 651.063851][T13782] R13: 00007f67072f6218 R14: 00007f67072f6180 R15: 00007fffc39356c8 [ 651.063893][T13782] [ 651.904514][ T32] usb 4-1: new full-speed USB device number 72 using dummy_hcd [ 652.123450][ T32] usb 4-1: unable to get BOS descriptor or descriptor too short [ 652.124370][ T32] usb 4-1: not running at top speed; connect to a high speed hub [ 652.125909][ T32] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 652.125938][ T32] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 652.226563][ T32] usb 4-1: New USB device found, idVendor=1235, idProduct=8213, bcdDevice= 0.40 [ 652.226603][ T32] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 652.226628][ T32] usb 4-1: Product: syz [ 652.226646][ T32] usb 4-1: Manufacturer: syz [ 652.226676][ T32] usb 4-1: SerialNumber: syz [ 652.284197][ T32] usb 4-1: 0:1 : does not exist [ 652.284302][ T32] usb 4-1: unit 3 not found! [ 652.284323][ T32] usb 4-1: unit 13 not found! [ 652.284978][ T32] usb 4-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8213); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 652.285053][ T32] usb 4-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 652.376828][T13791] 9p: Unknown access argument 18446744073709551615: -34 [ 652.474577][T13785] netlink: 88 bytes leftover after parsing attributes in process `syz.3.2701'. [ 652.622679][T13792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 652.623391][T13792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 652.723325][ T32] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 652.723961][T13792] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2701'. [ 652.759011][T13792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 652.776970][T13792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 652.858592][T12954] udevd[12954]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 652.980675][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 653.061028][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 653.083188][ T12] bond0 (unregistering): Released all slaves [ 653.208122][ T5271] 8021q: adding VLAN 0 to HW filter on device eth1 [ 653.276908][ T32] usb 4-1: USB disconnect, device number 72 [ 653.847510][T13806] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2707'. [ 654.359112][T13813] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2709'. [ 654.429406][ T5715] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 654.579466][ T5715] usb 4-1: Using ep0 maxpacket: 8 [ 654.585171][ T5715] usb 4-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 654.585217][ T5715] usb 4-1: config 1 interface 0 has no altsetting 0 [ 654.588163][ T5715] usb 4-1: New USB device found, idVendor=05ac, idProduct=0232, bcdDevice= 0.40 [ 654.588200][ T5715] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 654.588226][ T5715] usb 4-1: Product: syz [ 654.588243][ T5715] usb 4-1: Manufacturer: syz [ 654.588261][ T5715] usb 4-1: SerialNumber: syz [ 655.702086][T13833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 655.706022][T13833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 656.612249][T13840] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 656.639964][T13840] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 656.666008][T13840] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 656.675677][T13840] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 659.382422][T13864] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2722'. [ 660.100817][ T5715] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input30 [ 660.103515][ T4961] bcm5974 4-1:1.0: could not read from device [ 660.183857][ T4961] bcm5974 4-1:1.0: could not read from device [ 660.310853][ T4961] bcm5974 4-1:1.0: could not read from device [ 660.477217][ T4961] bcm5974 4-1:1.0: could not read from device [ 660.654026][T13177] bcm5974 4-1:1.0: could not read from device [ 660.999921][ T4961] bcm5974 4-1:1.0: could not read from device [ 661.088248][ T4961] bcm5974 4-1:1.0: could not read from device [ 661.304977][T13874] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 661.305651][T13874] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 661.310653][ T4961] bcm5974 4-1:1.0: could not read from device [ 661.932454][ T5271] 8021q: adding VLAN 0 to HW filter on device eth2 [ 662.405627][ T5715] usb 4-1: USB disconnect, device number 73 [ 662.457595][T13883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 662.458997][T13883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 662.613542][T13888] xt_l2tp: missing protocol rule (udp|l2tpip) [ 663.145477][T13880] syzkaller1: entered promiscuous mode [ 663.145510][T13880] syzkaller1: entered allmulticast mode [ 663.389584][ T12] hsr_slave_0: left promiscuous mode [ 663.429707][ T12] hsr_slave_1: left promiscuous mode [ 663.436105][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 663.436138][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 663.501177][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 663.516866][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 663.876396][ T12] veth1_macvtap: left promiscuous mode [ 663.876504][ T12] veth0_macvtap: left promiscuous mode [ 663.876850][ T12] veth1_vlan: left promiscuous mode [ 663.877055][ T12] veth0_vlan: left promiscuous mode [ 665.222807][ T12] team0 (unregistering): Port device team_slave_1 removed [ 665.300829][ T12] team0 (unregistering): Port device team_slave_0 removed [ 666.555995][T13909] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2734'. [ 667.066836][T13906] kthread_run failed with err -4 [ 668.289485][ T5715] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 668.442886][ T5715] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 668.442926][ T5715] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 668.442975][ T5715] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 668.443003][ T5715] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.463323][ T5715] usb 4-1: config 0 descriptor?? [ 669.171583][ T5715] ath6kl: Failed to submit usb control message: -71 [ 669.171633][ T5715] ath6kl: unable to send the bmi data to the device: -71 [ 669.171650][ T5715] ath6kl: Unable to send get target info: -71 [ 669.249701][ T5715] ath6kl: Failed to init ath6kl core: -71 [ 669.284956][ T5715] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 669.437878][ T5715] usb 4-1: USB disconnect, device number 74 [ 670.279463][ T5715] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 670.642553][ T5715] usb 4-1: Using ep0 maxpacket: 32 [ 670.646924][ T5715] usb 4-1: config 0 interface 0 has no altsetting 0 [ 670.646968][ T5715] usb 4-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 670.646996][ T5715] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 670.652346][ T5715] usb 4-1: config 0 descriptor?? [ 670.716113][ T5715] as10x_usb: device has been detected [ 670.724813][ T5715] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 670.755040][ T5715] usb 4-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 670.808510][ T5715] as10x_usb: error during firmware upload part1 [ 670.816327][ T5715] Registered device nBox DVB-T Dongle [ 671.015650][T13953] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 671.016380][T13953] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 671.504302][T13953] vivid-000: kernel_thread() failed [ 671.690497][ T5715] usb 4-1: USB disconnect, device number 75 [ 672.307709][ T5715] Unregistered device nBox DVB-T Dongle [ 672.406713][T13968] No source specified [ 672.445868][ T5715] as10x_usb: device has been disconnected [ 673.739875][T13984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 673.740708][T13984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 673.751284][T13984] netlink: 88 bytes leftover after parsing attributes in process `syz.0.2745'. [ 673.817359][T13984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 673.818062][T13984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 673.972848][T13984] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2745'. [ 673.986432][T13984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 673.992278][T13984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 674.035684][T13572] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 674.092925][T13572] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 674.098967][T13572] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 674.247074][T13572] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 674.359079][T13572] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 674.476121][T13995] netlink: 'syz.3.2751': attribute type 21 has an invalid length. [ 674.514614][T13572] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 674.515263][T13995] netlink: 'syz.3.2751': attribute type 6 has an invalid length. [ 674.515288][T13995] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2751'. [ 674.626180][T13572] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 674.747359][T13572] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 674.898218][T14008] FAULT_INJECTION: forcing a failure. [ 674.898218][T14008] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 674.898266][T14008] CPU: 1 UID: 0 PID: 14008 Comm: syz.0.2753 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 674.898313][T14008] Tainted: [L]=SOFTLOCKUP [ 674.898323][T14008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 674.898339][T14008] Call Trace: [ 674.898349][T14008] [ 674.898360][T14008] dump_stack_lvl+0xe8/0x150 [ 674.898396][T14008] should_fail_ex+0x46b/0x600 [ 674.898433][T14008] _copy_from_user+0x2d/0xb0 [ 674.898473][T14008] __se_sys_migrate_pages+0x264/0xca0 [ 674.898516][T14008] ? __pfx___se_sys_migrate_pages+0x10/0x10 [ 674.898551][T14008] ? ksys_write+0x248/0x270 [ 674.898588][T14008] ? __pfx_ksys_write+0x10/0x10 [ 674.898632][T14008] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.898660][T14008] do_syscall_64+0x15f/0xf80 [ 674.898684][T14008] ? trace_irq_disable+0x3b/0x140 [ 674.898719][T14008] ? clear_bhb_loop+0x40/0x90 [ 674.898750][T14008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.898775][T14008] RIP: 0033:0x7fa4e4eace59 [ 674.898799][T14008] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 674.898822][T14008] RSP: 002b:00007fa4e3106028 EFLAGS: 00000246 ORIG_RAX: 0000000000000100 [ 674.898850][T14008] RAX: ffffffffffffffda RBX: 00007fa4e5125fa0 RCX: 00007fa4e4eace59 [ 674.898870][T14008] RDX: 0000200000000000 RSI: 0000000000000524 RDI: 0000000000000000 [ 674.898887][T14008] RBP: 00007fa4e3106090 R08: 0000000000000000 R09: 0000000000000000 [ 674.898904][T14008] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 674.898921][T14008] R13: 00007fa4e5126038 R14: 00007fa4e5125fa0 R15: 00007ffce1b10da8 [ 674.898959][T14008] [ 675.443729][T14014] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 675.443858][T14014] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 675.444020][T14014] vhci_hcd vhci_hcd.0: Device attached [ 675.462557][T14015] vhci_hcd: cannot find a urb of seqnum 212 max seqnum 1 [ 675.464001][ T44] vhci_hcd vhci_hcd.0: stop threads [ 675.464024][ T44] vhci_hcd vhci_hcd.0: release socket [ 675.797327][ T44] vhci_hcd vhci_hcd.0: disconnect device [ 676.326001][T13572] 8021q: adding VLAN 0 to HW filter on device bond0 [ 676.811347][T13572] 8021q: adding VLAN 0 to HW filter on device team0 [ 677.156067][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 677.156252][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 677.445023][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 677.445211][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 677.729870][ T5802] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 677.894304][ T5802] usb 4-1: Using ep0 maxpacket: 8 [ 677.908582][ T5802] usb 4-1: config index 0 descriptor too short (expected 26, got 18) [ 677.922115][ T5802] usb 4-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 677.922152][ T5802] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.922173][ T5802] usb 4-1: Product: syz [ 677.922188][ T5802] usb 4-1: Manufacturer: syz [ 677.922204][ T5802] usb 4-1: SerialNumber: syz [ 678.009493][ T5802] usb 4-1: config 0 descriptor?? [ 678.086268][ T5802] gspca_main: sq930x-2.14.0 probing 2770:930c [ 678.589646][ T5802] gspca_sq930x: reg_r 001f failed -110 [ 678.589783][ T5802] sq930x 4-1:0.0: probe with driver sq930x failed with error -110 [ 678.748200][T14050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 678.785916][T14050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 679.658280][T14080] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2771'. [ 680.152779][T14087] FAULT_INJECTION: forcing a failure. [ 680.152779][T14087] name failslab, interval 1, probability 0, space 0, times 0 [ 680.152825][T14087] CPU: 1 UID: 0 PID: 14087 Comm: syz.0.2772 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 680.152858][T14087] Tainted: [L]=SOFTLOCKUP [ 680.152868][T14087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 680.152883][T14087] Call Trace: [ 680.152894][T14087] [ 680.152905][T14087] dump_stack_lvl+0xe8/0x150 [ 680.152952][T14087] should_fail_ex+0x46b/0x600 [ 680.152990][T14087] should_failslab+0xa8/0x100 [ 680.153029][T14087] __kmalloc_noprof+0xdf/0x7b0 [ 680.153064][T14087] ? tomoyo_encode+0x28b/0x550 [ 680.153109][T14087] tomoyo_encode+0x28b/0x550 [ 680.153155][T14087] tomoyo_mount_permission+0x4c1/0x9d0 [ 680.153200][T14087] ? tomoyo_mount_permission+0x2b3/0x9d0 [ 680.153238][T14087] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 680.153335][T14087] security_sb_mount+0xe4/0x320 [ 680.153379][T14087] path_mount+0xbc/0x10e0 [ 680.153407][T14087] ? user_path_at+0xd4/0x160 [ 680.153444][T14087] ? user_path_at+0xd4/0x160 [ 680.153480][T14087] __se_sys_mount+0x31d/0x420 [ 680.153516][T14087] ? __pfx___se_sys_mount+0x10/0x10 [ 680.153553][T14087] ? __x64_sys_mount+0x20/0xc0 [ 680.153582][T14087] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 680.153610][T14087] do_syscall_64+0x15f/0xf80 [ 680.153635][T14087] ? trace_irq_disable+0x3b/0x140 [ 680.153671][T14087] ? clear_bhb_loop+0x40/0x90 [ 680.153702][T14087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 680.153728][T14087] RIP: 0033:0x7fa4e4eace59 [ 680.153751][T14087] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 680.153774][T14087] RSP: 002b:00007fa4e3106028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 680.153802][T14087] RAX: ffffffffffffffda RBX: 00007fa4e5125fa0 RCX: 00007fa4e4eace59 [ 680.153822][T14087] RDX: 0000200000000080 RSI: 0000200000000300 RDI: 0000000000000000 [ 680.153840][T14087] RBP: 00007fa4e3106090 R08: 0000200000000140 R09: 0000000000000000 [ 680.153858][T14087] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 680.153875][T14087] R13: 00007fa4e5126038 R14: 00007fa4e5125fa0 R15: 00007ffce1b10da8 [ 680.153920][T14087] Stopping sshd: [ 680.473656][ T5802] usb 4-1: USB disconnect, device number 76 [ 680.795176][T14091] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 680.946375][T14096] binder: BINDER_SET_CONTEXT_MGR already set [ 680.946396][T14096] binder: 14092:14096 ioctl 4018620d 200000000100 returned -16 stopped /usr/sbin/sshd (pid 5364) [ 681.042123][T14099] binder: 14092:14099 ioctl c0306201 0 returned -14 OK Stopping crond: stopped /usr/sbin/crond (pid 5349) OK Stopping dhcpcd... [ 682.756235][T14130] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2781'. [ 682.810381][T13572] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 682.812395][T14130] tipc: Started in network mode [ 682.812432][T14130] tipc: Node identity ac14140f, cluster identity 4711 stopped /sbin/dhcpcd (pid 5270) [ 682.913436][T14130] tipc: Enabling of bearer rejected, failed to enable media [ 683.269667][T14140] tmpfs: Bad value for 'size' [ 683.657947][T13572] veth0_vlan: entered promiscuous mode Stopping network: [ 683.901753][T13572] veth1_vlan: entered promiscuous mode [ 684.785141][T14164] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2791'. [ 684.874832][ T5775] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 684.940143][T14164] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2791'. [ 685.042394][ T5775] usb 4-1: Using ep0 maxpacket: 8 [ 685.060645][ T5775] usb 4-1: config 0 has an invalid interface number: 148 but max is 0 [ 685.060696][ T5775] usb 4-1: config 0 has no interface number 0 [ 685.060857][ T5775] usb 4-1: config 0 interface 148 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 7 [ 685.060880][ T5775] usb 4-1: config 0 interface 148 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 685.085733][ T5775] usb 4-1: New USB device found, idVendor=0d46, idProduct=2012, bcdDevice=4d.ec [ 685.086142][ T5775] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 685.086531][ T5775] usb 4-1: Product: syz [ 685.086889][ T5775] usb 4-1: Manufacturer: syz [ 685.087247][ T5775] usb 4-1: SerialNumber: syz [ 685.226531][ T5775] usb 4-1: config 0 descriptor?? [ 685.263298][ T5775] kobil_sct 4-1:0.148: KOBIL USB smart card terminal converter detected [ 685.277168][T13572] veth0_macvtap: entered promiscuous mode [ 685.337090][ T5775] usb 4-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 685.535460][T13572] veth1_macvtap: entered promiscuous mode [ 685.945426][ T1335] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.945551][ T1335] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.969794][ T5715] usb 4-1: USB disconnect, device number 77 [ 686.017601][ T5715] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 686.031255][ T5715] kobil_sct 4-1:0.148: device disconnected [ 686.368583][T13572] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 686.646970][T13572] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 686.777561][T14191] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2797'. [ 686.985564][ T2164] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 687.122252][ T2164] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 687.126384][ T44] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 687.126442][ T44] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 OK [ 687.576706][T14203] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2800'. Stopping iptables: [ 688.281061][T14211] comedi comedi0: Minor 8 could not be opened [ 688.390582][T14211] usb usb5: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. modprobe: can't change directory to 'syzkaller': No such file or directory iptables v1.8.11 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded. FAIL [ 689.155276][T14225] netlink: 144 bytes leftover after parsing attributes in process `syz.0.2805'. Stopping system message bus: [ 690.299300][ T5756] usb 4-1: new full-speed USB device number 78 using dummy_hcd [ 690.546208][ T5756] usb 4-1: config index 0 descriptor too short (expected 100, got 36) [ 690.546248][ T5756] usb 4-1: config 2 has an invalid interface number: 174 but max is 0 [ 690.546276][ T5756] usb 4-1: config 2 has no interface number 0 [ 690.546347][ T5756] usb 4-1: config 2 interface 174 altsetting 0 has an endpoint descriptor with address 0x9E, changing to 0x8E [ 690.546381][ T5756] usb 4-1: config 2 interface 174 altsetting 0 endpoint 0x8E has invalid maxpacket 1023, setting to 64 [ 690.546416][ T5756] usb 4-1: config 2 interface 174 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 690.644719][ T5756] usb 4-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=22.7e [ 690.644758][ T5756] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 690.644783][ T5756] usb 4-1: Product: syz [ 690.644801][ T5756] usb 4-1: Manufacturer: syz [ 690.644819][ T5756] usb 4-1: SerialNumber: syz [ 690.748897][T14239] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 690.983901][ T1480] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 690.983922][ T1480] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 690.986683][ T5756] usb 4-1: probing VID:PID(0424:012C) [ 691.064459][ T5756] usb 4-1: vub300 testing BULK IN EndPoint(0) 8E [ 691.064491][ T5756] usb 4-1: vub300 testing UNKNOWN EndPoint(1) 82 [ 691.064511][ T5756] usb 4-1: vub300 ignoring EndPoint(1) 82 [ 691.064534][ T5756] usb 4-1: Could not find two sets of bulk-in/out endpoint pairs [ 691.523535][ T5756] vub300 4-1:2.174: probe with driver vub300 failed with error -22 [ 691.557069][ T5756] usb 4-1: USB disconnect, device number 78 done [ 692.817018][ T2164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 692.817042][ T2164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 695.373029][ T5714] usb 2-1: new full-speed USB device number 47 using dummy_hcd [ 695.528281][ T5714] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 695.528319][ T5714] usb 2-1: config 179 has no interface number 0 [ 695.528380][ T5714] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 695.528412][ T5714] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 64 [ 695.528447][ T5714] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 695.528478][ T5714] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 45824, setting to 64 [ 695.528478][ T5714] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 45824, setting to 64 [ 695.528511][ T5714] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 695.528568][ T5714] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 695.528595][ T5714] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 695.575849][T14285] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 695.580394][T14285] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 695.604037][ T4976] ------------[ cut here ]------------ [ 695.604077][ T4976] kcov->t != t [ 695.604117][ T4976] WARNING: kernel/kcov.c:483 at kcov_task_exit+0xf5/0x160, CPU#1: udevd/4976 [ 695.604197][ T4976] Modules linked in: [ 695.604240][ T4976] CPU: 1 UID: 0 PID: 4976 Comm: udevd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 695.604335][ T4976] Tainted: [L]=SOFTLOCKUP [ 695.604365][ T4976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 695.604382][ T4976] RIP: 0010:kcov_task_exit+0xf5/0x160 [ 695.604421][ T4976] Code: 10 00 00 48 8b bb 90 00 00 00 e8 a6 31 58 00 48 89 df 5b 41 5e 41 5f e9 c9 ed 5d 00 7c 1c 5b 41 5e 41 5f e9 bd 48 72 09 cc 90 <0f> 0b 90 4c 89 f7 5b 41 5e 41 5f e9 1b df 70 09 48 89 df be 03 00 [ 695.604446][ T4976] RSP: 0018:ffffc900015cfd20 EFLAGS: 00010283 [ 695.604470][ T4976] RAX: 83aa23895224e100 RBX: ffff8880298ca800 RCX: 0000000000000000 [ 695.604490][ T4976] RDX: 00000000b9174e89 RSI: ffffffff8baa6d40 RDI: 00000000ffffffff [ 695.604537][ T4976] RBP: ffffc900015cfe78 R08: ffffffff8b35f9d0 R09: ffffffff8e1c8240 [ 695.604577][ T4976] R10: dffffc0000000000 R11: fffffbfff1f59a7f R12: dffffc0000000000 [ 695.604594][ T4976] R13: 0000000000000000 R14: ffff8880298ca808 R15: ffff8880384bdc40 [ 695.604610][ T4976] FS: 00007f63a13f7880(0000) GS:ffff888125dc7000(0000) knlGS:0000000000000000 [ 695.604632][ T4976] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 695.604651][ T4976] CR2: 00007f63a1433e9c CR3: 0000000011d0e000 CR4: 00000000003526f0 [ 695.604675][ T4976] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 695.604694][ T4976] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 695.604713][ T4976] Call Trace: [ 695.604725][ T4976] [ 695.604738][ T4976] do_exit+0x150/0x22c0 [ 695.604778][ T4976] ? lockdep_hardirqs_on+0x7a/0x110 [ 695.604895][ T4976] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 695.604940][ T4976] ? reacquire_held_locks+0x104/0x190 [ 695.604971][ T4976] ? rt_spin_lock+0x1e0/0x400 [ 695.605015][ T4976] ? __pfx_do_exit+0x10/0x10 [ 695.605107][ T4976] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 695.605154][ T4976] ? rt_spin_unlock+0x160/0x200 [ 695.605192][ T4976] do_group_exit+0x21b/0x2d0 [ 695.605231][ T4976] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.605306][ T4976] __x64_sys_exit_group+0x3f/0x40 [ 695.605344][ T4976] x64_sys_call+0x221a/0x2240 [ 695.605380][ T4976] do_syscall_64+0x15f/0xf80 [ 695.605404][ T4976] ? trace_irq_disable+0x3b/0x140 [ 695.605452][ T4976] ? clear_bhb_loop+0x40/0x90 [ 695.605499][ T4976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.605549][ T4976] RIP: 0033:0x7f63a152f6c5 [ 695.605574][ T4976] Code: ff ff ff 64 89 02 eb d2 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 35 21 f7 0f 00 ba e7 00 00 00 eb 03 66 90 f4 89 d0 0f 05 <48> 3d 00 f0 ff ff 76 f3 f7 d8 64 89 06 eb ec 66 2e 0f 1f 84 00 00 [ 695.605599][ T4976] RSP: 002b:00007ffced35c818 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 695.605627][ T4976] RAX: ffffffffffffffda RBX: 00007f63a1630fe8 RCX: 00007f63a152f6c5 [ 695.605647][ T4976] RDX: 00000000000000e7 RSI: fffffffffffffe68 RDI: 0000000000000000 [ 695.605665][ T4976] RBP: 0000000000000001 R08: 00007ffced35c7b0 R09: 0000000000000000 [ 695.605703][ T4976] R10: 00007ffced35c660 R11: 0000000000000206 R12: 0000000000000000 [ 695.605747][ T4976] R13: 0000000000000000 R14: 00007f63a162f680 R15: 00007f63a1631000 [ 695.605799][ T4976] [ 695.605828][ T4976] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 695.605850][ T4976] CPU: 1 UID: 0 PID: 4976 Comm: udevd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 695.605886][ T4976] Tainted: [L]=SOFTLOCKUP [ 695.605903][ T4976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 695.605945][ T4976] Call Trace: [ 695.605970][ T4976] [ 695.605994][ T4976] vpanic+0x56c/0xa60 [ 695.606036][ T4976] ? __pfx__printk+0x10/0x10 [ 695.606065][ T4976] ? __pfx_vpanic+0x10/0x10 [ 695.606112][ T4976] ? is_bpf_text_address+0x292/0x2b0 [ 695.606186][ T4976] ? is_bpf_text_address+0x26/0x2b0 [ 695.606243][ T4976] panic+0xc5/0xd0 [ 695.606282][ T4976] ? __pfx_panic+0x10/0x10 [ 695.606339][ T4976] __warn+0x315/0x4c0 [ 695.606442][ T4976] ? kcov_task_exit+0xf5/0x160 [ 695.606480][ T4976] ? kcov_task_exit+0xf5/0x160 [ 695.606518][ T4976] __report_bug+0x29a/0x540 [ 695.606551][ T4976] ? kcov_task_exit+0xf5/0x160 [ 695.606620][ T4976] ? __pfx___report_bug+0x10/0x10 [ 695.606677][ T4976] ? __pfx_rtlock_slowlock_locked+0x10/0x10 [ 695.606718][ T4976] ? rt_spin_lock+0x1e0/0x400 [ 695.606753][ T4976] ? rt_spin_lock+0x1e0/0x400 [ 695.606806][ T4976] ? kcov_task_exit+0xf5/0x160 [ 695.606886][ T4976] report_bug+0x16a/0x220 [ 695.606914][ T4976] ? kcov_task_exit+0xf5/0x160 [ 695.606948][ T4976] ? kcov_task_exit+0xf7/0x160 [ 695.606982][ T4976] handle_bug+0x9c/0x200 [ 695.607034][ T4976] exc_invalid_op+0x1a/0x50 [ 695.607105][ T4976] asm_exc_invalid_op+0x1a/0x20 [ 695.607132][ T4976] RIP: 0010:kcov_task_exit+0xf5/0x160 [ 695.607169][ T4976] Code: 10 00 00 48 8b bb 90 00 00 00 e8 a6 31 58 00 48 89 df 5b 41 5e 41 5f e9 c9 ed 5d 00 7c 1c 5b 41 5e 41 5f e9 bd 48 72 09 cc 90 <0f> 0b 90 4c 89 f7 5b 41 5e 41 5f e9 1b df 70 09 48 89 df be 03 00 [ 695.607193][ T4976] RSP: 0018:ffffc900015cfd20 EFLAGS: 00010283 [ 695.607216][ T4976] RAX: 83aa23895224e100 RBX: ffff8880298ca800 RCX: 0000000000000000 [ 695.607264][ T4976] RDX: 00000000b9174e89 RSI: ffffffff8baa6d40 RDI: 00000000ffffffff [ 695.607316][ T4976] RBP: ffffc900015cfe78 R08: ffffffff8b35f9d0 R09: ffffffff8e1c8240 [ 695.607338][ T4976] R10: dffffc0000000000 R11: fffffbfff1f59a7f R12: dffffc0000000000 [ 695.607359][ T4976] R13: 0000000000000000 R14: ffff8880298ca808 R15: ffff8880384bdc40 [ 695.607387][ T4976] ? rt_spin_lock+0x1e0/0x400 [ 695.607432][ T4976] do_exit+0x150/0x22c0 [ 695.607492][ T4976] ? lockdep_hardirqs_on+0x7a/0x110 [ 695.607560][ T4976] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 695.607605][ T4976] ? reacquire_held_locks+0x104/0x190 [ 695.607637][ T4976] ? rt_spin_lock+0x1e0/0x400 [ 695.607694][ T4976] ? __pfx_do_exit+0x10/0x10 [ 695.607768][ T4976] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 695.607814][ T4976] ? rt_spin_unlock+0x160/0x200 [ 695.607852][ T4976] do_group_exit+0x21b/0x2d0 [ 695.607884][ T4976] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.607973][ T4976] __x64_sys_exit_group+0x3f/0x40 [ 695.608010][ T4976] x64_sys_call+0x221a/0x2240 [ 695.608046][ T4976] do_syscall_64+0x15f/0xf80 [ 695.608079][ T4976] ? trace_irq_disable+0x3b/0x140 [ 695.608139][ T4976] ? clear_bhb_loop+0x40/0x90 [ 695.608213][ T4976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.608241][ T4976] RIP: 0033:0x7f63a152f6c5 [ 695.608265][ T4976] Code: ff ff ff 64 89 02 eb d2 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 35 21 f7 0f 00 ba e7 00 00 00 eb 03 66 90 f4 89 d0 0f 05 <48> 3d 00 f0 ff ff 76 f3 f7 d8 64 89 06 eb ec 66 2e 0f 1f 84 00 00 [ 695.608289][ T4976] RSP: 002b:00007ffced35c818 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 [ 695.608316][ T4976] RAX: ffffffffffffffda RBX: 00007f63a1630fe8 RCX: 00007f63a152f6c5 [ 695.608338][ T4976] RDX: 00000000000000e7 RSI: fffffffffffffe68 RDI: 0000000000000000 [ 695.608371][ T4976] RBP: 0000000000000001 R08: 00007ffced35c7b0 R09: 0000000000000000 [ 695.608389][ T4976] R10: 00007ffced35c660 R11: 0000000000000206 R12: 0000000000000000 [ 695.608429][ T4976] R13: 0000000000000000 R14: 00007f63a162f680 R15: 00007f63a1631000 [ 695.608468][ T4976] [ 695.609087][ T4976] Kernel Offset: disabled serialport: VM disconnected.