last executing test programs: 2m59.194725555s ago: executing program 4 (id=2667): syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000100)=@any_dev={0x3, 0x2b7, 0x0, 0x0, 0x1000, 0x544, 0x0, 0x0, 0x10}}}, &(0x7f0000000380)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r3 = accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000280)) r4 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f0000002dc0)={&(0x7f0000001640)=@l2tp6={0xa, 0x0, 0x7fff, @local, 0x8}, 0x80, &(0x7f0000000340)}, 0x8001) setsockopt$sock_attach_bpf(r4, 0x84, 0x1e, &(0x7f0000000000), 0x4) setsockopt$sock_attach_bpf(r4, 0x84, 0x1e, &(0x7f0000000040), 0x4) socket$inet_sctp(0x2, 0x1, 0x84) fdatasync(0xffffffffffffffff) mremap(&(0x7f0000fc4000/0x4000)=nil, 0x4000, 0x1000, 0x7, &(0x7f0000fc5000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r5, &(0x7f0000032680)=""/102400, 0x19000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd, 0xfeefffff}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000040)={0x28, r2, 0x1, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0x4f}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008004) r7 = signalfd(r0, &(0x7f00000003c0)={[0x1]}, 0x8) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r7, &(0x7f0000000180)={0xa, 0x4e22, 0x800, @remote, 0x40002}, 0x1c) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x882) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r8, 0x40605346, &(0x7f0000000440)={0x0, 0x0, {0x3, 0x2, 0x0, 0x2, 0x3}, 0x4}) creat(&(0x7f0000000400)='./bus\x00', 0x0) socket(0x840000000002, 0x80000, 0xff) 2m52.250709693s ago: executing program 4 (id=2682): syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syz_tun\x00'}) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) syz_emit_ethernet(0xd83, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x88}, 0x0) mkdir(0x0, 0x7) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) openat$nullb(0xffffffffffffff9c, &(0x7f0000000280), 0x4000000004002, 0x0) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x3e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, 0xffffffffffffffff, 0x6000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 2m50.308408353s ago: executing program 2 (id=2688): syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000100)=@any_dev={0x3, 0x2b7, 0x0, 0x0, 0x1000, 0x544, 0x0, 0x0, 0x10}}}, &(0x7f0000000380)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r2 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r2, &(0x7f0000002dc0)={&(0x7f0000001640)=@l2tp6={0xa, 0x0, 0x7fff, @local, 0x8}, 0x80, &(0x7f0000000340)=[{&(0x7f00000003c0)}], 0x1}, 0x8001) setsockopt$sock_attach_bpf(r2, 0x84, 0x1e, &(0x7f0000000040), 0x4) socket$inet_sctp(0x2, 0x1, 0x84) fdatasync(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0x4f}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008004) r5 = signalfd(r0, &(0x7f00000003c0)={[0x1]}, 0x8) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e22, 0x800, @remote, 0x40002}, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00', 0xa3e}) creat(&(0x7f0000000400)='./bus\x00', 0x0) 2m49.55875519s ago: executing program 4 (id=2690): open_tree(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x8000) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000140), 0xfff7fffffffffffe, 0x483c1) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r1, 0xc0085666, &(0x7f0000000080)={0x2, 0x4}) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="640000001000370403000000ffffffff00000000", @ANYRES32=r2, @ANYBLOB="0b1b050000000000440012800b00010069703667726500003400028008000100", @ANYRES32, @ANYBLOB="140006"], 0x64}, 0x1, 0x0, 0x0, 0x48810}, 0x4000010) r3 = socket(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000600)={0x44000080, 0x0, 0x0, 0x0, {0x34}, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0], 0x6}, 0x58) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x2) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000004c0)="766b0fe8ad04cf39c28525c070fe31bb4b58743d9c6b713615ded1a2fb3d0d098bb4be65c1f7fdc46ed1db297da677c72032cd8b8a23a57f099e7a3378d859792df60c526980aa3639fe4504112becf43b074cfbb3fe74127d9307e55962dc14d260cd4ec7", 0x65}], 0x1}, 0x400804c) syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda443000090401"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x2b) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r6, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x8d0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000a40)=@newtfilter={0x740, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xc}, {0xfff2}, {0xfff1, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x714, 0x2, [@TCA_BPF_ACT={0x704, 0x1, [@m_vlan={0xa8, 0xd, 0x0, 0x0, {{0x9}, {0x74, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PRIORITY={0x5}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xa65}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x1, 0x1000, 0x2, 0xffffffff, 0x2}, 0x3}}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xd27}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x5}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x0, 0x59d7, 0x3, 0xfbf0, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}]}, {0xb, 0x6, "fb55829a1a07a3"}, {0xc}, {0xc, 0x8, {0x2}}}}, @m_tunnel_key={0x5c, 0x4, 0x0, 0x0, {{0xf}, {0x18, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @mcast2}]}, {0x15, 0x6, "0599b5d3188d63fb1994575a74dc0dcd0a"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_nat={0x1f0, 0x9, 0x0, 0x0, {{0x8}, {0xcc, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x6, 0xffff, 0xffffffffffffffff}, @loopback, @rand_addr=0x64010100, 0xffffffff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x2, 0x3, 0x1, 0x1, 0xe2b}, @remote, @empty, 0xff000000}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x6, 0x7, 0x8, 0x5, 0x4}, @multicast2, @loopback, 0x0, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x5, 0x6, 0x7, 0x6, 0x6}, @private=0xa010100, @remote, 0xffffff00, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xfffffff9, 0x5, 0xfffffffffffffffe, 0x6, 0xeff}, @multicast2, @loopback, 0x0, 0x1}}]}, {0x100, 0x6, "02849cfe51b43bf23b9864df433c30f7b23cad1d91d454bc5b01e764d2ae9da68dc17b2910758caec27f59286e63ae914a7bbceaa44291472113998c45e4d118c4c4899426b00f6d27ac8b18843b8ed980fffe7be45bc1126a0fe3fbd6eb310274bffedb629f270274dad563aa4e3f3563afc6296729b343889571971e565dad40d1dd3b42862c6f3aba15b03b472aba054bb7481a111ef2929980a56acbecec8b88adcc763ceb6fcab9a97f222f35ac9f728776339b79ee5be56dd56506abfc1067e36cb05fee0ebfaa01df9a8a1ed6e2b2910007018d83d5e0eb17fdf190f90607d956d2965685223706b912e7b575c9539bd80e26e0133024164e"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_vlan={0x64, 0x17, 0x0, 0x0, {{0x9}, {0x4}, {0x35, 0x6, "dc853b9cd377f07012900f3986db3d85a15288a8b1f2960bb01fa20b0aed3c45257f98a34c34351ecf9b998df30e098fb3"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_mpls={0x98, 0xa, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_MPLS_BOS={0x5}, @TCA_MPLS_TTL={0x5, 0x7, 0x4}, @TCA_MPLS_TC={0x5, 0x6, 0x6}]}, {0x54, 0x6, "df1c51bdf4edaa86ba4b853e4d4984b63a4be0f2515e34fcafc3ac04496df933773bdfe64010ffc61c43958320a2593d56805b0589fdd1203adbf6c49630eebaed3c9a612df4ceff1d2a6cd918d0b28f"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_xt={0x184, 0x2, 0x0, 0x0, {{0x7}, {0xd8, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x7c4}, @TCA_IPT_HOOK={0x8, 0x2, 0x1}, @TCA_IPT_INDEX={0x8, 0x3, 0x1}, @TCA_IPT_TABLE={0x24, 0x1, 'security\x00'}, @TCA_IPT_TABLE={0x24, 0x1, 'nat\x00'}, @TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_TARG={0x64, 0x6, {0x4, 'mangle\x00', 0x93, 0x800, "c9641caead2be81529cfa4c958b17e5676adc88dccbc31cfa38d0ff347ff2e7d28808b1603e6149ad011f50d9c65f0dc72762f36df754fbc1c60"}}, @TCA_IPT_INDEX={0x8, 0x3, 0x8}]}, {0x87, 0x6, "1d55d43afed31ab0e467db13e88cb1cf8ca0bb281efe6619faa9415e31412a9d882b10e50ed62e03c60d242a430be4b256740e0baaa6af6e15531df099dc0de9a4276a790c865246ed36b93b62589d2244ed80167bebf73a885af26bfaa4389842efd7753611225277b84ba9f7a9de9c23ed5ca21c4c1379f675dc8941c76ed7affeb4"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x7, 0x2}}}}, @m_nat={0x13c, 0x19, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xffffffff, 0x7, 0x2, 0x527ccf64, 0x5}, @loopback, @dev={0xac, 0x14, 0x14, 0x41}, 0xff, 0x1}}]}, {0xe9, 0x6, "cce92ab28c900565af45a7f1cc24debe4ecf10d340b921ed0ebfe28360eef11391fde2f2a45e523e8a4efa5b1408aae9c8f306a0d2543f62ab32a48a1c0561bacc675126105b6e28583db6fbd3c21fec41dc66323a4257d0fb942ae2b5fe4ad39bcba370051b54a9fc57419c44c27f356434bcd12e4ae1e44897080b1b0ab932c5abb50fcb05fd33db6e43273798e1e24467b0621924a3f462a5af1cdfc5061e682ca0a6bb08165ee092430967343f2e8405a89c1eb4d21d8abad62734071dd7f306eec33ff268432396b0852d52d31f5765b9d049015f578e9dcdb8b896acc58f6b758ec7"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}, @m_mpls={0x50, 0x5, 0x0, 0x0, {{0x9}, {0x14, 0x2, 0x0, 0x1, [@TCA_MPLS_PROTO={0x6, 0x4, 0x88f5}, @TCA_MPLS_TTL={0x5}]}, {0x14, 0x6, "5eea45bf3d39f90db67fe04e2fb19631"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}]}}]}, 0x740}}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e02100418"], 0x7) 2m48.885467563s ago: executing program 0 (id=2691): syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000100)=@any_dev={0x3, 0x2b7, 0x0, 0x0, 0x1000, 0x544, 0x0, 0x0, 0x10}}}, &(0x7f0000000380)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r3 = accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000280)) r4 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f0000002dc0)={&(0x7f0000001640)=@l2tp6={0xa, 0x0, 0x7fff, @local, 0x8}, 0x80, &(0x7f0000000340)}, 0x8001) setsockopt$sock_attach_bpf(r4, 0x84, 0x1e, &(0x7f0000000000), 0x4) setsockopt$sock_attach_bpf(r4, 0x84, 0x1e, &(0x7f0000000040), 0x4) socket$inet_sctp(0x2, 0x1, 0x84) fdatasync(0xffffffffffffffff) mremap(&(0x7f0000fc4000/0x4000)=nil, 0x4000, 0x1000, 0x7, &(0x7f0000fc5000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r5, &(0x7f0000032680)=""/102400, 0x19000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd, 0xfeefffff}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000040)={0x28, r2, 0x1, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0x4f}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008004) r7 = signalfd(r0, &(0x7f00000003c0)={[0x1]}, 0x8) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r7, &(0x7f0000000180)={0xa, 0x4e22, 0x800, @remote, 0x40002}, 0x1c) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x882) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r8, 0x40605346, &(0x7f0000000440)={0x0, 0x0, {0x3, 0x2, 0x0, 0x2, 0x3}, 0x4}) creat(&(0x7f0000000400)='./bus\x00', 0x0) socket(0x840000000002, 0x80000, 0xff) 2m47.706554334s ago: executing program 1 (id=2693): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000080)={0x0, 0xdfffffff, 0x800, 0x0, 0x1}, 0x20) (fail_nth: 4) 2m45.820245794s ago: executing program 1 (id=2696): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x2000000, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x604ad000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000003000)=""/4090, 0xffa, 0x0, 0x0}, &(0x7f0000000000)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000740)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1, 0x0, 0x31}, &(0x7f0000000780)=0x40) ioctl$COMEDI_INSN(0xffffffffffffffff, 0x8028640c, &(0x7f0000000080)={0xc000003, 0xf, &(0x7f0000000040)=[0x15, 0x4, 0x40005002, 0xffff32eb, 0x2, 0xffffdff9, 0x2d7b, 0x401, 0x0, 0x3, 0x0, 0x3, 0xfe09, 0xd2, 0x80000002], 0x1, 0x4000003}) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$OCFS2_IOC_RESVSP64(r1, 0x4030582a, &(0x7f0000000100)={0x1, 0x1, 0x5, 0x2, 0x8, 0x5}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r2 = socket$nl_route(0x10, 0x3, 0x0) capset(&(0x7f0000a31000)={0x20080522}, &(0x7f0000000080)) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) ioctl$FITHAW(r3, 0xc0045878) syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="12010900875b0d20d8130100220e012003010902120001000000000904"], 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xcf6, 0x34424752}}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000240)=0x1) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newqdisc={0x3c, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xffe0, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) bind$packet(r1, &(0x7f0000000040)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @remote}, 0x14) 2m44.089235941s ago: executing program 2 (id=2698): r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="120100000cb768405e0483020b990102030109021b00010000000009040000010129000009054f928c"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @empty, 0x4e21, 0x3, 'dh\x00', 0x11, 0x3240, 0x36}, {@loopback, 0x4e23, 0x2000, 0xfffffffe, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, &(0x7f0000000280)={{0x84, @rand_addr=0x64010102, 0x4e20, 0x3, 'nq\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x2000, 0xc24, 0x9, 0xfffffff9}}, 0x44) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x11, 0x4, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102400, 0x19000) getrlimit(0xa, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000019300), 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f0000000040)={0x0, 0x0, {0x3, 0x0, 0x4, 0x0, 0x7}, 0x76e0}) syz_io_uring_modify_offsets$generic(0x0, 0x0, 0x2c, 0x10000) fstatfs(0xffffffffffffffff, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) close(r4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r4, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="02000000000a"}) 2m42.90567865s ago: executing program 1 (id=2699): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000180)={0x8, {"d1347423facc5d1c40c9990badb12af40568dcf49f9a8810b8b798247df29281d071fae787e8ef6eb83481d5060be1bd1d5f4221ee4951277e25aac97f5e4b7765b0408038c6ba8f6fd9c57f3b4ffb6b2762c807cccd0d63c8b7b4e5c66e65bf436355d47d0b07e3afe376c4796d06d228507a9b36640ea5e90f393a5b251138781833fed0b6c3df77ffd6c4d0ce481977b27e84359a45d225231ce0ab05985b65c524dfaf90433e5dc08e663015d86270ce0b7b87a1d7fac3d02279d75b4928bf043317cadd8146b5e3dded47f5f74e7b0cb026dbeacb11eb7001a9e3a974e76e8ae491db04e5e060af7e956306168cb1afed82be4b2e66fc7a47117b49274747d23367c2d65f1b8d7a2b8c28e3b3115bbb90ec09f2add68bad5f9f125572d00249173c1046f043ee0aaadab9700cfc8910820cdd9ff89fbc21b37c708228104471e1b5414b87b3113d6e24d2b5b2515e4aa305cfe4aa0e30a75d682ededddcf5c5df45c1e113eeacba8104313959644fbc8c1813dac5c77314bd35981fdd95b3d46fc3f65e98b8b80c50064cd24e6d99a808cb7573755f97a4f1e771a362b41b2c1383603207c004fbf9e16db9f8fe71f9be9752c496be52bbaafd0722bb0013e33209d56557d5d3c3e76d4d3d2b4c27b0b800691291f31798fe0bf9efc57b83d5444dbcaae41f40ee4944d5b6c5b53ddf03fe6c81cf31809023765bdac31076e91864db9a73b654e7f53375a063ed3a3ca8aba998cddc9e5f9973e0ee8084388f5b8497fa33ff843dbceae13e8ef9e549252aa30d081c11951253f8d8e3b578b3ad02e2ea168c7c9e54f71a8755d7f83e0ad9a3fabb85e3c12a45f3beb48385d26d9dd22c00ead8c9b30a1959d3e345d1ba7ee049f1cba644defff7c3ba2ad549a3130103497efcf5e9c44079dcfaf4f6f55d0c488616de63d6cf659749b31dda2940923002e4395c232d376d0e8917e433e0506e96d078b9e1c050d3783b61c6ce3ba25aa745a2c97f246a0df5e4518d7e696de40b41e50dfe42935f76a4655aaf89b62df109f3ee5cced942083c2e015979e8017d0a435ccef44a6d122a7a61beb38fb0bf2cf20ff6538b343d33de81649f06b29536867760cd8fbec922f26d5373882bdf82bf7b4ce169d73cfb90e9b5366e630b1e6f86e79f935625fc84c9da002f89ed69cc902a755a0f65946466356c4d10501306c4afd04042cf9caa2ba5cdaf021549ff0f4e5329a6cf103e16be76907f038b983768c6608c29d52d5c0ecbc4d18de0d6511f976f03bf433a575680b3faa3069fb0725a46688a206cd6ac37a993fb98534c87a88517e8a8fdc1dff9243c3f328c96c5520c1549044ff729f4c1645d438afabd12f9a937c7f7eedfe11668211b595ffe174347a3a8b8c05175c8069dc44d35144a15e2cc0f4d6d2625fc2b8c89ade5d5ce723bf624694284baacefc181053d3e3cad426c832438f81177256f12e89c0cfe7647355017118a3a055e8869fa6de5ae0aba0bf0d3aa6dbc861a1ff61bbe8746d02f52c0d0d43671e153824c0db8cbbc56590b63dc87c84782ffbb6ef9ef0686501d1fdb7d7dcb1106c0c6a5fafcf82470a33009d953d64f657ddeb3a899822e41a92a089f9a9a5670c37e87c954214a05ee850e1f5387b2d8cdee9f75e8a4187053b838f7e759386bca861fa4f3a78de19c40825f77af4f316519df5a7e927b66399a6e7a6a5eb226252717fc40a1deabdff88ed50a760a3eb330038869f9b5d5b3d30c119b02e0e55fe61e1042243e912042989eae1e5ebd4e1c7b27230479e25f95eae977adb855ff10c5e6d0130d3b80c50e089c22d52943bf3a3ae6fd8f0f257ece4af2749b6c1f6b11db67c0770c6b2b86de957af81f10a06d76f9af780e805f704b823424e9782412e5788d6188d96c80c12a4e1e725e5dc6a9dbad152a688485c49b3b58f8412cad7ef04392bb8d51fe5de21dd2c49cf74c1d5bca87e339c522762cc65f7b45009e2ff57aeb067ea5bbf155d009b97ce1ee0eb0f4b5a02beb09d8fa54b63bc636ba2fa05dfe27d6e71d9f2c54a748bcdd8de453c3e7cfb039eaae05445f5146ae19eea8d1bc21364ad98439e1ee3229b1bf4e6506016ad5b526eae3d53adbcc930654a70169b895f70e64671cb5db886686ce829d6ba71c41ae6f4be6c7f2b8e770c8aecc8991ca0793abc970d2f595329d5cab231f22848415053290e33a87874a34f8f9f63847ed75bc29d48b038e3bc471da7e04bfaf14e447300a42febcd4eda28a44c45ada90acdd71a7314f7602d1f8bb46ff9d7ffdd5c246e5fb0e34df6303e7185a5897eca8bebdadb27d6754144a8aeeb9d9f0dd680fe81d22304c05f2b9020ad442ee2a98cde4e94c7a9a3c1c5db63c4b1b583e768f28c6b15d3cc8efa7d96d4a0eab8ec891a141d6b6f63530a93527ad1b47b2659a6a3d5a680f62d78adc78348affba123d8554aadd30f956b371d713654c3ee9731f9052b2b0b17a1470af0bf0f0e4d4797295ae08c96b09eef9c071bc71cdeef6bea0877f61a80a7975107f07e79fa0261f9a172c0c9841ee5a2a32c32b3882fd0a7c96f71cac2fddfd8acfff1b135a1f7b3ccf966b8b0fb32eadcfaa0c54ff11bf0abaebeaac4b0795180f240148b393668ec8911b38fb11a7042623f0c57a248b2afd30603ce8a20bc88180638d0571e51c0e3fce6f194a01762880d665369b335819d1e879307b0b01fb250577bbfe8ae03d33d0b97ceb697a1855a15f761a0108d3c59ead2194ea18c42487d900a0de473910bb0271cb54ee98b293305263ccf93a18e2a4b320ecc8e23b6d450f48b83d01f75f5b7f3354635b6e5022313f04e4cfefddcf284c2e5dde920a07303f442949ce949fbf2b08264f36dcfabdcece29d1743f839aa94cf7e747a48e6d1a4a65e9445def8c5e3d5ddf3040d24da56a7eec5edb2687eabf174b690d05bdbcdff9aec0a8dcfb94e4fff5a5b441fe3ef5b6189b2971dfb7b4976564a11bb8672d74e54251707acea501c02b66b0b7fe792e8180788b00aade3195f12b837144945e1f9263fd9894c52bea060578933702c85796c618a31243f7af6f6d4c22606fbe5ca70dadea0afa10c0ab3ae9beec09cddffa07be5b072f2dd5f3e54e3de8c232584ac76fa5dcdaeab544225c9c4786d9566eef1f0659e3ae462f9f3bef10117f77a26cf6ef3d0fa6a1d218d555f866da6e4efd5215813d28a54a98e8ef1529515f6a2bfa2cdf88797837d181965905f6878597834699995335fac5a58b5e10a4dfc8a96f2dcfd0fa122ffa0929d858a5cdf8a6347968d672e7dfea5210d2fa145c1d5731d9f8c1d37c97a8f779dc4c31ab5e7123f06c44f0efe58989bb70d4a3bfe2063360d9772653d7328f117607b5f447ea5beaf0df2408a8cb06d6d698915b8d19b9795bd411f4c129ad817bc02b563b3f92da951f952a05195f980e74d15ec221d5ccd1bf13a1bcc36d5de16b29a9465359b580230a34c2f3ed7c247ad15ffa3203d0020b5651c6b85f72c912c063b886b012b1a45c6a19d228cd8164951825de096a07d00b2e1d95d6d622682b515f1b9c72fb3f0acba749d4d4e0d8a30e3f07793d7efc567e47a90f03f01efc16fe174c8e16f84d9eff10d12175a13f064288094e9a873106c82b170858574bbcc16c5d901997b2357f750952e1155a9c2d542668cdcc31e038011b9214b7ca033aec807e07559f65879ed836be06950040fe314ff9939426ccdf47578999a517fe66a1dcadd05f6ef7659faa5cdbf0f9513677b9284dbe54497b18ac415585ef36b4a0a33972207a02c7e76960756eecff183a27be94143adf47179d8dc58c6d8834018d8169257743d77cd48a56516cfab7ce275a81e3359b72aaecf653fc52d88532adae33a1477c492aa307273252c7b61e44d7dc8e6270926560cf4abb2bdf3e821badfe807b9c69b73646e1c5d25e0d06a66c0b00b5069008c0ddaeb89d15fe63816dacd2496395e7f7c6237647dd6ebc286801ae91c05bad19a84ff8aef6628e633249ce60a5041b271ad8ceed29b75c9b9fc039854e55cb01b8bc83a89a7f69a7a6f6717c7920f030bb6617342e3418600681ced7360835323cb58d1b98c344cae84cc88fec716ba5682e786dc16e9370ada8e38e68018f770302a9e8a086b0e08f9a359d3e9c8beba655b1a247688e98650cefb822fa40c4b69221cd5e2208a76cae84fac46802887230846f74bb95da04a7bdfcaad2e9f2db404a985756a1be077e8a8c01a149818487ae896b91ff8d82bf2863712acaa564337d6e925a90b4646d06947ccf2a74d4a1a97d4cb50a53dac0a03c3e09c699a1708a0c26b7c386c97640c2a8f30d2d3bae0db2d018ce658dc3fd9802c308b00a86872fcd8d806dccc46bc763e8292f7d3d681d8cffcc95333e78ebf67bda3e90452a2e08c52957daa98ce0cf2329abda5ccac2b013bde8a4fc75b8258824e14fb87c154b7ac22f58531fcde7082aabd47cbbd0a3a112df521a5391bb047ac4fdb3ea39da1efead0860de63037253708d5e9fd63dc6ee7eacc17b6d9f5a2ea0a27059ec8ec7e696ee05727756fb31ffca4c9261cb8f72023a00d551da0bc08c21174882d5159842aa6316b4624a7d46cecc399bcfce0fca0cc5d3d307194e8bd60a76e43e0b3539ffa23a2b2a58942b1bd21f7c86cd824f4878a7e6dc946db839610f31b24d428cbd0038e314badd51f0f3dc85c3f5df1d08adacdb3553df04803700e53802c67d992e0b7ae12c660fd83cd84fe5ebd2584a5b27db59c948f9793868475b0e1b7a94b4b91555aeb2211f5518883c0f6c9662da5e9271d8e4075a92fae0c013952a947646d84e0d80ea05c6ff5a8308a32b3106e5e0299521d3facc2ab23331054429207bf895d62c949dcca014f136b99d6d42e62cb8ce740c2d10073956a66e95751d3df58e8f8be906baa58720a728ec17bcdca87f8c2e6eb458672b24105a5b4f028fc1c245b129ba99850af1688646eb8df27eb6f1c2804878b5da2280ae9f65416311709304f5e088acbd4ccca49b46ef5a5c256b1c4abd3ca07d9f8f74eefecd736b4fdf1cdfe9bdd084ed472746337afce3b6feadb9923a8b34db65b4e69c933aad7d7fd5648b2ec16c773890483dc2917ca4acd2cb4356aa6ba9769f37c550f0a3ab843d1d9b22b6b4fc6662f63b35f0f81f1b475491aa613f40ff96360ca29d07857f061fb66745caf98f7922ee920f499b56bd8a708df5cce704766ff09dcd49c952c49e1062e9b7b1ffc73982a20c71747015bcdac7fba9da1b8d9447f923b550e27a4e68f8d3b74c138e1291ead6637db271daa182cff002e3d78040378ac4b1aa3802ea70290bcd36efac75a2944ac63d0aaedca5d35f29ef168fa6c9f1f6f00a624fdee74ef2a110fe5b61e0af026b9e33a76639753b85326292a1b866b158576ae797509d6b0d1292afeed41e4d770f6b3df73140a699868ad2aa492f5f2d33447c86cbd65b02ea2fc0ac6f6741c6cb0aab6e0213ff77ad7290eb77edbcd538d7ee9d62d231382cc6e8af6d37cc37193c777faa5468023ef21ff6741905b3fd6d37476e2f2535201d9ee4b87ed35b65838757b74d7eccc00c1351fa0cf076026695c749dcdbb8ba5cc0cb17792712124b3ed779a945c5cd795ced3bb7611f26913512f34f38b946b1f06fa68c948d34ead4e162d893cae23e2389d8c22570fe9c76a0a1dc53f8a50f08872517b459d27e32ce15225c3dd27b19cdf09a2921f2d2a77b7db9c595e38d84d18cf5aac564168f", 0x1000}}, 0xffffff05) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x8000000000000001) ioctl$DRM_IOCTL_SET_VERSION(r0, 0xc0106407, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x8}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r1 = socket$kcm(0x2, 0x200000000000001, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x21, &(0x7f0000000240), 0x4) sendmsg$inet(r1, &(0x7f00000016c0)={&(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10, 0x0}, 0x24000084) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10, 0x0}, 0x2400c890) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)={0x64, 0x2, 0x6, 0x5, 0x0, 0x0, {0x2}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1}}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x64}, 0x1, 0x0, 0x0, 0x4810}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ioctl$DRM_IOCTL_GET_UNIQUE(r0, 0xc0106401, &(0x7f0000000400)={0x0, 0x0}) ioctl$OCFS2_IOC_RESVSP64(r0, 0x4030582a, &(0x7f0000000040)={0x0, 0x2, 0x7, 0x6, 0x4, 0xb}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x1bd) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) close(0x3) fcntl$dupfd(r4, 0x406, r3) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x4008, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r5]) ioctl$DRM_IOCTL_RM_MAP(r0, 0x4028641b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00001d6000/0xc000)=nil}) 2m42.903113475s ago: executing program 3 (id=2700): syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syz_tun\x00'}) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) syz_emit_ethernet(0xd83, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x88}, 0x0) mkdir(0x0, 0x7) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) openat$nullb(0xffffffffffffff9c, &(0x7f0000000280), 0x4000000004002, 0x0) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x3e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, 0xffffffffffffffff, 0x6000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 2m41.91716928s ago: executing program 1 (id=2701): r0 = socket$kcm(0x10, 0x2, 0x4) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5c00000012006b04000000d86e6c1d000a887ea6ea65670000000000000090f9c3dc90f8f41f8ecff32c6e020075e300250045586c8da718ad4b4460bc24eab55600000000000000bf9367b4fa51f60a64c9f4d4938037e786a6d0bd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 2m41.852475048s ago: executing program 1 (id=2702): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r1) r2 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x500, 0x8000) ioctl$FS_IOC_GETFSUUID(r2, 0x80111500, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r6 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$COMEDI_DEVCONFIG(r6, 0x40946400, &(0x7f0000000000)={'comedi_bond\x00', [0x4, 0x2f000000, 0x7fffffff, 0x8, 0x90000, 0x9, 0xed, 0x890, 0x280ffa, 0xfffffffb, 0x4, 0x1, 0x1030, 0x1000008, 0x4c, 0x40000009, 0xfff7ffa6, 0x3ff, 0x1ff, 0x9ea, 0x3, 0xb, 0x9, 0x101, 0x1, 0x990e, 0x5, 0x18, 0xf, 0x2000006, 0x77fd]}) set_mempolicy(0x8000, &(0x7f00000001c0)=0xfffffffffffffffd, 0x4) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) lstat(&(0x7f0000000380)='./cgroup\x00', &(0x7f0000000540)) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='.\x02\x00', 0x80040, 0x15b) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000440)='./file0\x00', 0x0, 0x2a05004, 0x0) rmdir(&(0x7f0000000140)='./file0\x00') syz_emit_ethernet(0xee, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000100000008864470b00e000680057"], 0x0) 2m41.002318317s ago: executing program 3 (id=2703): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setsig(0x4203, r0, 0x80, 0x0) 2m40.934920305s ago: executing program 1 (id=2704): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000180)='/dev/comedi0\x00', 0x601, 0x0) setreuid(0x0, 0xee01) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x7, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0xfffffffb}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1200}, {0x3, 0x3, 0x3, 0xa, 0x2, 0xfff0}, {0x6, 0x0, 0xd, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x6, 0xa, 0x9, 0xfff0, 0x41}, {0x7, 0x1, 0xb, 0x6, 0x8, 0x20}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0xa, 0x20}, {}, {}, {0x18, 0x8, 0x2, 0x0, r1}, {}, {0x15, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f00000002c0)='GPL\x00', 0x6, 0x0, 0x0, 0x40f00, 0x46, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x80, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r3, &(0x7f0000000100), 0x0, 0x36, 0xf5) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="ec0100000001050500000000000000000a0000003c0002802c00018014000300ff010000000000000000001f0000000114000400ff0200000000000000000000000000010c00028005000100000080003c0001800c00028005000100000000002c00018014000300ff0200000000000000000000000000011400040000000000000000000000ffffffffffff0800074001000001340006801400040000000000000000000000000000000001140005002001000000000000000000000000000008000200e00000010800154000000003600004"], 0x1ec}}, 0x0) close(r3) ioctl$COMEDI_RANGEINFO(r0, 0x80106408, &(0x7f0000000040)={0xfffffffd, 0x0}) 2m40.673139725s ago: executing program 4 (id=2705): openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}]}) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x5, 0x0, 0x717e387b, 0x40, "1ae34e060100000000000000b240794233a5bd", 0x4, 0x2}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000004c0), 0x60081, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000380)=0x27) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001500)=ANY=[@ANYBLOB="12010000000000407d1ef62c00000000000109022400010000000009040000010300020009210000000122070009058103"], 0x0) ioctl$KVM_GET_EMULATED_CPUID(0xffffffffffffffff, 0xc008ae09, &(0x7f0000000300)={0x2, 0x0, [{0xb, 0x0, 0x1, 0x1000, 0x40, 0x4, 0x9}, {0x6, 0x624, 0x1, 0x1ff, 0x8b8f, 0x73, 0x7}]}) 2m38.916490385s ago: executing program 2 (id=2706): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/comedi4\x00', 0x101200, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000840)='/proc/mdstat\x00', 0x0, 0x0) r2 = epoll_create(0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000001480)={@empty, @broadcast}, &(0x7f00000014c0)=0xc) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x30, 0x10, 0x801, 0xfffffffd, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x8, 0x1a, 0x0, 0x1, [@AF_INET6={0x4, 0x2d}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x44000}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x30000000}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x6, &(0x7f0000006680)) r6 = msgget$private(0x0, 0xa4) msgctl$IPC_INFO(r6, 0x3, &(0x7f0000000040)=""/24) write$cgroup_subtree(r5, &(0x7f0000000400)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) ioctl$COMEDI_BUFCONFIG(r0, 0x8020640d, &(0x7f0000000180)={0x5, 0x401, 0x2, 0x2}) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) r7 = syz_io_uring_setup(0xf03, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x4110}, 0x1}) io_uring_enter(r7, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 2m38.629442992s ago: executing program 3 (id=2707): syz_open_dev$tty1(0xc, 0x4, 0x1) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x2000000000000013, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xb8, &(0x7f0000000140)=""/184, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) keyctl$set_reqkey_keyring(0xe, 0x2) request_key(0x0, &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)='q\xa9', 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r5, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x2fc247, 0x3f}) socket$inet_tcp(0x2, 0x1, 0x0) 2m36.42389408s ago: executing program 2 (id=2709): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r1, 0x0, r2) r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0xa100) read(r4, 0x0, 0x0) read$FUSE(r3, 0x0, 0x0) ioctl$USBDEVFS_CLEAR_HALT(r0, 0x80045515, &(0x7f0000000080)={0xc}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r0, 0x0) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000000)={0x80, 0x0, 0x0, 0x0, 0x2}, 0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000140)=@urb_type_bulk={0x3, {0x1, 0x1}, 0x4, 0x22, 0x0, 0x0, 0x8, 0xfffffff8, 0x5f4, 0x81, 0x6, 0x0}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) landlock_create_ruleset(&(0x7f0000002080)={0x28000, 0x0, 0x1, 0x8, 0x1, 0x3}, 0x30, 0x0) inotify_init() r6 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') ioctl$PIO_CMAP(r3, 0x4b71, &(0x7f00000020c0)={0x3ff, 0xff, 0xd, 0x2f2d, 0x8000000000000000, 0x4}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x7, 0x7fffffff}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) read$FUSE(r6, &(0x7f0000000040)={0x2020}, 0x2020) close_range(r5, 0xffffffffffffffff, 0x200000000000000) 2m36.397031788s ago: executing program 0 (id=2710): r0 = syz_open_dev$video(&(0x7f0000000040), 0xd5, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05640, &(0x7f0000000340)={0xe, @pix={0x5, 0x5, 0x33565348, 0x8, 0x7ff, 0x6, 0xc, 0x3, 0x1, 0x3, 0x2, 0x5}}) 2m36.177181649s ago: executing program 3 (id=2711): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x6, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0xa}}, 0x20) ioperm(0x0, 0x2, 0x7e) clock_getres(0x8957b56da8435663, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10) connect$inet(r2, &(0x7f0000000200)={0x2, 0x4e22, @remote}, 0xa) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x40800, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_NEWPDP(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x30, r5, 0x3c1ef5685f8d0157, 0x0, 0x0, {}, [@GTPA_VERSION={0x8}, @GTPA_LINK={0x8}, @GTPA_TID={0xc, 0x3, 0x4}]}, 0x30}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r3, &(0x7f0000000240)={&(0x7f00000000c0), 0xfffffffffffffe25, &(0x7f00000001c0)={&(0x7f0000000300)={0x30, r4, 0x824, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x0, 0x3, r7}, @void}}, [@NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}]}, 0x30}}, 0x40040) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000600)={0x13, 0x10, 0xfa00, {&(0x7f0000000400), r1}}, 0x18) 2m35.936306202s ago: executing program 0 (id=2712): r0 = socket$kcm(0x10, 0x2, 0x4) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5c00000012006b04000000d86e6c1d000a887ea6ea65670000000000000090f9c3dc90f8f41f8ecff32c6e020075e300250045586c8da718ad4b4460bc24eab55600000000000000bf9367b4fa51f60a64c9f4d4938037e786a6d0bd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 2m35.56882803s ago: executing program 3 (id=2713): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x4) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) sendmsg$inet(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5c00000012006b04000000d86e6c1d000a887ea6ea65670000000000000090f9c3dc90f8f41f8ecff32c6e020075e300250045586c8da718ad4b4460bc24eab55600000000000000bf9367b4fa51f60a64", 0x51}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 2m35.436828655s ago: executing program 0 (id=2714): syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000380)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000280)) r3 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r3, &(0x7f0000002dc0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000003c0)="19", 0x1}], 0x1}, 0x8001) setsockopt$sock_attach_bpf(r3, 0x84, 0x1e, &(0x7f0000000000), 0x4) setsockopt$sock_attach_bpf(r3, 0x84, 0x1e, &(0x7f0000000040), 0x4) socket$inet_sctp(0x2, 0x1, 0x84) fdatasync(0xffffffffffffffff) mremap(&(0x7f0000fc4000/0x4000)=nil, 0x4000, 0x1000, 0x7, &(0x7f0000fc5000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd, 0xfeefffff}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000040)={0x28, 0x0, 0x1, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0x4f}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008004) r5 = signalfd(r0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4e22, 0x800, @remote, 0x40002}, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00', 0xa3e}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x882) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, 0x0) creat(&(0x7f0000000400)='./bus\x00', 0x0) socket(0x840000000002, 0x80000, 0xff) 2m35.031184242s ago: executing program 4 (id=2715): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x2000000, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x604ad000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000003000)=""/4090, 0xffa, 0x0, 0x0}, &(0x7f0000000000)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000740)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1, 0x0, 0x31}, &(0x7f0000000780)=0x40) ioctl$COMEDI_INSN(0xffffffffffffffff, 0x8028640c, &(0x7f0000000080)={0xc000003, 0xf, &(0x7f0000000040)=[0x15, 0x4, 0x40005002, 0xffff32eb, 0x2, 0xffffdff9, 0x2d7b, 0x401, 0x0, 0x3, 0x0, 0x3, 0xfe09, 0xd2, 0x80000002], 0x1, 0x4000003}) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$OCFS2_IOC_RESVSP64(r1, 0x4030582a, &(0x7f0000000100)={0x1, 0x1, 0x5, 0x2, 0x8, 0x5}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r2 = socket$nl_route(0x10, 0x3, 0x0) capset(&(0x7f0000a31000)={0x20080522}, &(0x7f0000000080)) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) ioctl$FITHAW(r3, 0xc0045878) syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="12010900875b0d20d8130100220e012003010902120001000000000904"], 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000200), 0xc, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newqdisc={0x3c, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0xffe0, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) 2m35.024014028s ago: executing program 3 (id=2716): syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000100)=@any_dev={0x3, 0x2b7, 0x0, 0x0, 0x1000, 0x544, 0x0, 0x0, 0x10}}}, &(0x7f0000000380)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r3 = accept$phonet_pipe(0xffffffffffffffff, 0x0, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f0000002dc0)={&(0x7f0000001640)=@l2tp6={0xa, 0x0, 0x7fff, @local, 0x8}, 0x80, &(0x7f0000000340)=[{&(0x7f00000003c0)}], 0x1}, 0x8001) setsockopt$sock_attach_bpf(r4, 0x84, 0x1e, &(0x7f0000000000), 0x4) setsockopt$sock_attach_bpf(r4, 0x84, 0x1e, &(0x7f0000000040), 0x4) socket$inet_sctp(0x2, 0x1, 0x84) fdatasync(0xffffffffffffffff) mremap(&(0x7f0000fc4000/0x4000)=nil, 0x4000, 0x1000, 0x7, &(0x7f0000fc5000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r5, &(0x7f0000032680)=""/102400, 0x19000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd, 0xfeefffff}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000040)={0x28, r2, 0x1, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0x4f}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008004) r7 = signalfd(r0, &(0x7f00000003c0)={[0x1]}, 0x8) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r7, &(0x7f0000000180)={0xa, 0x4e22, 0x800, @remote, 0x40002}, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r8, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00', 0xa3e}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x882) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r8, 0x40605346, &(0x7f0000000440)={0x0, 0x0, {0x3, 0x2, 0x0, 0x2, 0x3}, 0x4}) creat(&(0x7f0000000400)='./bus\x00', 0x0) socket(0x840000000002, 0x80000, 0xff) 2m33.844543434s ago: executing program 2 (id=2717): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x2000000, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x604ad000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000003000)=""/4090, 0xffa, 0x0, 0x0}, &(0x7f0000000000)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000740)={&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1, 0x0, 0x31}, &(0x7f0000000780)=0x40) ioctl$COMEDI_INSN(0xffffffffffffffff, 0x8028640c, &(0x7f0000000080)={0xc000003, 0xf, &(0x7f0000000040)=[0x15, 0x4, 0x40005002, 0xffff32eb, 0x2, 0xffffdff9, 0x2d7b, 0x401, 0x0, 0x3, 0x0, 0x3, 0xfe09, 0xd2, 0x80000002], 0x1, 0x4000003}) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$OCFS2_IOC_RESVSP64(r1, 0x4030582a, &(0x7f0000000100)={0x1, 0x1, 0x5, 0x2, 0x8, 0x5}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) r2 = socket$nl_route(0x10, 0x3, 0x0) capset(&(0x7f0000a31000)={0x20080522}, &(0x7f0000000080)) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) ioctl$FITHAW(r3, 0xc0045878) syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="12010900875b0d20d8130100220e012003010902120001000000000904"], 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xcf6, 0x34424752}}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newqdisc={0x3c, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0xffe0, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) 2m33.154048059s ago: executing program 0 (id=2718): r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_service_time\x00', 0x275a, 0x0) write$binfmt_script(r1, 0x0, 0x0) cachestat(r1, &(0x7f0000000040)={0xfffffffffffffff7, 0xfffffffffffffffc}, &(0x7f000009de80), 0x0) socket$pppl2tp(0x18, 0x1, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setrlimit(0xb, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r6) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/packet\x00') readv(r7, &(0x7f0000001840)=[{&(0x7f0000000300)=""/181, 0xb5}, {&(0x7f00000003c0)=""/45, 0x2d}, {&(0x7f00000005c0)=""/219, 0xdb}, {&(0x7f00000006c0)=""/215, 0xd7}, {&(0x7f00000007c0)=""/68, 0x44}, {&(0x7f0000000840)=""/4096, 0x1000}], 0x6) ioctl$VHOST_RESET_OWNER(r7, 0xaf02, 0x0) mremap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) 2m31.776486211s ago: executing program 0 (id=2719): r0 = syz_open_dev$dvb_frontend(&(0x7f00000000c0), 0x0, 0x40002) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='illinois', 0x8) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x200080c0, &(0x7f0000000400)={0xa, 0x2, 0x3ff, @loopback, 0xffffff1e}, 0x1c) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000000)={0x4, &(0x7f0000000100)=[{0x2, '\x00', @st={0x4, [{0x3, @uvalue=0xbeb3}, {0x3, @uvalue=0x8123}, {0x0, @uvalue=0xbcbf}, {0x3, @uvalue=0x2}]}, 0x80000001}, {0x18, '\x00', @st={0x4, [{0x0, @svalue=0x9}, {0x1, @uvalue=0xffffffff}, {0x2, @svalue=0xc5f}]}}, {0x26, '\x00', @data=0x9f, 0x4}, {0x16, '\x00', @buffer={"85955fce8e582347c7f89993cd2e0fe356ef0000000000000000000000000080", 0x20}, 0x1ff}]}) chmod(&(0x7f0000000040)='./file0\x00', 0x26) 2m31.773892455s ago: executing program 4 (id=2720): syz_open_dev$tty1(0xc, 0x4, 0x1) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x2000000000000013, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xb8, &(0x7f0000000140)=""/184, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) keyctl$set_reqkey_keyring(0xe, 0x2) request_key(0x0, &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)='q\xa9', 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r5, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x2fc247, 0x3f}) socket$inet_tcp(0x2, 0x1, 0x0) 2m24.078805264s ago: executing program 2 (id=2721): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$UFFDIO_CONTINUE(0xffffffffffffffff, 0xc020aa07, &(0x7f0000000080)={{&(0x7f0000bdf000/0x3000)=nil, 0x3000}}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB, @ANYRES32, @ANYRES32=r2], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)=@newtfilter={0x38, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, 0x0, {0xf}, {0xffff, 0x1}, {0xa, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0xf0ffffffffffff, 0x0, 0x60001d0}, 0xc084) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@any_dev={0x4, 0x90d, 0x0, 0x0, 0x1000, 0x4, 0x0, 0x0, 0x1a4}}}, &(0x7f0000000280)) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x4000800, 0x0, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) shutdown(r3, 0x0) recvmmsg(r3, &(0x7f00000048c0)=[{{0x0, 0x0, &(0x7f0000004a00)=[{0x0}], 0x1}}], 0x1, 0x10122, 0x0) 1m32.74131087s ago: executing program 32 (id=2719): r0 = syz_open_dev$dvb_frontend(&(0x7f00000000c0), 0x0, 0x40002) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='illinois', 0x8) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x200080c0, &(0x7f0000000400)={0xa, 0x2, 0x3ff, @loopback, 0xffffff1e}, 0x1c) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000000)={0x4, &(0x7f0000000100)=[{0x2, '\x00', @st={0x4, [{0x3, @uvalue=0xbeb3}, {0x3, @uvalue=0x8123}, {0x0, @uvalue=0xbcbf}, {0x3, @uvalue=0x2}]}, 0x80000001}, {0x18, '\x00', @st={0x4, [{0x0, @svalue=0x9}, {0x1, @uvalue=0xffffffff}, {0x2, @svalue=0xc5f}]}}, {0x26, '\x00', @data=0x9f, 0x4}, {0x16, '\x00', @buffer={"85955fce8e582347c7f89993cd2e0fe356ef0000000000000000000000000080", 0x20}, 0x1ff}]}) chmod(&(0x7f0000000040)='./file0\x00', 0x26) 0s ago: executing program 33 (id=2716): syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000100)=@any_dev={0x3, 0x2b7, 0x0, 0x0, 0x1000, 0x544, 0x0, 0x0, 0x10}}}, &(0x7f0000000380)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r3 = accept$phonet_pipe(0xffffffffffffffff, 0x0, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f0000002dc0)={&(0x7f0000001640)=@l2tp6={0xa, 0x0, 0x7fff, @local, 0x8}, 0x80, &(0x7f0000000340)=[{&(0x7f00000003c0)}], 0x1}, 0x8001) setsockopt$sock_attach_bpf(r4, 0x84, 0x1e, &(0x7f0000000000), 0x4) setsockopt$sock_attach_bpf(r4, 0x84, 0x1e, &(0x7f0000000040), 0x4) socket$inet_sctp(0x2, 0x1, 0x84) fdatasync(0xffffffffffffffff) mremap(&(0x7f0000fc4000/0x4000)=nil, 0x4000, 0x1000, 0x7, &(0x7f0000fc5000/0x1000)=nil) socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r5, &(0x7f0000032680)=""/102400, 0x19000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd, 0xfeefffff}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000040)={0x28, r2, 0x1, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0x4f}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008004) r7 = signalfd(r0, &(0x7f00000003c0)={[0x1]}, 0x8) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r7, &(0x7f0000000180)={0xa, 0x4e22, 0x800, @remote, 0x40002}, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r8, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00', 0xa3e}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x882) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r8, 0x40605346, &(0x7f0000000440)={0x0, 0x0, {0x3, 0x2, 0x0, 0x2, 0x3}, 0x4}) creat(&(0x7f0000000400)='./bus\x00', 0x0) socket(0x840000000002, 0x80000, 0xff) kernel console output (not intermixed with test programs): +0x5/0xa [ 790.904051][T14332] should_failslab+0xc2/0x120 [ 790.904074][T14332] __kmalloc_noprof+0xfc/0x820 [ 790.904094][T14332] ? genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 790.904129][T14332] genl_family_rcv_msg_attrs_parse.isra.0+0x100/0x2f0 [ 790.904164][T14332] genl_family_rcv_msg_doit+0xc7/0x300 [ 790.904193][T14332] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 790.904229][T14332] ? bpf_lsm_capable+0x9/0x10 [ 790.904248][T14332] ? security_capable+0x80/0x260 [ 790.904270][T14332] ? ns_capable+0xd2/0xf0 [ 790.904295][T14332] genl_rcv_msg+0x560/0x800 [ 790.904316][T14332] ? __pfx_genl_rcv_msg+0x10/0x10 [ 790.904333][T14332] ? __pfx_mptcp_pm_nl_set_flags_doit+0x10/0x10 [ 790.904358][T14332] ? __lock_acquire+0x49f/0x1a40 [ 790.904384][T14332] netlink_rcv_skb+0x159/0x420 [ 790.904407][T14332] ? __pfx_genl_rcv_msg+0x10/0x10 [ 790.904425][T14332] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 790.904459][T14332] ? netlink_deliver_tap+0x1ae/0xcc0 [ 790.904486][T14332] genl_rcv+0x28/0x40 [ 790.904510][T14332] netlink_unicast+0x585/0x850 [ 790.904537][T14332] ? __pfx_netlink_unicast+0x10/0x10 [ 790.904568][T14332] netlink_sendmsg+0x8b0/0xda0 [ 790.904596][T14332] ? __pfx_netlink_sendmsg+0x10/0x10 [ 790.904620][T14332] ? __might_fault+0x80/0x140 [ 790.904646][T14332] ____sys_sendmsg+0xa4d/0xbe0 [ 790.904667][T14332] ? __pfx_netlink_sendmsg+0x10/0x10 [ 790.904693][T14332] ? __pfx_____sys_sendmsg+0x10/0x10 [ 790.904727][T14332] ___sys_sendmsg+0x190/0x1e0 [ 790.904752][T14332] ? __pfx____sys_sendmsg+0x10/0x10 [ 790.904774][T14332] ? __lock_acquire+0x49f/0x1a40 [ 790.904795][T14332] ? get_pid_task+0x106/0x250 [ 790.904839][T14332] __sys_sendmsg+0x160/0x210 [ 790.904858][T14332] ? __pfx___sys_sendmsg+0x10/0x10 [ 790.904890][T14332] do_syscall_64+0x115/0x870 [ 790.904914][T14332] ? clear_bhb_loop+0x40/0x90 [ 790.904939][T14332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 790.904961][T14332] RIP: 0033:0x7f9fc8d9de59 [ 790.904978][T14332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 790.904994][T14332] RSP: 002b:00007f9fc9ca3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 790.905012][T14332] RAX: ffffffffffffffda RBX: 00007f9fc9025fa0 RCX: 00007f9fc8d9de59 [ 790.905023][T14332] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 790.905034][T14332] RBP: 00007f9fc9ca3090 R08: 0000000000000000 R09: 0000000000000000 [ 790.905044][T14332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 790.905053][T14332] R13: 00007f9fc9026038 R14: 00007f9fc9025fa0 R15: 00007ffc864d08c8 [ 790.905077][T14332] [ 791.467015][T14345] netlink: 'syz.3.2325': attribute type 1 has an invalid length. [ 791.495850][T14345] netlink: 'syz.3.2325': attribute type 2 has an invalid length. [ 791.579041][ T29] audit: type=1400 audit(1782935811.279:1869): avc: denied { connect } for pid=14341 comm="syz.3.2325" lport=56 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 791.621108][T14348] netlink: 'syz.2.2324': attribute type 14 has an invalid length. [ 791.646861][T14348] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2324'. [ 791.684972][ T492] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.686625][T14348] netlink: 'syz.2.2324': attribute type 14 has an invalid length. [ 791.732128][T14348] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2324'. [ 791.760415][ T492] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.831290][ T492] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.939261][ T492] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 792.747263][ T991] usb 1-1: new full-speed USB device number 86 using dummy_hcd [ 793.643479][ T46] usb 38-1: device descriptor read/8, error -110 [ 793.669304][ T991] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x4F, changing to 0xF [ 793.710433][ T991] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 140, setting to 64 [ 793.769128][ T991] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 793.796310][T14365] fuse: Bad value for 'fd' [ 793.815413][ T991] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 793.855321][ T991] usb 1-1: Product: syz [ 793.888084][ T991] usb 1-1: Manufacturer: syz [ 793.908287][ T991] usb 1-1: SerialNumber: syz [ 793.932493][ T991] usb 1-1: config 0 descriptor?? [ 793.965769][T14357] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 794.079570][ T46] usb usb38-port1: attempt power cycle [ 794.233688][T14357] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 794.808036][ T46] usb usb38-port1: unable to enumerate USB device [ 794.892243][ T46] usb 1-1: USB disconnect, device number 86 [ 796.330147][T14384] nfs: Bad value for 'source' [ 796.335066][T14384] nfs: Bad value for 'source' [ 798.950838][T14405] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 798.958361][T14405] UDF-fs: Scanning with blocksize 512 failed [ 798.965062][T14405] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 798.972643][T14405] UDF-fs: Scanning with blocksize 1024 failed [ 798.979027][T14405] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 798.986474][T14405] UDF-fs: Scanning with blocksize 2048 failed [ 798.992896][T14405] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 799.079211][T14405] UDF-fs: Scanning with blocksize 4096 failed [ 799.316905][ T11] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 799.540151][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 799.611919][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 799.629140][ T11] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 799.642631][ T11] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 799.672114][ T11] usb 4-1: config 0 descriptor?? [ 801.182217][ T11] usbhid 4-1:0.0: can't add hid device: -71 [ 801.252703][ T11] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 801.318399][ T11] usb 4-1: USB disconnect, device number 55 [ 801.823372][ T29] audit: type=1400 audit(1782935821.579:1870): avc: denied { read } for pid=14422 comm="syz.2.2347" laddr=::ffff:127.0.0.1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 802.277020][ T46] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 802.284754][ T991] usb 5-1: new full-speed USB device number 82 using dummy_hcd [ 803.027948][ T46] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x4F, changing to 0xF [ 803.066113][ T46] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 140, setting to 64 [ 803.081139][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 803.105578][ T46] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 803.119862][ T991] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x4F, changing to 0xF [ 803.243453][ T46] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 803.254351][ T991] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 140, setting to 64 [ 803.265299][ T46] usb 4-1: Product: syz [ 803.270041][ T46] usb 4-1: Manufacturer: syz [ 803.274778][ T46] usb 4-1: SerialNumber: syz [ 803.281627][ T991] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 803.292794][ T46] usb 4-1: config 0 descriptor?? [ 803.607424][ T991] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 803.616017][ T991] usb 5-1: Product: syz [ 803.620554][T14428] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 803.646202][ T991] usb 5-1: Manufacturer: syz [ 803.652758][ T991] usb 5-1: SerialNumber: syz [ 803.672219][ T991] usb 5-1: config 0 descriptor?? [ 803.687573][T14429] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 803.932409][T14428] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 805.595552][ T5342] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 805.597409][ T29] audit: type=1400 audit(1782935824.139:1871): avc: denied { write } for pid=14446 comm="syz.1.2354" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 805.746208][ T46] usb 4-1: USB disconnect, device number 56 [ 805.798657][ T5342] usb 1-1: Using ep0 maxpacket: 32 [ 805.855742][ T5342] usb 1-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22 [ 805.921834][ T5342] usb 1-1: New USB device strings: Mfr=1, Product=32, SerialNumber=3 [ 806.067981][ T991] usb 5-1: USB disconnect, device number 82 [ 806.073999][ T5342] usb 1-1: Product: syz [ 806.100447][ T5342] usb 1-1: Manufacturer: syz [ 806.108850][ T5342] usb 1-1: SerialNumber: syz [ 806.136571][ T5342] usb 1-1: config 0 descriptor?? [ 806.185028][T14470] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 806.193554][T14470] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 807.157953][ T5342] usb 1-1: selecting invalid altsetting 3 [ 807.260329][T14465] udevd[14465]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 807.437319][ T5342] comedi comedi4: could not set alternate setting 3 in high speed [ 807.495282][ T5342] usbdux 1-1:0.0: driver 'usbdux' failed to auto-configure device. [ 807.549785][ T5342] usbdux 1-1:0.0: probe with driver usbdux failed with error -22 [ 807.577524][ T5342] usb 1-1: USB disconnect, device number 87 [ 809.362545][T14504] FAULT_INJECTION: forcing a failure. [ 809.362545][T14504] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 809.415434][T14504] CPU: 0 UID: 0 PID: 14504 Comm: syz.0.2368 Tainted: G L syzkaller #0 PREEMPT(full) [ 809.415465][T14504] Tainted: [L]=SOFTLOCKUP [ 809.415472][T14504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 809.415482][T14504] Call Trace: [ 809.415488][T14504] [ 809.415496][T14504] dump_stack_lvl+0x100/0x190 [ 809.415524][T14504] should_fail_ex.cold+0x5/0xa [ 809.415552][T14504] _copy_from_user+0x2e/0xd0 [ 809.415577][T14504] copy_msghdr_from_user+0x9f/0x4c0 [ 809.415604][T14504] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 809.415640][T14504] ___sys_sendmsg+0x106/0x1e0 [ 809.415668][T14504] ? __pfx____sys_sendmsg+0x10/0x10 [ 809.415692][T14504] ? __lock_acquire+0x49f/0x1a40 [ 809.415716][T14504] ? get_pid_task+0x106/0x250 [ 809.415761][T14504] __sys_sendmsg+0x160/0x210 [ 809.415781][T14504] ? __pfx___sys_sendmsg+0x10/0x10 [ 809.415820][T14504] do_syscall_64+0x115/0x870 [ 809.415847][T14504] ? clear_bhb_loop+0x40/0x90 [ 809.415871][T14504] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 809.415889][T14504] RIP: 0033:0x7fa95299de59 [ 809.415904][T14504] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 809.415921][T14504] RSP: 002b:00007fa9537eb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 809.415940][T14504] RAX: ffffffffffffffda RBX: 00007fa952c25fa0 RCX: 00007fa95299de59 [ 809.415952][T14504] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 809.415963][T14504] RBP: 00007fa9537eb090 R08: 0000000000000000 R09: 0000000000000000 [ 809.415974][T14504] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 809.415984][T14504] R13: 00007fa952c26038 R14: 00007fa952c25fa0 R15: 00007fff48df3f68 [ 809.416009][T14504] [ 809.833627][T14512] netlink: 830 bytes leftover after parsing attributes in process `syz.4.2370'. [ 810.039414][ T5740] usb 1-1: new full-speed USB device number 88 using dummy_hcd [ 810.198826][ T5740] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x4F, changing to 0xF [ 810.211926][ T5740] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 140, setting to 64 [ 810.240816][ T5740] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 810.276921][ T5740] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 810.300778][ T5740] usb 1-1: Product: syz [ 810.310310][ T5740] usb 1-1: Manufacturer: syz [ 810.331340][ T5740] usb 1-1: SerialNumber: syz [ 810.386626][ T5740] usb 1-1: config 0 descriptor?? [ 810.427029][T14510] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 810.646608][T14510] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 811.206995][ T5342] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 811.375756][ T991] usb 1-1: USB disconnect, device number 88 [ 811.496833][ T5342] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 811.530946][ T5342] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 811.599579][ T5342] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 811.630773][ T5342] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 811.714912][T14546] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(11) [ 811.721536][T14546] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 811.731964][T14546] vhci_hcd vhci_hcd.0: Device attached [ 811.747096][ T5342] usb 5-1: config 0 descriptor?? [ 811.864297][T14536] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 811.988611][ T5342] usbhid 5-1:0.0: can't add hid device: -71 [ 812.018846][ T991] usb 38-1: SetAddress Request (14) to port 0 [ 812.031407][ T5342] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 812.052312][ T991] usb 38-1: new SuperSpeed USB device number 14 using vhci_hcd [ 812.106907][ T5342] usb 5-1: USB disconnect, device number 83 [ 812.261023][T14552] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 812.399858][T14552] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2378'. [ 812.474888][T14547] vhci_hcd: connection reset by peer [ 812.562676][ T9537] vhci_hcd vhci_hcd.2: stop threads [ 813.006984][ T9537] vhci_hcd vhci_hcd.2: release socket [ 813.045697][ T9537] vhci_hcd vhci_hcd.2: disconnect device [ 813.135910][T14562] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 813.147131][T14562] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 813.295049][ T5342] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 813.708245][ T5342] usb 1-1: config 1 has an invalid interface number: 7 but max is 0 [ 813.736852][ T5342] usb 1-1: config 1 has no interface number 0 [ 813.744604][ T5342] usb 1-1: config 1 interface 7 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1024 [ 813.780410][ T5342] usb 1-1: config 1 interface 7 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 32 [ 813.890400][T13340] Bluetooth: hci4: Malformed LE Event: 0x0d [ 813.964349][T14575] FAULT_INJECTION: forcing a failure. [ 813.964349][T14575] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 813.965596][ T5342] usb 1-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 813.986979][T14575] CPU: 0 UID: 0 PID: 14575 Comm: syz.2.2386 Tainted: G L syzkaller #0 PREEMPT(full) [ 813.987007][T14575] Tainted: [L]=SOFTLOCKUP [ 813.987013][T14575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 813.987023][T14575] Call Trace: [ 813.987029][T14575] [ 813.987036][T14575] dump_stack_lvl+0x100/0x190 [ 813.987063][T14575] should_fail_ex.cold+0x5/0xa [ 813.987089][T14575] strncpy_from_user+0x3b/0x2d0 [ 813.987112][T14575] do_getname+0x78/0x390 [ 813.987136][T14575] do_sys_openat2+0xc7/0x1e0 [ 813.987157][T14575] ? __pfx_do_sys_openat2+0x10/0x10 [ 813.987180][T14575] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 813.987210][T14575] ? __fget_files+0x21f/0x3d0 [ 813.987235][T14575] __x64_sys_openat+0x12d/0x210 [ 813.987259][T14575] ? __pfx___x64_sys_openat+0x10/0x10 [ 813.987281][T14575] ? ksys_write+0x1ac/0x250 [ 813.987301][T14575] do_syscall_64+0x115/0x870 [ 813.987323][T14575] ? clear_bhb_loop+0x40/0x90 [ 813.987342][T14575] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 813.987360][T14575] RIP: 0033:0x7f5aee79de59 [ 813.987376][T14575] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 813.987393][T14575] RSP: 002b:00007f5aef624028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 813.987412][T14575] RAX: ffffffffffffffda RBX: 00007f5aeea26090 RCX: 00007f5aee79de59 [ 813.987425][T14575] RDX: 0000000000001041 RSI: 0000200000001580 RDI: ffffffffffffff9c [ 813.987435][T14575] RBP: 00007f5aef624090 R08: 0000000000000000 R09: 0000000000000000 [ 813.987446][T14575] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 813.987457][T14575] R13: 00007f5aeea26128 R14: 00007f5aeea26090 R15: 00007ffc8c1eb9f8 [ 813.987481][T14575] [ 814.467025][ T5740] usb 5-1: new full-speed USB device number 84 using dummy_hcd [ 814.475290][ T5342] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 814.475315][ T5342] usb 1-1: Product: syz [ 814.475331][ T5342] usb 1-1: Manufacturer: syz [ 814.546881][ T5342] usb 1-1: SerialNumber: syz [ 814.573473][T14552] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 814.596936][T14552] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 814.616882][ T5740] usb 5-1: device descriptor read/64, error -71 [ 814.617610][ T5342] usb 1-1: Error in usbnet_get_endpoints (-22) [ 814.856877][ T5740] usb 5-1: new full-speed USB device number 85 using dummy_hcd [ 814.871100][T14578] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 814.959967][T14578] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 815.020856][ T5740] usb 5-1: device descriptor read/64, error -71 [ 815.148554][ T5740] usb usb5-port1: attempt power cycle [ 815.277112][ T5342] usb 4-1: new full-speed USB device number 57 using dummy_hcd [ 815.439156][ T5342] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x4F, changing to 0xF [ 815.451196][ T5342] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 140, setting to 64 [ 815.469318][ T5342] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 815.487728][ T5342] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 815.498825][ T5342] usb 4-1: Product: syz [ 815.503099][ T5342] usb 4-1: Manufacturer: syz [ 815.509224][ T5342] usb 4-1: SerialNumber: syz [ 815.516393][ T5740] usb 5-1: new full-speed USB device number 86 using dummy_hcd [ 815.542026][ T5342] usb 4-1: config 0 descriptor?? [ 815.560288][ T5740] usb 5-1: device descriptor read/8, error -71 [ 815.584968][T14581] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 815.802725][T14581] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 815.810591][ T5740] usb 5-1: new full-speed USB device number 87 using dummy_hcd [ 815.907545][ T5740] usb 5-1: device descriptor read/8, error -71 [ 815.946391][ T46] usb 1-1: USB disconnect, device number 89 [ 816.026194][ T5740] usb usb5-port1: unable to enumerate USB device [ 816.400413][ T46] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 816.520688][ T5740] usb 4-1: USB disconnect, device number 57 [ 816.598504][ T46] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 816.644104][ T46] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 816.682587][ T46] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 816.705243][ T46] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 816.748950][ T46] usb 1-1: config 0 descriptor?? [ 816.943726][T13340] Bluetooth: hci1: Malformed LE Event: 0x0d [ 817.032328][ T46] usbhid 1-1:0.0: can't add hid device: -71 [ 817.040713][ T46] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 817.204633][ T991] usb 38-1: device descriptor read/8, error -110 [ 817.261663][ T46] usb 1-1: USB disconnect, device number 90 [ 817.420013][T14590] random: crng reseeded on system resumption [ 817.556977][T14599] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(11) [ 817.563600][T14599] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 817.571492][T14599] vhci_hcd vhci_hcd.0: Device attached [ 817.629709][ T991] usb usb38-port1: attempt power cycle [ 817.651769][T14602] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 817.784607][T14602] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 817.825979][ T29] audit: type=1400 audit(1782935837.539:1872): avc: denied { mount } for pid=14595 comm="syz.1.2393" name="/" dev="autofs" ino=53090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 817.873292][ T46] usb 40-1: SetAddress Request (26) to port 0 [ 817.911792][ T46] usb 40-1: new SuperSpeed USB device number 26 using vhci_hcd [ 817.925302][T14605] FAULT_INJECTION: forcing a failure. [ 817.925302][T14605] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 818.012372][T14605] CPU: 1 UID: 0 PID: 14605 Comm: syz.0.2394 Tainted: G L syzkaller #0 PREEMPT(full) [ 818.012402][T14605] Tainted: [L]=SOFTLOCKUP [ 818.012409][T14605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 818.012419][T14605] Call Trace: [ 818.012425][T14605] [ 818.012433][T14605] dump_stack_lvl+0x100/0x190 [ 818.012463][T14605] should_fail_ex.cold+0x5/0xa [ 818.012491][T14605] _copy_to_user+0x32/0xd0 [ 818.012518][T14605] simple_read_from_buffer+0xcb/0x170 [ 818.012544][T14605] proc_fail_nth_read+0x1af/0x230 [ 818.012573][T14605] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 818.012600][T14605] ? rw_verify_area+0xce/0x6d0 [ 818.012624][T14605] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 818.012650][T14605] vfs_read+0x1e4/0xb40 [ 818.012680][T14605] ? __pfx_vfs_read+0x10/0x10 [ 818.012706][T14605] ? __fget_files+0x215/0x3d0 [ 818.012735][T14605] ? __fget_files+0x21f/0x3d0 [ 818.012760][T14605] ksys_read+0x12a/0x250 [ 818.012786][T14605] ? __pfx_ksys_read+0x10/0x10 [ 818.012811][T14605] ? v4l2_ioctl+0x1c5/0x250 [ 818.012839][T14605] do_syscall_64+0x115/0x870 [ 818.012864][T14605] ? clear_bhb_loop+0x40/0x90 [ 818.012886][T14605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 818.012904][T14605] RIP: 0033:0x7fa95295e68e [ 818.012920][T14605] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 818.012936][T14605] RSP: 002b:00007fa9537eafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 818.012954][T14605] RAX: ffffffffffffffda RBX: 00007fa9537eb6c0 RCX: 00007fa95295e68e [ 818.012966][T14605] RDX: 000000000000000f RSI: 00007fa9537eb0a0 RDI: 0000000000000004 [ 818.012976][T14605] RBP: 00007fa9537eb090 R08: 0000000000000000 R09: 0000000000000000 [ 818.012987][T14605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 818.012998][T14605] R13: 00007fa952c26038 R14: 00007fa952c25fa0 R15: 00007fff48df3f68 [ 818.013022][T14605] [ 818.515915][T14600] vhci_hcd: connection reset by peer [ 818.555898][ T8700] vhci_hcd vhci_hcd.3: stop threads [ 818.573551][ T8700] vhci_hcd vhci_hcd.3: release socket [ 818.592119][ T8700] vhci_hcd vhci_hcd.3: disconnect device [ 818.750062][ T991] usb usb38-port1: unable to enumerate USB device [ 819.658109][T14612] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(11) [ 819.664734][T14612] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 819.673724][T14612] vhci_hcd vhci_hcd.0: Device attached [ 820.576240][ T29] audit: type=1400 audit(1782935840.329:1873): avc: denied { unmount } for pid=5614 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1 [ 820.743977][T14616] vhci_hcd: connection closed [ 820.745818][ T9537] vhci_hcd vhci_hcd.3: stop threads [ 820.769293][ T9537] vhci_hcd vhci_hcd.3: release socket [ 820.787447][ T9537] vhci_hcd vhci_hcd.3: disconnect device [ 820.837275][ T991] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 820.896819][ T5342] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 820.996804][ T991] usb 1-1: Using ep0 maxpacket: 32 [ 821.008624][ T991] usb 1-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22 [ 821.021317][ T991] usb 1-1: New USB device strings: Mfr=1, Product=32, SerialNumber=3 [ 821.055670][ T991] usb 1-1: Product: syz [ 821.060985][ T5342] usb 5-1: Using ep0 maxpacket: 8 [ 821.072581][ T991] usb 1-1: Manufacturer: syz [ 821.079211][ T5342] usb 5-1: unable to get BOS descriptor or descriptor too short [ 821.090098][ T991] usb 1-1: SerialNumber: syz [ 821.097989][ T5342] usb 5-1: config 6 interface 0 has no altsetting 0 [ 821.119263][ T991] usb 1-1: config 0 descriptor?? [ 821.153401][ T5342] usb 5-1: New USB device found, idVendor=0a71, idProduct=0311, bcdDevice=7e.1c [ 821.170772][ T991] usb 1-1: selecting invalid altsetting 3 [ 821.185315][ T991] comedi comedi4: could not set alternate setting 3 in high speed [ 821.195838][ T5342] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.213324][ T5342] usb 5-1: Product: syz [ 821.217776][ T991] usbdux 1-1:0.0: driver 'usbdux' failed to auto-configure device. [ 821.226050][ T5342] usb 5-1: Manufacturer: syz [ 821.234095][ T5342] usb 5-1: SerialNumber: syz [ 821.265030][ T991] usbdux 1-1:0.0: probe with driver usbdux failed with error -22 [ 821.420946][T14631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 821.445147][T14631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 821.498833][ T991] usb 1-1: USB disconnect, device number 91 [ 821.584380][T14631] IPVS: ip_vs_add_dest(): server weight less than zero [ 821.721611][T14635] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 821.740773][T14635] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 822.298632][ T5342] usb 5-1: USB disconnect, device number 88 [ 822.806508][ T29] audit: type=1400 audit(1782935842.559:1874): avc: denied { read } for pid=14647 comm="syz.2.2407" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 822.976902][ T5740] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 823.113674][ T46] usb 40-1: device descriptor read/8, error -110 [ 823.287380][ T5740] usb 1-1: Using ep0 maxpacket: 32 [ 823.298263][ T5740] usb 1-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22 [ 823.320919][ T5740] usb 1-1: New USB device strings: Mfr=1, Product=32, SerialNumber=3 [ 823.351974][ T5740] usb 1-1: Product: syz [ 823.368751][ T5740] usb 1-1: Manufacturer: syz [ 823.380944][ T5740] usb 1-1: SerialNumber: syz [ 823.403455][ T5740] usb 1-1: config 0 descriptor?? [ 823.451096][ T5740] usb 1-1: selecting invalid altsetting 3 [ 823.459004][ T5740] comedi comedi4: could not set alternate setting 3 in high speed [ 823.480918][ T5740] usbdux 1-1:0.0: driver 'usbdux' failed to auto-configure device. [ 823.508313][ T46] usb usb40-port1: attempt power cycle [ 823.531530][ T5740] usbdux 1-1:0.0: probe with driver usbdux failed with error -22 [ 823.732837][ T5342] usb 1-1: USB disconnect, device number 92 [ 823.797914][T14664] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2411'. [ 824.087697][ T46] usb usb40-port1: unable to enumerate USB device [ 824.490098][ T46] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 824.509378][T14678] FAULT_INJECTION: forcing a failure. [ 824.509378][T14678] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 824.523868][T14678] CPU: 0 UID: 0 PID: 14678 Comm: syz.0.2416 Tainted: G L syzkaller #0 PREEMPT(full) [ 824.523898][T14678] Tainted: [L]=SOFTLOCKUP [ 824.523904][T14678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 824.523914][T14678] Call Trace: [ 824.523920][T14678] [ 824.523927][T14678] dump_stack_lvl+0x100/0x190 [ 824.523961][T14678] should_fail_ex.cold+0x5/0xa [ 824.523987][T14678] _copy_from_user+0x2e/0xd0 [ 824.524012][T14678] blkdev_common_ioctl+0x314/0x2b80 [ 824.524041][T14678] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 824.524071][T14678] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 824.524095][T14678] ? do_vfs_ioctl+0x226/0x13e0 [ 824.524119][T14678] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 824.524143][T14678] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 824.524173][T14678] ? __fget_files+0x215/0x3d0 [ 824.524194][T14678] blkdev_ioctl+0x43b/0x6f0 [ 824.524218][T14678] ? __pfx_blkdev_ioctl+0x10/0x10 [ 824.524241][T14678] ? selinux_file_ioctl+0x13b/0x290 [ 824.524264][T14678] ? selinux_file_ioctl+0xb6/0x290 [ 824.524289][T14678] ? __pfx_blkdev_ioctl+0x10/0x10 [ 824.524315][T14678] __x64_sys_ioctl+0x18e/0x210 [ 824.524341][T14678] do_syscall_64+0x115/0x870 [ 824.524365][T14678] ? clear_bhb_loop+0x40/0x90 [ 824.524386][T14678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 824.524402][T14678] RIP: 0033:0x7fa95299de59 [ 824.524418][T14678] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 824.524435][T14678] RSP: 002b:00007fa9537eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 824.524452][T14678] RAX: ffffffffffffffda RBX: 00007fa952c25fa0 RCX: 00007fa95299de59 [ 824.524463][T14678] RDX: 00002000000000c0 RSI: 000000000000127f RDI: 0000000000000003 [ 824.524473][T14678] RBP: 00007fa9537eb090 R08: 0000000000000000 R09: 0000000000000000 [ 824.524484][T14678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 824.524494][T14678] R13: 00007fa952c26038 R14: 00007fa952c25fa0 R15: 00007fff48df3f68 [ 824.524519][T14678] [ 824.903949][T14684] syzkaller0: entered promiscuous mode [ 824.917235][T14684] syzkaller0: entered allmulticast mode [ 824.923176][ T46] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 824.935219][ T46] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 824.957801][ T46] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 824.983260][ T46] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 825.010724][ T46] usb 3-1: config 0 descriptor?? [ 825.293865][ T5740] usb 5-1: new full-speed USB device number 89 using dummy_hcd [ 825.451342][ T46] usbhid 3-1:0.0: can't add hid device: -71 [ 825.479099][ T46] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 825.795564][ T5740] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x4F, changing to 0xF [ 825.811315][ T5740] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 140, setting to 64 [ 825.826978][ T5740] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 825.848353][ T46] usb 3-1: USB disconnect, device number 76 [ 825.858733][ T5740] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 825.876500][ T5740] usb 5-1: Product: syz [ 825.881511][ T5740] usb 5-1: Manufacturer: syz [ 825.886112][ T5740] usb 5-1: SerialNumber: syz [ 825.906983][ T5740] usb 5-1: config 0 descriptor?? [ 825.973675][T14686] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 826.170310][T14708] fuse: Unknown parameter '0x0000000000000003' [ 826.187776][T14686] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 827.047316][ T46] usb 5-1: USB disconnect, device number 89 [ 828.366929][ T46] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 828.686856][ T991] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 828.730958][ T29] audit: type=1400 audit(1782935848.489:1875): avc: denied { setopt } for pid=14743 comm="syz.2.2432" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 828.913214][T14744] devpts: Bad value for 'max' [ 828.926830][ T46] usb 5-1: Using ep0 maxpacket: 32 [ 828.943763][ T46] usb 5-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22 [ 828.966386][ T29] audit: type=1400 audit(1782935848.719:1876): avc: denied { getopt } for pid=14748 comm="syz.0.2433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 828.989280][ T991] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 829.000426][ T46] usb 5-1: New USB device strings: Mfr=1, Product=32, SerialNumber=3 [ 829.017269][ T29] audit: type=1400 audit(1782935848.719:1877): avc: denied { connect } for pid=14748 comm="syz.0.2433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 829.017876][ T991] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 829.046700][ T46] usb 5-1: Product: syz [ 829.053543][ T46] usb 5-1: Manufacturer: syz [ 829.058224][ T46] usb 5-1: SerialNumber: syz [ 829.065186][ T46] usb 5-1: config 0 descriptor?? [ 829.075765][ T29] audit: type=1400 audit(1782935848.749:1878): avc: denied { getopt } for pid=14748 comm="syz.0.2433" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 829.083592][ T46] usb 5-1: selecting invalid altsetting 3 [ 829.105290][ T991] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 829.114684][ T991] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 829.125065][ T46] comedi comedi4: could not set alternate setting 3 in high speed [ 829.144134][ T46] usbdux 5-1:0.0: driver 'usbdux' failed to auto-configure device. [ 829.156251][ T991] usb 4-1: config 0 descriptor?? [ 829.200545][ T46] usbdux 5-1:0.0: probe with driver usbdux failed with error -22 [ 829.394771][ T5740] usb 5-1: USB disconnect, device number 90 [ 829.436830][ T5342] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 829.568815][T14755] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(11) [ 829.575446][T14755] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 829.684376][T14755] vhci_hcd vhci_hcd.0: Device attached [ 829.750537][ T5342] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 829.780979][ T5342] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 829.799504][ T991] usbhid 4-1:0.0: can't add hid device: -71 [ 829.838322][ T991] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 829.854651][ T5342] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 829.912669][T14760] fuse: Unknown parameter 'fd0x0000000000000003' [ 829.923236][ T5342] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 829.943569][ T991] usb 4-1: USB disconnect, device number 58 [ 829.991793][ T46] usb 36-1: SetAddress Request (30) to port 0 [ 830.061651][ T5342] usb 3-1: config 0 descriptor?? [ 830.069779][ T46] usb 36-1: new SuperSpeed USB device number 30 using vhci_hcd [ 830.314191][T14756] vhci_hcd: connection reset by peer [ 830.354241][ T5342] usbhid 3-1:0.0: can't add hid device: -71 [ 830.392183][ T8700] vhci_hcd vhci_hcd.1: stop threads [ 830.422767][ T8700] vhci_hcd vhci_hcd.1: release socket [ 830.431874][ T5342] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 830.471996][ T8700] vhci_hcd vhci_hcd.1: disconnect device [ 830.689882][ T5342] usb 3-1: USB disconnect, device number 77 [ 830.875435][T14767] FAULT_INJECTION: forcing a failure. [ 830.875435][T14767] name failslab, interval 1, probability 0, space 0, times 0 [ 830.942429][T14767] CPU: 1 UID: 0 PID: 14767 Comm: syz.3.2439 Tainted: G L syzkaller #0 PREEMPT(full) [ 830.942460][T14767] Tainted: [L]=SOFTLOCKUP [ 830.942466][T14767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 830.942476][T14767] Call Trace: [ 830.942483][T14767] [ 830.942491][T14767] dump_stack_lvl+0x100/0x190 [ 830.942518][T14767] should_fail_ex.cold+0x5/0xa [ 830.942543][T14767] should_failslab+0xc2/0x120 [ 830.942565][T14767] __kmalloc_cache_noprof+0x91/0x6c0 [ 830.942593][T14767] ? vma_node_allow+0x57/0x370 [ 830.942615][T14767] vma_node_allow+0x57/0x370 [ 830.942635][T14767] drm_gem_handle_create_tail+0x1e1/0x4d0 [ 830.942658][T14767] drm_mode_getfb2_ioctl+0x7d2/0x12a0 [ 830.942689][T14767] drm_ioctl_kernel+0x1f3/0x3e0 [ 830.942708][T14767] ? __pfx_drm_mode_getfb2_ioctl+0x10/0x10 [ 830.942733][T14767] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 830.942758][T14767] drm_ioctl+0x5e6/0xc60 [ 830.942779][T14767] ? __pfx_drm_mode_getfb2_ioctl+0x10/0x10 [ 830.942803][T14767] ? __pfx_drm_ioctl+0x10/0x10 [ 830.942831][T14767] ? selinux_file_ioctl+0x13b/0x290 [ 830.942857][T14767] ? selinux_file_ioctl+0xb6/0x290 [ 830.942883][T14767] ? __pfx_drm_ioctl+0x10/0x10 [ 830.942902][T14767] __x64_sys_ioctl+0x18e/0x210 [ 830.942930][T14767] do_syscall_64+0x115/0x870 [ 830.942955][T14767] ? clear_bhb_loop+0x40/0x90 [ 830.942976][T14767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 830.942995][T14767] RIP: 0033:0x7f5c54d9de59 [ 830.943009][T14767] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 830.943025][T14767] RSP: 002b:00007f5c55d12028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 830.943043][T14767] RAX: ffffffffffffffda RBX: 00007f5c55025fa0 RCX: 00007f5c54d9de59 [ 830.943054][T14767] RDX: 0000200000000240 RSI: 00000000c06864ce RDI: 0000000000000003 [ 830.943064][T14767] RBP: 00007f5c55d12090 R08: 0000000000000000 R09: 0000000000000000 [ 830.943075][T14767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 830.943085][T14767] R13: 00007f5c55026038 R14: 00007f5c55025fa0 R15: 00007ffe5784fce8 [ 830.943108][T14767] [ 831.792249][ T29] audit: type=1400 audit(1782935851.549:1879): avc: denied { bind } for pid=14774 comm="syz.2.2442" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 832.117533][ T5342] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 832.298214][ T5342] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 832.331229][ T5342] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 832.361086][ T5342] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 832.393349][ T5342] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 832.410649][ T5342] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 832.445099][ T5342] usb 5-1: Product: syz [ 832.465405][ T5342] usb 5-1: Manufacturer: syz [ 832.490400][ T5342] usb 5-1: SerialNumber: syz [ 832.716082][T14781] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 832.763480][T14781] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 832.825242][T14781] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 832.872903][T14781] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 832.919736][T14781] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 832.971612][T14781] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 833.009133][T14781] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 833.044205][T14781] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 833.079954][T14781] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 833.116034][T14781] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 833.278053][ T5342] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 91 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 833.333716][ T5342] usb 5-1: USB disconnect, device number 91 [ 833.372182][ T5342] usblp0: removed [ 834.788847][ T5740] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 834.807131][T14806] fuse: Unknown parameter 'fd0x0000000000000003' [ 835.338554][ T46] usb 36-1: device descriptor read/8, error -110 [ 835.398766][T14785] random: crng reseeded on system resumption [ 835.417707][T14785] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2444'. [ 835.443616][ T29] audit: type=1400 audit(1782935855.169:1880): avc: denied { ioctl } for pid=14784 comm="syz.1.2444" path="/dev/snapshot" dev="devtmpfs" ino=92 ioctlcmd=0x330d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 835.559808][ T5740] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 835.633018][ T5740] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 835.876651][ T5740] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 835.993264][ T46] usb usb36-port1: attempt power cycle [ 836.153122][ T5740] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 836.239857][ T11] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 837.033867][ T11] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 837.045539][ T11] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 837.060723][ T11] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 837.071195][ T11] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 837.100717][ T11] usb 1-1: config 0 descriptor?? [ 837.107505][ T5740] usb 3-1: config 0 descriptor?? [ 837.192751][ T5740] usb 3-1: can't set config #0, error -71 [ 837.202572][ T5740] usb 3-1: USB disconnect, device number 78 [ 837.291107][T14829] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2454'. [ 837.357989][ T9534] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 837.371336][ T9534] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 837.378310][ T46] usb usb36-port1: unable to enumerate USB device [ 837.389332][ T9534] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 837.404776][ T9534] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 837.504634][ T11] usbhid 1-1:0.0: can't add hid device: -71 [ 837.511181][ T11] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 837.579340][ T11] usb 1-1: USB disconnect, device number 93 [ 837.765839][T14834] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 837.779195][T14834] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 838.829945][T14853] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(10) [ 838.836585][T14853] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 838.844860][T14853] vhci_hcd vhci_hcd.0: Device attached [ 839.108169][ T991] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 839.238214][ T46] usb 40-1: SetAddress Request (30) to port 0 [ 839.308595][ T46] usb 40-1: new SuperSpeed USB device number 30 using vhci_hcd [ 839.362188][ T991] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 839.519735][ T991] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 839.584631][T14854] vhci_hcd: connection reset by peer [ 839.662792][ T991] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 839.683302][ T9537] vhci_hcd vhci_hcd.3: stop threads [ 839.726138][ T9537] vhci_hcd vhci_hcd.3: release socket [ 839.739479][ T991] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 839.827653][ T9537] vhci_hcd vhci_hcd.3: disconnect device [ 839.942937][ T991] usb 1-1: config 0 descriptor?? [ 842.226472][ T991] usbhid 1-1:0.0: can't add hid device: -71 [ 842.254777][ T991] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 842.336785][T10820] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 842.356470][ T991] usb 1-1: USB disconnect, device number 94 [ 842.549832][T10820] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 842.644669][T10820] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 842.707021][T10820] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 842.742982][T10820] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 842.793020][T10820] usb 4-1: config 0 descriptor?? [ 842.875125][ T29] audit: type=1400 audit(1782935862.629:1881): avc: denied { setopt } for pid=14879 comm="syz.2.2467" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 844.506880][ T46] usb 40-1: device descriptor read/8, error -110 [ 844.753147][T10820] usbhid 4-1:0.0: can't add hid device: -71 [ 844.803044][T10820] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 844.862848][T10820] usb 4-1: USB disconnect, device number 59 [ 844.910356][ T46] usb usb40-port1: attempt power cycle [ 845.629247][ T46] usb usb40-port1: unable to enumerate USB device [ 846.745288][ T29] audit: type=1400 audit(1782935866.499:1882): avc: denied { ioctl } for pid=14909 comm="syz.1.2477" path="/dev/ttyq6" dev="devtmpfs" ino=381 ioctlcmd=0x540a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 847.010876][ T29] audit: type=1400 audit(1782935866.519:1883): avc: denied { transfer } for pid=14905 comm="syz.4.2476" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 847.749828][T14912] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 849.379459][T14943] misc userio: The device must be registered before sending interrupts [ 849.444383][T14926] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 849.468262][ T29] audit: type=1400 audit(1782935869.219:1884): avc: denied { bind } for pid=14925 comm="syz.4.2480" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 850.283156][ T11] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 850.346050][ T46] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 850.448939][T13340] Bluetooth: hci3: Malformed LE Event: 0x0d [ 851.336121][ T46] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 851.346817][ T11] usb 4-1: Using ep0 maxpacket: 32 [ 851.367098][ T11] usb 4-1: unable to get BOS descriptor or descriptor too short [ 851.380468][ T46] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 851.396639][ T46] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 851.410262][ T46] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 851.419499][ T46] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 851.448627][ T11] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 851.457766][ T11] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 851.464469][ T46] usb 1-1: config 0 descriptor?? [ 851.476882][ T11] usb 4-1: config 14 has no interface number 0 [ 851.494174][T14973] random: crng reseeded on system resumption [ 851.520437][ T11] usb 4-1: config 14 has no interface number 1 [ 851.552676][ T11] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 851.553405][T14982] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=14982 comm=syz.4.2496 [ 851.598255][T14982] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=14982 comm=syz.4.2496 [ 851.611663][ T11] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 851.638815][ T11] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 851.668012][ T11] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 851.677859][T14962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 851.693467][ T11] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 851.694428][T14962] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 851.705414][ T11] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 851.759919][T14962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 851.787402][T14962] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 851.798075][ T11] usb 4-1: config 14 interface 57 has no altsetting 0 [ 851.798089][T10820] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 851.804854][ T11] usb 4-1: config 14 interface 228 has no altsetting 0 [ 851.825968][T14962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 851.861773][T14962] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 851.889948][T14962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 851.929779][T14962] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 851.945281][T14962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 851.967690][ T11] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 851.982370][ T11] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 852.006291][ T11] usb 4-1: Product: syz [ 852.009695][T14962] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 852.037615][T10820] usb 3-1: Using ep0 maxpacket: 8 [ 852.045575][T10820] usb 3-1: unable to get BOS descriptor or descriptor too short [ 852.061691][T10820] usb 3-1: config 6 interface 0 has no altsetting 0 [ 852.068385][ T11] usb 4-1: Manufacturer: syz [ 852.078881][ T11] usb 4-1: SerialNumber: syz [ 852.078881][T10820] usb 3-1: New USB device found, idVendor=0a71, idProduct=0311, bcdDevice=7e.1c [ 852.123589][T10820] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 852.163576][T10820] usb 3-1: Product: syz [ 852.169030][T14963] kvm: user requested TSC rate below hardware speed [ 852.178170][T10820] usb 3-1: Manufacturer: syz [ 852.182813][T10820] usb 3-1: SerialNumber: syz [ 852.188000][ T46] usbhid 1-1:0.0: can't add hid device: -32 [ 852.194108][ T46] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 852.202782][T14963] kvm: user requested TSC rate below hardware speed [ 852.250002][T14963] kvm: user requested TSC rate below hardware speed [ 852.257333][T14963] kvm: user requested TSC rate below hardware speed [ 852.267368][T14963] kvm: user requested TSC rate below hardware speed [ 852.287101][T14963] kvm: user requested TSC rate below hardware speed [ 852.294027][T14963] kvm: user requested TSC rate below hardware speed [ 852.313429][T14963] kvm: user requested TSC rate below hardware speed [ 852.342488][T14963] kvm: user requested TSC rate below hardware speed [ 852.370389][T14963] kvm: user requested TSC rate below hardware speed [ 852.560112][ T11] legousbtower 4-1:14.57: interrupt endpoints not found [ 852.658801][T14991] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 852.705503][T14991] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 852.959578][ T11] legousbtower 4-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 852.988356][ T11] legousbtower 4-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 855.038674][ T11] usb 1-1: USB disconnect, device number 95 [ 855.112648][ C1] usb 4-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 855.123741][ T5740] usb 4-1: USB disconnect, device number 60 [ 855.150187][ T5740] legousbtower 4-1:14.228: LEGO USB Tower #-160 now disconnected [ 855.405137][T10820] usb 3-1: USB disconnect, device number 79 [ 855.422961][ T46] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 855.482692][T15012] FAULT_INJECTION: forcing a failure. [ 855.482692][T15012] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 855.495910][T13340] Bluetooth: hci0: Malformed LE Event: 0x0d [ 855.525461][T15012] CPU: 1 UID: 0 PID: 15012 Comm: syz.3.2502 Tainted: G L syzkaller #0 PREEMPT(full) [ 855.525487][T15012] Tainted: [L]=SOFTLOCKUP [ 855.525493][T15012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 855.525503][T15012] Call Trace: [ 855.525510][T15012] [ 855.525517][T15012] dump_stack_lvl+0x100/0x190 [ 855.525545][T15012] should_fail_ex.cold+0x5/0xa [ 855.525569][T15012] strncpy_from_user+0x3b/0x2d0 [ 855.525590][T15012] ? get_pid_task+0x106/0x250 [ 855.525609][T15012] path_setxattrat+0x127/0x3b0 [ 855.525631][T15012] ? __pfx_path_setxattrat+0x10/0x10 [ 855.525654][T15012] ? ksys_write+0x190/0x250 [ 855.525669][T15012] ? ksys_write+0x190/0x250 [ 855.525700][T15012] ? fput+0x79/0x100 [ 855.525719][T15012] ? ksys_write+0x1ac/0x250 [ 855.525734][T15012] ? __pfx_ksys_write+0x10/0x10 [ 855.525762][T15012] __x64_sys_setxattr+0xc6/0x140 [ 855.525784][T15012] ? do_syscall_64+0x90/0x870 [ 855.525808][T15012] ? lockdep_hardirqs_on+0x78/0x100 [ 855.525833][T15012] do_syscall_64+0x115/0x870 [ 855.525857][T15012] ? clear_bhb_loop+0x40/0x90 [ 855.525879][T15012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 855.525896][T15012] RIP: 0033:0x7f5c54d9de59 [ 855.525912][T15012] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 855.525927][T15012] RSP: 002b:00007f5c55cf1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc [ 855.525952][T15012] RAX: ffffffffffffffda RBX: 00007f5c55026090 RCX: 00007f5c54d9de59 [ 855.525963][T15012] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000200000000480 [ 855.525973][T15012] RBP: 00007f5c55cf1090 R08: 0000000000000002 R09: 0000000000000000 [ 855.525983][T15012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 855.525993][T15012] R13: 00007f5c55026128 R14: 00007f5c55026090 R15: 00007ffe5784fce8 [ 855.526016][T15012] [ 855.936774][ T46] usb 5-1: Using ep0 maxpacket: 16 [ 855.945471][ T46] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 855.976158][ T46] usb 5-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0xFE, changing to 0x8E [ 855.993693][ T29] audit: type=1400 audit(1782935875.729:1885): avc: denied { ioctl } for pid=15015 comm="syz.2.2503" path="socket:[55585]" dev="sockfs" ino=55585 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 856.034061][ T46] usb 5-1: New USB device found, idVendor=08e4, idProduct=017f, bcdDevice= 0.40 [ 856.055737][ T46] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 856.058481][T15019] random: crng reseeded on system resumption [ 856.106119][ T46] usb 5-1: Product: syz [ 856.122457][ T46] usb 5-1: Manufacturer: syz [ 856.147248][ T46] usb 5-1: SerialNumber: syz [ 857.890821][ T46] usb 5-1: Can't get UAC3 power state for id 11 [ 857.929845][ T46] usb 5-1: BAAD SPEAKERPHONE c_chmask mismatch [ 858.149170][ T46] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 858.192223][ T46] usb 5-1: USB disconnect, device number 92 [ 858.330125][T14957] udevd[14957]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 858.485704][T15052] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2510'. [ 858.878312][ T5740] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 858.886639][ T11] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 859.080751][ T11] usb 5-1: Using ep0 maxpacket: 32 [ 859.090011][ T5740] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 859.130631][ T11] usb 5-1: unable to get BOS descriptor or descriptor too short [ 859.172581][ T5740] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 859.203829][ T11] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 859.256571][ T11] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 859.264928][ T5740] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 859.273966][ T5740] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 859.389939][ T11] usb 5-1: config 14 has no interface number 0 [ 859.396114][ T11] usb 5-1: config 14 has no interface number 1 [ 859.417245][ T5740] usb 1-1: config 0 descriptor?? [ 859.432603][ T11] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 859.450128][ T11] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 859.583410][ T11] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 859.598602][ T11] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 859.612181][ T11] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 7 [ 859.655594][T15071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 859.674723][T15071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 859.693184][ T11] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 859.709227][ T11] usb 5-1: config 14 interface 57 has no altsetting 0 [ 859.717457][ T11] usb 5-1: config 14 interface 228 has no altsetting 0 [ 859.890417][T15073] netlink: 'syz.1.2516': attribute type 6 has an invalid length. [ 859.899627][T15073] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2516'. [ 859.998326][ T11] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 860.135664][ T11] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 860.328377][ T5740] usbhid 1-1:0.0: can't add hid device: -71 [ 860.375267][ T11] usb 5-1: Product: syz [ 860.466140][ T5740] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 860.527187][ T11] usb 5-1: Manufacturer: syz [ 860.651972][ T11] usb 5-1: SerialNumber: syz [ 861.054239][ T5740] usb 1-1: USB disconnect, device number 96 [ 861.487535][ T11] legousbtower 5-1:14.57: interrupt endpoints not found [ 861.581857][T15078] netlink: 'syz.2.2518': attribute type 4 has an invalid length. [ 861.589881][T15078] netlink: 17 bytes leftover after parsing attributes in process `syz.2.2518'. [ 861.651764][T13340] Bluetooth: hci2: Unknown advertising packet type: 0x11 [ 861.651792][T13340] Bluetooth: hci2: Unknown advertising packet type: 0x17 [ 861.888117][ T11] legousbtower 5-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 861.916923][ T46] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 861.925990][ T11] legousbtower 5-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 862.206929][ T46] usb 3-1: Using ep0 maxpacket: 8 [ 862.215001][ T46] usb 3-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 862.224155][ T46] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 862.233599][ T46] usb 3-1: Product: syz [ 862.237797][ T46] usb 3-1: Manufacturer: syz [ 862.242628][ T46] usb 3-1: SerialNumber: syz [ 862.248785][ T46] usb 3-1: config 0 descriptor?? [ 862.363504][T10820] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 863.243274][ T46] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in warm state. [ 863.252726][ T46] dvb-usb: bulk message failed: -22 (2/0) [ 863.263536][ T46] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 863.273258][ T11] usb 5-1: USB disconnect, device number 93 [ 863.277270][ T46] dvbdev: DVB: registering new adapter (DViCO FusionHDTV DVB-T USB (LGZ201)) [ 863.293137][ T46] usb 3-1: media controller created [ 863.308253][ T46] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 863.316774][T10820] usb 1-1: Using ep0 maxpacket: 8 [ 863.325409][T10820] usb 1-1: unable to get BOS descriptor or descriptor too short [ 863.346152][T10820] usb 1-1: config 6 interface 0 has no altsetting 0 [ 863.746534][ T11] legousbtower 5-1:14.228: LEGO USB Tower #-160 now disconnected [ 863.793854][T10820] usb 1-1: New USB device found, idVendor=0a71, idProduct=0311, bcdDevice=7e.1c [ 863.863829][T10820] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.921301][T10820] usb 1-1: Product: syz [ 863.947154][T10820] usb 1-1: Manufacturer: syz [ 863.966851][T10820] usb 1-1: SerialNumber: syz [ 864.634339][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 864.865857][T15078] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 864.931535][T15106] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 864.956593][ T46] cxusb: set interface failed [ 864.968489][ T46] dvb-usb: bulk message failed: -22 (1/0) [ 864.979064][T15106] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 865.045015][T15118] binder: 15117:15118 unknown command 0 [ 865.070175][T15118] binder: 15117:15118 ioctl c0306201 2000000001c0 returned -22 [ 865.154665][ T46] DVB: Unable to find symbol mt352_attach() [ 865.171464][ T46] dvb-usb: no frontend was attached by 'DViCO FusionHDTV DVB-T USB (LGZ201)' [ 865.418821][ T46] rc_core: IR keymap rc-dvico-portable not found [ 865.432190][ T46] Registered IR keymap rc-empty [ 865.455477][ T46] rc rc0: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 865.503169][ T46] input: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input31 [ 865.545192][ T46] dvb-usb: schedule remote query interval to 100 msecs. [ 865.552305][ T5342] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 865.570011][ T46] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized and connected. [ 865.597406][ T46] usb 3-1: USB disconnect, device number 80 [ 865.806807][ T5342] usb 5-1: Using ep0 maxpacket: 32 [ 865.850028][ T5342] usb 5-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22 [ 865.868400][ T46] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully deinitialized and disconnected. [ 865.878812][ T5342] usb 5-1: New USB device strings: Mfr=1, Product=32, SerialNumber=3 [ 867.052226][ T5342] usb 5-1: Product: syz [ 867.067503][ T5342] usb 5-1: Manufacturer: syz [ 867.516011][ T5342] usb 5-1: SerialNumber: syz [ 867.549938][ T5342] usb 5-1: config 0 descriptor?? [ 867.589576][ T5342] usb 5-1: selecting invalid altsetting 3 [ 867.797221][ T5342] comedi comedi4: could not set alternate setting 3 in high speed [ 867.808093][ T5342] usbdux 5-1:0.0: driver 'usbdux' failed to auto-configure device. [ 868.478319][ T46] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 868.511454][ T5342] usbdux 5-1:0.0: probe with driver usbdux failed with error -22 [ 868.565519][ T5342] usb 5-1: USB disconnect, device number 94 [ 868.716801][ T46] usb 3-1: Using ep0 maxpacket: 32 [ 868.728571][ T46] usb 3-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22 [ 868.751459][ T46] usb 3-1: New USB device strings: Mfr=1, Product=32, SerialNumber=3 [ 868.760845][ T29] audit: type=1400 audit(1782935888.509:1886): avc: denied { read } for pid=15143 comm="syz.1.2534" path="socket:[54972]" dev="sockfs" ino=54972 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 868.763580][T15144] input: syz0 as /devices/virtual/input/input32 [ 868.784922][ T46] usb 3-1: Product: syz [ 868.784942][ T46] usb 3-1: Manufacturer: syz [ 868.784959][ T46] usb 3-1: SerialNumber: syz [ 868.788196][ T46] usb 3-1: config 0 descriptor?? [ 868.837035][ T991] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 868.866083][ T46] usb 3-1: selecting invalid altsetting 3 [ 868.872136][ T46] comedi comedi4: could not set alternate setting 3 in high speed [ 868.882555][ T46] usbdux 3-1:0.0: driver 'usbdux' failed to auto-configure device. [ 868.908877][ T46] usbdux 3-1:0.0: probe with driver usbdux failed with error -22 [ 869.018075][ T991] usb 4-1: Using ep0 maxpacket: 16 [ 869.031180][ T991] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 869.035247][ T11] usb 3-1: USB disconnect, device number 81 [ 869.069439][ T991] usb 4-1: config 1 interface 1 altsetting 1 has an endpoint descriptor with address 0xFE, changing to 0x8E [ 869.100575][T10820] usb 1-1: USB disconnect, device number 97 [ 869.119818][ T991] usb 4-1: New USB device found, idVendor=08e4, idProduct=017f, bcdDevice= 0.40 [ 869.137879][ T991] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 869.155056][ T991] usb 4-1: Product: syz [ 869.160844][ T991] usb 4-1: Manufacturer: syz [ 869.165483][ T991] usb 4-1: SerialNumber: syz [ 869.487165][T10820] usb 1-1: new full-speed USB device number 98 using dummy_hcd [ 870.350197][T10820] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x4F, changing to 0xF [ 870.364343][T15163] netlink: 'syz.3.2533': attribute type 21 has an invalid length. [ 870.372376][T10820] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 140, setting to 64 [ 870.383640][T15163] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2533'. [ 870.559762][T10820] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 870.576204][T10820] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.889906][T15163] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2533'. [ 870.954383][T10820] usb 1-1: Product: syz [ 870.970074][T15170] netlink: 'syz.3.2533': attribute type 21 has an invalid length. [ 870.994290][T10820] usb 1-1: Manufacturer: syz [ 871.046191][T10820] usb 1-1: SerialNumber: syz [ 871.073014][T15170] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2533'. [ 871.087751][T10820] usb 1-1: config 0 descriptor?? [ 871.106602][T15151] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 871.207646][T15170] netlink: 3 bytes leftover after parsing attributes in process `syz.3.2533'. [ 871.412360][T15151] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 872.349591][T15188] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(10) [ 872.356222][T15188] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 872.468508][T15188] vhci_hcd vhci_hcd.0: Device attached [ 872.505037][ T991] usb 4-1: Can't get UAC3 power state for id 11 [ 872.568957][ T991] usb 4-1: BAAD SPEAKERPHONE c_chmask mismatch [ 872.627947][T10820] usb 1-1: USB disconnect, device number 98 [ 872.721540][ T991] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 872.749809][ T46] usb 38-1: SetAddress Request (18) to port 0 [ 872.773994][ T46] usb 38-1: new SuperSpeed USB device number 18 using vhci_hcd [ 872.786985][ T991] usb 4-1: USB disconnect, device number 61 [ 872.907673][T15048] udevd[15048]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 872.992212][T15190] vhci_hcd: connection reset by peer [ 872.999281][ T9537] vhci_hcd vhci_hcd.2: stop threads [ 873.005157][ T9537] vhci_hcd vhci_hcd.2: release socket [ 873.013699][ T9537] vhci_hcd vhci_hcd.2: disconnect device [ 874.290300][T15208] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(11) [ 874.296938][T15208] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 874.317856][T15208] vhci_hcd vhci_hcd.0: Device attached [ 874.737794][T15217] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 874.776916][ T11] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 874.809275][T15219] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2552'. [ 874.851088][ T29] audit: type=1400 audit(1782935894.609:1887): avc: denied { write } for pid=15218 comm="syz.4.2552" name="mtd0" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 874.886850][ T5740] usb 34-1: SetAddress Request (19) to port 0 [ 874.930582][ T29] audit: type=1400 audit(1782935894.609:1888): avc: denied { open } for pid=15218 comm="syz.4.2552" path="/dev/mtd0" dev="devtmpfs" ino=704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1 [ 874.957854][ T5740] usb 34-1: new SuperSpeed USB device number 19 using vhci_hcd [ 874.967272][ T11] usb 4-1: Using ep0 maxpacket: 32 [ 875.001609][ T11] usb 4-1: unable to get BOS descriptor or descriptor too short [ 875.033064][ T11] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 875.048134][ T11] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 875.059250][ T11] usb 4-1: config 14 has no interface number 0 [ 875.066259][ T11] usb 4-1: config 14 has no interface number 1 [ 875.075079][ T11] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 875.091691][ T11] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 875.104833][ T11] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 875.121963][ T11] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 875.123020][T15209] vhci_hcd: connection reset by peer [ 875.142782][T15222] netlink: 'syz.4.2554': attribute type 21 has an invalid length. [ 875.164762][ T492] vhci_hcd vhci_hcd.0: stop threads [ 875.166303][ T11] usb 4-1: config 14 interface 228 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 875.171119][ T492] vhci_hcd vhci_hcd.0: release socket [ 875.188985][T15222] netlink: 128 bytes leftover after parsing attributes in process `syz.4.2554'. [ 875.209129][ T11] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 875.216788][ T492] vhci_hcd vhci_hcd.0: disconnect device [ 875.224052][T15222] netlink: 'syz.4.2554': attribute type 4 has an invalid length. [ 875.236174][T15222] netlink: 'syz.4.2554': attribute type 5 has an invalid length. [ 875.244327][ T11] usb 4-1: config 14 interface 57 has no altsetting 0 [ 875.251190][ T11] usb 4-1: config 14 interface 228 has no altsetting 0 [ 875.258133][T15222] netlink: 3 bytes leftover after parsing attributes in process `syz.4.2554'. [ 876.386365][ T11] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 876.396279][ T11] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 876.405397][ T11] usb 4-1: Product: syz [ 876.412136][ T11] usb 4-1: Manufacturer: syz [ 876.417579][ T11] usb 4-1: SerialNumber: syz [ 877.027915][ T11] legousbtower 4-1:14.57: interrupt endpoints not found [ 877.245898][ T11] legousbtower 4-1:14.228: interrupt endpoints not found [ 877.457145][T15241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 877.477653][T15241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 877.490196][ T29] audit: type=1400 audit(1782935897.249:1889): avc: denied { execute_no_trans } for pid=15239 comm="syz.1.2559" path="/547/file0" dev="tmpfs" ino=2927 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 877.866850][ T46] usb 38-1: device descriptor read/8, error -110 [ 878.267634][ T46] usb usb38-port1: attempt power cycle [ 879.528309][ T5729] usb 4-1: USB disconnect, device number 62 [ 879.608839][ T46] usb usb38-port1: unable to enumerate USB device [ 879.651268][T15263] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 879.686224][T15263] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 879.924417][ T29] audit: type=1400 audit(1782935899.679:1890): avc: denied { getopt } for pid=15257 comm="syz.4.2564" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 880.028042][ T5740] usb 34-1: device descriptor read/8, error -110 [ 880.287263][ T46] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 880.482754][ T46] usb 1-1: Using ep0 maxpacket: 16 [ 880.484468][ T5740] usb usb34-port1: attempt power cycle [ 880.718541][ T46] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 880.761071][ T46] usb 1-1: config 0 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 880.822345][ T46] usb 1-1: config 0 interface 0 has no altsetting 0 [ 880.861368][ T46] usb 1-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 880.897457][ T46] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 880.944283][ T46] usb 1-1: config 0 descriptor?? [ 881.256585][ T5740] usb usb34-port1: unable to enumerate USB device [ 881.431047][ T46] petalynx 0003:18B1:0037.001C: unknown main item tag 0x0 [ 881.440437][ T46] petalynx 0003:18B1:0037.001C: unknown main item tag 0x0 [ 881.466913][ T46] petalynx 0003:18B1:0037.001C: unknown main item tag 0x0 [ 881.475850][ T46] petalynx 0003:18B1:0037.001C: unknown main item tag 0x0 [ 881.484155][ T46] petalynx 0003:18B1:0037.001C: unknown main item tag 0x0 [ 881.492589][ T46] petalynx 0003:18B1:0037.001C: unknown main item tag 0x0 [ 881.501621][ T46] petalynx 0003:18B1:0037.001C: unknown main item tag 0x0 [ 881.509138][ T46] petalynx 0003:18B1:0037.001C: unknown main item tag 0x0 [ 881.516484][ T46] petalynx 0003:18B1:0037.001C: unknown main item tag 0x0 [ 881.523772][ T46] petalynx 0003:18B1:0037.001C: unknown main item tag 0x0 [ 881.557996][ T46] petalynx 0003:18B1:0037.001C: hidraw0: USB HID v0.09 Device [HID 18b1:0037] on usb-dummy_hcd.0-1/input0 [ 881.655599][T15275] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2569'. [ 881.679668][T15275] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2569'. [ 881.704236][T15275] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2569'. [ 881.731568][T15275] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2569'. [ 881.759743][T15275] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2569'. [ 881.792900][T15298] FAULT_INJECTION: forcing a failure. [ 881.792900][T15298] name failslab, interval 1, probability 0, space 0, times 0 [ 881.810210][T15298] CPU: 1 UID: 0 PID: 15298 Comm: syz.2.2575 Tainted: G L syzkaller #0 PREEMPT(full) [ 881.810238][T15298] Tainted: [L]=SOFTLOCKUP [ 881.810244][T15298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 881.810255][T15298] Call Trace: [ 881.810267][T15298] [ 881.810274][T15298] dump_stack_lvl+0x100/0x190 [ 881.810302][T15298] should_fail_ex.cold+0x5/0xa [ 881.810326][T15298] should_failslab+0xc2/0x120 [ 881.810352][T15298] __kmalloc_noprof+0xfc/0x820 [ 881.810373][T15298] ? tomoyo_encode2+0xfb/0x3c0 [ 881.810402][T15298] tomoyo_encode2+0xfb/0x3c0 [ 881.810431][T15298] tomoyo_encode+0x29/0x50 [ 881.810454][T15298] tomoyo_realpath_from_path+0x18c/0x690 [ 881.810486][T15298] tomoyo_path_number_perm+0x23c/0x580 [ 881.810507][T15298] ? tomoyo_path_number_perm+0x22e/0x580 [ 881.810531][T15298] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 881.810577][T15298] ? find_held_lock+0x2b/0x80 [ 881.810593][T15298] ? __fget_files+0x215/0x3d0 [ 881.810609][T15298] ? hook_file_ioctl_common+0x140/0x440 [ 881.810626][T15298] ? __fget_files+0x215/0x3d0 [ 881.810648][T15298] ? __fget_files+0x21f/0x3d0 [ 881.810669][T15298] security_file_ioctl+0xd3/0x230 [ 881.810694][T15298] __x64_sys_ioctl+0xb7/0x210 [ 881.810720][T15298] do_syscall_64+0x115/0x870 [ 881.810745][T15298] ? clear_bhb_loop+0x40/0x90 [ 881.810766][T15298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 881.810782][T15298] RIP: 0033:0x7f5aee79de59 [ 881.810798][T15298] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 881.810813][T15298] RSP: 002b:00007f5aef645028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 881.810831][T15298] RAX: ffffffffffffffda RBX: 00007f5aeea25fa0 RCX: 00007f5aee79de59 [ 881.810842][T15298] RDX: 0000000000000003 RSI: 0000000000005608 RDI: 0000000000000003 [ 881.810852][T15298] RBP: 00007f5aef645090 R08: 0000000000000000 R09: 0000000000000000 [ 881.810863][T15298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 881.810872][T15298] R13: 00007f5aeea26038 R14: 00007f5aeea25fa0 R15: 00007ffc8c1eb9f8 [ 881.810896][T15298] [ 881.811237][T15298] ERROR: Out of memory at tomoyo_realpath_from_path. [ 882.376894][ T46] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 882.786912][ T46] usb 3-1: Using ep0 maxpacket: 32 [ 882.794950][ T46] usb 3-1: unable to get BOS descriptor or descriptor too short [ 882.806432][ T46] usb 3-1: config 14 has an invalid interface number: 57 but max is 1 [ 882.816015][ T46] usb 3-1: config 14 has an invalid interface number: 228 but max is 1 [ 882.825114][ T46] usb 3-1: config 14 has no interface number 0 [ 882.836453][ T46] usb 3-1: config 14 has no interface number 1 [ 882.843419][ T46] usb 3-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 882.854825][ T46] usb 3-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 882.867111][ T46] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 882.879220][ T46] usb 3-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 882.891457][ T46] usb 3-1: config 14 interface 228 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 882.903365][ T46] usb 3-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 882.917863][ T46] usb 3-1: config 14 interface 57 has no altsetting 0 [ 882.924990][ T46] usb 3-1: config 14 interface 228 has no altsetting 0 [ 882.935140][ T46] usb 3-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 882.944634][ T46] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 882.953846][ T46] usb 3-1: Product: syz [ 882.958534][ T46] usb 3-1: Manufacturer: syz [ 883.098894][ T46] usb 3-1: SerialNumber: syz [ 883.211187][T15318] fuse: Bad value for 'fd' [ 883.807681][ T991] usb 1-1: USB disconnect, device number 99 [ 883.900056][T15320] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2584'. [ 883.909210][T15322] syz.0.2585(15322): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 883.923744][T15320] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2584'. [ 883.933758][T15320] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2584'. [ 884.028480][ T46] legousbtower 3-1:14.57: interrupt endpoints not found [ 884.043611][T15320] xt_hashlimit: size too large, truncated to 1048576 [ 884.678316][ T46] legousbtower 3-1:14.228: interrupt endpoints not found [ 884.875633][T15322] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 885.153841][T15322] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 885.366867][T15335] syz.3.2588 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 885.449991][ T29] audit: type=1400 audit(1782935905.099:1891): avc: denied { audit_write } for pid=15332 comm="syz.3.2588" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 885.471390][ T29] audit: type=1400 audit(1782935905.099:1892): avc: denied { setopt } for pid=15332 comm="syz.3.2588" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 885.727598][T15322] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 885.864683][T15322] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 886.451270][T15347] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(10) [ 886.457873][T15347] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 886.565150][ T5729] usb 3-1: USB disconnect, device number 82 [ 887.643163][T15347] vhci_hcd vhci_hcd.0: Device attached [ 887.674903][T15349] vhci_hcd: connection closed [ 887.708260][ T9420] vhci_hcd vhci_hcd.3: stop threads [ 887.903377][ T9420] vhci_hcd vhci_hcd.3: release socket [ 887.917578][ T9420] vhci_hcd vhci_hcd.3: disconnect device [ 887.999906][T15358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 888.024047][T15358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 888.062309][ T9420] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 888.270722][ T9537] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 888.415567][ T9420] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 888.476182][ T9420] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 888.670196][ T29] audit: type=1400 audit(1782935908.429:1893): avc: denied { read append } for pid=15364 comm="syz.3.2593" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 888.747407][ T11] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 888.812683][T15367] IPv6: sit2: Disabled Multicast RS [ 889.488846][T15366] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 889.535564][T15366] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 889.626858][ T11] usb 5-1: device descriptor read/64, error -71 [ 889.665311][T15366] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 889.672311][T15383] FAULT_INJECTION: forcing a failure. [ 889.672311][T15383] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 889.697838][T15366] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 889.719921][T15383] CPU: 1 UID: 0 PID: 15383 Comm: syz.1.2597 Tainted: G L syzkaller #0 PREEMPT(full) [ 889.719950][T15383] Tainted: [L]=SOFTLOCKUP [ 889.719957][T15383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 889.719966][T15383] Call Trace: [ 889.719972][T15383] [ 889.719979][T15383] dump_stack_lvl+0x100/0x190 [ 889.720007][T15383] should_fail_ex.cold+0x5/0xa [ 889.720032][T15383] _copy_from_iter+0x1f4/0x1690 [ 889.720056][T15383] ? __asan_memset+0x23/0x50 [ 889.720075][T15383] ? __pfx__copy_from_iter+0x10/0x10 [ 889.720097][T15383] ? __pfx___alloc_skb+0x10/0x10 [ 889.720123][T15383] netlink_sendmsg+0x808/0xda0 [ 889.720152][T15383] ? __pfx_netlink_sendmsg+0x10/0x10 [ 889.720174][T15383] ? __might_fault+0x80/0x140 [ 889.720199][T15383] ____sys_sendmsg+0xa4d/0xbe0 [ 889.720220][T15383] ? __pfx_netlink_sendmsg+0x10/0x10 [ 889.720249][T15383] ? __pfx_____sys_sendmsg+0x10/0x10 [ 889.720282][T15383] ___sys_sendmsg+0x190/0x1e0 [ 889.720307][T15383] ? __pfx____sys_sendmsg+0x10/0x10 [ 889.720328][T15383] ? __lock_acquire+0x49f/0x1a40 [ 889.720350][T15383] ? get_pid_task+0x106/0x250 [ 889.720392][T15383] __sys_sendmsg+0x160/0x210 [ 889.720410][T15383] ? __pfx___sys_sendmsg+0x10/0x10 [ 889.720440][T15383] do_syscall_64+0x115/0x870 [ 889.720465][T15383] ? clear_bhb_loop+0x40/0x90 [ 889.720486][T15383] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.720503][T15383] RIP: 0033:0x7f3a37b9de59 [ 889.720517][T15383] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 889.720533][T15383] RSP: 002b:00007f3a38a4c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 889.720551][T15383] RAX: ffffffffffffffda RBX: 00007f3a37e25fa0 RCX: 00007f3a37b9de59 [ 889.720562][T15383] RDX: 0000000000000000 RSI: 0000200000000740 RDI: 0000000000000005 [ 889.720572][T15383] RBP: 00007f3a38a4c090 R08: 0000000000000000 R09: 0000000000000000 [ 889.720582][T15383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 889.720592][T15383] R13: 00007f3a37e26038 R14: 00007f3a37e25fa0 R15: 00007fff4843bc48 [ 889.720629][T15383] [ 889.876889][ T11] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 890.050959][T15366] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 890.081179][T15366] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 890.116797][ T11] usb 5-1: device descriptor read/64, error -71 [ 890.125417][T15366] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 890.163470][T15366] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 890.226782][T15366] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 890.247101][ T11] usb usb5-port1: attempt power cycle [ 890.262309][T15388] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 890.335343][T15388] audit: out of memory in audit_log_start [ 890.560885][ T29] audit: type=1400 audit(1782935910.319:1894): avc: denied { getopt } for pid=15394 comm="syz.1.2602" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 890.606827][ T11] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 890.637496][ T11] usb 5-1: device descriptor read/8, error -71 [ 890.754335][ T5740] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 890.826763][T13340] Bluetooth: hci0: command 0x0403 tx timeout [ 891.069264][ T11] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 891.197906][ T11] usb 5-1: device descriptor read/8, error -71 [ 891.205413][ T5740] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 891.216975][ T5740] usb 1-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 891.228128][ T5729] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 891.236088][ T5740] usb 1-1: config 0 interface 0 has no altsetting 0 [ 891.253809][ T5740] usb 1-1: New USB device found, idVendor=320f, idProduct=5041, bcdDevice= 0.00 [ 891.264264][ T5740] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 891.276527][ T5740] usb 1-1: config 0 descriptor?? [ 891.319280][ T11] usb usb5-port1: unable to enumerate USB device [ 891.504570][T15391] bridge0: port 3(syz_tun) entered disabled state [ 891.506911][ T5729] usb 3-1: Using ep0 maxpacket: 32 [ 891.511795][T15391] bridge0: entered allmulticast mode [ 891.533138][ T5729] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 891.545752][T15391] syz_tun: left allmulticast mode [ 891.554133][T15391] syz_tun: left promiscuous mode [ 891.554990][ T5729] usb 3-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 891.561430][T15391] bridge0: port 3(syz_tun) entered disabled state [ 891.579309][ T5729] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 891.600122][T15391] bridge_slave_1: left allmulticast mode [ 891.611953][T15391] bridge_slave_1: left promiscuous mode [ 891.625235][T15391] bridge0: port 2(bridge_slave_1) entered disabled state [ 891.649895][ T5729] usb 3-1: Product: syz [ 891.661848][T15391] bridge_slave_0: left allmulticast mode [ 891.676864][T15391] bridge_slave_0: left promiscuous mode [ 891.690528][ T5729] usb 3-1: Manufacturer: syz [ 891.690775][T15391] bridge0: port 1(bridge_slave_0) entered disabled state [ 891.707247][T13340] Bluetooth: hci1: command 0x0406 tx timeout [ 891.733230][ T5729] usb 3-1: SerialNumber: syz [ 891.752824][ T5729] usb 3-1: config 0 descriptor?? [ 891.770596][T15416] input: syz1 as /devices/virtual/input/input33 [ 891.770614][ T29] audit: type=1400 audit(1782935911.529:1895): avc: denied { setopt } for pid=15415 comm="syz.1.2610" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 891.807573][ T5729] cdc_ether 3-1:0.0: Descriptor too short [ 891.837558][ T5729] usb 3-1: unsupported MDLM descriptors [ 891.853186][ T5740] hid_parser_main: 34 callbacks suppressed [ 891.853205][ T5740] evision 0003:320F:5041.001D: unknown main item tag 0x0 [ 891.866864][ T5740] evision 0003:320F:5041.001D: unknown main item tag 0x0 [ 891.874350][ T5740] evision 0003:320F:5041.001D: unknown main item tag 0x0 [ 891.881398][ T5740] evision 0003:320F:5041.001D: unknown main item tag 0x0 [ 891.888443][ T5740] evision 0003:320F:5041.001D: unknown main item tag 0x0 [ 891.895477][ T5740] evision 0003:320F:5041.001D: unknown main item tag 0x0 [ 891.902515][ T5740] evision 0003:320F:5041.001D: unknown main item tag 0x0 [ 891.909551][ T5740] evision 0003:320F:5041.001D: unknown main item tag 0x0 [ 891.916580][ T5740] evision 0003:320F:5041.001D: unknown main item tag 0x0 [ 891.923609][ T5740] evision 0003:320F:5041.001D: unknown main item tag 0x0 [ 891.950079][ T5740] evision 0003:320F:5041.001D: hidraw0: USB HID v7f.fd Device [HID 320f:5041] on usb-dummy_hcd.0-1/input0 [ 892.011393][T15425] FAULT_INJECTION: forcing a failure. [ 892.011393][T15425] name failslab, interval 1, probability 0, space 0, times 0 [ 892.018966][T10820] usb 3-1: USB disconnect, device number 83 [ 892.041073][T15425] CPU: 1 UID: 0 PID: 15425 Comm: syz.1.2612 Tainted: G L syzkaller #0 PREEMPT(full) [ 892.041100][T15425] Tainted: [L]=SOFTLOCKUP [ 892.041109][T15425] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 892.041118][T15425] Call Trace: [ 892.041124][T15425] [ 892.041131][T15425] dump_stack_lvl+0x100/0x190 [ 892.041159][T15425] should_fail_ex.cold+0x5/0xa [ 892.041208][T15425] should_failslab+0xc2/0x120 [ 892.041233][T15425] __kvmalloc_node_noprof+0x116/0x970 [ 892.041257][T15425] ? bpf_test_run_xdp_live+0x13a/0x760 [ 892.041284][T15425] bpf_test_run_xdp_live+0x13a/0x760 [ 892.041307][T15425] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 892.041329][T15425] ? __mutex_unlock_slowpath+0x35d/0x930 [ 892.041360][T15425] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 892.041385][T15425] ? find_held_lock+0x2b/0x80 [ 892.041405][T15425] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 892.041428][T15425] ? bpf_dispatcher_change_prog+0x2d9/0xa50 [ 892.041465][T15425] ? 0xffffffffa0205480 [ 892.041482][T15425] ? 0xffffffffa0205480 [ 892.041497][T15425] ? 0xffffffffa0205480 [ 892.041510][T15425] ? bpf_dispatcher_change_prog+0x2de/0xa50 [ 892.041534][T15425] bpf_prog_test_run_xdp+0xd7d/0x1670 [ 892.041568][T15425] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 892.041599][T15425] ? fput+0x79/0x100 [ 892.041620][T15425] ? __bpf_prog_get+0x97/0x2a0 [ 892.041644][T15425] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 892.041668][T15425] __sys_bpf+0x2a12/0x4e80 [ 892.041693][T15425] ? __pfx___sys_bpf+0x10/0x10 [ 892.041711][T15425] ? find_held_lock+0x2b/0x80 [ 892.041727][T15425] ? get_pid_task+0xfc/0x250 [ 892.041742][T15425] ? get_pid_task+0xfc/0x250 [ 892.041764][T15425] ? find_held_lock+0x2b/0x80 [ 892.041785][T15425] ? rcu_read_lock_any_held+0x6a/0xa0 [ 892.041802][T15425] ? find_held_lock+0x2b/0x80 [ 892.041817][T15425] ? ksys_write+0x190/0x250 [ 892.041832][T15425] ? ksys_write+0x190/0x250 [ 892.041864][T15425] ? fput+0x79/0x100 [ 892.041889][T15425] ? __x64_sys_bpf+0xce/0x140 [ 892.041907][T15425] __x64_sys_bpf+0xce/0x140 [ 892.041926][T15425] ? do_syscall_64+0x90/0x870 [ 892.041951][T15425] do_syscall_64+0x115/0x870 [ 892.041975][T15425] ? clear_bhb_loop+0x40/0x90 [ 892.041996][T15425] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.042014][T15425] RIP: 0033:0x7f3a37b9de59 [ 892.042028][T15425] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 892.042044][T15425] RSP: 002b:00007f3a38a4c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 892.042061][T15425] RAX: ffffffffffffffda RBX: 00007f3a37e25fa0 RCX: 00007f3a37b9de59 [ 892.042073][T15425] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 892.042083][T15425] RBP: 00007f3a38a4c090 R08: 0000000000000000 R09: 0000000000000000 [ 892.042094][T15425] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 892.042105][T15425] R13: 00007f3a37e26038 R14: 00007f3a37e25fa0 R15: 00007fff4843bc48 [ 892.042128][T15425] [ 892.347933][T13340] Bluetooth: hci2: command 0x0406 tx timeout [ 892.353986][T13340] Bluetooth: hci3: command 0x0406 tx timeout [ 892.360024][T13340] Bluetooth: hci4: command 0x0406 tx timeout [ 892.946865][ T5616] Bluetooth: hci0: command 0x0403 tx timeout [ 893.876790][ T5616] Bluetooth: hci1: command 0x0406 tx timeout [ 894.427487][T13340] Bluetooth: hci2: command 0x0406 tx timeout [ 894.433628][ T5616] Bluetooth: hci3: command 0x0406 tx timeout [ 894.691125][T10820] usb 1-1: USB disconnect, device number 100 [ 895.636517][T15465] netlink: 'syz.0.2624': attribute type 3 has an invalid length. [ 895.644313][T15465] netlink: 'syz.0.2624': attribute type 3 has an invalid length. [ 895.652077][T15465] netlink: 'syz.0.2624': attribute type 3 has an invalid length. [ 895.659811][T15465] netlink: 'syz.0.2624': attribute type 3 has an invalid length. [ 895.667556][T15465] netlink: 'syz.0.2624': attribute type 3 has an invalid length. [ 895.675286][T15465] netlink: 'syz.0.2624': attribute type 3 has an invalid length. [ 895.683021][T15465] netlink: 'syz.0.2624': attribute type 3 has an invalid length. [ 895.690759][T15465] netlink: 'syz.0.2624': attribute type 3 has an invalid length. [ 895.698504][T15465] netlink: 'syz.0.2624': attribute type 3 has an invalid length. [ 895.706226][T15465] netlink: 'syz.0.2624': attribute type 3 has an invalid length. [ 895.893278][T15468] FAULT_INJECTION: forcing a failure. [ 895.893278][T15468] name failslab, interval 1, probability 0, space 0, times 0 [ 895.909137][ T5740] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 895.921628][T15468] CPU: 0 UID: 0 PID: 15468 Comm: syz.0.2625 Tainted: G L syzkaller #0 PREEMPT(full) [ 895.921658][T15468] Tainted: [L]=SOFTLOCKUP [ 895.921665][T15468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 895.921675][T15468] Call Trace: [ 895.921681][T15468] [ 895.921688][T15468] dump_stack_lvl+0x100/0x190 [ 895.921723][T15468] should_fail_ex.cold+0x5/0xa [ 895.921749][T15468] should_failslab+0xc2/0x120 [ 895.921773][T15468] __kmalloc_noprof+0xfc/0x820 [ 895.921794][T15468] ? video_usercopy+0x1a3/0x1730 [ 895.921818][T15468] video_usercopy+0x1a3/0x1730 [ 895.921839][T15468] ? __pfx___video_do_ioctl+0x10/0x10 [ 895.921858][T15468] ? irqentry_exit+0x24d/0xa00 [ 895.921883][T15468] ? __pfx_video_usercopy+0x10/0x10 [ 895.921913][T15468] ? __x64_sys_ioctl+0x123/0x210 [ 895.921942][T15468] v4l2_ioctl+0x1bd/0x250 [ 895.921962][T15468] ? __pfx_v4l2_ioctl+0x10/0x10 [ 895.921983][T15468] __x64_sys_ioctl+0x18e/0x210 [ 895.922010][T15468] do_syscall_64+0x115/0x870 [ 895.922033][T15468] ? clear_bhb_loop+0x40/0x90 [ 895.922055][T15468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 895.922074][T15468] RIP: 0033:0x7fa95299de59 [ 895.922090][T15468] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 895.922106][T15468] RSP: 002b:00007fa9537eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 895.922123][T15468] RAX: ffffffffffffffda RBX: 00007fa952c25fa0 RCX: 00007fa95299de59 [ 895.922134][T15468] RDX: 0000200000000380 RSI: 00000000c0d05605 RDI: 0000000000000003 [ 895.922146][T15468] RBP: 00007fa9537eb090 R08: 0000000000000000 R09: 0000000000000000 [ 895.922157][T15468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 895.922167][T15468] R13: 00007fa952c26038 R14: 00007fa952c25fa0 R15: 00007fff48df3f68 [ 895.922191][T15468] [ 896.319855][ T5740] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 896.331192][ T5740] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 896.341846][ T5740] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 896.351510][ T5740] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 896.385626][ T5740] usb 5-1: config 0 descriptor?? [ 897.716405][ T5740] usbhid 5-1:0.0: can't add hid device: -71 [ 897.722921][ T5740] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 897.735839][ T5740] usb 5-1: USB disconnect, device number 99 [ 898.181088][ T5729] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 899.119513][ T5729] usb 3-1: device descriptor read/64, error -71 [ 899.284573][T15490] FAULT_INJECTION: forcing a failure. [ 899.284573][T15490] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 899.326841][T15490] CPU: 1 UID: 0 PID: 15490 Comm: syz.0.2633 Tainted: G L syzkaller #0 PREEMPT(full) [ 899.326871][T15490] Tainted: [L]=SOFTLOCKUP [ 899.326878][T15490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 899.326889][T15490] Call Trace: [ 899.326896][T15490] [ 899.326903][T15490] dump_stack_lvl+0x100/0x190 [ 899.326933][T15490] should_fail_ex.cold+0x5/0xa [ 899.326958][T15490] _copy_from_user+0x2e/0xd0 [ 899.326983][T15490] copy_msghdr_from_user+0x9f/0x4c0 [ 899.327009][T15490] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 899.327046][T15490] ___sys_sendmsg+0x106/0x1e0 [ 899.327071][T15490] ? __pfx____sys_sendmsg+0x10/0x10 [ 899.327094][T15490] ? __lock_acquire+0x49f/0x1a40 [ 899.327117][T15490] ? get_pid_task+0x106/0x250 [ 899.327161][T15490] __sys_sendmsg+0x160/0x210 [ 899.327181][T15490] ? __pfx___sys_sendmsg+0x10/0x10 [ 899.327213][T15490] do_syscall_64+0x115/0x870 [ 899.327238][T15490] ? clear_bhb_loop+0x40/0x90 [ 899.327259][T15490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 899.327278][T15490] RIP: 0033:0x7fa95299de59 [ 899.327293][T15490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 899.327310][T15490] RSP: 002b:00007fa9537eb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 899.327328][T15490] RAX: ffffffffffffffda RBX: 00007fa952c25fa0 RCX: 00007fa95299de59 [ 899.327340][T15490] RDX: 0000000004000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 899.327351][T15490] RBP: 00007fa9537eb090 R08: 0000000000000000 R09: 0000000000000000 [ 899.327362][T15490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 899.327373][T15490] R13: 00007fa952c26038 R14: 00007fa952c25fa0 R15: 00007fff48df3f68 [ 899.327397][T15490] [ 900.270158][T15501] FAULT_INJECTION: forcing a failure. [ 900.270158][T15501] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 900.290268][T15502] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2635'. [ 900.310233][T15501] CPU: 1 UID: 0 PID: 15501 Comm: syz.4.2638 Tainted: G L syzkaller #0 PREEMPT(full) [ 900.310261][T15501] Tainted: [L]=SOFTLOCKUP [ 900.310268][T15501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 900.310278][T15501] Call Trace: [ 900.310284][T15501] [ 900.310291][T15501] dump_stack_lvl+0x100/0x190 [ 900.310319][T15501] should_fail_ex.cold+0x5/0xa [ 900.310344][T15501] _copy_to_user+0x32/0xd0 [ 900.310367][T15501] simple_read_from_buffer+0xcb/0x170 [ 900.310388][T15501] proc_fail_nth_read+0x1af/0x230 [ 900.310414][T15501] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 900.310440][T15501] ? rw_verify_area+0xce/0x6d0 [ 900.310464][T15501] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 900.310488][T15501] vfs_read+0x1e4/0xb40 [ 900.310516][T15501] ? __pfx_vfs_read+0x10/0x10 [ 900.310541][T15501] ? __fget_files+0x215/0x3d0 [ 900.310564][T15501] ? __fget_files+0x21f/0x3d0 [ 900.310589][T15501] ksys_read+0x12a/0x250 [ 900.310613][T15501] ? __pfx_ksys_read+0x10/0x10 [ 900.310645][T15501] do_syscall_64+0x115/0x870 [ 900.310669][T15501] ? clear_bhb_loop+0x40/0x90 [ 900.310690][T15501] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.310707][T15501] RIP: 0033:0x7f9fc8d5e68e [ 900.310722][T15501] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 900.310738][T15501] RSP: 002b:00007f9fc9ca2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 900.310755][T15501] RAX: ffffffffffffffda RBX: 00007f9fc9ca36c0 RCX: 00007f9fc8d5e68e [ 900.310766][T15501] RDX: 000000000000000f RSI: 00007f9fc9ca30a0 RDI: 0000000000000004 [ 900.310776][T15501] RBP: 00007f9fc9ca3090 R08: 0000000000000000 R09: 0000000000000000 [ 900.310787][T15501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 900.310797][T15501] R13: 00007f9fc9026038 R14: 00007f9fc9025fa0 R15: 00007ffc864d08c8 [ 900.310820][T15501] [ 900.593892][ T29] audit: type=1400 audit(1782935920.349:1896): avc: denied { execute } for pid=15506 comm="syz.2.2642" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=58173 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 900.642290][T15510] FAULT_INJECTION: forcing a failure. [ 900.642290][T15510] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 900.680963][T15510] CPU: 0 UID: 0 PID: 15510 Comm: syz.4.2643 Tainted: G L syzkaller #0 PREEMPT(full) [ 900.680996][T15510] Tainted: [L]=SOFTLOCKUP [ 900.681003][T15510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 900.681014][T15510] Call Trace: [ 900.681020][T15510] [ 900.681028][T15510] dump_stack_lvl+0x100/0x190 [ 900.681058][T15510] should_fail_ex.cold+0x5/0xa [ 900.681086][T15510] _copy_from_iter+0x1f4/0x1690 [ 900.681113][T15510] ? __asan_memset+0x23/0x50 [ 900.681133][T15510] ? __pfx__copy_from_iter+0x10/0x10 [ 900.681157][T15510] ? __pfx___alloc_skb+0x10/0x10 [ 900.681185][T15510] netlink_sendmsg+0x808/0xda0 [ 900.681216][T15510] ? __pfx_netlink_sendmsg+0x10/0x10 [ 900.681252][T15510] ____sys_sendmsg+0xa4d/0xbe0 [ 900.681275][T15510] ? __pfx_netlink_sendmsg+0x10/0x10 [ 900.681304][T15510] ? __pfx_____sys_sendmsg+0x10/0x10 [ 900.681339][T15510] ___sys_sendmsg+0x190/0x1e0 [ 900.681367][T15510] ? __pfx____sys_sendmsg+0x10/0x10 [ 900.681391][T15510] ? __lock_acquire+0x49f/0x1a40 [ 900.681414][T15510] ? get_pid_task+0x106/0x250 [ 900.681459][T15510] __sys_sendmsg+0x160/0x210 [ 900.681480][T15510] ? __pfx___sys_sendmsg+0x10/0x10 [ 900.681513][T15510] do_syscall_64+0x115/0x870 [ 900.681540][T15510] ? clear_bhb_loop+0x40/0x90 [ 900.681562][T15510] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.681582][T15510] RIP: 0033:0x7f9fc8d9de59 [ 900.681597][T15510] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 900.681614][T15510] RSP: 002b:00007f9fc9ca3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 900.681633][T15510] RAX: ffffffffffffffda RBX: 00007f9fc9025fa0 RCX: 00007f9fc8d9de59 [ 900.681645][T15510] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 900.681655][T15510] RBP: 00007f9fc9ca3090 R08: 0000000000000000 R09: 0000000000000000 [ 900.681672][T15510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 900.681682][T15510] R13: 00007f9fc9026038 R14: 00007f9fc9025fa0 R15: 00007ffc864d08c8 [ 900.681707][T15510] [ 900.902835][ T29] audit: type=1400 audit(1782935920.429:1897): avc: denied { listen } for pid=15506 comm="syz.2.2642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 901.117384][T15520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 901.225848][T15520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 901.617985][ T29] audit: type=1400 audit(1782935921.369:1898): avc: denied { accept } for pid=15506 comm="syz.2.2642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 901.745609][ T29] audit: type=1400 audit(1782935921.469:1899): avc: denied { remount } for pid=15527 comm="syz.4.2646" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 901.871141][ T5740] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 901.944520][T15532] IPv6: Can't replace route, no match found [ 901.957231][T15532] IPv6: Can't replace route, no match found [ 902.228498][ T5740] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 902.237380][ T5740] usb 4-1: config 1 has no interface number 0 [ 902.299608][ T5740] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1024 [ 902.310759][ T5740] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 32 [ 902.321831][T15528] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2646'. [ 902.324195][ T5740] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 902.343714][ T5740] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 902.360339][ T5740] usb 4-1: Product: syz [ 902.379301][ T5740] usb 4-1: Manufacturer: syz [ 902.386973][ T5740] usb 4-1: SerialNumber: syz [ 902.392879][T15528] ip6erspan0: entered allmulticast mode [ 902.403670][T15502] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 902.412189][T15502] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 902.424824][ T5740] usb 4-1: Error in usbnet_get_endpoints (-22) [ 902.537562][T15540] FAULT_INJECTION: forcing a failure. [ 902.537562][T15540] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 902.551344][T15540] CPU: 1 UID: 0 PID: 15540 Comm: syz.1.2649 Tainted: G L syzkaller #0 PREEMPT(full) [ 902.551371][T15540] Tainted: [L]=SOFTLOCKUP [ 902.551377][T15540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 902.551387][T15540] Call Trace: [ 902.551393][T15540] [ 902.551401][T15540] dump_stack_lvl+0x100/0x190 [ 902.551430][T15540] should_fail_ex.cold+0x5/0xa [ 902.551454][T15540] _copy_from_user+0x2e/0xd0 [ 902.551477][T15540] copy_msghdr_from_user+0x9f/0x4c0 [ 902.551503][T15540] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 902.551537][T15540] ___sys_sendmsg+0x106/0x1e0 [ 902.551561][T15540] ? __pfx____sys_sendmsg+0x10/0x10 [ 902.551582][T15540] ? __lock_acquire+0x49f/0x1a40 [ 902.551604][T15540] ? get_pid_task+0x106/0x250 [ 902.551645][T15540] __sys_sendmsg+0x160/0x210 [ 902.551664][T15540] ? __pfx___sys_sendmsg+0x10/0x10 [ 902.551695][T15540] do_syscall_64+0x115/0x870 [ 902.551719][T15540] ? clear_bhb_loop+0x40/0x90 [ 902.551740][T15540] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 902.551758][T15540] RIP: 0033:0x7f3a37b9de59 [ 902.551773][T15540] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 902.551789][T15540] RSP: 002b:00007f3a38a4c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 902.551806][T15540] RAX: ffffffffffffffda RBX: 00007f3a37e25fa0 RCX: 00007f3a37b9de59 [ 902.551818][T15540] RDX: 0000000004000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 902.551828][T15540] RBP: 00007f3a38a4c090 R08: 0000000000000000 R09: 0000000000000000 [ 902.551839][T15540] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 902.551849][T15540] R13: 00007f3a37e26038 R14: 00007f3a37e25fa0 R15: 00007fff4843bc48 [ 902.551872][T15540] [ 902.786825][ T5740] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 902.794850][ T5729] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 902.874886][ T29] audit: type=1400 audit(1782935922.629:1900): avc: denied { setopt } for pid=15543 comm="syz.1.2652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 902.963968][T15547] FAULT_INJECTION: forcing a failure. [ 902.963968][T15547] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 902.981043][ T5729] usb 1-1: Using ep0 maxpacket: 32 [ 902.989232][ T5729] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 902.999951][ T5740] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 903.013359][ T5729] usb 1-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 903.016810][T15547] CPU: 1 UID: 0 PID: 15547 Comm: syz.1.2653 Tainted: G L syzkaller #0 PREEMPT(full) [ 903.016836][T15547] Tainted: [L]=SOFTLOCKUP [ 903.016842][T15547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026 [ 903.016851][T15547] Call Trace: [ 903.016858][T15547] [ 903.016865][T15547] dump_stack_lvl+0x100/0x190 [ 903.016890][T15547] should_fail_ex.cold+0x5/0xa [ 903.016913][T15547] _copy_from_iter+0x1f4/0x1690 [ 903.016935][T15547] ? __asan_memset+0x23/0x50 [ 903.016953][T15547] ? __pfx__copy_from_iter+0x10/0x10 [ 903.016972][T15547] ? __pfx___alloc_skb+0x10/0x10 [ 903.016996][T15547] netlink_sendmsg+0x808/0xda0 [ 903.017023][T15547] ? __pfx_netlink_sendmsg+0x10/0x10 [ 903.017043][T15547] ? __might_fault+0x80/0x140 [ 903.017066][T15547] ____sys_sendmsg+0xa4d/0xbe0 [ 903.017085][T15547] ? __pfx_netlink_sendmsg+0x10/0x10 [ 903.017108][T15547] ? __pfx_____sys_sendmsg+0x10/0x10 [ 903.017138][T15547] ___sys_sendmsg+0x190/0x1e0 [ 903.017160][T15547] ? __pfx____sys_sendmsg+0x10/0x10 [ 903.017179][T15547] ? __lock_acquire+0x49f/0x1a40 [ 903.017199][T15547] ? get_pid_task+0x106/0x250 [ 903.017238][T15547] __sys_sendmsg+0x160/0x210 [ 903.017256][T15547] ? __pfx___sys_sendmsg+0x10/0x10 [ 903.017284][T15547] do_syscall_64+0x115/0x870 [ 903.017306][T15547] ? clear_bhb_loop+0x40/0x90 [ 903.017325][T15547] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 903.017341][T15547] RIP: 0033:0x7f3a37b9de59 [ 903.017355][T15547] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 903.017370][T15547] RSP: 002b:00007f3a38a4c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 903.017386][T15547] RAX: ffffffffffffffda RBX: 00007f3a37e25fa0 RCX: 00007f3a37b9de59 [ 903.017396][T15547] RDX: 0000000020004804 RSI: 00002000000002c0 RDI: 0000000000000006 [ 903.017406][T15547] RBP: 00007f3a38a4c090 R08: 0000000000000000 R09: 0000000000000000 [ 903.017416][T15547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 903.017425][T15547] R13: 00007f3a37e26038 R14: 00007f3a37e25fa0 R15: 00007fff4843bc48 [ 903.017447][T15547] [ 903.245061][ T5740] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 903.255445][ T5740] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 903.267043][ T5740] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 903.282754][ T5729] usb 1-1: config 0 interface 0 has no altsetting 0 [ 903.291815][ T5740] usb 5-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 903.301464][ T5740] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 903.310170][ T5740] usb 5-1: Product: syz [ 903.314523][ T5740] usb 5-1: Manufacturer: syz [ 903.319620][ T5740] usb 5-1: SerialNumber: syz [ 903.326070][ T5729] usb 1-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 903.337544][ T5729] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 903.350089][ T5740] usb 5-1: config 0 descriptor?? [ 903.355324][ T5729] usb 1-1: Product: syz [ 903.360450][ T5729] usb 1-1: Manufacturer: syz [ 903.373947][ T5729] usb 1-1: SerialNumber: syz [ 903.394480][ T5729] usb 1-1: config 0 descriptor?? [ 903.611456][ T5740] adutux 5-1:0.0: ADU208 4242424 now attached to /dev/usb/adutux0 [ 903.620339][ T5729] gs_usb 1-1:0.0: Couldn't send data format (err=-71) [ 903.629043][ T5729] gs_usb 1-1:0.0: probe with driver gs_usb failed with error -71 [ 903.671986][ T5729] usb 1-1: USB disconnect, device number 101 [ 904.045536][T10820] usb 4-1: USB disconnect, device number 63 [ 904.129642][ T46] usb 5-1: USB disconnect, device number 100 [ 904.172453][ T29] audit: type=1400 audit(1782935923.929:1901): avc: denied { setattr } for pid=15553 comm="syz.3.2655" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 904.401388][T15558] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 904.424000][T15558] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 904.523299][T15562] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(11) [ 904.529923][T15562] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 904.537945][T15562] vhci_hcd vhci_hcd.0: Device attached [ 905.017104][T15572] ip6erspan0: entered allmulticast mode [ 906.371630][T15573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 906.437686][T15573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 906.582784][ T46] usb 40-1: SetAddress Request (35) to port 0 [ 906.672037][T15563] vhci_hcd: connection closed [ 906.715773][ T9537] vhci_hcd vhci_hcd.3: stop threads [ 906.768645][ T9537] vhci_hcd vhci_hcd.3: release socket [ 906.775403][ T9537] vhci_hcd vhci_hcd.3: disconnect device [ 907.370036][ T46] usb 40-1: new SuperSpeed USB device number 35 using vhci_hcd [ 907.396774][ T46] usb 40-1: enqueue for inactive port 0 [ 907.546488][T15583] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 907.787644][ T46] usb usb40-port1: attempt power cycle [ 908.801180][ T46] usb usb40-port1: unable to enumerate USB device [ 909.831906][T15606] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(10) [ 909.838509][T15606] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 909.973371][T15615] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 910.008069][T15615] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 910.022450][T15606] vhci_hcd vhci_hcd.0: Device attached [ 910.121629][T15615] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2673'. [ 910.191965][T15615] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2673'. [ 910.286283][T15620] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(8) [ 910.292842][T15620] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 910.296778][ T46] usb 34-1: SetAddress Request (23) to port 0 [ 910.301677][T15615] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2673'. [ 910.317701][T15620] vhci_hcd vhci_hcd.0: Device attached [ 910.753701][ T5729] usb 40-1: SetAddress Request (39) to port 0 [ 910.919598][ T5729] usb 40-1: new SuperSpeed USB device number 39 using vhci_hcd [ 910.939441][T15615] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2673'. [ 910.979204][T15615] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2673'. [ 911.023956][T15609] vhci_hcd: connection closed [ 911.024580][ T8700] vhci_hcd vhci_hcd.0: stop threads [ 911.079438][T15621] vhci_hcd: connection reset by peer [ 911.087713][ T8700] vhci_hcd vhci_hcd.0: release socket [ 911.105425][ T8700] vhci_hcd vhci_hcd.0: disconnect device [ 911.124042][ T8700] vhci_hcd vhci_hcd.3: stop threads [ 911.137949][ T8700] vhci_hcd vhci_hcd.3: release socket [ 911.162310][ T8700] vhci_hcd vhci_hcd.3: disconnect device [ 911.698503][ T46] usb 34-1: new SuperSpeed USB device number 23 using vhci_hcd [ 911.716820][ T46] usb 34-1: enqueue for inactive port 0 [ 911.917862][ T29] audit: type=1400 audit(1782935931.669:1902): avc: denied { attach_queue } for pid=15626 comm="syz.3.2675" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 912.151632][ T46] usb usb34-port1: attempt power cycle [ 912.151745][ T5740] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 912.478089][T15641] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 912.484622][T15641] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 912.493428][T15641] vhci_hcd vhci_hcd.0: Device attached [ 912.524131][ T5740] usb 3-1: Using ep0 maxpacket: 32 [ 912.799662][ T11] usb 36-1: SetAddress Request (34) to port 0 [ 912.829346][ T5740] usb 3-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22 [ 912.893208][ T11] usb 36-1: new SuperSpeed USB device number 34 using vhci_hcd [ 912.923948][ T5740] usb 3-1: New USB device strings: Mfr=1, Product=32, SerialNumber=3 [ 912.983389][ T5740] usb 3-1: Product: syz [ 913.041919][ T5740] usb 3-1: Manufacturer: syz [ 913.114043][ T5740] usb 3-1: SerialNumber: syz [ 913.306562][ T5740] usb 3-1: config 0 descriptor?? [ 913.679405][ T46] usb usb34-port1: unable to enumerate USB device [ 913.695787][T15642] vhci_hcd: connection reset by peer [ 914.050924][ T14] vhci_hcd vhci_hcd.1: stop threads [ 914.057038][ T5740] usb 3-1: selecting invalid altsetting 3 [ 914.069320][ T14] vhci_hcd vhci_hcd.1: release socket [ 914.261435][ T5740] comedi comedi4: could not set alternate setting 3 in high speed [ 914.263781][ T14] vhci_hcd vhci_hcd.1: disconnect device [ 914.269962][ T5740] usbdux 3-1:0.0: driver 'usbdux' failed to auto-configure device. [ 914.392030][ T5740] usbdux 3-1:0.0: probe with driver usbdux failed with error -22 [ 914.430325][ T5740] usb 3-1: USB disconnect, device number 86 [ 916.106930][ T5729] usb 40-1: device descriptor read/8, error -110 [ 916.392926][T15665] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2687'. [ 916.558082][ T5729] usb usb40-port1: attempt power cycle [ 916.756632][T15665] IPv6: NLM_F_CREATE should be specified when creating new route [ 917.668621][ T5729] usb usb40-port1: unable to enumerate USB device [ 918.034635][ T11] usb 36-1: device descriptor read/8, error -110 [ 918.172814][T15675] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2690'. [ 918.497970][T15675] ip6gre1: entered promiscuous mode [ 918.702810][ T11] usb usb36-port1: attempt power cycle [ 918.719530][T15675] ip6gre1: entered allmulticast mode [ 918.929457][T15681] lo speed is unknown, defaulting to 1000 [ 919.218470][ T5740] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 919.367988][ T11] usb usb36-port1: unable to enumerate USB device [ 920.929612][ T5740] usb 5-1: unable to get BOS descriptor or descriptor too short [ 922.194131][T15693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 922.270332][T15693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 922.503095][T15681] lo speed is unknown, defaulting to 1000 [ 923.698031][ T11] usb 3-1: new full-speed USB device number 87 using dummy_hcd [ 923.860498][ T11] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x4F, changing to 0xF [ 923.942254][ T11] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 140, setting to 64 [ 924.200608][ T11] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 924.275079][ T11] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 924.297483][ T11] usb 3-1: Product: syz [ 924.301658][ T11] usb 3-1: Manufacturer: syz [ 924.407248][ T11] usb 3-1: SerialNumber: syz [ 924.442108][ T11] usb 3-1: config 0 descriptor?? [ 924.505195][T15700] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 924.896220][T15713] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2702'. [ 924.980977][T15700] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 925.090636][T15715] comedi comedi0: Minor 4 could not be opened [ 925.954230][ T5740] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 926.005716][ T5740] usb 5-1: can't read configurations, error -71 [ 926.047012][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 927.047219][T15721] netlink: 188 bytes leftover after parsing attributes in process `syz.1.2704'. [ 927.221183][T15721] netlink: 92 bytes leftover after parsing attributes in process `syz.1.2704'. [ 927.789068][ T46] usb 3-1: USB disconnect, device number 87 [ 927.980991][ T5740] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 928.792988][ T5740] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 928.841583][ T5740] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 929.144749][ T5740] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 929.263637][ T5740] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 929.665065][T13881] usb 2-1: USB disconnect, device number 12 [ 929.674239][ T5740] usb 5-1: config 0 descriptor?? [ 930.039825][T13340] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 930.052753][T13340] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 930.060519][T13340] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 930.068326][T13340] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 930.075770][T13340] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 930.141282][ T29] audit: type=1400 audit(1782935949.849:1903): avc: denied { mounton } for pid=15734 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 930.827531][ T29] audit: type=1400 audit(1782935950.539:1904): avc: denied { map } for pid=15741 comm="syz.2.2709" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 931.107030][ T5740] usbhid 5-1:0.0: can't add hid device: -71 [ 931.113044][ T5740] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 931.137344][ T5740] usb 5-1: USB disconnect, device number 103 [ 932.215544][ T5616] Bluetooth: hci5: command tx timeout [ 932.292475][ T5729] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 932.411815][T15734] lo speed is unknown, defaulting to 1000 [ 932.460291][ T5729] usb 5-1: Using ep0 maxpacket: 32 [ 932.544731][ T5729] usb 5-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22 [ 932.572464][ T5729] usb 5-1: New USB device strings: Mfr=1, Product=32, SerialNumber=3 [ 932.603761][ T5729] usb 5-1: Product: syz [ 932.621940][ T5729] usb 5-1: Manufacturer: syz [ 932.643499][ T5729] usb 5-1: SerialNumber: syz [ 932.709883][ T5729] usb 5-1: config 0 descriptor?? [ 932.971840][T15734] lo speed is unknown, defaulting to 1000 [ 933.077464][ T5729] usb 5-1: selecting invalid altsetting 3 [ 933.083932][ T5729] comedi comedi4: could not set alternate setting 3 in high speed [ 933.091737][ T5729] usbdux 5-1:0.0: driver 'usbdux' failed to auto-configure device. [ 933.137545][ T5729] usbdux 5-1:0.0: probe with driver usbdux failed with error -22 [ 933.192944][ T5740] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 933.460167][ T46] usb 5-1: USB disconnect, device number 104 [ 933.468730][ T5740] usb 3-1: Using ep0 maxpacket: 32 [ 933.768791][ T5740] usb 3-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22 [ 933.780426][ T5740] usb 3-1: New USB device strings: Mfr=1, Product=32, SerialNumber=3 [ 933.802240][ T5740] usb 3-1: Product: syz [ 933.806409][ T5740] usb 3-1: Manufacturer: syz [ 933.811009][ T5740] usb 3-1: SerialNumber: syz [ 933.838333][ T5740] usb 3-1: config 0 descriptor?? [ 934.037467][ T5740] usb 3-1: selecting invalid altsetting 3 [ 934.064826][ T5740] comedi comedi4: could not set alternate setting 3 in high speed [ 934.491512][ T5740] usbdux 3-1:0.0: driver 'usbdux' failed to auto-configure device. [ 934.507931][ T5740] usbdux 3-1:0.0: probe with driver usbdux failed with error -22 [ 934.546945][ T5616] Bluetooth: hci5: command tx timeout [ 934.591233][ T5740] usb 3-1: USB disconnect, device number 88 [ 934.695061][T15734] bridge0: port 1(bridge_slave_0) entered blocking state [ 934.731547][T15734] bridge0: port 1(bridge_slave_0) entered disabled state [ 934.740775][T15734] bridge_slave_0: entered allmulticast mode [ 934.851745][T15734] bridge_slave_0: entered promiscuous mode [ 934.869337][T15734] bridge0: port 2(bridge_slave_1) entered blocking state [ 934.877303][T15734] bridge0: port 2(bridge_slave_1) entered disabled state [ 934.885026][T15734] bridge_slave_1: entered allmulticast mode [ 934.920886][T15734] bridge_slave_1: entered promiscuous mode [ 934.951856][T15734] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 934.979757][T15734] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 935.014842][T15734] team0: Port device team_slave_0 added [ 935.024683][T15734] team0: Port device team_slave_1 added [ 937.299736][ T5616] Bluetooth: hci5: command tx timeout [ 939.794877][ C1] sched: DL replenish lagged too much [ 941.690292][ T5616] Bluetooth: hci5: command tx timeout [ 988.644173][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 1048.946689][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 1079.611181][T15799] Bluetooth: hci5: command tx timeout [ 1095.908732][ T30] INFO: task kworker/u8:14:9537 blocked for more than 153 seconds. [ 1095.922731][ T30] Tainted: G L syzkaller #0 [ 1096.646563][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1099.154431][ T30] task:kworker/u8:14 state:D stack:23480 pid:9537 tgid:9537 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1099.688490][ T30] Workqueue: events_unbound linkwatch_event [ 1099.908227][ T30] Call Trace: [ 1099.911551][ T30] [ 1099.914489][ T30] __schedule+0x125c/0x6730 [ 1100.046522][ T30] ? do_raw_spin_lock+0x128/0x260 [ 1100.051609][ T30] ? __pfx___schedule+0x10/0x10 [ 1100.056468][ T30] ? find_held_lock+0x2b/0x80 [ 1100.061144][ T30] ? schedule+0x225/0x2c0 [ 1100.065485][ T30] schedule+0xdd/0x2c0 [ 1100.069557][ T30] schedule_preempt_disabled+0x13/0x30 [ 1100.075041][ T30] __mutex_lock+0xccc/0x1bd0 [ 1100.079638][ T30] ? linkwatch_event+0x51/0xc0 [ 1100.084402][ T30] ? register_lock_class+0x40/0x560 [ 1100.089606][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 1100.094637][ T30] ? __lock_acquire+0x49f/0x1a40 [ 1100.099598][ T30] ? linkwatch_event+0x51/0xc0 [ 1100.104361][ T30] ? rtnl_lock+0x9/0x20 [ 1100.108521][ T30] linkwatch_event+0x51/0xc0