last executing test programs: 13.382016413s ago: executing program 3 (id=2591): r0 = syz_usb_connect(0x3, 0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000200000040ca08100100010102030109023e0001010080fa0904000002ff00000007058302000200070504020002"], 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) 10.823975125s ago: executing program 0 (id=2599): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x6, 0x1c, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900000000000035090100ffffffd09500000000000000b509020002000000739a00fe00000000b509000004000000c39a04fef1000000bf8700000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32, @ANYBLOB="0000000002010000b705000008"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x44, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="400000004100070127bd04000000ffff047c000008004280040008000c00018006000600800a0000180007"], 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) 10.687010197s ago: executing program 0 (id=2600): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, &(0x7f0000000000), 0x4) listen(0xffffffffffffffff, 0x1) (async) listen(0xffffffffffffffff, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="b405000034d90f00711633000000000006000000000000009500008c000000008c20f93b4668a61da2175078787476c67504be0fe53181e193ef31552a5feb213c5740086e529fb6c4974482a81f9d27dbca45af30108f5acac0579460d633b54c647305b07ff48d59ee7018dcf1207b0f100bdd6521c2834744b10141aaa40a03ae59a2b18900e6928fd09fc19b6ead5210613a8f33a6adffdfe66024be6870a4f3fa69f5e9d1f52d"], &(0x7f0000000380)='GPL\x00', 0x5, 0x3, &(0x7f00000003c0)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000004c0), 0xfffffffffffffd56, 0x10, &(0x7f0000000500), 0x1dd}, 0x48) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={0x90, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x3}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast2}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x86}}]}, @CTA_EXPECT_MASTER={0xc, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) (async) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={0x90, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x3}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast2}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x86}}]}, @CTA_EXPECT_MASTER={0xc, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f00000001c0)=ANY=[@ANYRES16=r0, @ANYRES8, @ANYRESOCT=r0, @ANYRES16=0x0], 0x0) 10.132591876s ago: executing program 3 (id=2601): socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c000200080001", @ANYRES16=r1], 0x3c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) write$FUSE_LK(0xffffffffffffffff, &(0x7f0000002c40)={0x28, 0x0, 0x0, {{0x8, 0x200, 0x2}}}, 0x28) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x400880f4) 9.810884782s ago: executing program 3 (id=2602): socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) rseq(&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) unshare(0x2040400) r0 = socket$kcm(0x2, 0x5, 0x84) accept4(r0, 0x0, 0x0, 0x180000) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) unshare(0x4000400) add_key$keyring(&(0x7f0000000180), 0x0, 0x0, 0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'vcan0\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) timer_create(0x3, &(0x7f0000000140)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000200)) timer_create(0x3, &(0x7f0000000240)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000280)=0x0) add_key(&(0x7f0000000480)='asymmetric\x00', 0x0, &(0x7f0000000540)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d040302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c2f43657274696669636174652076657269666963617428a2e0861e1ae90d412073656c662d6e657374696e67206b65793059301306072a8648ce3d02011e082a8648ce3d0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e141604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d3e0418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d3300c0603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xfffffffffffffffd) timer_settime(r3, 0x1, &(0x7f00000002c0)={{0x77359400}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000300)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'geneve0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="440000001000ffff26bd7000f9dbdf0800000000", @ANYRES32=0x0, @ANYBLOB="1d950300bcb7040008000a00", @ANYRES32, @ANYBLOB="140012800b0001006970766c616e00000400028008000500", @ANYRES32=r4], 0x44}, 0x1, 0x0, 0x0, 0x24004854}, 0x8000002) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000006a00010021bd7000fbdbdf250a00000000001f00080001"], 0x20}, 0x1, 0xba01, 0x0, 0x400c002}, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) connect$inet(r1, &(0x7f0000000940)={0x2, 0x0, @multicast1}, 0x10) 8.932174045s ago: executing program 3 (id=2605): r0 = syz_usb_connect(0x3, 0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000200000040ca08100100010102030109023e00010100"], 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_write(r0, 0x83, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000840)={0xc, &(0x7f00000003c0)={0x40, 0xc, 0x2f, {0x2f, 0xa, "51d170b8d16d35c9d3dcf6bb5acbc171646f5d80f6b02da147f7d2eaed66d10fbd613b61db24da7e0479d28624"}}, &(0x7f0000000400)={0x0, 0x3, 0xad, @string={0xad, 0x3, "89624975c33c8d686bf0c833fb8d86f33221a28069eb40dca07ae3e070f14e318ed9919628bba6c3c4712b10b56f4418ef50cacdf13e7a40b5abb924de30a6bfa1d52ddd9c393c7c643e493916e0ba471db5f5fee0521fc1debfe0d75973bbb141e743190e1ea740bbaaa3f4890ed234678f5409ff0d601e95ff2f64101f96af9ff9a951468eed9f786cf0daed1b82a9194f0724aa8a3e0b6aa349f9e924af10747f33a321bf66812a780c"}}}, &(0x7f0000000b40)={0x24, &(0x7f0000000c00)={0x20, 0x15, 0xdc, "efb0f27cfa286d7035fc84545aaebbaad4e6e3c62c2a33e323e26fc42fca7066c5307dc991396f88ec4ba84d4b5df271ba1921dd36cce1f96a27013d2de972f8dc86a7742209ac2fa50a22152943c040388d551a75b80e95e0eee6f572aecf566dd7854dea4425c1e29a3977b920bf4a15f737b47eb05ddb7840a6f7824ef69c2274eb9533f36f227b35e895ecdadbb4c50a96e737668222bba06cecb94aaf5ecad9bf34870b5e1a662d4ea674194848b8ec11b2aafee4fc2bd0355e3037fab191d675b98cda5e000df59b3ea865f9890be8f9d2ca2f113e04cef0c8"}, &(0x7f0000000980)={0x0, 0xa, 0x1, 0x12}, &(0x7f00000009c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000a00)={0x20, 0x81, 0x2, ' i'}, &(0x7f0000000a40)=ANY=[@ANYBLOB="0b43000100045a"], &(0x7f0000000a80)={0x20, 0x83, 0x2, "e9f2"}, &(0x7f0000000ac0)={0x20, 0x84, 0x1, '!'}, &(0x7f0000000b00)={0x20, 0x85, 0x3, "993255"}}) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) r1 = syz_open_dev$video(&(0x7f0000000240), 0x0, 0x0) ioctl$VIDIOC_S_SELECTION(r1, 0xc0405668, &(0x7f0000000280)={0x4, 0x0, 0xe, {0x0, 0x0, 0x8001, 0x4}}) 7.463895056s ago: executing program 0 (id=2606): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000e40)={0x18, &(0x7f0000000c40)={0x20, 0x29, 0x3, "6719e2"}, 0x0, &(0x7f0000000d00)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000d40)={0x20, 0x1, 0xb8, "312cf444463eb5b864a82ec47c951364455ca79cd499d9b3a9badb9e60a9297028b3f9f8be35910a96bc354a2d275b149d5ce8cf3bd9012de0354337a99aa698bd4ae197dd76029f7e7e31446e069ba5f812f1dd228ffe946480a34645a262728c23ed68d2443d2d5a11f7ccd636a5290f24c4bb9288d7405242aaddc219fec827db004f013a3af27b0be2ba752a2276e8e9b633a1af69a6613bfc8f977a99a3b913e42480dd7d03261a38dd962e1e63c526604350572f77"}, &(0x7f0000000e00)={0x20, 0x3, 0x1, 0xf7}}) 6.858020918s ago: executing program 1 (id=2607): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) userfaultfd(0x800) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0xfffffffe, @loopback, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000140), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000180)=@ccm_128={{0x303, 0x39}, "4526000000927650", '\x00', "c406b192"}, 0x28) r2 = openat$uhid(0xffffff9c, &(0x7f0000000500), 0x802, 0x0) write$UHID_INPUT2(r2, &(0x7f00000005c0)=ANY=[@ANYBLOB="0c0000007d8358dffa0ac404da28356700d06d68298a8371134a510484a52ab38499388f4df6104d6dcff659ee9046fe64be18b03ba95aa935ea8aeca8cbe80b65339c87bebda53270702d254becb33fa71f5b7d9a4b88d965f664fbd71e01ab98ffd065ae95cdfe444c7f90c6dffb6530332df8e462d52c"], 0x6d) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000200)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000280)={r5, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000340)=0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000380)=@assoc_value, &(0x7f00000003c0)=0x8) r6 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r6, &(0x7f0000000400)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x0, 0x0, 0x0) r7 = syz_usb_connect(0x3, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r7, 0x83, 0x8, &(0x7f00000004c0)=ANY=[@ANYBLOB="bc"]) setsockopt$inet6_int(r0, 0x29, 0x33, &(0x7f00000000c0)=0x8253, 0x4) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000040)=0xf2b, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000001500)=""/19, &(0x7f0000000080)=0x13) 5.611895032s ago: executing program 3 (id=2610): r0 = syz_usb_connect(0x3, 0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000200000040ca08100100010102030109023e0001010080fa0904000002ff00000007058302000200070504020002"], 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) 5.510075314s ago: executing program 0 (id=2611): bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x6, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x29, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000b80)={0x0, 0x0, "d607f8f9951e76c13f64323723e7eecdf40c363423eb3d259266ec9c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468a957ff3e24852548deb01efd54f11ed2c41d078b9cf1fc8f72566153c97e4af37017ea6b16b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2233f9d5c3b90400000000000000c279f03558083906666827d61dcc3a633bffff250b5a293e3877adc1660edbc9a0307a25720a170e7f5670e419dc44febf7ddc73fd4a5a0b6c28665f7f46c7084e17c809268103a2584ab40a68e528329d97afc3612e325c1eb4a3ab2e156a97444800", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3800bda0178e898540debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c877364776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b2ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ad0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd1d347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dcf1f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c30000d6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1034581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"}) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000001b80)=ANY=[]) ioctl$XFS_IOC_GETBMAPX(r0, 0xc0205838, &(0x7f0000001bc0)={0x6, 0xd, 0x8, 0xaf8a, 0x2, 0x10}) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001c00), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000001c40)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000001c80), 0x111, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001cc0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r4 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000001dc0)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r6 = accept4(r5, 0x0, 0x0, 0x80800) sendmmsg$alg(r6, &(0x7f0000001e40)=[{0x0, 0x0, &(0x7f0000001e80)=[{&(0x7f0000001ec0)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f0000001f40)="66f7", 0x4}, {&(0x7f0000001f80)='l3', 0x7fffef80}], 0x3}], 0x1, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000001fc0)={0xffffffffffffffff, 0xffffffffffffffff, 0x35, 0x0, @val=@netkit}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000002000)={0x1, 0x8, &(0x7f00000020c0)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}}]}, &(0x7f0000002100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000002140)=ANY=[@ANYBLOB="12010000bde5a44070275290f515010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r7, 0x0, 0x0) syz_usb_control_io$lan78xx(r7, 0x0, &(0x7f0000002180)={0x34, &(0x7f00000021c0)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) connect$pppoe(r0, &(0x7f0000002200)={0x18, 0x0, {0x1, @empty, 'ip6tnl0\x00'}}, 0x1e) ioctl$PPPIOCSMRU(r0, 0x40047452, &(0x7f0000002240)=0x9a) syz_emit_ethernet(0x6a, &(0x7f0000000000)={@multicast, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x4002, 0x5, 0x11, 0x0, @empty, @empty}, {0x4e24, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "96597d00c5c0577eec4f99e3a24dd89fb66655d7b05291cb", "af6af5116bf52dbb91d30ae25aab828a961858f6c338a29f34c53e0526788e16"}}}}}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0xffd9}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 4.922523303s ago: executing program 1 (id=2613): r0 = syz_open_dev$video(&(0x7f0000000040), 0x1, 0x2) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file1\x00', 0x800010, &(0x7f0000000100)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1c00}}]}}, 0x0, 0x0, 0x0) ioctl$VIDIOC_TRY_DECODER_CMD(r0, 0xc0485661, &(0x7f0000000200)={0x0, 0xd3281dc5fd302c39, @stop_pts=0xc}) 4.712341563s ago: executing program 4 (id=2615): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x801, 0x0) pwrite64(r0, 0x0, 0x0, 0x7ff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x2c, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_CQM={0x10, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x4}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0xb}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc010}, 0x0) 4.652092565s ago: executing program 1 (id=2616): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = io_uring_setup(0x56d0, &(0x7f00000004c0)={0x0, 0xbc2e, 0x4, 0x20000003, 0x2001c8}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r4, 0xb, &(0x7f00000005c0), 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x700, 0x0) setsockopt$sock_timeval(r3, 0x1, 0x14, &(0x7f0000000200)={0x0, 0xea60}, 0x10) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20049008}, 0xc4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_clone(0x100011, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r6, &(0x7f0000000280), 0x0, &(0x7f00000002c0)) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r9, 0xc040aed5, &(0x7f00000003c0)={0xf000, 0x118000}) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) openat$sysfs(0xffffff9c, &(0x7f0000000480)='/sys/kernel/softlockup_count', 0x103840, 0x2) ioctl$int_in(r3, 0x5452, &(0x7f0000000540)=0x4) recvmmsg(r3, &(0x7f0000000580), 0x0, 0x4001a061, 0x0) r10 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r10) connect$unix(r2, &(0x7f0000000140)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 4.571935517s ago: executing program 4 (id=2617): r0 = syz_usb_connect(0x6, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000b1bd2f087d0403508c2f010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0xc, &(0x7f00000000c0)=ANY=[], 0x0}, 0x0) mmap(&(0x7f00005c1000/0x3000)=nil, 0x3000, 0x300000f, 0x8010, 0xffffffffffffffff, 0x0) syz_clone(0x2db00000, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f00000002c0)={0x0, {{0xa, 0x4e1f, 0x7, @mcast1, 0xabdf}}, 0x1}, 0x90) r2 = syz_ublk_setup_io_uring(0x329b, &(0x7f00000000c0)={0x0, 0x635a, 0x8000, 0x1, 0x2e1}, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) r3 = openat$apparmor_task_current(0xffffff9c, &(0x7f0000000200), 0x2, 0x0) r4 = openat$qrtrtun(0xffffff9c, &(0x7f0000000240), 0x111800) r5 = socket$inet6_udp(0xa, 0x2, 0x0) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000000280)=[r3, 0xffffffffffffffff, r4, r5], 0x4) 3.885769235s ago: executing program 4 (id=2619): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f0000000ec0), r2) getsockname$packet(r2, &(0x7f0000000f00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000f40)=0x14) sendmsg$nl_route(r1, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000001000)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYBLOB], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000010c0)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x8d0) sendmsg$nl_route_sched(r1, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001180)={0x0}}, 0x8000) 3.792811143s ago: executing program 4 (id=2620): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000040)={0x11080, 0x0, 0x0, 0x9}) 3.758492699s ago: executing program 4 (id=2621): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000000000200304306000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000200)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00140d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e23, 0x20006, @empty, 0x6}}, 0x7f, 0x2, 0x0, 0x5, 0x392, 0x94}, 0x9c) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000540), 0x800000, 0x0) ioctl$TCSBRKP(r2, 0x5425, 0x0) r3 = syz_io_uring_setup(0xf00, &(0x7f0000000580)={0x0, 0x7842, 0x10000, 0x20, 0x40055}, &(0x7f0000000900), &(0x7f0000000fc0), &(0x7f0000001000)) r4 = socket$inet(0x2, 0x3, 0x5) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f00000010c0)={'gre0\x00', &(0x7f0000001100)={'syztnl2\x00', 0x0, 0x2100, 0x0, 0xfffffffd, 0xfffffffc, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x68, 0x0, 0x3, 0x2f, 0x0, @multicast2, @rand_addr=0x64010101}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000001140)={'syztnl2\x00', &(0x7f0000001180)={'gre0\x00', r5, 0x10, 0x0, 0xb0, 0x4, {{0x5, 0x4, 0x2, 0x6, 0x14, 0x85f, 0x0, 0xfa, 0x2f, 0x0, @empty, @rand_addr=0x64010102}}}}) io_uring_enter(r3, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000000), &(0x7f0000000500)=0xe) syz_usb_control_io$sierra_net(0xffffffffffffffff, &(0x7f0000000a40)={0xc, &(0x7f0000000800)={0x20, 0x4, 0x1d, {0x1d, 0x9, "aebb9fb39171d0c40225df962d6befbd1774bdfe5639a295ef8c07"}}, &(0x7f00000009c0)={0x0, 0x3, 0x4d, @string={0x4d, 0x3, "46bc47ceee87f104d2ad598ac618a6c9553425bc20488a322ece1b06772a1d324b108aec718925ae7c838feca0f0d62381e9c400870a9174288f2efb1a92c036278462aaf32bfd59e72ec8"}}}, &(0x7f0000000f80)={0x10, &(0x7f0000000a80)={0x40, 0x16, 0x60, "7974c37c44a635cd1cea356a12c35e2627ae30d3a1a4d69abd72b1deb95f586cb5e70adfb64828c9468d72fda352dda789c3f0eab538cd5bf9d217514c294b1d2f059876fec9dc84083e343c68eebe35e94305b4a78d2ed402d366f075555d5c"}, &(0x7f0000000b00)={0xa1, 0x1, 0x400, "a14db6605ffac5bf7bcb4a76198b2a95935ee4d4634c5258d8f0ea1af8cec69af60aa4c96a3d0359fa383cf763b357e3ec21fb977674d58816a0eb31a891205323da40b00cf3d121a316f8dc7d9311531e0c732e0a897eba53aba6a39b9fbf5a765def173aff2087bf98cdeae32970ae2008934c658d762049d9ba5bcc86f5bf1b54d250ea8754d6d6c2503ac763db4b8f453ebed7e34628c65b2036074ed41cb305443b8d966325960da9c30754dd88859fff94c8271c5ac97d1cc98a25cd31fe57040157263a6740b81158f2917786b5ec216875b7c031b3b0b7ea1d9fe0870c145213409127e325861b2d0412c6c6a6d1ba0581c76965f1b7a018599655f860b16fff9e220debed905443986cd35c8b0a89df27b49a65005cba36a28bff9e6d6489dace937775f58aa24caa674650023f23ccbdccdfb8fb5153ceb5c340386aa131b8bbbd59cd0c3411136b3055ed41439f514bbb899d687ee4079f4e47a8a50493f98c98449d7d1bb087995313708010b537bf819990ce5391bdc4d3f261c000934207044107911a9ebd80ac1c222a0a11eac4a786aa0f78573fc7cf4edde8c0f7847a1eb135b0b85ff2e360d89b3459ce996fb353836d213fd891225a55b3a3d14aa553148de4ef2b994d19116e21d47b85ea1c26c271d22d39e8218d9219762348ecd861b35cb0099e18e641e3c0965edb73ea3ffc2599a095a2c78e0a6cdc9fd6f0b7317b294fddc8c78969f69c374c2d725001c74a45fd092ba24c89a4b3d4d06c99b13db7dd0444f99275b4d73bc083ade6e4c39f41a8d25243de4519dfc32b0af10847a6ba873c12bb77e8c59875338c21aecf226a90e6b1554ff63bf8a4fe4b117a0568b3f4fd92c9e3da068ad9f646def01c8e6835a8565fed097b25da2075c3db93c90b4bf4701cb7df83bb970ab7dd8c57a77d4c464ea1ff40fc6bbb1ede96c829c10855d5d3d9226ce95cef010ef9d805e1575cfb92a3bb4ff824700999903b121c3b0b220102d17a5e46f036d81b735d679e4af81f42d92dc2f424660d3ff2fd84c20df59cc46c1dd85734fa2c3300280f7de710eced02f4e805d1ec72d610d60acf5ca7e97f5014a96c7067fd0c12fbf8461967ed95bb684ea038a353adb742805c9eef9ba2290276c61b49872dca64ee6ec721e3da1a82c82a4f0015d4c9094aba6eace5180a8516d3e445f37357f9ff47d3e0d267b3d89a35981356990c9b5f77ad285384b2da01c4d7cbb3e6767a6123e996899168513f8f65a889bd54e6a731b5e0109cafef489ef198ec557bd6e51cd901b8b1542180b47452c810aa998bb990b776a38e41849cbd06d9673331a7a50ff4231b81c8717d567b995297562091def54ea5133b60ae5c308b32200a66adf8d0f6f463917af288f83b19220577055bcaa43c640437d4dee90d93e90276db01d5c4eba155"}, &(0x7f0000000f40)={0x21, 0x0, 0x2, "18de"}}) shutdown(r1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000180)=[@in={0x2, 0x4e20, @loopback}]}, &(0x7f00000001c0)=0xc) socket$nl_xfrm(0x10, 0x3, 0x6) 3.734587542s ago: executing program 0 (id=2622): r0 = syz_usb_connect(0x3, 0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000200000040ca08100100010102030109023e0001010080fa0904000002ff00000007"], 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_write(r0, 0x83, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000840)={0xc, &(0x7f00000003c0)={0x40, 0xc, 0x2f, {0x2f, 0xa, "51d170b8d16d35c9d3dcf6bb5acbc171646f5d80f6b02da147f7d2eaed66d10fbd613b61db24da7e0479d28624"}}, &(0x7f0000000400)={0x0, 0x3, 0xad, @string={0xad, 0x3, "89624975c33c8d686bf0c833fb8d86f33221a28069eb40dca07ae3e070f14e318ed9919628bba6c3c4712b10b56f4418ef50cacdf13e7a40b5abb924de30a6bfa1d52ddd9c393c7c643e493916e0ba471db5f5fee0521fc1debfe0d75973bbb141e743190e1ea740bbaaa3f4890ed234678f5409ff0d601e95ff2f64101f96af9ff9a951468eed9f786cf0daed1b82a9194f0724aa8a3e0b6aa349f9e924af10747f33a321bf66812a780c"}}}, &(0x7f0000000b40)={0x24, &(0x7f0000000c00)={0x20, 0x15, 0xdc, "efb0f27cfa286d7035fc84545aaebbaad4e6e3c62c2a33e323e26fc42fca7066c5307dc991396f88ec4ba84d4b5df271ba1921dd36cce1f96a27013d2de972f8dc86a7742209ac2fa50a22152943c040388d551a75b80e95e0eee6f572aecf566dd7854dea4425c1e29a3977b920bf4a15f737b47eb05ddb7840a6f7824ef69c2274eb9533f36f227b35e895ecdadbb4c50a96e737668222bba06cecb94aaf5ecad9bf34870b5e1a662d4ea674194848b8ec11b2aafee4fc2bd0355e3037fab191d675b98cda5e000df59b3ea865f9890be8f9d2ca2f113e04cef0c8"}, &(0x7f0000000980)={0x0, 0xa, 0x1, 0x12}, &(0x7f00000009c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000a00)={0x20, 0x81, 0x2, ' i'}, &(0x7f0000000a40)=ANY=[@ANYBLOB="0b43000100045a"], &(0x7f0000000a80)={0x20, 0x83, 0x2, "e9f2"}, &(0x7f0000000ac0)={0x20, 0x84, 0x1, '!'}, &(0x7f0000000b00)={0x20, 0x85, 0x3, "993255"}}) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) r1 = syz_open_dev$video(&(0x7f0000000240), 0x0, 0x0) ioctl$VIDIOC_S_SELECTION(r1, 0xc0405668, &(0x7f0000000280)={0x4, 0x0, 0xe, {0x0, 0x0, 0x8001, 0x4}}) 3.619187231s ago: executing program 1 (id=2624): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0x3fe3aa0262d8c583, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x2, 0x0, 0xa, 0x0, 0x101}, 0x1, 0x1, 0x80000001, 0x6, 0x2, 0x20, 0xa, 0x0, 0x5, 0x7f, {0x1c609, 0x5, 0x80, 0x5, 0x6, 0xf}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40092}, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x28, 0x0, 0xfd, 0x1}, {0x16}]}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x80, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000240)="e8", 0x6200, 0x0, 0x0, 0x0) r2 = socket(0x2, 0x2, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000280)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x278, 0x24, 0x3fe3aa0262d8c583, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x10, 0xe}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x248, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x3, 0x8, 0x401, 0x14, 0xd, 0x1e, 0x2}}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x9, 0x7ff, 0xffffffff, 0x0, 0x12, 0x13, 0x3}}, @TCA_CHOKE_STAB={0xffffffffffffff42, 0x2, "e142c61a9a6edb3e4c4c7c8e6a6a6d41fa18ca52b7bd1c5a492079cfa14370b42e7535781605c3cee64f1742535d8b0f365e7e130f5da0100e8b47b76b3f90fe1db14735d8a52091166847bc313e07f91ed483fd56f84dea60a1bec6ac13f5133191a3bab77393bc6f77eddd114deea9e825bb4b77663a39b16507330dcfe2adbdfd06f8b3f92995734e3891c3c0f01dc500c47eefb9a2b9654ddfbcba00338fb44bad09a64f788332a96f3ced58d7bcc989b64023f308bdc8528b22aa1905d398f0dfbb135064e75014494b2a35d383349796ecff43d13ffadbd61606a074b40013b09a217f2fbeb89971cc8b5f76f4a5993748fe80fd9d7243d9ca9e797516"}, @TCA_CHOKE_STAB={0x104, 0x2, "fa57567348ab9bf1a32aeb330300004d95237ac4eb54d2275d3ad59b73554c81346fbe5f4c688001ef75078e3ccbffe2eb64746d3d767138b7578019ea487a25bd4d0e96338ebeebe4f8e8e0c9eec2b2d99f119bf92a4390dffdfc77372cdf95a3ad844382bc8d4fc896a84f91e8beb943fea3000d5f8a4d916fa5e8169f98cc3599456c322c81c48dafca6075a17b16881cf29e8337132aebc04cc66ebe9b95ff90a2d96111fc6479267d870168e8669f2099ef3d99d6464618a35b001d08cbac96a7524389021cddc6f35c96adb7cf1f033baec3f3438719ca0590fef07d98c338cd5f468e69deb7ac4d72a394a0a79686581a612b5fe489c5a18074237607"}, @TCA_CHOKE_PARMS={0x14, 0x1, {0xfffffffd, 0x2, 0xedb8, 0x6, 0xd, 0x18}}]}}]}, 0x278}, 0x1, 0x0, 0x0, 0x4}, 0x4048000) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000180)={0x0, 'syz_tun\x00'}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8804) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000001cc0)={0x0, 0x0, &(0x7f0000001d00)={&(0x7f0000001d40)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14080, 0x42510}, [@IFLA_OPERSTATE={0x5, 0x10, 0x5}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000040}, 0x20040001) 3.556980988s ago: executing program 1 (id=2625): syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff00070581020002000705020200020007058303"], 0x0) r0 = syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) sched_setattr(r0, &(0x7f0000000080)={0x38, 0x5, 0x4, 0x1, 0x0, 0xffff, 0x8, 0xfffffffffffffffe, 0xfffffffc}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_io_uring_setup(0x111, 0x0, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) r1 = syz_open_dev$vim2m(0x0, 0x8000000000007ffb, 0x2) dup(r1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r2, &(0x7f0000000280)={0x2, 0x4e20, @remote}, 0x10) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000300)="3900000013000347", 0x8}], 0x1) setsockopt$sock_int(r2, 0x1, 0x35, &(0x7f0000000340)=0x11, 0x4) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f00000003c0), 0x4000000004002, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r4, 0x2000) r5 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000044b87384da68b919000073797a3000000000000000000000000000000000005900000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a300000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c0003003412000078560000010000000000000005200973a10185010a19031500250775089501b1020a16039501b102850216008026ff7f75100a5304950181020a5404950181020a550495018102c0"], 0x154) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newqdisc={0xf8, 0x24, 0x800, 0x70bd2e, 0x0, {0x0, 0x0, 0x12, 0x0, {0xc}, {0x5, 0xffff}, {0xd}}, [@TCA_STAB={0xd4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x8, 0xf3, 0x6, 0x7, 0x0, 0x9, 0x9, 0x4}}, {0xc, 0x2, [0x1, 0x3, 0x0, 0x100]}}, {{0x1c, 0x1, {0x7, 0x7, 0xd7, 0x1, 0x1, 0xfba2, 0x1, 0x5}}, {0xe, 0x2, [0xffff, 0x8001, 0x78, 0x6, 0x1]}}, {{0x1c, 0x1, {0xa, 0x55, 0x0, 0x5, 0x3, 0x8e5f, 0x1, 0x4}}, {0xc, 0x2, [0xc, 0x8, 0xd, 0x2]}}, {{0x1c, 0x1, {0x2, 0x6, 0x2, 0x9, 0x1, 0x4, 0xfffffc0f, 0x5}}, {0xe, 0x2, [0x80, 0x3, 0x4, 0x5, 0x4]}}, {{0x1c, 0x1, {0x2b, 0x8, 0x7, 0x0, 0x2, 0x8, 0x6, 0x3}}, {0xa, 0x2, [0xb, 0x5, 0x30b6]}}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0xc00084d}, 0x4) write$UHID_DESTROY(r5, &(0x7f0000000780), 0x4) 2.290600263s ago: executing program 3 (id=2627): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000400)) syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000000c0)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000100), 0x2) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000140)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000240)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000280)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000300)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000340)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000380)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x800002, 0x10000, 0xa100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0x2, 0xae}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x4000, 0x2000000, 0xf8, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x20, 0x2, 0x250}}], 0x1, &(0x7f0000000700)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1, 0x6, 0x0, &(0x7f0000000840)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) syz_clone(0x8100000, 0x0, 0x0, &(0x7f0000000440), 0x0, 0x0) 1.997376646s ago: executing program 2 (id=2628): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xe2842, 0x0) (async) r1 = socket$rds(0x15, 0x5, 0x0) connect(r1, &(0x7f0000000040)=@in6={0xa, 0x4e24, 0x0, @mcast2}, 0x80) (async) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f00000001c0)={0x1, 0x0, [{0x26e, 0x0, 0x3ff}]}) 1.829291888s ago: executing program 1 (id=2629): syz_usb_connect(0x2, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000400605014600010000000109022700010100a0320904000003ffffff00070581024000000705020240000007058303"], 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_int(r0, 0x1, 0x4a, 0x0, &(0x7f0000000040)) 1.619646551s ago: executing program 2 (id=2630): bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="0500000000000000bc100000a6b400000fa00000000000009500000091e80723"], &(0x7f00000004c0)='GPL\x00', 0x2, 0xff06, &(0x7f0000000500)=""/195}, 0x48) 1.587593066s ago: executing program 2 (id=2631): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f0000000ec0), r2) getsockname$packet(r2, &(0x7f0000000f00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000f40)=0x14) sendmsg$nl_route(r1, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000001000)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYBLOB], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000010c0)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x8d0) sendmsg$nl_route_sched(r1, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001180)={0x0}}, 0x8000) 1.460283696s ago: executing program 2 (id=2632): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8042, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x130, 0x0, 0x8, {0x0, 0x3, 0x0, '\x00', {0x11, 0x0, 0xae3, 0x6, 0x0, 0xffffffffffffffff, 0xc000, '\x00', 0x6, 0x7e, 0x1000000000001, 0x4, {0x5, 0x5}, {0x20400000000000b, 0x45}, {0x5, 0x35}, {0xffffffffffffffff, 0xa00}, 0x10007, 0x6, 0x80000000, 0x5}}}}) write$P9_RSTATu(r0, &(0x7f00000002c0)=ANY=[], 0x2f9) (fail_nth: 2) 1.082914965s ago: executing program 2 (id=2633): bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="0500000000000000bc100000a6b400000fa00000000000009500000091e80723"], &(0x7f00000004c0)='GPL\x00', 0x2, 0xff06, &(0x7f0000000500)=""/195}, 0x48) (fail_nth: 2) 1.058838484s ago: executing program 4 (id=2634): r0 = socket(0x10, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001680)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000016c0)={0x1, 0x2a, &(0x7f0000001780)=ANY=[@ANYBLOB="1800000097000000000000000100000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007baaf8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000b50005008200000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b70300000000b0ff8500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r1, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8a00fe00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000001900)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000001940)={0x4, 0x3, &(0x7f0000001a00)=ANY=[@ANYBLOB="18000001000000000000000000000000950000000000cc1b9006bf43eb560410f47f39b90000"], &(0x7f0000001a40)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001a80)='stat\x00') read$FUSE(r2, &(0x7f0000001ac0)={0x2020}, 0x2020) r3 = syz_open_dev$evdev(&(0x7f0000003b00), 0x1bbc, 0x801) r4 = openat$sysfs(0xffffff9c, &(0x7f0000003b40)='/sys/power/pm_test', 0xc0b00, 0x1ea) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) r5 = epoll_create1(0x80000) r6 = openat$cuse(0xffffffffffffff9c, &(0x7f0000003b80), 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000003bc0)={0x20002016}) syz_emit_ethernet(0x46, &(0x7f0000003c00)=ANY=[@ANYRESDEC=r4], 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000003c40)='./cgroup.net/syz0\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000003c80), 0x200002, 0x0) syz_clone3(&(0x7f0000003cc0)={0x385200080, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r7}}, 0x58) write$evdev(r3, &(0x7f0000003d40)=[{{}, 0x0, 0x1, 0x3}], 0x5b) ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000003d80)=0x5) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000003dc0), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, &(0x7f0000003e00)={@my=0x1}) socket$unix(0x1, 0x2, 0x0) r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000003e40)=ANY=[@ANYBLOB="12010000000000086666048800000000000109022400010000100809040090010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io(r8, &(0x7f0000003e80)={0x18, &(0x7f0000003ec0)=ANY=[@ANYBLOB="00242300000048220f041b"], 0x0, 0x0, 0x0, 0x0}, 0x0) sendto(r0, &(0x7f0000000040)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000100)=[{{&(0x7f0000000140)=@ethernet={0x0, @random}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/100, 0x7f}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/109, 0x6a}, {&(0x7f0000001380)=""/73, 0x49}, {&(0x7f0000001400)=""/77, 0x4d}, {&(0x7f0000001480)=""/139, 0xa7}, {&(0x7f0000001540)=""/6, 0x6}], 0x8, &(0x7f0000001580)=""/191, 0xbf}, 0x2005}], 0x40000000000004c, 0x2000, &(0x7f0000001640)={0x77359400}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b4050000000000ff8910180000000000ce050000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x7, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0xfffffee3, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) 413.325724ms ago: executing program 2 (id=2635): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f0000000000), 0x4) setsockopt$inet6_int(r0, 0x29, 0xd0, 0x0, 0x0) (async) syz_usb_connect$uac3(0x5, 0x80, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x47f, 0xc010, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7, 0x50, 0x5, {0x8, 0xb, 0x0, 0x1, 0x1, 0x21, 0x30, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x4, 0xa, 0x53}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0xbc, 0xb, 0x9, {0xa, 0x25, 0x25, 0x4, 0x3, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x48, 0x7, 0x0, {0xa, 0x25, 0x25, 0xc, 0x47, 0x1}}}}}}}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x5, &(0x7f0000000080)={0x5, 0xf, 0xfffffffffffffd9a}, 0x1}) 0s ago: executing program 0 (id=2636): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000000000200304306000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000200)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00140d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000540), 0x800000, 0x0) ioctl$TCSBRKP(r1, 0x5425, 0x0) r2 = syz_io_uring_setup(0xf00, &(0x7f0000000580)={0x0, 0x7842, 0x10000, 0x20, 0x40055}, &(0x7f0000000900), &(0x7f0000000fc0), &(0x7f0000001000)) r3 = socket$inet(0x2, 0x3, 0x5) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000010c0)={'gre0\x00', &(0x7f0000001100)={'syztnl2\x00', 0x0, 0x2100, 0x0, 0xfffffffd, 0xfffffffc, {{0x5, 0x4, 0x0, 0x1, 0x14, 0x68, 0x0, 0x3, 0x2f, 0x0, @multicast2, @rand_addr=0x64010101}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000001140)={'syztnl2\x00', &(0x7f0000001180)={'gre0\x00', r4, 0x10, 0x0, 0xb0, 0x4, {{0x5, 0x4, 0x2, 0x6, 0x14, 0x85f, 0x0, 0xfa, 0x2f, 0x0, @empty, @rand_addr=0x64010102}}}}) io_uring_enter(r2, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000000), &(0x7f0000000500)=0xe) syz_usb_control_io$sierra_net(0xffffffffffffffff, &(0x7f0000000a40)={0xc, &(0x7f0000000800)={0x20, 0x4, 0x1d, {0x1d, 0x9, "aebb9fb39171d0c40225df962d6befbd1774bdfe5639a295ef8c07"}}, &(0x7f00000009c0)={0x0, 0x3, 0x4d, @string={0x4d, 0x3, "46bc47ceee87f104d2ad598ac618a6c9553425bc20488a322ece1b06772a1d324b108aec718925ae7c838feca0f0d62381e9c400870a9174288f2efb1a92c036278462aaf32bfd59e72ec8"}}}, &(0x7f0000000f80)={0x10, &(0x7f0000000a80)={0x40, 0x16, 0x60, "7974c37c44a635cd1cea356a12c35e2627ae30d3a1a4d69abd72b1deb95f586cb5e70adfb64828c9468d72fda352dda789c3f0eab538cd5bf9d217514c294b1d2f059876fec9dc84083e343c68eebe35e94305b4a78d2ed402d366f075555d5c"}, &(0x7f0000000b00)={0xa1, 0x1, 0x400, "a14db6605ffac5bf7bcb4a76198b2a95935ee4d4634c5258d8f0ea1af8cec69af60aa4c96a3d0359fa383cf763b357e3ec21fb977674d58816a0eb31a891205323da40b00cf3d121a316f8dc7d9311531e0c732e0a897eba53aba6a39b9fbf5a765def173aff2087bf98cdeae32970ae2008934c658d762049d9ba5bcc86f5bf1b54d250ea8754d6d6c2503ac763db4b8f453ebed7e34628c65b2036074ed41cb305443b8d966325960da9c30754dd88859fff94c8271c5ac97d1cc98a25cd31fe57040157263a6740b81158f2917786b5ec216875b7c031b3b0b7ea1d9fe0870c145213409127e325861b2d0412c6c6a6d1ba0581c76965f1b7a018599655f860b16fff9e220debed905443986cd35c8b0a89df27b49a65005cba36a28bff9e6d6489dace937775f58aa24caa674650023f23ccbdccdfb8fb5153ceb5c340386aa131b8bbbd59cd0c3411136b3055ed41439f514bbb899d687ee4079f4e47a8a50493f98c98449d7d1bb087995313708010b537bf819990ce5391bdc4d3f261c000934207044107911a9ebd80ac1c222a0a11eac4a786aa0f78573fc7cf4edde8c0f7847a1eb135b0b85ff2e360d89b3459ce996fb353836d213fd891225a55b3a3d14aa553148de4ef2b994d19116e21d47b85ea1c26c271d22d39e8218d9219762348ecd861b35cb0099e18e641e3c0965edb73ea3ffc2599a095a2c78e0a6cdc9fd6f0b7317b294fddc8c78969f69c374c2d725001c74a45fd092ba24c89a4b3d4d06c99b13db7dd0444f99275b4d73bc083ade6e4c39f41a8d25243de4519dfc32b0af10847a6ba873c12bb77e8c59875338c21aecf226a90e6b1554ff63bf8a4fe4b117a0568b3f4fd92c9e3da068ad9f646def01c8e6835a8565fed097b25da2075c3db93c90b4bf4701cb7df83bb970ab7dd8c57a77d4c464ea1ff40fc6bbb1ede96c829c10855d5d3d9226ce95cef010ef9d805e1575cfb92a3bb4ff824700999903b121c3b0b220102d17a5e46f036d81b735d679e4af81f42d92dc2f424660d3ff2fd84c20df59cc46c1dd85734fa2c3300280f7de710eced02f4e805d1ec72d610d60acf5ca7e97f5014a96c7067fd0c12fbf8461967ed95bb684ea038a353adb742805c9eef9ba2290276c61b49872dca64ee6ec721e3da1a82c82a4f0015d4c9094aba6eace5180a8516d3e445f37357f9ff47d3e0d267b3d89a35981356990c9b5f77ad285384b2da01c4d7cbb3e6767a6123e996899168513f8f65a889bd54e6a731b5e0109cafef489ef198ec557bd6e51cd901b8b1542180b47452c810aa998bb990b776a38e41849cbd06d9673331a7a50ff4231b81c8717d567b995297562091def54ea5133b60ae5c308b32200a66adf8d0f6f463917af288f83b19220577055bcaa43c640437d4dee90d93e90276db01d5c4eba155"}, &(0x7f0000000f40)={0x21, 0x0, 0x2, "18de"}}) shutdown(0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000180)=[@in={0x2, 0x4e20, @loopback}]}, &(0x7f00000001c0)=0xc) socket$nl_xfrm(0x10, 0x3, 0x6) kernel console output (not intermixed with test programs): sb_control_msg failed (-110) [ 554.081254][ T5703] sq905c 1-1:0.0: probe with driver sq905c failed with error -110 [ 554.111124][ T988] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 554.281099][ T988] usb 2-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 554.282683][ T988] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 554.282718][ T988] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 554.282760][ T988] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 554.434391][T12649] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 554.434896][T12649] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.641577][ T5623] Bluetooth: hci4: command 0x0406 tx timeout [ 554.739011][ T5738] hid-sensor-hub 0003:1234:5678.0073: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 554.898021][T12653] fido_id[12653]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 555.090799][ T988] qmi_wwan 2-1:1.0: probe with driver qmi_wwan failed with error -71 [ 555.113941][ T988] usb 2-1: USB disconnect, device number 122 [ 555.228429][T12657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 555.228901][T12657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 555.960666][ T5703] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 555.994558][ T988] usb 1-1: USB disconnect, device number 110 [ 556.054471][T12663] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2406'. [ 556.110603][ T5703] usb 2-1: Using ep0 maxpacket: 8 [ 556.111518][ T5703] usb 2-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 556.116284][ T5703] usb 2-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 556.116324][ T5703] usb 2-1: Product: syz [ 556.116341][ T5703] usb 2-1: Manufacturer: syz [ 556.116358][ T5703] usb 2-1: SerialNumber: syz [ 556.119556][ T5703] usb 2-1: config 0 descriptor?? [ 556.170793][ T5703] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 556.401414][ T988] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 556.430412][ T5738] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 556.551060][ T988] usb 1-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 556.552549][ T988] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 556.552585][ T988] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 556.552627][ T988] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 556.610391][ T5738] usb 5-1: Using ep0 maxpacket: 8 [ 556.611321][ T5738] usb 5-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 556.616450][ T5738] usb 5-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 556.616479][ T5738] usb 5-1: Product: syz [ 556.616522][ T5738] usb 5-1: Manufacturer: syz [ 556.616539][ T5738] usb 5-1: SerialNumber: syz [ 556.663607][ T5738] usb 5-1: config 0 descriptor?? [ 556.676400][ T5738] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 556.735943][ T5703] gspca_zc3xx: reg_w_i err -71 [ 556.736039][ T5703] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 556.744018][ T5703] usb 2-1: USB disconnect, device number 123 [ 556.794075][T12670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.794546][T12670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.836493][T12671] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.839568][T12671] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.952569][ T5695] hid-sensor-hub 0003:1234:5678.0074: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 557.144387][ T5703] hid-sensor-hub 0003:1234:5678.0075: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 557.288566][ T5738] gspca_zc3xx: reg_w_i err -71 [ 557.288673][ T5738] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 557.313791][ T5738] usb 5-1: USB disconnect, device number 2 [ 557.356573][T12676] fido_id[12676]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 557.616978][T12677] fido_id[12677]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 557.738298][T12683] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2411'. [ 557.799927][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 557.987164][T12689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 557.988014][T12689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.033804][ T988] qmi_wwan 1-1:1.0: probe with driver qmi_wwan failed with error -71 [ 558.050568][ T988] usb 1-1: USB disconnect, device number 111 [ 558.250034][ T5703] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 558.395072][T12694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.395657][T12694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.400385][ T5703] usb 2-1: Using ep0 maxpacket: 16 [ 558.407124][ T5703] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 558.412718][ T5703] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 558.412807][ T5703] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 558.419140][ T5703] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.419233][ T5703] usb 2-1: Product: syz [ 558.419276][ T5703] usb 2-1: Manufacturer: syz [ 558.419318][ T5703] usb 2-1: SerialNumber: syz [ 558.465419][ T5703] usb 2-1: config 0 descriptor?? [ 558.495264][ T5703] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 558.495305][ T5703] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 558.727097][T12699] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2417'. [ 559.104979][ T5703] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 559.115539][ T5703] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 559.525135][ T5703] em28xx 2-1:0.0: AC97 chip type couldn't be determined [ 559.525162][ T5703] em28xx 2-1:0.0: No AC97 audio processor [ 559.994098][T12702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.994565][T12702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 560.323072][T12704] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 560.323566][T12704] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 560.957881][ T988] usb 2-1: USB disconnect, device number 124 [ 560.959763][ T988] em28xx 2-1:0.0: Disconnecting em28xx [ 560.977772][ T988] em28xx: Freeing device [ 561.279458][T12716] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2424'. [ 561.491042][ T5703] usb 1-1: new low-speed USB device number 112 using dummy_hcd [ 561.500028][ T988] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 561.643781][ T5703] usb 1-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 561.645172][ T5703] usb 1-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 561.645249][ T5703] usb 1-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 561.645282][ T5703] usb 1-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 255, setting to 8 [ 561.645324][ T5703] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.648638][T12714] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 561.650020][ T988] usb 2-1: Using ep0 maxpacket: 8 [ 561.651846][ T988] usb 2-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 561.677050][ T988] usb 2-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 561.677134][ T988] usb 2-1: Product: syz [ 561.677176][ T988] usb 2-1: Manufacturer: syz [ 561.677221][ T988] usb 2-1: SerialNumber: syz [ 561.732082][ T988] usb 2-1: config 0 descriptor?? [ 561.775424][ T988] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 561.793415][ T5738] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 561.940329][ T5738] usb 5-1: Using ep0 maxpacket: 8 [ 561.941285][ T5738] usb 5-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 561.942910][ T5738] usb 5-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 561.942945][ T5738] usb 5-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 561.943006][ T5738] usb 5-1: config 0 interface 0 has no altsetting 0 [ 561.943043][ T5738] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.948069][ T5738] usb 5-1: config 0 descriptor?? [ 562.125951][T12724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 562.126569][T12724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 562.387581][ T5738] smartjoyplus 0003:6666:8804.0076: unknown main item tag 0x2 [ 562.387621][ T5738] smartjoyplus 0003:6666:8804.0076: item fetching failed at offset 4/5 [ 562.388478][ T5738] smartjoyplus 0003:6666:8804.0076: parse failed [ 562.388581][ T5738] smartjoyplus 0003:6666:8804.0076: probe with driver smartjoyplus failed with error -22 [ 562.430151][ T988] gspca_zc3xx: reg_w_i err -71 [ 562.430237][ T988] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 562.455326][ T988] usb 2-1: USB disconnect, device number 125 [ 562.513050][T12726] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2428'. [ 562.568238][T12728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 562.568828][T12728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 562.616065][ T5738] usb 5-1: USB disconnect, device number 3 [ 562.698595][ T5715] hid-sensor-hub 0003:1234:5678.0077: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 563.022375][T12730] fido_id[12730]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 563.042988][T12733] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 563.044037][T12733] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 563.123277][T12733] bond5: option lacp_rate: invalid value (5) [ 563.142519][T12733] bond5 (unregistering): Released all slaves [ 563.194935][T12732] netlink: 396 bytes leftover after parsing attributes in process `syz.2.2430'. [ 563.194970][T12732] openvswitch: netlink: Tunnel attr 352 out of range max 16 [ 563.285588][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.285667][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.510049][ T5715] usb 2-1: new low-speed USB device number 126 using dummy_hcd [ 563.666355][ T5715] usb 2-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 563.668398][ T5715] usb 2-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 563.668453][ T5715] usb 2-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 563.668507][ T5715] usb 2-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 255, setting to 8 [ 563.668539][ T5715] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 563.734095][T12736] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 563.762079][ T5738] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 563.817378][T12741] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2433'. [ 563.910032][ T5738] usb 5-1: Using ep0 maxpacket: 16 [ 563.910784][ T5738] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 563.912365][ T5738] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 563.912406][ T5738] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 563.965325][ T5738] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.965355][ T5738] usb 5-1: Product: syz [ 563.965370][ T5738] usb 5-1: Manufacturer: syz [ 563.965387][ T5738] usb 5-1: SerialNumber: syz [ 563.968654][ T5738] usb 5-1: config 0 descriptor?? [ 564.012792][ T5738] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 564.012833][ T5738] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 564.210714][T12747] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2435'. [ 564.426595][ T5703] usb 1-1: string descriptor 0 read error: -71 [ 564.608285][ T5738] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 564.609731][ T5703] usb 1-1: USB disconnect, device number 112 [ 564.610038][ T5738] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 565.003644][ T5703] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 565.044517][ T5738] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 565.044545][ T5738] em28xx 5-1:0.0: No AC97 audio processor [ 565.152043][ T5703] usb 1-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 565.157400][ T5703] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.157432][ T5703] usb 1-1: Product: syz [ 565.157477][ T5703] usb 1-1: Manufacturer: syz [ 565.157495][ T5703] usb 1-1: SerialNumber: syz [ 565.194552][ T5703] usb 1-1: config 0 descriptor?? [ 565.215253][ T5703] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 566.141463][ T5703] gspca_sq905c: sq905c_command: usb_control_msg failed (-110) [ 566.141586][ T5703] sq905c 1-1:0.0: probe with driver sq905c failed with error -110 [ 566.393089][ T5715] usb 2-1: string descriptor 0 read error: -71 [ 566.571597][ T5715] usb 2-1: USB disconnect, device number 126 [ 566.589375][ T5738] usb 5-1: USB disconnect, device number 4 [ 566.591702][ T5738] em28xx 5-1:0.0: Disconnecting em28xx [ 566.617405][ T5738] em28xx: Freeing device [ 567.261874][ T5738] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 567.399535][ T988] usb 1-1: USB disconnect, device number 113 [ 567.414622][ T5738] usb 2-1: Using ep0 maxpacket: 8 [ 567.416714][ T5738] usb 2-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 567.418930][ T5738] usb 2-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 567.418965][ T5738] usb 2-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 567.418990][ T5738] usb 2-1: config 0 interface 0 has no altsetting 0 [ 567.419033][ T5738] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 567.437177][ T5738] usb 2-1: config 0 descriptor?? [ 567.578079][T12764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 567.578841][T12764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 567.623285][T12766] FAULT_INJECTION: forcing a failure. [ 567.623285][T12766] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 567.623371][T12766] CPU: 1 UID: 0 PID: 12766 Comm: syz.2.2442 Tainted: G L syzkaller #0 PREEMPT(full) [ 567.623401][T12766] Tainted: [L]=SOFTLOCKUP [ 567.623410][T12766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 567.623430][T12766] Call Trace: [ 567.623445][T12766] [ 567.623456][T12766] dump_stack_lvl+0xe8/0x150 [ 567.623501][T12766] should_fail_ex+0x410/0x560 [ 567.623551][T12766] _copy_from_user+0x2d/0xb0 [ 567.623576][T12766] memdup_user+0x5e/0xd0 [ 567.623607][T12766] strndup_user+0x68/0xd0 [ 567.623637][T12766] __se_sys_fsconfig+0x4d0/0x810 [ 567.623675][T12766] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 567.623719][T12766] ? __ia32_sys_fsconfig+0x20/0xc0 [ 567.623752][T12766] __do_fast_syscall_32+0x27a/0x6b0 [ 567.623787][T12766] ? do_fast_syscall_32+0x33/0x70 [ 567.623815][T12766] ? asm_int80_emulation+0x1a/0x20 [ 567.623839][T12766] ? do_int80_emulation+0x299/0x500 [ 567.623867][T12766] ? trace_irq_disable+0x3b/0x140 [ 567.623899][T12766] do_fast_syscall_32+0x33/0x70 [ 567.623930][T12766] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 567.623959][T12766] RIP: 0023:0xf748f0ec [ 567.623979][T12766] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 567.624000][T12766] RSP: 002b:00000000f54a650c EFLAGS: 00000206 ORIG_RAX: 00000000000001af [ 567.624025][T12766] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000005 [ 567.624042][T12766] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000003 [ 567.624057][T12766] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 567.624070][T12766] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 567.624084][T12766] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 567.624119][T12766] [ 567.914505][ T5738] smartjoyplus 0003:6666:8804.0078: unknown main item tag 0x2 [ 567.914547][ T5738] smartjoyplus 0003:6666:8804.0078: item fetching failed at offset 4/5 [ 567.919245][T12770] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2444'. [ 567.920572][ T5738] smartjoyplus 0003:6666:8804.0078: parse failed [ 567.920652][ T5738] smartjoyplus 0003:6666:8804.0078: probe with driver smartjoyplus failed with error -22 [ 568.088502][T12777] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.088985][T12777] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.136652][T12777] bond5: option lacp_rate: invalid value (5) [ 568.186576][T12779] netlink: 396 bytes leftover after parsing attributes in process `syz.2.2446'. [ 568.186611][T12779] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 568.187637][T12777] bond5 (unregistering): Released all slaves [ 568.281181][ T5715] usb 2-1: USB disconnect, device number 127 [ 568.300071][ T5738] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 568.318315][ T988] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 568.324733][T12783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.334514][T12783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.363139][T12783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.363981][T12783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.450823][ T5738] usb 1-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 568.452275][ T5738] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 568.452306][ T5738] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 568.452342][ T5738] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 568.494159][ T988] usb 5-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 568.513916][ T988] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 568.517435][ T988] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.517465][ T988] usb 5-1: Product: syz [ 568.517481][ T988] usb 5-1: Manufacturer: syz [ 568.517538][ T988] usb 5-1: SerialNumber: syz [ 568.558930][ T988] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 568.735671][ T5715] hid-sensor-hub 0003:1234:5678.0079: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 568.917174][T12785] fido_id[12785]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 569.123349][ T5738] qmi_wwan 1-1:1.0: probe with driver qmi_wwan failed with error -71 [ 569.152043][ T5738] usb 1-1: USB disconnect, device number 114 [ 569.243568][T12790] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 569.244139][T12790] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 569.280563][ T988] gspca_mr97310a: reg read [21] error -110 [ 569.280631][ T988] mr97310a 5-1:1.0: probe with driver mr97310a failed with error -110 [ 569.360331][T12580] Bluetooth: hci2: command 0x0406 tx timeout [ 569.899994][ T5715] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 570.066339][ T5715] usb 2-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 570.067763][ T5715] usb 2-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 570.067819][ T5715] usb 2-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 570.067849][ T5715] usb 2-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 255, setting to 8 [ 570.067892][ T5715] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 570.096377][T12794] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 570.204898][T12799] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2453'. [ 571.065088][ T5703] usb 5-1: USB disconnect, device number 5 [ 571.449534][T12811] Bluetooth: hci2: command 0x0406 tx timeout [ 571.504258][T12815] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2456'. [ 571.945197][T12817] FAULT_INJECTION: forcing a failure. [ 571.945197][T12817] name failslab, interval 1, probability 0, space 0, times 0 [ 571.945262][T12817] CPU: 1 UID: 0 PID: 12817 Comm: syz.3.2457 Tainted: G L syzkaller #0 PREEMPT(full) [ 571.945291][T12817] Tainted: [L]=SOFTLOCKUP [ 571.945299][T12817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 571.945312][T12817] Call Trace: [ 571.945320][T12817] [ 571.945329][T12817] dump_stack_lvl+0xe8/0x150 [ 571.945370][T12817] should_fail_ex+0x410/0x560 [ 571.945407][T12817] should_failslab+0xa8/0x100 [ 571.945440][T12817] __kmalloc_noprof+0xfe/0x720 [ 571.945464][T12817] ? tomoyo_encode+0x2ad/0x570 [ 571.945485][T12817] ? tomoyo_encode+0x2ad/0x570 [ 571.945512][T12817] tomoyo_encode+0x2ad/0x570 [ 571.945540][T12817] tomoyo_realpath_from_path+0x5fa/0x640 [ 571.945571][T12817] ? tomoyo_path_number_perm+0x219/0x5f0 [ 571.945611][T12817] tomoyo_path_number_perm+0x246/0x5f0 [ 571.945644][T12817] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 571.945672][T12817] ? __lock_acquire+0x747/0x2de0 [ 571.945713][T12817] ? hook_file_ioctl_compat+0x1f2/0x600 [ 571.945766][T12817] ? __fget_files+0x2a/0x420 [ 571.945791][T12817] ? __fget_files+0x3a2/0x420 [ 571.945808][T12817] ? __fget_files+0x2a/0x420 [ 571.945831][T12817] security_file_ioctl_compat+0xc3/0x2a0 [ 571.945865][T12817] __ia32_compat_sys_ioctl+0x139/0x950 [ 571.945895][T12817] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 571.945923][T12817] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 571.945951][T12817] ? __fget_files+0x3a2/0x420 [ 571.945977][T12817] ? fput+0xa0/0xd0 [ 571.946006][T12817] ? ksys_write+0x242/0x270 [ 571.946041][T12817] __do_fast_syscall_32+0x27a/0x6b0 [ 571.946069][T12817] ? do_fast_syscall_32+0x33/0x70 [ 571.946096][T12817] ? asm_int80_emulation+0x1a/0x20 [ 571.946117][T12817] ? do_int80_emulation+0x299/0x500 [ 571.946142][T12817] ? trace_irq_disable+0x3b/0x140 [ 571.946170][T12817] do_fast_syscall_32+0x33/0x70 [ 571.946197][T12817] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 571.946223][T12817] RIP: 0023:0xf741f0ec [ 571.946242][T12817] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 571.946260][T12817] RSP: 002b:00000000f543650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 571.946283][T12817] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c040565f [ 571.946298][T12817] RDX: 0000000080000340 RSI: 0000000000000000 RDI: 0000000000000000 [ 571.946311][T12817] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 571.946324][T12817] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 571.946337][T12817] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 571.946368][T12817] [ 571.946438][T12817] ERROR: Out of memory at tomoyo_realpath_from_path. [ 572.333010][T12819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 572.333591][T12819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 572.777493][ T5715] usb 2-1: string descriptor 0 read error: -71 [ 572.945041][ T5715] usb 2-1: USB disconnect, device number 2 [ 573.028527][T12799] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 573.178036][T12829] FAULT_INJECTION: forcing a failure. [ 573.178036][T12829] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 573.178079][T12829] CPU: 0 UID: 0 PID: 12829 Comm: syz.2.2462 Tainted: G L syzkaller #0 PREEMPT(full) [ 573.178110][T12829] Tainted: [L]=SOFTLOCKUP [ 573.178119][T12829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 573.178142][T12829] Call Trace: [ 573.178152][T12829] [ 573.178162][T12829] dump_stack_lvl+0xe8/0x150 [ 573.178203][T12829] should_fail_ex+0x410/0x560 [ 573.178243][T12829] _copy_to_user+0x31/0xb0 [ 573.178271][T12829] simple_read_from_buffer+0xe1/0x170 [ 573.178314][T12829] proc_fail_nth_read+0x1bb/0x230 [ 573.178342][T12829] ? common_file_perm+0x20e/0x2b0 [ 573.178381][T12829] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 573.178412][T12829] ? rw_verify_area+0x24a/0x4c0 [ 573.178439][T12829] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 573.178466][T12829] vfs_read+0x213/0xa80 [ 573.178497][T12829] ? __pfx___mutex_lock+0x10/0x10 [ 573.178527][T12829] ? __pfx_vfs_read+0x10/0x10 [ 573.178553][T12829] ? __fget_files+0x2a/0x420 [ 573.178580][T12829] ? __fget_files+0x3a2/0x420 [ 573.178601][T12829] ? __fget_files+0x2a/0x420 [ 573.178631][T12829] ksys_read+0x150/0x270 [ 573.178659][T12829] ? __pfx_ksys_read+0x10/0x10 [ 573.178689][T12829] ? asm_int80_emulation+0x1a/0x20 [ 573.178719][T12829] do_int80_emulation+0x198/0x500 [ 573.178749][T12829] ? trace_irq_disable+0x3b/0x140 [ 573.178775][T12829] ? asm_int80_emulation+0x1a/0x20 [ 573.178798][T12829] ? clear_bhb_loop+0x70/0xc0 [ 573.178821][T12829] ? clear_bhb_loop+0x70/0xc0 [ 573.178850][T12829] asm_int80_emulation+0x1a/0x20 [ 573.178872][T12829] RIP: 0023:0xf71e77eb [ 573.178894][T12829] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 573.178919][T12829] RSP: 002b:00000000f54a64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 573.178943][T12829] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000f54a65d0 [ 573.178960][T12829] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 573.178973][T12829] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 573.178987][T12829] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 573.179001][T12829] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 573.179036][T12829] [ 573.310142][ T5715] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 573.442873][ T5623] Bluetooth: hci0: command 0x0406 tx timeout [ 573.491057][ T5715] usb 2-1: Using ep0 maxpacket: 8 [ 573.492762][ T5715] usb 2-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 573.497095][ T5715] usb 2-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 573.497136][ T5715] usb 2-1: Product: syz [ 573.497153][ T5715] usb 2-1: Manufacturer: syz [ 573.497170][ T5715] usb 2-1: SerialNumber: syz [ 573.540223][ T5715] usb 2-1: config 0 descriptor?? [ 573.545682][ T5715] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 573.673137][T12834] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 573.679002][T12834] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 573.737074][T12832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 573.737553][T12832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 574.010112][ T5738] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 574.160455][ T5738] usb 1-1: Using ep0 maxpacket: 8 [ 574.162176][ T5738] usb 1-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 574.163682][ T5738] usb 1-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 574.163717][ T5738] usb 1-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 574.163745][ T5738] usb 1-1: config 0 interface 0 has no altsetting 0 [ 574.163780][ T5738] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.167288][ T5738] usb 1-1: config 0 descriptor?? [ 574.202904][ T988] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 574.243637][ T5715] input: gspca_zc3xx as /devices/platform/dummy_hcd.1/usb2/2-1/input/input41 [ 574.366901][ T988] usb 5-1: Using ep0 maxpacket: 8 [ 574.367843][ T988] usb 5-1: New USB device found, idVendor=04b4, idProduct=8613, bcdDevice=95.8f [ 574.392613][ T988] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 574.392674][ T988] usb 5-1: Product: syz [ 574.392692][ T988] usb 5-1: Manufacturer: syz [ 574.392710][ T988] usb 5-1: SerialNumber: syz [ 574.399433][ T988] usb 5-1: config 0 descriptor?? [ 574.435976][ T988] usbtest 5-1:0.0: FX2 device [ 574.436001][ T988] usbtest 5-1:0.0: high-speed {control bulk-in bulk-out} tests (+alt) [ 574.455927][T12846] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 574.456382][T12846] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 574.496796][T12846] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 574.508682][T12846] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 574.548865][ T988] usb 2-1: USB disconnect, device number 3 [ 574.605956][ T5738] smartjoyplus 0003:6666:8804.007A: unknown main item tag 0x2 [ 574.605987][ T5738] smartjoyplus 0003:6666:8804.007A: item fetching failed at offset 4/5 [ 574.606449][ T5738] smartjoyplus 0003:6666:8804.007A: parse failed [ 574.606506][ T5738] smartjoyplus 0003:6666:8804.007A: probe with driver smartjoyplus failed with error -22 [ 574.696669][T12848] 8021q: adding VLAN 0 to HW filter on device bond7 [ 574.737642][T12850] bond7: (slave veth9): Enslaving as an active interface with an up link [ 574.766340][T12841] bond1: option lacp_rate: invalid value (5) [ 574.767586][T12841] bond1 (unregistering): Released all slaves [ 574.783414][T12842] netlink: 396 bytes leftover after parsing attributes in process `syz.4.2465'. [ 574.783452][T12842] openvswitch: netlink: Tunnel attr 352 out of range max 16 [ 574.844299][T12848] bond6: (slave macvlan0): Releasing backup interface [ 574.869163][T12848] bond7: (slave macvlan0): Enslaving as an active interface with an up link [ 574.916456][ T5738] usb 1-1: USB disconnect, device number 115 [ 575.048597][ T988] usb 5-1: USB disconnect, device number 6 [ 575.181166][T12853] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 575.181710][T12853] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 575.282580][T12859] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2469'. [ 575.282608][T12859] netlink: 'syz.1.2469': attribute type 5 has an invalid length. [ 575.282620][T12859] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2469'. [ 575.288852][T12859] geneve2: entered promiscuous mode [ 575.288871][T12859] geneve2: entered allmulticast mode [ 575.521945][T12811] Bluetooth: hci0: command 0x0406 tx timeout [ 575.572189][T12861] sg_write: data in/out 443356/194 bytes for SCSI command 0x0-- guessing data in; [ 575.572189][T12861] program syz.0.2470 not setting count and/or reply_len properly [ 575.678413][T12863] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2471'. [ 576.005443][ T5715] usb 5-1: new low-speed USB device number 7 using dummy_hcd [ 576.173636][ T5715] usb 5-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 576.175241][ T5715] usb 5-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 576.175294][ T5715] usb 5-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 576.175332][ T5715] usb 5-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 255, setting to 8 [ 576.175376][ T5715] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 576.188597][T12867] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 576.538893][ T5703] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 576.691375][ T5703] usb 2-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 576.715410][ T5703] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.715441][ T5703] usb 2-1: Product: syz [ 576.715498][ T5703] usb 2-1: Manufacturer: syz [ 576.715516][ T5703] usb 2-1: SerialNumber: syz [ 576.732669][ T5703] usb 2-1: config 0 descriptor?? [ 576.772554][ T5703] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 577.696197][ T5703] gspca_sq905c: sq905c_command: usb_control_msg failed (-110) [ 577.696313][ T5703] sq905c 2-1:0.0: probe with driver sq905c failed with error -110 [ 578.673389][ T5703] usb 2-1: USB disconnect, device number 4 [ 578.821312][T12880] 8021q: adding VLAN 0 to HW filter on device bond5 [ 578.924516][T12887] FAULT_INJECTION: forcing a failure. [ 578.924516][T12887] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 578.924556][T12887] CPU: 1 UID: 0 PID: 12887 Comm: syz.0.2481 Tainted: G L syzkaller #0 PREEMPT(full) [ 578.924587][T12887] Tainted: [L]=SOFTLOCKUP [ 578.924596][T12887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 578.924611][T12887] Call Trace: [ 578.924624][T12887] [ 578.924634][T12887] dump_stack_lvl+0xe8/0x150 [ 578.924675][T12887] should_fail_ex+0x410/0x560 [ 578.924714][T12887] _copy_to_user+0x31/0xb0 [ 578.924741][T12887] simple_read_from_buffer+0xe1/0x170 [ 578.924783][T12887] proc_fail_nth_read+0x1bb/0x230 [ 578.924810][T12887] ? common_file_perm+0x20e/0x2b0 [ 578.924848][T12887] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 578.924880][T12887] ? rw_verify_area+0x24a/0x4c0 [ 578.924906][T12887] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 578.924933][T12887] vfs_read+0x213/0xa80 [ 578.924962][T12887] ? __pfx___mutex_lock+0x10/0x10 [ 578.924993][T12887] ? __pfx_vfs_read+0x10/0x10 [ 578.925019][T12887] ? __fget_files+0x2a/0x420 [ 578.925045][T12887] ? __fget_files+0x3a2/0x420 [ 578.925065][T12887] ? __fget_files+0x2a/0x420 [ 578.925102][T12887] ksys_read+0x150/0x270 [ 578.925128][T12887] ? __pfx_ksys_read+0x10/0x10 [ 578.925157][T12887] ? asm_int80_emulation+0x1a/0x20 [ 578.925184][T12887] do_int80_emulation+0x198/0x500 [ 578.925207][T12887] ? trace_irq_disable+0x3b/0x140 [ 578.925227][T12887] ? asm_int80_emulation+0x1a/0x20 [ 578.925244][T12887] ? clear_bhb_loop+0x70/0xc0 [ 578.925262][T12887] ? clear_bhb_loop+0x70/0xc0 [ 578.925284][T12887] asm_int80_emulation+0x1a/0x20 [ 578.925301][T12887] RIP: 0023:0xf71677eb [ 578.925318][T12887] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 578.925334][T12887] RSP: 002b:00000000f54264bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 578.925353][T12887] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54265d0 [ 578.925366][T12887] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 578.925377][T12887] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 578.925388][T12887] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 578.925399][T12887] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 578.925425][T12887] [ 578.962107][T12881] bond5: (slave veth11): Enslaving as an active interface with an up link [ 578.978574][T12885] FAULT_INJECTION: forcing a failure. [ 578.978574][T12885] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 578.993220][T12885] CPU: 0 UID: 0 PID: 12885 Comm: syz.3.2480 Tainted: G L syzkaller #0 PREEMPT(full) [ 578.993314][T12885] Tainted: [L]=SOFTLOCKUP [ 578.993336][T12885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 578.993379][T12885] Call Trace: [ 578.993411][T12885] [ 578.993443][T12885] dump_stack_lvl+0xe8/0x150 [ 578.993545][T12885] should_fail_ex+0x410/0x560 [ 578.993663][T12885] _copy_to_user+0x31/0xb0 [ 578.993729][T12885] simple_read_from_buffer+0xe1/0x170 [ 578.993835][T12885] proc_fail_nth_read+0x1bb/0x230 [ 578.993900][T12885] ? common_file_perm+0x20e/0x2b0 [ 578.994003][T12885] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 578.994078][T12885] ? rw_verify_area+0x24a/0x4c0 [ 578.994130][T12885] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 578.994203][T12885] vfs_read+0x213/0xa80 [ 578.994283][T12885] ? __pfx_vfs_read+0x10/0x10 [ 578.994357][T12885] ? kmem_cache_free+0x182/0x650 [ 578.994464][T12885] ? rcu_is_watching+0x16/0xb0 [ 578.994660][T12885] ksys_read+0x150/0x270 [ 578.994715][T12885] ? do_sock_setsockopt+0x185/0x1b0 [ 578.994791][T12885] ? __pfx_ksys_read+0x10/0x10 [ 578.994867][T12885] ? asm_int80_emulation+0x1a/0x20 [ 578.994941][T12885] do_int80_emulation+0x198/0x500 [ 578.995016][T12885] ? trace_irq_disable+0x3b/0x140 [ 578.995080][T12885] ? asm_int80_emulation+0x1a/0x20 [ 578.995128][T12885] ? clear_bhb_loop+0x70/0xc0 [ 578.995190][T12885] ? clear_bhb_loop+0x70/0xc0 [ 578.995257][T12885] asm_int80_emulation+0x1a/0x20 [ 578.995319][T12885] RIP: 0023:0xf71777eb [ 578.995373][T12885] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 578.995425][T12885] RSP: 002b:00000000f54364bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 578.995490][T12885] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f54365d0 [ 578.995533][T12885] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 578.995573][T12885] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 578.995606][T12885] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 578.995640][T12885] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 578.995727][T12885] [ 579.085805][ T5715] usb 5-1: string descriptor 0 read error: -71 [ 579.559065][ T5715] usb 5-1: USB disconnect, device number 7 [ 579.582689][T12889] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2483'. [ 579.628362][ T8429] udevd[8429]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:32.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 579.719826][T12889] 8021q: adding VLAN 0 to HW filter on device bond4 [ 579.816590][T12902] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2484'. [ 579.836719][T12893] bond4: (slave veth5): Enslaving as an active interface with an up link [ 579.866221][T12899] bond4: (slave macvlan0): Enslaving as an active interface with an up link [ 580.238957][T12898] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 580.239461][T12898] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 580.340363][T12915] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2486'. [ 580.340402][T12915] netlink: 'syz.3.2486': attribute type 5 has an invalid length. [ 580.340420][T12915] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2486'. [ 580.414665][T12915] geneve2: entered promiscuous mode [ 580.414692][T12915] geneve2: entered allmulticast mode [ 580.440279][ T7454] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 580.440431][ T7454] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 580.450356][ T60] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 580.452435][ T7454] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 580.650134][ T988] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 580.749281][T12897] input: syz1 as /devices/virtual/input/input43 [ 580.807598][ T988] usb 1-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 580.812543][ T988] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 580.812637][ T988] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 580.812754][ T988] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.142191][T12926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 581.144422][T12926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 581.251430][ T5738] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 581.304596][ T5695] hid-sensor-hub 0003:1234:5678.007B: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 581.412901][ T5738] usb 2-1: Using ep0 maxpacket: 16 [ 581.414933][ T5738] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 581.449501][ T5738] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.449544][ T5738] usb 2-1: Product: syz [ 581.449555][ T5738] usb 2-1: Manufacturer: syz [ 581.449567][ T5738] usb 2-1: SerialNumber: syz [ 581.515021][ T5738] r8152-cfgselector 2-1: Unknown version 0x0000 [ 581.515044][ T5738] r8152-cfgselector 2-1: config 0 descriptor?? [ 582.033091][T12934] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2493'. [ 582.456624][T12937] bond1: Unable to set down delay as MII monitoring is disabled [ 582.753619][ T5738] r8152-cfgselector 2-1: USB disconnect, device number 5 [ 583.183035][T12937] bond1 (unregistering): Released all slaves [ 584.828760][T12948] 8021q: adding VLAN 0 to HW filter on device bond4 [ 584.894675][T12957] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2500'. [ 585.110000][ T5715] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 585.269116][T12949] bond4: (slave veth7): Enslaving as an active interface with an up link [ 585.283578][ T5715] usb 5-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 585.285037][ T5715] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 585.287415][ T5715] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 585.287440][ T5715] usb 5-1: Product: syz [ 585.287458][ T5715] usb 5-1: Manufacturer: syz [ 585.287474][ T5715] usb 5-1: SerialNumber: syz [ 585.345784][T12950] bond4: (slave macvlan0): Enslaving as an active interface with an up link [ 585.347542][ T5715] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 585.800035][ T1785] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 585.885311][T12962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 585.886017][T12962] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 585.923066][ T988] qmi_wwan 1-1:1.0: probe with driver qmi_wwan failed with error -110 [ 585.961887][ T1785] usb 2-1: Using ep0 maxpacket: 8 [ 585.964321][ T1785] usb 2-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 585.967746][ T1785] usb 2-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 585.967768][ T1785] usb 2-1: Product: syz [ 585.967779][ T1785] usb 2-1: Manufacturer: syz [ 585.967811][ T1785] usb 2-1: SerialNumber: syz [ 585.984243][ T1785] usb 2-1: config 0 descriptor?? [ 586.036865][ T1785] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 586.061651][ T5715] gspca_mr97310a: reg read [21] error -110 [ 586.061785][ T5715] mr97310a 5-1:1.0: probe with driver mr97310a failed with error -110 [ 586.104598][T12975] ip6gre1: entered allmulticast mode [ 586.107072][ T7455] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 586.175640][T12977] netlink: 140 bytes leftover after parsing attributes in process `syz.3.2507'. [ 586.176681][T12977] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2507'. [ 586.238605][T12981] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 586.239091][T12981] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 586.434222][ T1785] gspca_zc3xx: reg_r err -71 [ 586.434307][ T1785] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 586.459445][ T1785] usb 2-1: USB disconnect, device number 6 [ 586.575504][T12987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 586.580177][T12987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 586.697181][T12989] bond6: Unable to set down delay as MII monitoring is disabled [ 586.891662][T12989] bond6 (unregistering): Released all slaves [ 586.990867][T12995] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 586.997130][T12995] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 587.641957][ T1785] usb 1-1: USB disconnect, device number 116 [ 587.752605][T13003] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2515'. [ 587.974553][ T988] usb 5-1: USB disconnect, device number 8 [ 588.393128][ T988] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 588.540013][ T988] usb 5-1: Using ep0 maxpacket: 16 [ 588.541539][ T988] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 588.546176][ T988] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 588.546206][ T988] usb 5-1: config 0 has no interface number 0 [ 588.546251][ T988] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 588.546281][ T988] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 588.580479][ T988] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.580563][ T988] usb 5-1: Product: syz [ 588.580607][ T988] usb 5-1: Manufacturer: syz [ 588.580649][ T988] usb 5-1: SerialNumber: syz [ 588.616396][ T988] usb 5-1: config 0 descriptor?? [ 588.637121][T13018] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 588.637278][T13018] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 588.859411][T13018] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 588.859557][T13018] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 588.885483][ T5738] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 588.980436][ T5695] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 589.040601][ T5738] usb 1-1: Using ep0 maxpacket: 8 [ 589.041841][ T5738] usb 1-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 589.043298][ T5738] usb 1-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 589.043332][ T5738] usb 1-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 589.043388][ T5738] usb 1-1: config 0 interface 0 has no altsetting 0 [ 589.043426][ T5738] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 589.076438][ T5738] usb 1-1: config 0 descriptor?? [ 589.091704][ T988] asix 5-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 589.160668][ T5695] usb 2-1: Using ep0 maxpacket: 8 [ 589.162226][ T5695] usb 2-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 589.192148][ T5695] usb 2-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 589.192214][ T5695] usb 2-1: Product: syz [ 589.192232][ T5695] usb 2-1: Manufacturer: syz [ 589.192250][ T5695] usb 2-1: SerialNumber: syz [ 589.228255][ T5695] usb 2-1: config 0 descriptor?? [ 589.260810][ T5695] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 589.524659][ T988] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 589.524975][ T988] asix 5-1:0.34: probe with driver asix failed with error -32 [ 589.590739][ T5738] smartjoyplus 0003:6666:8804.007C: unknown main item tag 0x2 [ 589.590783][ T5738] smartjoyplus 0003:6666:8804.007C: item fetching failed at offset 4/5 [ 589.591661][ T5738] smartjoyplus 0003:6666:8804.007C: parse failed [ 589.591767][ T5738] smartjoyplus 0003:6666:8804.007C: probe with driver smartjoyplus failed with error -22 [ 589.657983][ T5695] gspca_zc3xx: reg_r err -71 [ 589.658071][ T5695] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 589.698752][ T5695] usb 2-1: USB disconnect, device number 7 [ 589.802090][ T1785] usb 1-1: USB disconnect, device number 117 [ 589.933463][T13032] bond8: Unable to set down delay as MII monitoring is disabled [ 589.935414][T13032] bond8 (unregistering): Released all slaves [ 590.025490][T13023] input: syz1 as /devices/virtual/input/input45 [ 590.045109][T13032] bond7: (slave macvlan0): Releasing backup interface [ 590.119212][T13039] process 'syz.3.2525' launched './file2' with NULL argv: empty string added [ 590.240107][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 590.406256][T13050] FAULT_INJECTION: forcing a failure. [ 590.406256][T13050] name failslab, interval 1, probability 0, space 0, times 0 [ 590.406295][T13050] CPU: 1 UID: 0 PID: 13050 Comm: syz.3.2527 Tainted: G L syzkaller #0 PREEMPT(full) [ 590.406329][T13050] Tainted: [L]=SOFTLOCKUP [ 590.406338][T13050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 590.406352][T13050] Call Trace: [ 590.406362][T13050] [ 590.406372][T13050] dump_stack_lvl+0xe8/0x150 [ 590.406410][T13050] should_fail_ex+0x410/0x560 [ 590.406447][T13050] ? __pfx_sock_alloc_inode+0x10/0x10 [ 590.406478][T13050] should_failslab+0xa8/0x100 [ 590.406511][T13050] ? __pfx_sock_alloc_inode+0x10/0x10 [ 590.406540][T13050] kmem_cache_alloc_lru_noprof+0xa7/0x5f0 [ 590.406565][T13050] ? tomoyo_check_inet_address+0x27f/0x930 [ 590.406597][T13050] ? sock_alloc_inode+0x2c/0x1a0 [ 590.406625][T13050] ? sock_alloc_inode+0x2c/0x1a0 [ 590.406661][T13050] ? __pfx_sock_alloc_inode+0x10/0x10 [ 590.406690][T13050] sock_alloc_inode+0x2c/0x1a0 [ 590.406722][T13050] ? __pfx_sock_alloc_inode+0x10/0x10 [ 590.406752][T13050] alloc_inode+0x6a/0x1b0 [ 590.406788][T13050] __sock_create+0x12d/0x9d0 [ 590.406834][T13050] mptcp_subflow_create_socket+0xfd/0x810 [ 590.406941][T13050] ? __pfx_mptcp_subflow_create_socket+0x10/0x10 [ 590.406980][T13050] ? do_raw_spin_lock+0x12b/0x2f0 [ 590.407019][T13050] __mptcp_nmpc_sk+0x155/0x770 [ 590.407084][T13050] ? __pfx___mptcp_nmpc_sk+0x10/0x10 [ 590.407119][T13050] ? __local_bh_enable_ip+0xd6/0x140 [ 590.407158][T13050] mptcp_bind+0xab/0x1d0 [ 590.407194][T13050] __sys_bind+0x2e3/0x410 [ 590.407231][T13050] ? __pfx___sys_bind+0x10/0x10 [ 590.407290][T13050] __ia32_sys_bind+0x7a/0x90 [ 590.407327][T13050] __do_fast_syscall_32+0x27a/0x6b0 [ 590.407360][T13050] ? do_fast_syscall_32+0x33/0x70 [ 590.407388][T13050] ? asm_int80_emulation+0x1a/0x20 [ 590.407410][T13050] ? do_int80_emulation+0x299/0x500 [ 590.407437][T13050] ? trace_irq_disable+0x3b/0x140 [ 590.407467][T13050] do_fast_syscall_32+0x33/0x70 [ 590.407496][T13050] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 590.407524][T13050] RIP: 0023:0xf741f0ec [ 590.407545][T13050] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 590.407565][T13050] RSP: 002b:00000000f543650c EFLAGS: 00000206 ORIG_RAX: 0000000000000169 [ 590.407599][T13050] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 590.407616][T13050] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 590.407630][T13050] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 590.407644][T13050] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 590.407659][T13050] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 590.407694][T13050] [ 590.409377][T13050] socket: no more sockets [ 590.827139][T13052] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2528'. [ 590.896556][T13056] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 590.897452][T13056] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 591.068767][T13062] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 591.070708][T13062] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 591.139096][ T5695] usb 5-1: USB disconnect, device number 9 [ 591.488858][T13076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 591.489405][T13076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 591.570178][ T988] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 591.590269][ T5695] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 591.715064][T13079] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 591.715593][T13079] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 591.729187][ T988] usb 1-1: Using ep0 maxpacket: 16 [ 591.737226][T13079] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 591.740784][ T5715] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 591.744095][ T988] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 591.748355][T13079] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 591.753167][ T5695] usb 5-1: Using ep0 maxpacket: 8 [ 591.779230][ T5695] usb 5-1: New USB device found, idVendor=04b4, idProduct=8613, bcdDevice=95.8f [ 591.779836][ T988] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 591.784506][ T988] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 591.795731][ T988] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 591.795761][ T988] usb 1-1: Product: syz [ 591.795806][ T988] usb 1-1: Manufacturer: syz [ 591.795823][ T988] usb 1-1: SerialNumber: syz [ 591.810363][ T5695] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 591.810439][ T5695] usb 5-1: Product: syz [ 591.810483][ T5695] usb 5-1: Manufacturer: syz [ 591.810554][ T5695] usb 5-1: SerialNumber: syz [ 591.817542][ T988] usb 1-1: config 0 descriptor?? [ 591.844413][ T5695] usb 5-1: config 0 descriptor?? [ 591.883301][ T988] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 591.883339][ T988] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 591.884403][ T5695] usbtest 5-1:0.0: FX2 device [ 591.884424][ T5695] usbtest 5-1:0.0: high-speed {control bulk-in bulk-out} tests (+alt) [ 591.931462][ T5715] usb 2-1: Using ep0 maxpacket: 8 [ 591.934705][ T5715] usb 2-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 591.937746][ T5715] usb 2-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 591.937775][ T5715] usb 2-1: Product: syz [ 591.937790][ T5715] usb 2-1: Manufacturer: syz [ 591.937805][ T5715] usb 2-1: SerialNumber: syz [ 591.942514][ T5715] usb 2-1: config 0 descriptor?? [ 591.965384][ T5715] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 592.077978][T13081] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2540'. [ 592.127004][T13065] bond1: option lacp_rate: invalid value (5) [ 592.129144][T13070] netlink: 396 bytes leftover after parsing attributes in process `syz.4.2534'. [ 592.129181][T13070] openvswitch: netlink: Tunnel attr 352 out of range max 16 [ 592.129380][T13065] bond1 (unregistering): Released all slaves [ 592.322354][ T5695] usb 5-1: USB disconnect, device number 10 [ 592.427263][ T988] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 592.429140][ T988] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 592.563322][ T5715] gspca_zc3xx: reg_w_i err -71 [ 592.563414][ T5715] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 592.586923][ T5715] usb 2-1: USB disconnect, device number 8 [ 592.680749][T13087] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 592.681233][T13087] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 592.834296][ T988] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 592.834315][ T988] em28xx 1-1:0.0: No AC97 audio processor [ 593.115675][T13094] kernel profiling enabled (shift: 4) [ 593.231211][T13098] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2546'. [ 593.250063][ T5715] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 593.322364][T13100] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2547'. [ 593.323697][T13100] FAULT_INJECTION: forcing a failure. [ 593.323697][T13100] name failslab, interval 1, probability 0, space 0, times 0 [ 593.323723][T13100] CPU: 1 UID: 0 PID: 13100 Comm: syz.1.2547 Tainted: G L syzkaller #0 PREEMPT(full) [ 593.323745][T13100] Tainted: [L]=SOFTLOCKUP [ 593.323752][T13100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 593.323762][T13100] Call Trace: [ 593.323769][T13100] [ 593.323777][T13100] dump_stack_lvl+0xe8/0x150 [ 593.323806][T13100] should_fail_ex+0x410/0x560 [ 593.323832][T13100] ? __alloc_skb+0x1db/0x7a0 [ 593.323958][T13100] should_failslab+0xa8/0x100 [ 593.323993][T13100] ? __alloc_skb+0x1db/0x7a0 [ 593.324012][T13100] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 593.324031][T13100] ? __alloc_skb+0x18d/0x7a0 [ 593.324047][T13100] ? __alloc_skb+0x1db/0x7a0 [ 593.324066][T13100] __alloc_skb+0x1db/0x7a0 [ 593.324085][T13100] alloc_skb_with_frags+0xc6/0x760 [ 593.324134][T13100] ? __lock_acquire+0x747/0x2de0 [ 593.324159][T13100] sock_alloc_send_pskb+0x878/0x990 [ 593.324195][T13100] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 593.324227][T13100] __ip6_append_data+0x2de9/0x40c0 [ 593.324318][T13100] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 593.324406][T13100] ? ip6_mtu+0x7d/0x4a0 [ 593.324443][T13100] ? __pfx___ip6_append_data+0x10/0x10 [ 593.324460][T13100] ? ip6_mtu+0x38c/0x4a0 [ 593.324476][T13100] ? __pfx_ip6_mtu+0x10/0x10 [ 593.324513][T13100] ? ip6_setup_cork+0x631/0xfb0 [ 593.324549][T13100] ip6_make_skb+0x2af/0x320 [ 593.324577][T13100] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 593.324617][T13100] ? __pfx_ip6_make_skb+0x10/0x10 [ 593.324646][T13100] ? ip6_dst_hoplimit+0x65/0x3e0 [ 593.324660][T13100] ? ip6_dst_hoplimit+0x65/0x3e0 [ 593.324679][T13100] udpv6_sendmsg+0x1dfb/0x2610 [ 593.324734][T13100] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 593.324751][T13100] ? udp_lib_get_port+0x177b/0x1c60 [ 593.324832][T13100] ? inet_send_prepare+0x1b4/0x260 [ 593.324893][T13100] ? lockdep_hardirqs_on+0x7b/0x110 [ 593.324935][T13100] ? inet_send_prepare+0x1b4/0x260 [ 593.324957][T13100] ? __local_bh_enable_ip+0xd6/0x140 [ 593.324980][T13100] ? inet_send_prepare+0x1b4/0x260 [ 593.325054][T13100] ? inet6_sendmsg+0xe4/0x120 [ 593.325081][T13100] ? __pfx_inet6_sendmsg+0x10/0x10 [ 593.325104][T13100] sock_sendmsg_nosec+0x90/0x180 [ 593.325130][T13100] __sys_sendto+0x408/0x5a0 [ 593.325150][T13100] ? __pfx___sys_sendto+0x10/0x10 [ 593.325176][T13100] ? __fget_files+0x3a2/0x420 [ 593.325200][T13100] ? ksys_write+0x242/0x270 [ 593.325222][T13100] __ia32_sys_sendto+0xdd/0x100 [ 593.325241][T13100] __do_fast_syscall_32+0x27a/0x6b0 [ 593.325263][T13100] ? do_fast_syscall_32+0x33/0x70 [ 593.325282][T13100] ? asm_int80_emulation+0x1a/0x20 [ 593.325305][T13100] ? do_int80_emulation+0x299/0x500 [ 593.325325][T13100] ? trace_irq_disable+0x3b/0x140 [ 593.325346][T13100] do_fast_syscall_32+0x33/0x70 [ 593.325367][T13100] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 593.325386][T13100] RIP: 0023:0xf740f0ec [ 593.325406][T13100] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 593.325420][T13100] RSP: 002b:00000000f542650c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 593.325437][T13100] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000 [ 593.325449][T13100] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000800008c0 [ 593.325459][T13100] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 593.325469][T13100] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 593.325480][T13100] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 593.325503][T13100] [ 593.410209][ T5715] usb 5-1: Using ep0 maxpacket: 16 [ 593.412277][ T5715] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 593.415349][ T5715] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 593.415423][ T5715] usb 5-1: config 0 has no interface number 0 [ 593.415541][ T5715] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 593.415645][ T5715] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 593.431924][ T5715] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.432000][ T5715] usb 5-1: Product: syz [ 593.432037][ T5715] usb 5-1: Manufacturer: syz [ 593.432081][ T5715] usb 5-1: SerialNumber: syz [ 593.496747][ T5715] usb 5-1: config 0 descriptor?? [ 593.516049][T13092] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 593.525634][T13092] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 593.827204][T13092] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 593.827337][T13092] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 593.931457][T13105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 593.931936][T13105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 594.028433][ T5715] asix 5-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 594.200091][ T988] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 594.307885][ T1785] usb 1-1: USB disconnect, device number 118 [ 594.328961][ T1785] em28xx 1-1:0.0: Disconnecting em28xx [ 594.346529][ T1785] em28xx: Freeing device [ 594.357111][ T988] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 594.359317][ T988] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 594.359345][ T988] usb 2-1: config 0 has no interface number 0 [ 594.376634][ T988] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.376722][ T988] usb 2-1: Product: syz [ 594.376772][ T988] usb 2-1: Manufacturer: syz [ 594.376822][ T988] usb 2-1: SerialNumber: syz [ 594.425144][ T988] usb 2-1: config 0 descriptor?? [ 594.438190][ T5715] asix 5-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 594.438434][ T5715] asix 5-1:0.34: probe with driver asix failed with error -32 [ 594.447246][T13110] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2551'. [ 594.627065][T13117] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 594.627528][T13117] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 594.725435][T13118] netlink: 396 bytes leftover after parsing attributes in process `syz.2.2553'. [ 594.725468][T13118] openvswitch: netlink: Tunnel attr 352 out of range max 16 [ 594.725886][ T988] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 594.762501][ T988] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 594.762824][ T988] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 594.762873][ T988] usb 2-1: media controller created [ 594.812375][T13117] bond6: option lacp_rate: invalid value (5) [ 594.816851][T13117] bond6 (unregistering): Released all slaves [ 594.844071][ T988] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 594.850767][ T1785] usb 1-1: new low-speed USB device number 119 using dummy_hcd [ 594.877137][T13121] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2555'. [ 595.009543][T13124] bond8: Unable to set down delay as MII monitoring is disabled [ 595.019949][ T1785] usb 1-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 595.021534][ T1785] usb 1-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 595.021588][ T1785] usb 1-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 595.021618][ T1785] usb 1-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 255, setting to 8 [ 595.021663][ T1785] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 595.023014][T13124] bond8 (unregistering): Released all slaves [ 595.029569][T13116] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 595.163893][ T988] usb 2-1: USB disconnect, device number 9 [ 595.315813][T13130] xt_hashlimit: size too large, truncated to 1048576 [ 595.570774][T13134] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2558'. [ 595.965939][T12811] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 595.979331][T12811] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 595.989393][T12811] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 595.999821][T12811] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 596.008116][T12811] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 596.105117][ T5695] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 596.143817][ T5703] usb 5-1: USB disconnect, device number 11 [ 596.261161][ T5695] usb 2-1: Using ep0 maxpacket: 32 [ 596.264793][ T5695] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 596.279590][ T5695] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 596.279629][ T5695] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 596.279674][ T5695] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 596.319254][ T5695] usb 2-1: config 0 descriptor?? [ 596.372838][T13137] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 596.373421][T13137] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 596.506940][ T5738] usb 4-1: USB disconnect, device number 38 [ 596.650165][ T5680] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 596.769180][ T5695] ft260 0003:0403:6030.007D: unknown main item tag 0x0 [ 596.769222][ T5695] ft260 0003:0403:6030.007D: unknown main item tag 0x0 [ 596.812017][ T5680] usb 5-1: Using ep0 maxpacket: 16 [ 596.814539][ T5680] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 596.815963][ T5680] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 596.815997][ T5680] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 596.818744][ T5680] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 596.818771][ T5680] usb 5-1: Product: syz [ 596.818790][ T5680] usb 5-1: Manufacturer: syz [ 596.818806][ T5680] usb 5-1: SerialNumber: syz [ 596.887865][ T5680] usb 5-1: config 0 descriptor?? [ 596.900241][ T5680] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 596.900283][ T5680] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 596.960824][ T5695] ft260 0003:0403:6030.007D: chip code: 0000 0000 [ 597.012655][T13141] bridge0: port 1(bridge_slave_0) entered blocking state [ 597.012915][T13141] bridge0: port 1(bridge_slave_0) entered disabled state [ 597.013501][T13141] bridge_slave_0: entered allmulticast mode [ 597.016109][T13141] bridge_slave_0: entered promiscuous mode [ 597.048440][T13141] bridge0: port 2(bridge_slave_1) entered blocking state [ 597.048680][T13141] bridge0: port 2(bridge_slave_1) entered disabled state [ 597.048878][T13141] bridge_slave_1: entered allmulticast mode [ 597.074904][T13141] bridge_slave_1: entered promiscuous mode [ 597.136378][T13141] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 597.151529][T13141] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 597.220292][T13141] team0: Port device team_slave_0 added [ 597.225275][T13141] team0: Port device team_slave_1 added [ 597.293472][T13141] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 597.293495][T13141] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 597.293556][T13141] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 597.296572][T13141] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 597.296601][T13141] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 597.296632][T13141] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 597.421017][T13156] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2563'. [ 597.471980][ T5695] ft260 0003:0403:6030.007D: failed to retrieve system status [ 597.472480][ T5695] ft260 0003:0403:6030.007D: probe with driver ft260 failed with error -71 [ 597.500898][ T5680] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 597.501813][ T5680] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 597.533603][ T5695] usb 2-1: USB disconnect, device number 10 [ 597.561469][T13141] hsr_slave_0: entered promiscuous mode [ 597.579146][T13141] hsr_slave_1: entered promiscuous mode [ 597.591894][T13141] debugfs: 'hsr0' already exists in 'hsr' [ 597.591920][T13141] Cannot create hsr debugfs directory [ 597.786819][ T1785] usb 1-1: string descriptor 0 read error: -71 [ 597.788619][T13160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 597.802276][T13160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 597.924194][ T5680] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 597.924222][ T5680] em28xx 5-1:0.0: No AC97 audio processor [ 598.042110][ T1785] usb 1-1: USB disconnect, device number 119 [ 598.081232][ T5623] Bluetooth: hci5: command tx timeout [ 598.161671][T13141] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.161713][T13141] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 598.290630][T13141] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.290672][T13141] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 598.480162][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 598.517987][T13172] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 598.531786][T13172] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 598.736937][T13176] capability: warning: `syz.2.2568' uses deprecated v2 capabilities in a way that may be insecure [ 598.742532][ T62] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.742626][ T62] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.742698][ T62] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.742796][ T62] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.829076][T13141] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.829115][T13141] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 598.930005][ T5738] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 598.983015][T13179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 598.983494][T13179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 599.048681][T13178] netlink: 396 bytes leftover after parsing attributes in process `syz.2.2569'. [ 599.048714][T13178] openvswitch: netlink: Tunnel attr 352 out of range max 16 [ 599.086417][T13179] bond6: option lacp_rate: invalid value (5) [ 599.094025][T13179] bond6 (unregistering): Released all slaves [ 599.096302][ T5738] usb 2-1: Using ep0 maxpacket: 8 [ 599.109827][ T5738] usb 2-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 599.126896][ T5738] usb 2-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 599.126935][ T5738] usb 2-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 599.126962][ T5738] usb 2-1: config 0 interface 0 has no altsetting 0 [ 599.127000][ T5738] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 599.172812][ T5738] usb 2-1: config 0 descriptor?? [ 599.255184][T13141] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.255224][T13141] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 599.348386][ T1785] usb 5-1: USB disconnect, device number 12 [ 599.351269][ T1785] em28xx 5-1:0.0: Disconnecting em28xx [ 599.357101][ T1785] em28xx: Freeing device [ 599.487726][T13190] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2573'. [ 599.542559][T13141] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 599.547360][T13141] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 599.548611][T13141] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 599.572591][T13141] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 599.573823][T13141] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 599.578335][T13141] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 599.579604][T13141] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 599.619013][ T5738] smartjoyplus 0003:6666:8804.007E: unknown main item tag 0x2 [ 599.619051][ T5738] smartjoyplus 0003:6666:8804.007E: item fetching failed at offset 4/5 [ 599.637221][T13141] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 599.638353][ T5738] smartjoyplus 0003:6666:8804.007E: parse failed [ 599.638430][ T5738] smartjoyplus 0003:6666:8804.007E: probe with driver smartjoyplus failed with error -22 [ 599.690730][ T5703] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 599.784131][T13141] 8021q: adding VLAN 0 to HW filter on device bond0 [ 599.807605][T13141] 8021q: adding VLAN 0 to HW filter on device team0 [ 599.825589][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 599.825711][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 599.844511][ T5703] usb 1-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 599.859325][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 599.859442][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 599.877614][ T5703] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.877644][ T5703] usb 1-1: Product: syz [ 599.877659][ T5703] usb 1-1: Manufacturer: syz [ 599.877673][ T5703] usb 1-1: SerialNumber: syz [ 599.907426][ T5703] usb 1-1: config 0 descriptor?? [ 599.937262][ T5703] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 599.972095][ T5680] usb 2-1: USB disconnect, device number 11 [ 599.981847][ T5679] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 600.076662][T13141] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 600.132817][ T5679] usb 5-1: Using ep0 maxpacket: 32 [ 600.133630][ T5679] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 600.136025][ T5679] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 600.136059][ T5679] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 600.136102][ T5679] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 600.167254][ T5623] Bluetooth: hci5: command tx timeout [ 600.178179][ T5679] usb 5-1: config 0 descriptor?? [ 600.218442][T13141] veth0_vlan: entered promiscuous mode [ 600.235413][T13141] veth1_vlan: entered promiscuous mode [ 600.277155][T13141] veth0_macvtap: entered promiscuous mode [ 600.288553][T13141] veth1_macvtap: entered promiscuous mode [ 600.315160][T13141] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 600.342322][T13141] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 600.409494][ T7451] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.409614][ T7451] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.409653][ T7451] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.409719][ T7451] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.516246][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 600.516272][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 600.576305][ T5703] gspca_sq905c: sq905c_command: usb_control_msg failed (-71) [ 600.576424][ T5703] sq905c 1-1:0.0: probe with driver sq905c failed with error -71 [ 600.610740][ T5703] usb 1-1: USB disconnect, device number 120 [ 600.652875][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 600.652901][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 600.685294][ T5679] ft260 0003:0403:6030.007F: unknown main item tag 0x0 [ 600.685336][ T5679] ft260 0003:0403:6030.007F: unknown main item tag 0x0 [ 600.879174][ T5679] ft260 0003:0403:6030.007F: chip code: 0000 0000 [ 601.129995][ T5695] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 601.194867][T13214] FAULT_INJECTION: forcing a failure. [ 601.194867][T13214] name failslab, interval 1, probability 0, space 0, times 0 [ 601.194906][T13214] CPU: 0 UID: 0 PID: 13214 Comm: syz.0.2580 Tainted: G L syzkaller #0 PREEMPT(full) [ 601.194937][T13214] Tainted: [L]=SOFTLOCKUP [ 601.194947][T13214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 601.194963][T13214] Call Trace: [ 601.194990][T13214] [ 601.195001][T13214] dump_stack_lvl+0xe8/0x150 [ 601.195041][T13214] should_fail_ex+0x410/0x560 [ 601.195085][T13214] should_failslab+0xa8/0x100 [ 601.195122][T13214] __kmalloc_noprof+0xfe/0x720 [ 601.195150][T13214] ? tomoyo_encode+0x2ad/0x570 [ 601.195172][T13214] ? tomoyo_encode+0x2ad/0x570 [ 601.195203][T13214] tomoyo_encode+0x2ad/0x570 [ 601.195233][T13214] tomoyo_realpath_from_path+0x5fa/0x640 [ 601.195269][T13214] ? tomoyo_path_number_perm+0x219/0x5f0 [ 601.195302][T13214] tomoyo_path_number_perm+0x246/0x5f0 [ 601.195335][T13214] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 601.195368][T13214] ? __lock_acquire+0x747/0x2de0 [ 601.195411][T13214] ? hook_file_ioctl_compat+0x1f2/0x600 [ 601.195468][T13214] ? __fget_files+0x2a/0x420 [ 601.195495][T13214] ? __fget_files+0x3a2/0x420 [ 601.195516][T13214] ? __fget_files+0x2a/0x420 [ 601.195542][T13214] security_file_ioctl_compat+0xc3/0x2a0 [ 601.195582][T13214] __ia32_compat_sys_ioctl+0x139/0x950 [ 601.195617][T13214] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 601.195647][T13214] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 601.195680][T13214] ? __fget_files+0x3a2/0x420 [ 601.195708][T13214] ? fput+0xa0/0xd0 [ 601.195741][T13214] ? ksys_write+0x242/0x270 [ 601.195786][T13214] __do_fast_syscall_32+0x27a/0x6b0 [ 601.195823][T13214] ? do_fast_syscall_32+0x33/0x70 [ 601.195851][T13214] ? asm_int80_emulation+0x1a/0x20 [ 601.195873][T13214] ? do_int80_emulation+0x299/0x500 [ 601.195907][T13214] ? trace_irq_disable+0x3b/0x140 [ 601.195938][T13214] do_fast_syscall_32+0x33/0x70 [ 601.195969][T13214] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 601.195997][T13214] RIP: 0023:0xf740f0ec [ 601.196018][T13214] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 601.196039][T13214] RSP: 002b:00000000f542650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 601.196063][T13214] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000008983 [ 601.196079][T13214] RDX: 0000000080000240 RSI: 0000000000000000 RDI: 0000000000000000 [ 601.196094][T13214] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 601.196108][T13214] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 601.196123][T13214] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 601.196156][T13214] [ 601.196208][T13214] ERROR: Out of memory at tomoyo_realpath_from_path. [ 601.324530][ T5695] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 601.351957][ T5695] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 601.352016][ T5695] usb 2-1: config 0 has no interface number 0 [ 601.382005][ T5695] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 601.382037][ T5695] usb 2-1: Product: syz [ 601.382053][ T5695] usb 2-1: Manufacturer: syz [ 601.382070][ T5695] usb 2-1: SerialNumber: syz [ 601.439063][ T5695] usb 2-1: config 0 descriptor?? [ 601.468079][T13216] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 601.502898][ T5679] ft260 0003:0403:6030.007F: failed to retrieve system status [ 601.503300][ T5679] ft260 0003:0403:6030.007F: probe with driver ft260 failed with error -71 [ 601.507134][T13216] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 601.620036][ T5679] usb 5-1: USB disconnect, device number 13 [ 601.697636][ T5695] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 601.713885][ T5695] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 601.714113][ T5695] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 601.714160][ T5695] usb 2-1: media controller created [ 601.768132][ T5695] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 602.006806][T13228] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2585'. [ 602.120738][ T5679] usb 2-1: USB disconnect, device number 12 [ 602.247809][ T5623] Bluetooth: hci5: command tx timeout [ 602.381313][ T5695] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 602.430168][ T5703] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 602.530380][ T5695] usb 1-1: Using ep0 maxpacket: 16 [ 602.531182][ T5695] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 602.532824][ T5695] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 602.532857][ T5695] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 602.535969][ T5695] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 602.535998][ T5695] usb 1-1: Product: syz [ 602.536010][ T5695] usb 1-1: Manufacturer: syz [ 602.536021][ T5695] usb 1-1: SerialNumber: syz [ 602.538623][ T5695] usb 1-1: config 0 descriptor?? [ 602.550149][ T5680] usb 5-1: new low-speed USB device number 14 using dummy_hcd [ 602.555038][ T5695] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 602.555079][ T5695] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 602.634294][ T5703] usb 4-1: Using ep0 maxpacket: 8 [ 602.651168][ T5703] usb 4-1: New USB device found, idVendor=04b4, idProduct=8613, bcdDevice=95.8f [ 602.658076][ T5703] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 602.658106][ T5703] usb 4-1: Product: syz [ 602.658123][ T5703] usb 4-1: Manufacturer: syz [ 602.658138][ T5703] usb 4-1: SerialNumber: syz [ 602.701327][ T5680] usb 5-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 602.702745][ T5680] usb 5-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 602.702784][ T5680] usb 5-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 602.702805][ T5680] usb 5-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 255, setting to 8 [ 602.702857][ T5680] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 602.712435][T13237] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 602.743791][ T5703] usb 4-1: config 0 descriptor?? [ 602.814330][ T5703] usbtest 4-1:0.0: FX2 device [ 602.814357][ T5703] usbtest 4-1:0.0: high-speed {control bulk-in bulk-out} tests (+alt) [ 603.054531][T13244] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2590'. [ 603.125581][T13232] netlink: 396 bytes leftover after parsing attributes in process `syz.3.2586'. [ 603.125616][T13232] openvswitch: netlink: Tunnel attr 352 out of range max 16 [ 603.199797][ T5695] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 603.213508][ T5695] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 603.254047][T13231] bond1: option lacp_rate: invalid value (5) [ 603.273609][T13231] bond1 (unregistering): Released all slaves [ 603.544736][ T1785] usb 4-1: USB disconnect, device number 39 [ 603.644501][ T5695] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 603.644540][ T5695] em28xx 1-1:0.0: No AC97 audio processor [ 604.320572][ T5623] Bluetooth: hci5: command tx timeout [ 604.681620][ T1785] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 604.830299][T11901] usb 2-1: new low-speed USB device number 13 using dummy_hcd [ 604.855678][ T1785] usb 4-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 604.857857][ T1785] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 604.888329][ T1785] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.888360][ T1785] usb 4-1: Product: syz [ 604.888378][ T1785] usb 4-1: Manufacturer: syz [ 604.888395][ T1785] usb 4-1: SerialNumber: syz [ 604.929721][ T1785] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 604.980907][T11901] usb 2-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 604.982495][T11901] usb 2-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 604.982552][T11901] usb 2-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 604.982611][T11901] usb 2-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 255, setting to 8 [ 604.982656][T11901] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 605.037786][T13256] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 605.241204][ T5679] usb 1-1: USB disconnect, device number 121 [ 605.249317][ T5679] em28xx 1-1:0.0: Disconnecting em28xx [ 605.277120][ T5679] em28xx: Freeing device [ 605.629733][ T5680] usb 5-1: string descriptor 0 read error: -71 [ 605.664389][ T1785] gspca_mr97310a: reg read [21] error -110 [ 605.664514][ T1785] mr97310a 4-1:1.0: probe with driver mr97310a failed with error -110 [ 605.739605][T13265] loop9: detected capacity change from 0 to 7 [ 605.951152][ T5680] usb 5-1: USB disconnect, device number 14 [ 606.352518][ T5680] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 606.426591][T12811] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 606.432726][T12811] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 606.447762][T12811] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 606.458372][T12811] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 606.458673][T13265] Dev loop9: unable to read RDB block 7 [ 606.458718][T13265] loop9: unable to read partition table [ 606.459271][T12811] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 606.467495][T13265] loop9: partition table beyond EOD, truncated [ 606.467533][T13265] loop_reread_partitions: partition scan of loop9 (ъщ) failed (rc=-5) [ 606.509967][ T5680] usb 5-1: Using ep0 maxpacket: 32 [ 606.510723][ T5680] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 606.511917][ T5680] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 606.511951][ T5680] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 606.512001][ T5680] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 606.517418][ T5680] usb 5-1: config 0 descriptor?? [ 606.964168][ T5680] ft260 0003:0403:6030.0080: unknown main item tag 0x0 [ 606.964206][ T5680] ft260 0003:0403:6030.0080: unknown main item tag 0x0 [ 607.066329][ T5703] usb 3-1: USB disconnect, device number 70 [ 607.151585][ T5680] ft260 0003:0403:6030.0080: chip code: 0000 0000 [ 607.251143][T13201] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 607.381075][T13201] usb 1-1: device descriptor read/64, error -71 [ 607.449132][T13205] usb 4-1: USB disconnect, device number 40 [ 607.623074][ T5680] ft260 0003:0403:6030.0080: failed to retrieve system status [ 607.623472][ T5680] ft260 0003:0403:6030.0080: probe with driver ft260 failed with error -71 [ 607.627220][ T5680] usb 5-1: USB disconnect, device number 15 [ 607.635037][T13201] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 607.771917][T13201] usb 1-1: device descriptor read/64, error -71 [ 607.825032][T13272] bridge0: port 1(bridge_slave_0) entered blocking state [ 607.825225][T13272] bridge0: port 1(bridge_slave_0) entered disabled state [ 607.825365][T13272] bridge_slave_0: entered allmulticast mode [ 607.827365][T13272] bridge_slave_0: entered promiscuous mode [ 607.858280][T13272] bridge0: port 2(bridge_slave_1) entered blocking state [ 607.858433][T13272] bridge0: port 2(bridge_slave_1) entered disabled state [ 607.858564][T13272] bridge_slave_1: entered allmulticast mode [ 607.868333][T11901] usb 2-1: string descriptor 0 read error: -71 [ 607.885607][T13201] usb usb1-port1: attempt power cycle [ 607.895015][T13272] bridge_slave_1: entered promiscuous mode [ 607.976784][ T30] audit: type=1326 audit(1792425683.559:436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13289 comm="syz.3.2602" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f590ec code=0x7ffc0000 [ 607.976844][ T30] audit: type=1326 audit(1792425683.559:437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13289 comm="syz.3.2602" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f590ec code=0x7ffc0000 [ 607.976965][ T30] audit: type=1326 audit(1792425683.559:438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13289 comm="syz.3.2602" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf7f590ec code=0x7ffc0000 [ 607.977014][ T30] audit: type=1326 audit(1792425683.559:439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13289 comm="syz.3.2602" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f590ec code=0x7ffc0000 [ 607.977136][ T30] audit: type=1326 audit(1792425683.559:440): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13289 comm="syz.3.2602" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=310 compat=1 ip=0xf7f590ec code=0x7ffc0000 [ 607.977180][ T30] audit: type=1326 audit(1792425683.559:441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13289 comm="syz.3.2602" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f590ec code=0x7ffc0000 [ 607.977226][ T30] audit: type=1326 audit(1792425683.559:442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13289 comm="syz.3.2602" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f590ec code=0x7ffc0000 [ 607.977332][ T30] audit: type=1326 audit(1792425683.559:443): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13289 comm="syz.3.2602" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f590ec code=0x7ffc0000 [ 607.978949][T13272] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 607.980318][ T30] audit: type=1326 audit(1792425683.559:444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13289 comm="syz.3.2602" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f590ec code=0x7ffc0000 [ 607.980374][ T30] audit: type=1326 audit(1792425683.559:445): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13289 comm="syz.3.2602" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=364 compat=1 ip=0xf7f590ec code=0x7ffc0000 [ 608.256081][T13201] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 608.268836][T13272] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 608.286782][T13201] usb 1-1: device descriptor read/8, error -71 [ 608.438256][T13290] ipvlan2: entered promiscuous mode [ 608.471573][T11901] usb 2-1: USB disconnect, device number 13 [ 608.524712][T13201] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 608.529322][T13272] team0: Port device team_slave_0 added [ 608.543781][T13201] usb 1-1: device descriptor read/8, error -71 [ 608.553570][T13272] team0: Port device team_slave_1 added [ 608.640381][ T5623] Bluetooth: hci0: command tx timeout [ 608.653181][T13201] usb usb1-port1: unable to enumerate USB device [ 608.674326][T13272] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 608.674347][T13272] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 608.674376][T13272] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 608.676849][T13272] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 608.676867][T13272] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 608.676906][T13272] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 608.833599][T13272] hsr_slave_0: entered promiscuous mode [ 608.834765][T13272] hsr_slave_1: entered promiscuous mode [ 608.835686][T13272] debugfs: 'hsr0' already exists in 'hsr' [ 608.835708][T13272] Cannot create hsr debugfs directory [ 608.880248][T11901] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 609.030843][T11901] usb 2-1: Using ep0 maxpacket: 32 [ 609.032176][T11901] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 609.036071][T11901] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 609.036105][T11901] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 609.036146][T11901] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.041258][T13201] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 609.048955][T11901] usb 2-1: config 0 descriptor?? [ 609.132697][T13272] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.191366][T13201] usb 4-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 609.194645][T13201] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 609.194676][T13201] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 609.197572][T13201] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.197603][T13201] usb 4-1: Product: syz [ 609.197627][T13201] usb 4-1: Manufacturer: syz [ 609.197643][T13201] usb 4-1: SerialNumber: syz [ 609.238543][ T5703] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 609.309846][T13272] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.385177][T13272] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.400555][ T5703] usb 5-1: Using ep0 maxpacket: 8 [ 609.403880][ T5703] usb 5-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 609.409379][ T5703] usb 5-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 609.409521][ T5703] usb 5-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 609.409587][ T5703] usb 5-1: config 0 interface 0 has no altsetting 0 [ 609.409805][ T5703] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.458370][ T5703] usb 5-1: config 0 descriptor?? [ 609.487020][T11901] ft260 0003:0403:6030.0081: unknown main item tag 0x0 [ 609.487068][T11901] ft260 0003:0403:6030.0081: unknown main item tag 0x0 [ 609.534512][T13272] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.674910][T11901] ft260 0003:0403:6030.0081: chip code: 0000 0000 [ 609.675919][T13272] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 609.691256][T13272] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 609.703516][T13272] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 609.713363][T13272] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 609.726563][T13272] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 609.736948][T13272] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 609.737922][T13272] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 609.757579][T13272] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 609.874334][T13272] 8021q: adding VLAN 0 to HW filter on device bond0 [ 609.886779][ T5703] smartjoyplus 0003:6666:8804.0082: unknown main item tag 0x2 [ 609.886898][ T5703] smartjoyplus 0003:6666:8804.0082: item fetching failed at offset 4/5 [ 609.903659][ T5703] smartjoyplus 0003:6666:8804.0082: parse failed [ 609.908711][ T5703] smartjoyplus 0003:6666:8804.0082: probe with driver smartjoyplus failed with error -22 [ 609.933554][T13272] 8021q: adding VLAN 0 to HW filter on device team0 [ 609.953947][ T7453] bridge0: port 1(bridge_slave_0) entered blocking state [ 609.954090][ T7453] bridge0: port 1(bridge_slave_0) entered forwarding state [ 609.987874][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 609.988000][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 610.078779][T11901] ft260 0003:0403:6030.0081: failed to retrieve system status [ 610.079207][T11901] ft260 0003:0403:6030.0081: probe with driver ft260 failed with error -71 [ 610.124400][T11901] usb 2-1: USB disconnect, device number 14 [ 610.211001][T13272] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 610.215618][ T5703] usb 5-1: USB disconnect, device number 16 [ 610.298765][T13272] veth0_vlan: entered promiscuous mode [ 610.313687][T13272] veth1_vlan: entered promiscuous mode [ 610.346344][T13272] veth0_macvtap: entered promiscuous mode [ 610.357676][T13272] veth1_macvtap: entered promiscuous mode [ 610.380910][T13272] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 610.387932][T13272] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 610.421147][ T62] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.442353][ T7453] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.442476][ T7453] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.442515][ T7453] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.480507][T13201] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 610.562838][ T7454] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 610.562865][ T7454] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 610.613218][ T7451] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 610.613253][ T7451] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 610.634276][T13201] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 610.638772][T13201] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 610.638849][T13201] usb 1-1: config 0 has no interface number 0 [ 610.679714][T13201] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.679746][T13201] usb 1-1: Product: syz [ 610.679763][T13201] usb 1-1: Manufacturer: syz [ 610.679780][T13201] usb 1-1: SerialNumber: syz [ 610.704745][T13201] usb 1-1: config 0 descriptor?? [ 610.722456][ T5623] Bluetooth: hci0: command tx timeout [ 610.784641][T13313] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2597'. [ 610.924671][T13201] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 610.949089][T13201] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 610.949434][T13201] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 610.949484][T13201] usb 1-1: media controller created [ 611.037485][T13201] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 611.130000][ T988] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 611.220414][T13205] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 611.282104][ T988] usb 3-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 611.283711][ T988] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 611.283746][ T988] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 611.283789][ T988] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 611.320799][ T5695] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 611.370280][T13201] usb 1-1: USB disconnect, device number 126 [ 611.370478][T13205] usb 2-1: Using ep0 maxpacket: 8 [ 611.371262][T13205] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 611.373172][T13205] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 611.373201][T13205] usb 2-1: config 179 has no interface number 0 [ 611.373247][T13205] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 611.373306][T13205] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 611.373337][T13205] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 611.373365][T13205] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 611.373392][T13205] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 611.373463][T13205] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 611.505060][ T5695] usb 5-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 611.518545][ T5695] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 611.518653][ T5695] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 611.518835][ T5695] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 611.527221][T13321] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 611.657563][ T5736] hid-sensor-hub 0003:1234:5678.0083: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 611.776509][T13326] fido_id[13326]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 611.947360][ T5736] usb 4-1: USB disconnect, device number 41 [ 612.103952][ T5703] usb 2-1: USB disconnect, device number 15 [ 612.104144][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 612.104194][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 612.251912][ T988] qmi_wwan 3-1:1.0: probe with driver qmi_wwan failed with error -71 [ 612.273479][ T988] usb 3-1: USB disconnect, device number 71 [ 612.349359][ T5695] qmi_wwan 5-1:1.0: probe with driver qmi_wwan failed with error -71 [ 612.364437][ T5695] usb 5-1: USB disconnect, device number 17 [ 612.530417][ T5741] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 612.561611][ T5736] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 612.683014][ T5741] usb 1-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 612.701256][ T5741] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.701289][ T5741] usb 1-1: Product: syz [ 612.701308][ T5741] usb 1-1: Manufacturer: syz [ 612.701324][ T5741] usb 1-1: SerialNumber: syz [ 612.706145][ T5741] usb 1-1: config 0 descriptor?? [ 612.734033][ T5736] usb 4-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 612.755104][ T5736] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 612.771285][ T5736] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.771317][ T5736] usb 4-1: Product: syz [ 612.771333][ T5736] usb 4-1: Manufacturer: syz [ 612.771349][ T5736] usb 4-1: SerialNumber: syz [ 612.796344][ T5741] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 612.803916][ T5623] Bluetooth: hci0: command tx timeout [ 612.831692][ T5736] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 612.869460][T13336] fuse: blksize only supported for fuseblk [ 613.321713][ T5741] gspca_sq905c: sq905c_command: usb_control_msg failed (-71) [ 613.321842][ T5741] sq905c 1-1:0.0: probe with driver sq905c failed with error -71 [ 613.348845][ T5695] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 613.360160][ T5741] usb 1-1: USB disconnect, device number 127 [ 613.520793][ T5695] usb 3-1: Using ep0 maxpacket: 32 [ 613.521809][ T5695] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 613.522966][ T5695] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 613.523009][ T5695] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 613.523044][ T5695] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 613.526713][ T5695] usb 3-1: config 0 descriptor?? [ 613.558858][ T5736] gspca_mr97310a: reg read [21] error -110 [ 613.558980][ T5736] mr97310a 4-1:1.0: probe with driver mr97310a failed with error -110 [ 613.735815][T13353] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2619'. [ 613.975627][ T5695] ft260 0003:0403:6030.0084: unknown main item tag 0x0 [ 613.976368][ T5695] ft260 0003:0403:6030.0084: unknown main item tag 0x0 [ 614.003753][T13361] netlink: 540 bytes leftover after parsing attributes in process `syz.1.2624'. [ 614.143142][ T5695] ft260 0003:0403:6030.0084: chip code: 0000 0000 [ 614.170037][ T5703] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 614.190009][T13201] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 614.321254][ T5703] usb 1-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 614.322796][ T5703] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 614.322855][ T5703] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 614.325607][ T5703] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.325638][ T5703] usb 1-1: Product: syz [ 614.325658][ T5703] usb 1-1: Manufacturer: syz [ 614.325676][ T5703] usb 1-1: SerialNumber: syz [ 614.341830][T13201] usb 5-1: Using ep0 maxpacket: 32 [ 614.351136][ T5680] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 614.380207][T13201] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 614.425162][T13201] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 614.425200][T13201] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 614.425243][T13201] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.463238][ T5703] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 614.463383][ T5703] gspca_mr97310a: reg write [21] error -22 [ 614.463474][ T5703] mr97310a 1-1:1.0: probe with driver mr97310a failed with error -22 [ 614.464830][T13201] usb 5-1: config 0 descriptor?? [ 614.532171][ T5680] usb 2-1: New USB device found, idVendor=2c7c, idProduct=0125, bcdDevice= 0.00 [ 614.533685][ T5680] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 614.533756][ T5680] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 614.533806][ T5680] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.674689][ T5695] ft260 0003:0403:6030.0084: failed to retrieve system status [ 614.675158][ T5695] ft260 0003:0403:6030.0084: probe with driver ft260 failed with error -71 [ 614.686331][ T5695] usb 3-1: USB disconnect, device number 72 [ 614.854509][ T5741] hid-sensor-hub 0003:1234:5678.0085: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 614.881064][ T5623] Bluetooth: hci0: command tx timeout [ 614.932590][T13201] ft260 0003:0403:6030.0086: unknown main item tag 0x0 [ 614.932632][T13201] ft260 0003:0403:6030.0086: unknown main item tag 0x0 [ 615.065957][T13367] fido_id[13367]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 615.120837][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 615.122957][T13201] ft260 0003:0403:6030.0086: chip code: 0000 0000 [ 615.256806][ T5703] usb 4-1: USB disconnect, device number 42 [ 615.276678][T13370] FAULT_INJECTION: forcing a failure. [ 615.276678][T13370] name failslab, interval 1, probability 0, space 0, times 0 [ 615.276718][T13370] CPU: 0 UID: 0 PID: 13370 Comm: syz.2.2626 Tainted: G L syzkaller #0 PREEMPT(full) [ 615.276753][T13370] Tainted: [L]=SOFTLOCKUP [ 615.276763][T13370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 615.276777][T13370] Call Trace: [ 615.276787][T13370] [ 615.276798][T13370] dump_stack_lvl+0xe8/0x150 [ 615.276851][T13370] should_fail_ex+0x410/0x560 [ 615.276893][T13370] should_failslab+0xa8/0x100 [ 615.276929][T13370] __kmalloc_noprof+0xfe/0x720 [ 615.276963][T13370] ? tomoyo_encode+0x2ad/0x570 [ 615.276986][T13370] ? tomoyo_encode+0x2ad/0x570 [ 615.277017][T13370] tomoyo_encode+0x2ad/0x570 [ 615.277046][T13370] tomoyo_realpath_from_path+0x5fa/0x640 [ 615.277082][T13370] ? tomoyo_path_number_perm+0x219/0x5f0 [ 615.277115][T13370] tomoyo_path_number_perm+0x246/0x5f0 [ 615.277150][T13370] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 615.277189][T13370] ? __lock_acquire+0x747/0x2de0 [ 615.277234][T13370] ? hook_file_ioctl_compat+0x1f2/0x600 [ 615.277292][T13370] ? __fget_files+0x2a/0x420 [ 615.277320][T13370] ? __fget_files+0x3a2/0x420 [ 615.277339][T13370] ? __fget_files+0x2a/0x420 [ 615.277366][T13370] security_file_ioctl_compat+0xc3/0x2a0 [ 615.277403][T13370] __ia32_compat_sys_ioctl+0x139/0x950 [ 615.277437][T13370] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 615.277468][T13370] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 615.277501][T13370] ? __fget_files+0x3a2/0x420 [ 615.277531][T13370] ? fput+0xa0/0xd0 [ 615.277563][T13370] ? ksys_write+0x242/0x270 [ 615.277601][T13370] __do_fast_syscall_32+0x27a/0x6b0 [ 615.277632][T13370] ? do_fast_syscall_32+0x33/0x70 [ 615.277662][T13370] ? asm_int80_emulation+0x1a/0x20 [ 615.277685][T13370] ? do_int80_emulation+0x299/0x500 [ 615.277713][T13370] ? trace_irq_disable+0x3b/0x140 [ 615.277757][T13370] do_fast_syscall_32+0x33/0x70 [ 615.277788][T13370] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 615.277817][T13370] RIP: 0023:0xf747f0ec [ 615.277838][T13370] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 615.277866][T13370] RSP: 002b:00000000f549650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 615.277890][T13370] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000401c5820 [ 615.277906][T13370] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 615.277920][T13370] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 615.277934][T13370] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 615.277949][T13370] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 615.277984][T13370] [ 615.292581][T13370] ERROR: Out of memory at tomoyo_realpath_from_path. [ 615.426474][ T5680] qmi_wwan 2-1:1.0: probe with driver qmi_wwan failed with error -71 [ 615.641935][ T5680] usb 2-1: USB disconnect, device number 16 [ 615.649154][T13201] ft260 0003:0403:6030.0086: failed to retrieve system status [ 615.649571][T13201] ft260 0003:0403:6030.0086: probe with driver ft260 failed with error -71 [ 615.682140][T13201] usb 5-1: USB disconnect, device number 18 [ 616.091220][T13386] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2631'. [ 616.208774][T13388] FAULT_INJECTION: forcing a failure. [ 616.208774][T13388] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 616.208816][T13388] CPU: 0 UID: 0 PID: 13388 Comm: syz.2.2632 Tainted: G L syzkaller #0 PREEMPT(full) [ 616.208848][T13388] Tainted: [L]=SOFTLOCKUP [ 616.208857][T13388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 616.208872][T13388] Call Trace: [ 616.208882][T13388] [ 616.208893][T13388] dump_stack_lvl+0xe8/0x150 [ 616.208934][T13388] should_fail_ex+0x410/0x560 [ 616.208974][T13388] _copy_from_user+0x2d/0xb0 [ 616.209000][T13388] snd_seq_oss_write+0x6e2/0x950 [ 616.209249][T13388] ? __pfx_snd_seq_oss_write+0x10/0x10 [ 616.209293][T13388] ? security_file_permission+0x75/0x260 [ 616.209331][T13388] odev_write+0x5a/0x80 [ 616.209365][T13388] ? __pfx_odev_write+0x10/0x10 [ 616.209389][T13388] vfs_write+0x296/0xba0 [ 616.209424][T13388] ? __pfx_vfs_write+0x10/0x10 [ 616.209451][T13388] ? __fget_files+0x2a/0x420 [ 616.209477][T13388] ? __fget_files+0x2a/0x420 [ 616.209498][T13388] ? __fget_files+0x3a2/0x420 [ 616.209519][T13388] ? __fget_files+0x2a/0x420 [ 616.209550][T13388] ksys_write+0x150/0x270 [ 616.209579][T13388] ? __pfx_ksys_write+0x10/0x10 [ 616.209615][T13388] __do_fast_syscall_32+0x27a/0x6b0 [ 616.209648][T13388] ? do_fast_syscall_32+0x33/0x70 [ 616.209677][T13388] ? asm_int80_emulation+0x1a/0x20 [ 616.209700][T13388] ? do_int80_emulation+0x299/0x500 [ 616.209729][T13388] ? trace_irq_disable+0x3b/0x140 [ 616.209760][T13388] do_fast_syscall_32+0x33/0x70 [ 616.209790][T13388] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 616.209819][T13388] RIP: 0023:0xf747f0ec [ 616.209840][T13388] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 616.209860][T13388] RSP: 002b:00000000f549650c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 616.209882][T13388] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 616.209897][T13388] RDX: 00000000000002f9 RSI: 0000000000000000 RDI: 0000000000000000 [ 616.209910][T13388] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 616.209923][T13388] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 616.209937][T13388] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 616.209969][T13388] [ 616.345885][ T5680] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 616.518186][T13390] FAULT_INJECTION: forcing a failure. [ 616.518186][T13390] name failslab, interval 1, probability 0, space 0, times 0 [ 616.518226][T13390] CPU: 1 UID: 0 PID: 13390 Comm: syz.2.2633 Tainted: G L syzkaller #0 PREEMPT(full) [ 616.518257][T13390] Tainted: [L]=SOFTLOCKUP [ 616.518267][T13390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 616.518281][T13390] Call Trace: [ 616.518311][T13390] [ 616.518322][T13390] dump_stack_lvl+0xe8/0x150 [ 616.518360][T13390] should_fail_ex+0x410/0x560 [ 616.518399][T13390] should_failslab+0xa8/0x100 [ 616.518435][T13390] __kmalloc_cache_node_noprof+0xaa/0x620 [ 616.518465][T13390] ? __get_vm_area_node+0x155/0x2f0 [ 616.518485][T13390] ? __get_vm_area_node+0x155/0x2f0 [ 616.518513][T13390] __get_vm_area_node+0x155/0x2f0 [ 616.518542][T13390] __vmalloc_node_range_noprof+0x343/0x1540 [ 616.518568][T13390] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 616.518629][T13390] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 616.518655][T13390] ? lock_acquire+0x115/0x350 [ 616.518685][T13390] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 616.518721][T13390] __vmalloc_noprof+0xd2/0x120 [ 616.518746][T13390] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 616.518779][T13390] bpf_prog_alloc_no_stats+0x47/0x560 [ 616.518808][T13390] ? bpf_prog_alloc+0x2a/0x1a0 [ 616.518839][T13390] bpf_prog_alloc+0x3c/0x1a0 [ 616.518872][T13390] bpf_prog_load+0x7f8/0x1c20 [ 616.518915][T13390] ? __pfx_bpf_prog_load+0x10/0x10 [ 616.518973][T13390] __sys_bpf+0xd0d/0xd90 [ 616.519012][T13390] ? __pfx___sys_bpf+0x10/0x10 [ 616.519043][T13390] ? ksys_write+0x1e6/0x270 [ 616.519073][T13390] ? __mutex_unlock_slowpath+0x731/0x900 [ 616.519128][T13390] ? fput+0xa0/0xd0 [ 616.519161][T13390] ? ksys_write+0x242/0x270 [ 616.519192][T13390] __ia32_sys_bpf+0xba/0xd0 [ 616.519223][T13390] __do_fast_syscall_32+0x27a/0x6b0 [ 616.519254][T13390] ? do_fast_syscall_32+0x33/0x70 [ 616.519283][T13390] ? asm_int80_emulation+0x1a/0x20 [ 616.519306][T13390] ? do_int80_emulation+0x299/0x500 [ 616.519335][T13390] ? trace_irq_disable+0x3b/0x140 [ 616.519366][T13390] do_fast_syscall_32+0x33/0x70 [ 616.519396][T13390] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 616.519425][T13390] RIP: 0023:0xf747f0ec [ 616.519446][T13390] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 616.519466][T13390] RSP: 002b:00000000f549650c EFLAGS: 00000206 ORIG_RAX: 0000000000000165 [ 616.519491][T13390] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800003c0 [ 616.519507][T13390] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 616.519520][T13390] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 616.519534][T13390] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 616.519548][T13390] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 616.519580][T13390] [ 616.529052][ T5680] usb 2-1: New USB device found, idVendor=0506, idProduct=4601, bcdDevice= 1.00 [ 616.542437][ T5680] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 616.542541][ T5680] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 616.542652][ T5680] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 616.691358][T13390] warn_alloc: 1 callbacks suppressed [ 616.691384][T13390] syz.2.2633: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 616.691476][T13390] CPU: 0 UID: 0 PID: 13390 Comm: syz.2.2633 Tainted: G L syzkaller #0 PREEMPT(full) [ 616.691506][T13390] Tainted: [L]=SOFTLOCKUP [ 616.691515][T13390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 616.691529][T13390] Call Trace: [ 616.691539][T13390] [ 616.691550][T13390] dump_stack_lvl+0xe8/0x150 [ 616.691590][T13390] warn_alloc+0x24d/0x270 [ 616.691621][T13390] ? __kasan_kmalloc+0x22/0xb0 [ 616.691664][T13390] ? __pfx_warn_alloc+0x10/0x10 [ 616.691689][T13390] ? __get_vm_area_node+0x155/0x2f0 [ 616.691719][T13390] ? __get_vm_area_node+0x2a9/0x2f0 [ 616.691749][T13390] __vmalloc_node_range_noprof+0x36b/0x1540 [ 616.691805][T13390] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 616.691830][T13390] ? lock_acquire+0x115/0x350 [ 616.691860][T13390] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 616.691966][T13390] __vmalloc_noprof+0xd2/0x120 [ 616.692041][T13390] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 616.692126][T13390] bpf_prog_alloc_no_stats+0x47/0x560 [ 616.692205][T13390] ? bpf_prog_alloc+0x2a/0x1a0 [ 616.692282][T13390] bpf_prog_alloc+0x3c/0x1a0 [ 616.692365][T13390] bpf_prog_load+0x7f8/0x1c20 [ 616.692475][T13390] ? __pfx_bpf_prog_load+0x10/0x10 [ 616.692624][T13390] __sys_bpf+0xd0d/0xd90 [ 616.692743][T13390] ? __pfx___sys_bpf+0x10/0x10 [ 616.692819][T13390] ? ksys_write+0x1e6/0x270 [ 616.692894][T13390] ? __mutex_unlock_slowpath+0x731/0x900 [ 616.693024][T13390] ? fput+0xa0/0xd0 [ 616.693107][T13390] ? ksys_write+0x242/0x270 [ 616.693189][T13390] __ia32_sys_bpf+0xba/0xd0 [ 616.693266][T13390] __do_fast_syscall_32+0x27a/0x6b0 [ 616.693350][T13390] ? do_fast_syscall_32+0x33/0x70 [ 616.693444][T13390] ? asm_int80_emulation+0x1a/0x20 [ 616.693500][T13390] ? do_int80_emulation+0x299/0x500 [ 616.693574][T13390] ? trace_irq_disable+0x3b/0x140 [ 616.693659][T13390] do_fast_syscall_32+0x33/0x70 [ 616.693742][T13390] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 616.693864][T13390] RIP: 0023:0xf747f0ec [ 616.693919][T13390] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 616.693965][T13390] RSP: 002b:00000000f549650c EFLAGS: 00000206 ORIG_RAX: 0000000000000165 [ 616.694028][T13390] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800003c0 [ 616.694071][T13390] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 616.694112][T13390] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 616.694138][T13390] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 616.694150][T13390] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 616.694187][T13390] [ 616.708078][T13390] Mem-Info: [ 616.708123][T13390] active_anon:6352 inactive_anon:3 isolated_anon:0 [ 616.708123][T13390] active_file:2 inactive_file:60042 isolated_file:0 [ 616.708123][T13390] unevictable:0 dirty:351 writeback:0 [ 616.708123][T13390] slab_reclaimable:9932 slab_unreclaimable:111096 [ 616.708123][T13390] mapped:31439 shmem:522 pagetables:1391 [ 616.708123][T13390] sec_pagetables:0 bounce:0 [ 616.708123][T13390] kernel_misc_reclaimable:0 [ 616.708123][T13390] free:1267940 free_pcp:7378 free_cma:0 [ 616.712010][T13390] Node 0 active_anon:25408kB inactive_anon:12kB active_file:8kB inactive_file:239960kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:125756kB dirty:1400kB writeback:0kB shmem:2088kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13256kB pagetables:5424kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 616.712248][T13390] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 616.712562][T13390] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 616.741827][T13390] lowmem_reserve[]: 0 2468 2468 2468 2468 [ 616.741967][T13390] Node 0 DMA32 free:1106824kB boost:0kB min:33984kB low:42480kB high:50976kB reserved_highatomic:0kB free_highatomic:0kB active_anon:25408kB inactive_anon:12kB active_file:8kB inactive_file:239960kB unevictable:0kB writepending:1400kB zspages:248kB present:3129332kB managed:2527508kB mlocked:0kB bounce:0kB free_pcp:29500kB local_pcp:19668kB free_cma:0kB [ 616.742158][T13390] lowmem_reserve[]: 0 0 0 0 0 [ 616.742258][T13390] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 616.742409][T13390] lowmem_reserve[]: 0 0 0 0 0 [ 616.742517][T13390] Node 1 Normal free:3949576kB boost:0kB min:55916kB low:69892kB high:83868kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 616.742705][T13390] lowmem_reserve[]: 0 0 0 0 0 [ 616.748026][T13390] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 616.761785][T13390] Node 0 DMA32: 552*4kB (ME) 821*8kB (ME) 352*16kB (ME) 256*32kB (ME) 67*64kB (UME) 79*128kB (UME) 55*256kB (UME) 10*512kB (UME) 2*1024kB (ME) 8*2048kB (ME) 252*4096kB (UM) = 1106824kB [ 616.762313][T13390] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 616.762603][T13390] Node 1 Normal: 4*4kB (UM) 7*8kB (UM) 8*16kB (UM) 6*32kB (UM) 12*64kB (UM) 5*128kB (UM) 7*256kB (UM) 5*512kB (UM) 3*1024kB (UM) 2*2048kB (U) 961*4096kB (UM) = 3949576kB [ 616.763043][T13390] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 616.763094][T13390] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 616.763181][T13390] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 616.763233][T13390] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 616.763278][T13390] 60569 total pagecache pages [ 616.767421][T13390] 7 pages in swap cache [ 616.767462][T13390] Free swap = 124912kB [ 616.767493][T13390] Total swap = 124996kB [ 616.767518][T13390] 2097051 pages RAM [ 616.767549][T13390] 0 pages HighMem/MovableOnly [ 616.767572][T13390] 433558 pages reserved [ 616.767601][T13390] 0 pages cma reserved [ 617.309746][ T5695] usb 1-1: USB disconnect, device number 2 [ 617.667929][ T5680] pegasus 2-1:1.0: probe with driver pegasus failed with error -71 [ 617.708908][ T5680] usb 2-1: USB disconnect, device number 17 [ 617.760976][T13366] ================================================================== [ 617.761056][T13366] BUG: KASAN: double-free in dev_free+0x43f/0x750 [ 617.761164][T13366] Free of addr ffff88804ca7c520 by task syz.1.2625/13366 [ 617.761175][T13366] [ 617.761211][T13366] CPU: 0 UID: 0 PID: 13366 Comm: syz.1.2625 Tainted: G L syzkaller #0 PREEMPT(full) [ 617.761256][T13366] Tainted: [L]=SOFTLOCKUP SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 617.761262][T13366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 617.761273][T13366] Call Trace: [ 617.761280][T13366] [ 617.761287][T13366] dump_stack_lvl+0xe8/0x150 [ 617.761312][T13366] print_address_description+0x55/0x1e0 [ 617.761341][T13366] print_report+0x58/0x70 [ 617.761362][T13366] ? dev_free+0x43f/0x750 [ 617.761375][T13366] kasan_report_invalid_free+0xea/0x110 [ 617.761401][T13366] ? dev_free+0x43f/0x750 [ 617.761417][T13366] ? dev_free+0x43f/0x750 [ 617.761432][T13366] __kasan_slab_pre_free+0x104/0x120 [ 617.761454][T13366] kfree+0x173/0x650 [ 617.761469][T13366] ? rcu_is_watching+0x16/0xb0 [ 617.761490][T13366] ? dev_free+0x43f/0x750 [ 617.761507][T13366] dev_free+0x43f/0x750 [ 617.761558][T13366] raw_release+0x199/0x260 [ 617.761580][T13366] ? __pfx_raw_release+0x10/0x10 [ 617.761600][T13366] __fput+0x40d/0xa50 [ 617.761633][T13366] task_work_run+0x1d9/0x270 [ 617.761653][T13366] ? __pfx_task_work_run+0x10/0x10 [ 617.761671][T13366] ? do_exit+0x735/0x2350 [ 617.761686][T13366] ? kmem_cache_free+0x182/0x650 [ 617.761704][T13366] ? put_net+0x191/0x260 [ 617.761725][T13366] do_exit+0x73a/0x2350 [ 617.761744][T13366] ? __pfx_do_exit+0x10/0x10 [ 617.761766][T13366] __ia32_sys_exit+0x40/0x40 [ 617.761781][T13366] ia32_sys_call+0x18c5/0x18d0 [ 617.761800][T13366] __do_fast_syscall_32+0x27a/0x6b0 [ 617.761838][T13366] ? do_fast_syscall_32+0x33/0x70 [ 617.761866][T13366] ? asm_int80_emulation+0x1a/0x20 [ 617.761887][T13366] ? do_int80_emulation+0x299/0x500 [ 617.761914][T13366] ? trace_irq_disable+0x3b/0x140 [ 617.761940][T13366] do_fast_syscall_32+0x33/0x70 [ 617.761966][T13366] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 617.761993][T13366] RIP: 0023:0xf740f0ec [ 617.762010][T13366] Code: Unable to access opcode bytes at 0xf740f0c2. [ 617.762069][T13366] RSP: 002b:00000000f54264cc EFLAGS: 00000206 ORIG_RAX: 0000000000000001 [ 617.762094][T13366] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000000 [ 617.762111][T13366] RDX: 0000000000000000 RSI: 00000000f7051360 RDI: 00000000f54265f4 [ 617.762125][T13366] RBP: 00000000f70565b9 R08: 0000000000000000 R09: 0000000000000000 [ 617.762140][T13366] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 617.762154][T13366] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 617.762177][T13366] [ 617.762185][T13366] [ 617.762192][T13366] Allocated by task 13379: [ 617.762233][T13366] kasan_save_track+0x3e/0x80 [ 617.762258][T13366] __kasan_kmalloc+0x93/0xb0 [ 617.762283][T13366] __kmalloc_node_track_caller_noprof+0x4b4/0x720 [ 617.762309][T13366] memdup_user+0x2b/0xd0 [ 617.762333][T13366] raw_ioctl+0xdbc/0x41c0 [ 617.762351][T13366] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 617.762376][T13366] __do_fast_syscall_32+0x27a/0x6b0 [ 617.762401][T13366] do_fast_syscall_32+0x33/0x70 [ 617.762426][T13366] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 617.762452][T13366] [ 617.762457][T13366] Freed by task 13377: [ 617.762467][T13366] kasan_save_track+0x3e/0x80 [ 617.762489][T13366] kasan_save_free_info+0x40/0x50 [ 617.762509][T13366] __kasan_slab_free+0x5c/0x80 [ 617.762531][T13366] kfree+0x1c5/0x650 [ 617.762548][T13366] dev_free+0x43f/0x750 [ 617.762567][T13366] raw_release+0x199/0x260 [ 617.762623][T13366] __fput+0x40d/0xa50 [ 617.762650][T13366] task_work_run+0x1d9/0x270 [ 617.762672][T13366] exit_to_user_mode_loop+0x204/0x770 [ 617.762695][T13366] __do_fast_syscall_32+0x437/0x6b0 [ 617.762720][T13366] do_fast_syscall_32+0x33/0x70 [ 617.762745][T13366] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 617.762771][T13366] [ 617.762776][T13366] The buggy address belongs to the object at ffff88804ca7c520 [ 617.762776][T13366] which belongs to the cache kmalloc-16 of size 16 [ 617.762859][T13366] The buggy address is located 0 bytes inside of [ 617.762859][T13366] 16-byte region [ffff88804ca7c520, ffff88804ca7c530) [ 617.762882][T13366] [ 617.762889][T13366] The buggy address belongs to the physical page: [ 617.762907][T13366] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804ca7c780 pfn:0x4ca7c [ 617.762929][T13366] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 617.762948][T13366] page_type: f5(slab) [ 617.762970][T13366] raw: 00fff00000000200 ffff88801c041640 ffffea00012ae8d0 ffffea00012a8ed0 [ 617.762990][T13366] raw: ffff88804ca7c780 000000000080003c 00000000f5000000 0000000000000000 [ 617.763002][T13366] page dumped because: kasan: bad access detected [ 617.763018][T13366] page_owner tracks the page as allocated [ 617.763027][T13366] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5680, tgid 5680 (kworker/0:4), ts 616529361705 [ 617.763061][T13366] register_dummy_stack+0x98/0x100 [ 617.763089][T13366] init_page_owner+0x2e/0x600 [ 617.763228][T13366] page_ext_init+0x511/0x550 [ 617.763261][T13366] mm_core_init+0x97/0xb0 [ 617.763324][T13366] page last free pid 13371 tgid 13357 ts 616507637365 stack trace: [ 617.763341][T13366] __free_frozen_pages+0xc93/0xd90 [ 617.763363][T13366] tlb_finish_mmu+0x13e/0x220 [ 617.763386][T13366] exit_mmap+0x4b2/0x9f0 [ 617.763405][T13366] __mmput+0x118/0x420 [ 617.763429][T13366] exit_mm+0x18e/0x240 [ 617.763447][T13366] do_exit+0x6cd/0x2350 [ 617.763466][T13366] do_group_exit+0x22d/0x2f0 [ 617.763487][T13366] get_signal+0x121b/0x12c0 [ 617.763513][T13366] arch_do_signal_or_restart+0xbb/0x860 [ 617.763560][T13366] exit_to_user_mode_loop+0x10e/0x770 [ 617.763583][T13366] __do_fast_syscall_32+0x437/0x6b0 [ 617.763616][T13366] do_fast_syscall_32+0x33/0x70 [ 617.763642][T13366] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 617.763668][T13366] [ 617.763675][T13366] Memory state around the buggy address: [ 617.763688][T13366] ffff88804ca7c400: fa fb fc fc fa fb fc fc 00 01 fc fc 00 05 fc fc [ 617.763705][T13366] ffff88804ca7c480: 00 05 fc fc 00 00 fc fc fa fb fc fc fa fb fc fc [ 617.763757][T13366] >ffff88804ca7c500: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 617.763770][T13366] ^ [ 617.763783][T13366] ffff88804ca7c580: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc [ 617.763798][T13366] ffff88804ca7c600: fa fb fc fc fa fb fc fc 00 06 fc fc fa fb fc fc [ 617.763810][T13366] ================================================================== [ 617.782825][ T5736] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 617.870734][T13201] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 617.940676][ T5736] usb 5-1: Using ep0 maxpacket: 8 [ 617.955862][ T5736] usb 5-1: New USB device found, idVendor=6666, idProduct=8804, bcdDevice= 0.00 [ 617.988017][ T5736] usb 5-1: config 0 interface 0 altsetting 144 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 617.988123][ T5736] usb 5-1: config 0 interface 0 altsetting 144 endpoint 0x81 has invalid wMaxPacketSize 0 [ 617.988187][ T5736] usb 5-1: config 0 interface 0 has no altsetting 0 [ 617.988304][ T5736] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 618.053278][T13201] usb 3-1: Using ep0 maxpacket: 16 [ 618.076754][ T5736] usb 5-1: config 0 descriptor?? [ 618.089568][T13201] usb 3-1: unable to get BOS descriptor set [ 618.090934][T13201] usb 3-1: New USB device found, idVendor=047f, idProduct=c010, bcdDevice= 0.40 [ 618.121309][ T5695] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 618.255099][T13201] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 188, changing to 7 [ 618.255152][T13201] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 72, changing to 7 [ 618.304214][ T5695] usb 1-1: Using ep0 maxpacket: 32 [ 618.307499][ T5695] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 618.363971][ T5695] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 618.364118][ T5695] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 618.364320][ T5695] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 618.369821][T13201] usb 3-1: string descriptor 0 read error: -22 [ 618.371101][T13201] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.499097][ T5695] usb 1-1: config 0 descriptor?? [ 618.681636][ T5736] smartjoyplus 0003:6666:8804.0087: unknown main item tag 0x2 [ 618.681680][ T5736] smartjoyplus 0003:6666:8804.0087: item fetching failed at offset 4/5 [ 618.688854][ T5736] smartjoyplus 0003:6666:8804.0087: parse failed [ 618.688912][ T5736] smartjoyplus 0003:6666:8804.0087: probe with driver smartjoyplus failed with error -22 [ 618.900064][T13201] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 618.960529][T13201] usb 3-1: USB disconnect, device number 73 [ 619.023777][ T5695] ft260 0003:0403:6030.0088: unknown main item tag 0x0 [ 619.023808][ T5695] ft260 0003:0403:6030.0088: unknown main item tag 0x0 [ 619.851492][ T5741] usb 5-1: USB disconnect, device number 19 [ 620.117730][ T5695] ft260 0003:0403:6030.0088: failed to retrieve chip version [ 620.118134][ T5695] ft260 0003:0403:6030.0088: probe with driver ft260 failed with error -71 [ 620.341677][ T62] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.341845][T13366] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 620.359323][T13366] CPU: 1 UID: 0 PID: 13366 Comm: syz.1.2625 Tainted: G L syzkaller #0 PREEMPT(full) [ 620.370266][T13366] Tainted: [L]=SOFTLOCKUP [ 620.374679][T13366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 620.384736][T13366] Call Trace: [ 620.388023][T13366] [ 620.390963][T13366] vpanic+0x56d/0xa60 [ 620.394964][T13366] ? __pfx_vpanic+0x10/0x10 [ 620.399489][T13366] ? __pfx___schedule+0x10/0x10 [ 620.404451][T13366] panic+0xc5/0xd0 [ 620.408225][T13366] ? __pfx_panic+0x10/0x10 [ 620.412744][T13366] ? preempt_schedule_common+0x7f/0xd0 [ 620.418240][T13366] check_panic_on_warn+0x89/0xb0 [ 620.423204][T13366] end_report+0x73/0x170 [ 620.427534][T13366] ? dev_free+0x43f/0x750 [ 620.431938][T13366] kasan_report_invalid_free+0xfa/0x110 [ 620.437535][T13366] ? dev_free+0x43f/0x750 [ 620.441911][T13366] ? dev_free+0x43f/0x750 [ 620.446269][T13366] __kasan_slab_pre_free+0x104/0x120 [ 620.451587][T13366] kfree+0x173/0x650 [ 620.455519][T13366] ? rcu_is_watching+0x16/0xb0 [ 620.460330][T13366] ? dev_free+0x43f/0x750 [ 620.464711][T13366] dev_free+0x43f/0x750 [ 620.468907][T13366] raw_release+0x199/0x260 [ 620.473363][T13366] ? __pfx_raw_release+0x10/0x10 [ 620.478338][T13366] __fput+0x40d/0xa50 [ 620.482378][T13366] task_work_run+0x1d9/0x270 [ 620.487007][T13366] ? __pfx_task_work_run+0x10/0x10 [ 620.492140][T13366] ? do_exit+0x735/0x2350 [ 620.496502][T13366] ? kmem_cache_free+0x182/0x650 [ 620.501482][T13366] ? put_net+0x191/0x260 [ 620.505803][T13366] do_exit+0x73a/0x2350 [ 620.510019][T13366] ? __pfx_do_exit+0x10/0x10 [ 620.514655][T13366] __ia32_sys_exit+0x40/0x40 [ 620.519277][T13366] ia32_sys_call+0x18c5/0x18d0 [ 620.524064][T13366] __do_fast_syscall_32+0x27a/0x6b0 [ 620.529310][T13366] ? do_fast_syscall_32+0x33/0x70 [ 620.534383][T13366] ? asm_int80_emulation+0x1a/0x20 [ 620.539544][T13366] ? do_int80_emulation+0x299/0x500 [ 620.544970][T13366] ? trace_irq_disable+0x3b/0x140 [ 620.550047][T13366] do_fast_syscall_32+0x33/0x70 [ 620.554987][T13366] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 620.561391][T13366] RIP: 0023:0xf740f0ec [ 620.565489][T13366] Code: Unable to access opcode bytes at 0xf740f0c2. [ 620.572189][T13366] RSP: 002b:00000000f54264cc EFLAGS: 00000206 ORIG_RAX: 0000000000000001 [ 620.580655][T13366] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000000 [ 620.588667][T13366] RDX: 0000000000000000 RSI: 00000000f7051360 RDI: 00000000f54265f4 [ 620.596677][T13366] RBP: 00000000f70565b9 R08: 0000000000000000 R09: 0000000000000000 [ 620.604682][T13366] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 620.612687][T13366] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 620.620703][T13366] [ 620.623921][T13366] Kernel Offset: disabled [ 620.628264][T13366] Rebooting in 86400 seconds..