last executing test programs: 8.479838007s ago: executing program 4 (id=1604): socket$inet6(0xa, 0x80002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket(0x2c, 0x803, 0x3) syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) readv(r2, &(0x7f00000007c0)=[{&(0x7f00000006c0)=""/209, 0xd1}, {&(0x7f00000004c0)=""/166, 0xa6}, {&(0x7f00000008c0)=""/94, 0x5e}, {&(0x7f0000000840)=""/90, 0x5a}], 0x4) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_int(r3, &(0x7f0000000280)='cpu.weight\x00', 0x2, 0x0) write$cgroup_int(r4, &(0x7f0000000080)=0x400, 0x12) r5 = syz_open_dev$sndctrl(&(0x7f0000000000), 0xf3d, 0x40082) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r5, 0xc008551c, &(0x7f00000001c0)=ANY=[@ANYBLOB="101596cf1f3d3e868c61000000080000009c0e000004000000"]) r6 = socket$alg(0x26, 0x5, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) fcntl$getownex(r6, 0x10, &(0x7f0000000100)={0x0, 0x0}) fcntl$lock(r6, 0x6, &(0x7f0000000140)={0x1, 0x3, 0x4, 0x5, r7}) r8 = syz_io_uring_setup(0xbd9, &(0x7f0000000640)={0x0, 0xe826, 0x800, 0x1, 0x3c3}, &(0x7f0000000dc0)=0x0, &(0x7f0000000000)=0x0) unshare(0x400) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001240)=ANY=[@ANYBLOB="bf16000000000000b707000001009fa35070000000000000280000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36bb3010100bd2321afb56fa54f26fb0b71d0e6adff07f1d8f7faf75e0f226bd99eea7960707142fa2dc79b9723741c4a0e168c1886d0d4d94f2f4e345c652fbc16ee988ee99fbfbf9b0a4def23d410f6296b32a834388107200759cda9036b4e369a9e152ddcc7b1b85f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c3b35967dec6e802f5ab3eea57b09a2ed4048d3b867ddd58211d6ececb0cd2b6d357b85a0218ce740068725837079e468ee207d2f73902fbcfcf49822775985bf31b715f5888b24efa000000000000ffffffdf0000000000000000000000000000020000000000000000000000000000b27cf3d1848a54d7132be1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b9349e31aa3701c38c527d3237c18e521ab219efdebb7b3de8f67581cf796a1d4223b90b80fcad3f6c962b9f292324b7ab7f7da31cf41ab12012fb1e0a494034127de745409e35a30b23bcee46762c2093bcc9eae5ee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d307db98ca112874ec309baed0499104dcfe7c0f694bd5fc9e66d058b75fa4c81e5c9f42d9383e41d277b10392a96286744f049c3f128f8f92ef992239eafce5b43b4ec1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637598f37ad380a447483cac394c7bbdcd0e3b1c39b2e00916de48a4e70f03cc415ba77af02c1d4cef5379da860aed8477dfa8ceefb405005c6977c78cdbf37704ec73755539280b064bda144910fe050038ec9e47de89298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06cd58b638c234bbb55ff413c86ba9affb12ec757c7234c270246c87a901160e6c07bf6cf8809c3a0d46ff7f000000000000ad1e1f493354b2822b9837421134c0167d78e6c24ed0a2768e825972ea3b774a1467c89fa0f82e8440105051e5510a33dcda5e143fbfff161c12ca389cbe4cc302b52e2101de18a1f1f7c551b3fa00055cc1c46c5fd9c26a54d43fa050645bd6109b113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e378a9b15bc20f49e298727340e97c870800000047546103f123f661c84726e7c7c55eff231a1b033d8f841ba3442b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2ef7be184f5e93ba5c8c2a4c04450b652b8d4c2ff030000000000000007c6bbd6cb2b240ce7d47ae636a5dbe9864a117d27326850a7c3b57086a4482c218b10af13d7be94987005088a83880ccab9c99220002af8c5e13d52c87c3a3ee6c08384865b66d2b4dcb5dd9cba16b64ebbbf8702ae12c77e6e34991a225c120a3c950942fe0bc9f2a1a7506d35e5b439edeb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a700a86c814459f3cdaaf99000000000000000000bf2130d1b32c826563c718d0ad23bc83ba3f3757210a057e177615c0683f000000000000006d4e0413ab52f5aaab812201d1aba3d70471fcd9b466569f3ef72f39d87fcccab514fcff030000629c9b73ce7bc4be7f8be71cb7b2d0a4acff8f6abe7dbad64dfa63966945d93c33b038ce0d890f85f8a6ab8487c383e24d4a8051f80e1811e387723a25dda119f64b35e71c5400000000000000000000000000000034c751ebdf3f207ea3df3d6c0002a41783078e56c70afe8016b3dd9dc7785b36e609f173cc747837d600283b3452c57a5d44cacd363589845637071320921d32c1663964eddec97cc33158bc306d8c3bdae8108a23d2dc96a5cdb518f58832ec0906aaec43659c79c8ad37b0f961f3beaa3e02f7762c5dd633d13b5e487e996597b2ab42c81eb7dd8390e13b395aacce4683e55bcfe8c17615257364365fd48bd77da79e52ce9adfe6dcb0c42c4d719347f3d16304fa000008ffffffffffffff003049ca923d059c0ab5d886a491adacb7e4b43b1b57586e5fe2aa611f6232a9b71882ce24fce75cf105fa57f000756755b7230e2c0c1fed5487271c4f2981cf8f4351ef5d08641dacaed000080000000000000000000000fa36bbac00bb77c933d3961556f3fe647b05643b0000000000000000000000967aef9c5706e13d5889e77dab80a2548ec31629b7355a2bb8b93e4b6323061f545b26accc4621b568ab0bfaf30aa4f60705532c4a09c0a4a5487c762167edf362be35b9c90ad7e372a66bbb1471aa21000000000000104061c66a7432f25687618e31dcef8c5d4a2457a93f3fc6d3d7131746c75ccf400fc1a7a51826832ef7f5fbc78827d937768443a1c1ca3aba930826fd21aa1201d9225256df8de405d1f12c17cdaff3ad675aa333aa7e919459babd3cc1000000000000000000000000000000000000000000000000000000000000000059fdc6a54a2a8b28fa7d9b92aeb58e78e3b8594a5ef6bb67e52bf43b6145f544273a8f62852706c0abef368bfc72f92fa99a7bf121019cff8001fd7d2f6c2c295a5cab383235fec4c1decbed258ee9df8963c0fc828ad2119ffefe36c78692fffb6942b9da0922b2aa8f6b66c14ee7f42d5951edcc986356b41c0de3549f851ca340d9e425e355c1decb785a1042a72c1c98a084b04b1d9be473e50a15d76b110eda3b7cc1f2501211773cf510a43888422c1328476dd6f42659c61a18618fd28d5cd342c276aa9c4cc035077fa09d672b8dcfb3ac1751628647047d07338a8619037e3449a173ddd697f541a0795a2de7ef1396d70675341ebf004be122de04b5275fe7e53d28ebdc5051cec00759d73ca97229d93b965926060b6f91d01324bd458b425ea51c5d5b69551d599188fc6040370ac9ca7ae9eea9e5ede79bd66bd3d616dd7d7dd4c3a8fd055a3585af6fe7f5046c61154598cd33c33a48ece1072afd04b1fd85eb1655d9f3f813392c9634200d892dc6810b436820a1e0f6b464855e28953eb63cd3d6fc1b7bfb588ce28a51af1658d45d759a8399da55a3ff6597bb9f47167fe55ca240623a001e5fe15d9ddefea06a3750501916163844106c4ce662f418d9fc509e5447f712048d53e7e36ee7de083c5ea1119969d858eb6785395fc5a2c551de9a086cb4583f55c47828645e3046"], &(0x7f0000000140)='GPL\x00', 0x3000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f}, 0x94) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x6, 0x4, 0x5b, 0x8a}, 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000180)={r11, r12}, 0xc) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}) io_uring_enter(r8, 0x847ba, 0x0, 0xe, 0x0, 0x0) 7.854030953s ago: executing program 1 (id=1605): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="020000000400000008"], 0x50) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x200000c0, 0xffffffff, 0xfffffff8}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@ipv4_newroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x2, 0x20, 0x80, 0x0, 0x0, 0x1, 0xff}}, 0x1c}, 0x1, 0x0, 0x0, 0x8c0}, 0x4008000) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0xac, 0x9b, 0xcc, 0x20, 0x18d1, 0x1eaf, 0x5abb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7, 0x0, 0x80, 0xb, [{{0x9, 0x4, 0xbb, 0x6, 0x0, 0x3a, 0xe5, 0x4}}]}}]}}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) r2 = socket$alg(0x26, 0x5, 0x0) clock_gettime(0x0, &(0x7f0000000740)={0x0, 0x0}) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="d80000001c0081044e81f782db44b904021d080201000000120000a118000c000600142603600e3b08000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67ffc94007134cf6ee08000a0e408e8d8ef075c11503c13223e3f52a98516277ce06bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006000000000000008065b44f95caae586a81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r6 = syz_open_dev$video4linux(&(0x7f0000000000), 0x0, 0x0) ioctl$VIDIOC_QUERY_EXT_CTRL(r6, 0xc02c5625, &(0x7f0000000140)={0x80f0f000, 0x2, "9a555c14c966e134d198b9aaaa7da80f8e4fa888dece6ffdb507a3c83e58e128", 0x0, 0x0, 0x0, 0x0, 0x3, 0x100, 0x0, 0x0, [0x1]}) recvmmsg(r2, &(0x7f0000000700)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0xff}, {&(0x7f0000000f00)=""/4096, 0x1000}], 0x2, &(0x7f0000000400)=""/255, 0xff}, 0xffffb872}, {{&(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000500)=""/237, 0xed}, {&(0x7f0000000600)=""/87, 0x57}], 0x2, &(0x7f00000006c0)=""/30, 0x1e}, 0x100}], 0x2, 0x140, &(0x7f00000007c0)={r3, r4+60000000}) bind$alg(r2, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'adiantum(rfc3686(cts(cbc(aes))),aes,crct10dif-arm64-ce)\x00'}, 0x36) socket$nl_generic(0x10, 0x3, 0x10) openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet_icmp_raw(0x2, 0x3, 0x1) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r7, @ANYBLOB="06001500070000000c00168008000100", @ANYRES8=r7], 0x38}}, 0x10) syz_usb_control_io(r1, 0x0, &(0x7f0000000e80)={0x44, &(0x7f0000000a00)={0x40, 0xd, 0x2, "def0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@newqdisc={0x48, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r10, {0x0, 0xa}, {0xffff, 0xffff}, {0x1, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0xf93, 0x80, 0x8, 0x5}}}}]}, 0x48}}, 0x44080) sendmsg$nl_route_sched(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x34, 0x24, 0xd0f, 0x70ad26, 0x0, {0x60, 0x0, 0x0, r10, {}, {0x8, 0xa}, {0xfff2, 0x7}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c040}, 0x0) r11 = socket(0x11, 0x3, 0x0) sendmmsg(r11, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="d479183d7d98d181a4b5f3e38100", 0xe}], 0x1}}], 0x1, 0x24044015) 7.179418514s ago: executing program 4 (id=1607): open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) ioctl$SNDCTL_SEQ_SYNC(0xffffffffffffffff, 0x5101) write$binfmt_aout(0xffffffffffffffff, 0x0, 0xc8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) socket$netlink(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = syz_io_uring_setup(0x495, &(0x7f0000000400)={0x0, 0x7079, 0x0, 0x7, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r2, 0x4, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0xf5ff, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000a40), 0x9, 0x2) 6.49385486s ago: executing program 3 (id=1609): r0 = openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = gettid() r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x3, 0x0, &(0x7f0000000e00)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_handle={0x77682a85, 0x2000, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x2000000000000022}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000bc0)={0x0, 0x18, 0x40}}, 0x40}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r5}, @flat=@weak_handle={0x77682a85, 0x1001}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) prlimit64(0x0, 0x7, &(0x7f0000000ec0), 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={r1, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) write$cgroup_pid(r0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r8, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r9, 0x107, 0xc, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r11], 0x54}, 0x1, 0x0, 0x0, 0x4048011}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) 6.018381144s ago: executing program 4 (id=1610): socket(0x1e, 0x4, 0x0) r0 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100, 0x4}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r4, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="201109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r5, 0x720, &(0x7f0000000200)={0x1, 0xd9, 0x3, &(0x7f0000000040)={0xa, "810556c721393f4084cc9efc7ddb01702fb9a7f77d040b00"}}) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000002e00090027bd70000000000004000000050018000800000004001e00b2caa151fac23e6ef29f64c147027c9d"], 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x20, 0x0, @fd_index=0x3}) io_uring_enter(r0, 0x2def, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r0, 0x18, &(0x7f0000000180)={0x5, r0, 0x15, {0x6, 0x3}, 0x7f}, 0x1) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4d8, 0xdd, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x7}}}}}]}}]}}, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r6, 0x720, &(0x7f0000000980)={0x0, 0x70, 0x6, &(0x7f0000000280)={0x1b, "79b8142115db2c05f171e2306c0c14f1e37ef9335b502c1502568e77a025abe98e"}}) 5.883809293s ago: executing program 1 (id=1611): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x1, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x8904, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000680)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000580)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="02050003020000000300000000000000"], 0x10}, 0x1, 0x7}, 0x0) r5 = openat$binder_debug(0xffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) sendmsg$NFT_MSG_GETTABLE(r5, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x1, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x1}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x4001080}, 0x48800) r6 = accept4(r3, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r6, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x40881) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) unshare(0x2c060000) unshare(0x24020400) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140)='i', 0x1, 0x4050, 0x0, 0x0) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000540), 0x1, 0x0) r7 = socket(0x840000000002, 0x3, 0xfa) connect$inet(r7, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r7, &(0x7f0000002fc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000002e40)=[@ip_retopts={{0x10, 0x0, 0x7, {[@timestamp_addr={0x44, 0x4, 0x81, 0x1, 0xf}]}}}], 0x10}}], 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x70bd2c, 0x25dfdbff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@FRA_GENERIC_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e24, 0x4e24}}]}, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="28000000210001"], 0x28}}, 0x0) 5.490963683s ago: executing program 3 (id=1613): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001300)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r2, {0x10}, {}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x0) 5.431152387s ago: executing program 0 (id=1614): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001300)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r2, {0x10}, {}, {0x2, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x0) (fail_nth: 1) 5.409733354s ago: executing program 3 (id=1615): socket$inet(0x10, 0x3, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000040), 0x44002, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pselect6(0x40, &(0x7f0000000200)={0x1, 0x6, 0x1, 0x2, 0xffffffff, 0x100000000, 0x6418, 0x5}, &(0x7f0000000240)={0x7, 0x8, 0xfffffffffffffffc, 0x7, 0x800, 0x9, 0x9, 0x9}, &(0x7f0000000280)={0x80000000, 0x37000000000, 0x6, 0xa, 0x1, 0x0, 0x10000, 0x9}, &(0x7f0000000300)={0x0, 0x3938700}, &(0x7f0000000380)={&(0x7f0000000340)={[0x7, 0xfffffffd]}, 0x8}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x801, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x3131}, [@IFLA_XDP={0x1c, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x2}, @IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) syz_open_procfs(0x0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r3, &(0x7f0000000580)="17", 0xfdef, 0x10008095, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x6, 0x76, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff3b, 0x0, 0x0, 0x0, 0x2}, 0x94) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x2) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, 0x0) write$sndseq(r4, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) 5.051544391s ago: executing program 0 (id=1616): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000840)={0x14, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0) syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) unshare(0x24020400) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, &(0x7f0000000240)={0x1e, 0x0, 0xffffffffffffffff}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r3, {0x10, 0x6}, {}, {0x0, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x4801c}, 0x20000000) 4.642586511s ago: executing program 1 (id=1617): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) mbind(&(0x7f00007ec000/0x2000)=nil, 0x2000, 0xc002, 0x0, 0x4, 0x3) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='numa_maps\x00') read$FUSE(r4, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) getdents(r3, &(0x7f0000000300)=""/171, 0xab) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) r7 = socket$netlink(0x10, 0x3, 0x0) set_mempolicy(0x6005, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e00)=ANY=[@ANYBLOB="380000001000830500"/20, @ANYRES32=0x0, @ANYBLOB="15010000812000001800128008000100677470000c000280"], 0x38}}, 0x28000000) ioctl$vim2m_VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000100)={0x0, 0x2}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="3bf422542115c736491323453285514d1d4bad2558c77532b917778a20db421accc32b3ebf9c910b269fe7d25d7178cade90e572bd24cf3c94ba82e16061f6d2fd35d00b58c8fd0b2c3edd038626c9008ddb45f21d63b4d2166ab8e5c87d718c60c5ffb1fa20ac750668622bb659e106909e64ceb0955b433562deb9a25bc6eecc95322d211ca202fbe60a3404c4409769ecd3ce0f7e5619a1f53c03ce8f668a9dd0532d2e64b4d40ba3a2f582d50a9672e105e9cc138da2a333", @ANYRES16=r1, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r5, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000080)={{0x1, 0x1, 0x18}, './file0\x00'}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r9 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r9, &(0x7f0000000100)={0xa, 0x0, 0x10001, @dev={0xfe, 0x80, '\x00', 0x1a}, 0x1}, 0x1c) unshare(0x22020600) r10 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r10, 0x114, 0x6, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r8, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r8) 4.037700022s ago: executing program 1 (id=1618): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000240)) openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000001500)={0x0, 0x2c, &(0x7f00000014c0)=[@in6={0xa, 0x4e23, 0x2, @remote, 0x9192}, @in={0x2, 0x4e21, @broadcast}]}, &(0x7f0000001540)=0xc) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00'}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58840}, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000240)=ANY=[], 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ifreq(r2, 0x8932, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000002000000a20000000000a03080000000000000000070000000900010073797a31000000003c000000090a01040000000000000000070000000900020073797a31000000000900010073797a30000000000800054000000021440000000c0a09030000000000000000070000000900020073797a3100e2c339fa31c9e84e3f79f106ca71a598583cd129f10d71ea7f0bcf74c28385f1bf0d26af993d9d51914f4dddde74db18745b3734836c36f3ce9cfee895cb9c3ce18779db4b7136c0dc7c4918e6b770f48c7608e5b43bc5869e8d205ed949e4de1db30400000046d3bf8ac7bb572d321f8479fbeabd8168dd178eb69cf219030e5837389acd94ff9ec1f2259197a71df3d1e6ae8e4fcd66ecf69da6dfedea4fa69d7d627ef6971aacc10000000000000000"], 0xc8}}, 0x0) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r7, &(0x7f0000000000)=0xfe8e, 0x12) ioctl$EVIOCSREP(r7, 0x40084503, &(0x7f00000002c0)=[0x431d, 0x1000000]) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000440)={0x1, @pix_mp={0x62, 0x1, 0x3031334d, 0x3, 0xa, [{0x3, 0x6}, {0x2, 0x2}, {0x3, 0x411}, {0x10001, 0x8}, {0x6, 0x8}, {0x4, 0xd}, {0x8, 0xfffffff8}, {0x5, 0x1}], 0xc, 0x2, 0x1, 0x0, 0x2}}) syz_mount_image$fuse(0x0, &(0x7f0000000400)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000002140)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}}) 3.227509822s ago: executing program 0 (id=1619): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) syz_io_uring_setup(0xcd8, &(0x7f0000000200)={0x0, 0x4661, 0x80, 0x3, 0x30d}, &(0x7f0000000340), 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100), 0x20001, 0x0) r4 = fsopen(&(0x7f0000000000)='udf\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000080)='iocharset', &(0x7f0000000100)='$L\xcf\x13k\xd6C\x03\x06', 0x0) socket$nl_generic(0x10, 0x3, 0x10) fsconfig$FSCONFIG_SET_FD(r4, 0x5, &(0x7f0000000040)='iocharset', 0x0, r4) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x2) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@loopback, @in6=@private1, 0x4e24, 0x67e, 0x6, 0x0, 0x2, 0x20, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x6, 0xfffffffffffff506, 0x0, 0x40000008, 0x5, 0xffffffffffffffff, 0xc, 0xffffffffffffffff}, {0x7, 0x0, 0x800000000000001, 0xffffffffffffffff}, 0x0, 0x6e6bb5, 0x2, 0x1, 0x2}, {{@in=@rand_addr=0x64010102, 0x2, 0x62}, 0x2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8003509, 0x3, 0x3, 0x0, 0xffffffee, 0x97a7, 0x80}}, 0xe4) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000005000000080000000e"], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000006020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000ecff850000000400000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r8}, 0x10) sendmsg$ETHTOOL_MSG_DEBUG_SET(r5, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000b00)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e0000000000000000001800028014000380"], 0x44}, 0x1, 0x0, 0x0, 0x200040c4}, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x5, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @pic={0x3a, 0x3, 0x2, 0x8, 0x80, 0x4, 0x8, 0xa, 0x5, 0xfe, 0x8, 0xf, 0x8, 0x0, 0x2, 0xa8}}) r10 = syz_usb_connect$cdc_ncm(0x4, 0x79, &(0x7f0000000080)=ANY=[@ANYBLOB="12015002020000402505a1a4400001020301090267000201ff50070904000001020d0000052406000102000000000d240f010400000008000f000906241a17a2140424020607241406000200090581030800fd40060904010000020d00000904010102020d0000090582020002280601090503020000030f08"], &(0x7f0000000940)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x250, 0x6, 0x6, 0x1, 0x10, 0x4e}, 0x14d, &(0x7f0000000e00)=ANY=[@ANYBLOB="050f4d01060b10010c90000d0500000014100480bc2923bf73acc60a99839b42311682a90b1001065200074a85000c1410040112c48369acb2bb9934a6f6385ae0b8f10710020000050003100199359736769c2920ec565570ac4e4eec38e468c2a174f42a717de04e12cdf26035927e37db88fe49830500472442e704691b1b253477d89c51e5bc6c50e93ee3131096c5d40e6321ab6a3b039c7396886efd45723fc37fd3e07aa19e9555e3448fd4b56156c7bc3aa675598cca001623170e3576db4302d41f9abdb4ce8ccfd647ec553fcd3da79fce81cd4f83cc95be913cdc1e4338556342c8e2eb9a0138aad769a736f15a4fe0c05468a1cfc69211d016ce323deed894326d55e86efd91084d316041c23f9f42bced3c8a3e35c115c5c06b0792b0ff9ff1a4f90c109e2e8ea00a4c25d7d9efb158d34b41011126ca7b1b0000000000000000000000100008f62d83bb415d48d29f114b909c175c39ea44890261cbcd0f6fd46e724e02416e63cc6799c0ed3bec15e96793a7b795ebda11c9ac98e7af335859f66d8161a403a8d3b115a5f2420a9a7780547d9c35b719"], 0x7, [{0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x51edc7f4c29c4763}}, {0x2a, &(0x7f0000000600)=@string={0x2a, 0x3, "8ace4c08bbec1b9622774381c63f1dc8c01aa0109f316e893472b0d4e72b6dcaef2804800f604f04"}}, {0x84, &(0x7f00000006c0)=ANY=[@ANYBLOB="8403d6bf7836262c04ec392b9bc1fb8a324720f6488968a36266173904819352ee4f51ec25804afa7fd3f98b1e0f65e263bed5bd4232e1cab7334d78e7c7de9d5adcd7978f7b88c74852be5928a43af2102bd89a5b48ccb06bc1d3f603d756d2bb7c91417e8a9613f8f6b10bc3609950f4582e6a41ed844e314702a54499d07bb52a3bfa"]}, {0x66, &(0x7f0000000780)=@string={0x66, 0x3, "7b8d22b210c63c0a8e3f05db125d2684dab5d84bbc5cb40b733d452bc3d973183df1f0bba48ee9fb9b1f3f3292524a69ebcd52d75d9074940e5b05d34f597e0a297aa870ec07629ecf9c57ac622b5a1c8a0fca2befca21376baa353a59455b67095f39b0"}}, {0xb1, &(0x7f0000000800)=ANY=[@ANYBLOB="b10315d01c7d75a404b6659e985b10b5d14c189d297722ded8d1f0778b88ec0cf61e8a965dbf99c4d8ef75c0155ceb9c88b19ffee5bd92740a0df61c58940e99f84254b8c78041adcebc2cbdf8033c39e9591f3270cb82ce2ca2240cdd2a76cfd31900deba406ac4baf54a7ecf164d51cacb7569fecb443651c236ccc049cf35fb91aabccdafb477307ef31c74397c76413ce17606722d9730d52fd949ec80b8ae0e09663700"/177]}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x861}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x422}}]}) syz_usb_ep_read(r10, 0x8, 0x9d, &(0x7f00000009c0)=""/157) socket$nl_route(0x10, 0x3, 0x0) r11 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r11, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) connect$can_bcm(r11, &(0x7f0000000140)={0x1d, r12}, 0x10) sendmsg$can_bcm(r11, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000b40)=ANY=[@ANYRES16=r9, @ANYRES32=0x77359400, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000004001000000800000002b000000f33d8e7b847ec8b36f1107e036dd9805479107485e371bcf5c6b77db5463d084795c49eca9b92241dc9fc39f976ad52e581942d9fc2178681e6866aa6ef10d069a0471cba305c55719f0d68379a77d44c96c533a01dd4f77e8b14c07ef4ac306e690fb21669b5aeed8c854a92ce82c540a5e477f0730260b873faafb94214fa851e82958193a14057a576a391a7c7832ecbc9c666ece051629cc31c64e6125a419939bb36e5bd93f6580652642413ffeb65b1915ed84e85456499edc450d2afe17b67098f6ba89e661417ea33325bc92022e796a4f4f182869b03aada22d0be57c49bffeb95447"], 0x80}, 0x1, 0x0, 0x0, 0x40084}, 0x20000000) r13 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r13, 0x8933, &(0x7f0000000180)={'vxcan0\x00'}) 3.109056261s ago: executing program 1 (id=1620): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x20642) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = syz_io_uring_setup(0x24fb, &(0x7f0000000680)={0x0, 0x0, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x3, r5, 0x0}) io_uring_enter(r2, 0x2d3e, 0x0, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x34, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "cc"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x5c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x50, 0x7, 0xa, 0x5, 0x0, 0x0, {0x3, 0x0, 0x4001}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0xc, 0x1, 'RATEEST\x00'}]}}}]}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x200408d0}, 0x600008d0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r0, 0x40405514, &(0x7f0000000a40)={0x1, 0x0, 0x0, 0x0, 'syz0\x00'}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000540)={0x1, 0x6, 0x2, 0x5, 'syz0\x00', 0x7}) r7 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000200)={0x43, 0x0, 0x1}, 0x10) 3.06017907s ago: executing program 1 (id=1621): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x20500, 0x0) ioctl$SOUND_MIXER_READ_CAPS(r2, 0x80044dfc, &(0x7f0000004f00)) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105511, &(0x7f00000000c0)={{0xb, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x4, 0x0, 0x0, 0x0, 0x7, 0x100000000, 0x6, 0x0, 0x0, 0x60fe, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x100000000, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0xa8, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfffffffffffffffc, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x23]}) socket(0x400000000010, 0x3, 0x0) ptrace$peek(0x1, 0x0, &(0x7f00000005c0)) poll(0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r3, 0x8982, &(0x7f0000000440)) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) r4 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x10) read$FUSE(r5, &(0x7f0000000e40)={0x2020}, 0x2020) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f00000000c0)=0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000c80), 0x0, 0x0) ppoll(&(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0) connect$unix(r6, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ioctl$SNDCTL_DSP_STEREO(r4, 0xc0045003, &(0x7f0000000600)=0x180004) write$binfmt_elf32(r4, 0x0, 0x4cd) r7 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="540000001200010000000000000000000a00000000004e22fcffffff000000007ecd0000000000000000", @ANYRES32=0x0, @ANYBLOB="01e38020000008000300060100"/24], 0x54}}, 0x20000080) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000100)=0x1) write$dsp(r4, &(0x7f0000000140)="755a5398d512d39077459e67ee110daaf0413bc745ef85b89f2141d513969bd8", 0xffaa) 2.971590114s ago: executing program 4 (id=1622): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x18, r1, 0x4c1dad3e3d6a7499, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000080}, 0x2400c000) 2.928312411s ago: executing program 4 (id=1623): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000680)={0x10000000}) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x3000) ioctl$TCGETS(r5, 0x5401, &(0x7f0000000040)) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xf8, 0x19, 0x1, 0x0, 0x25dfdbfc, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0xffffffffffffffff, 0x4, 0x0, 0x0, 0xffffffffffffffff, 0x1}, {0x0, 0x4000000000000000, 0x200000000000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@empty, 0x2, 0x2b}, 0xa, @in6=@local, 0x0, 0x4}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) pipe(0x0) bind$inet(r6, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) r8 = socket$kcm(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) sendmsg$tipc(r9, &(0x7f0000000140)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x4}}, 0x10, &(0x7f0000000180)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0xfffffffffffffec6}], 0x4, 0x0, 0x0, 0x880}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/config', 0x0, 0x0) recvmsg(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000b80)=""/4096, 0x1000}], 0x8}, 0x0) setsockopt$sock_int(r6, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r6, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r6, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(0xffffffffffffffff, 0xc0605345, &(0x7f00000000c0)={0x0, 0x1, {0x1, 0x0, 0xc00000, 0x1, 0xe5}, 0xffff}) write(r5, &(0x7f00000002c0)="c714176c91dfa539425200d69960776ff6d7255c9274f492a8462559896e813a34f6fe7bc5d77c59490594628ef2bebeaa07e5d8c0336cbb0a79850acaefb37d329b4f42b4a3a5e5d4e84595f6221a43ffb2ddad4edbb38f435e799abeba54", 0x5f) 2.577790379s ago: executing program 0 (id=1624): r0 = openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = gettid() r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x3, 0x0, &(0x7f0000000e00)=[@acquire, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_handle={0x77682a85, 0x2000, 0x1}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x2000000000000022}, @fd={0x66642a85, 0x0, r3}}, &(0x7f0000000bc0)={0x0, 0x18, 0x40}}, 0x40}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f00000004c0)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r5}, @flat=@weak_handle={0x77682a85, 0x1001}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) prlimit64(0x0, 0x7, &(0x7f0000000ec0), 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x1, 0x1000000000000, &(0x7f0000000340)="cb"}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={r1, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) write$cgroup_pid(r0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r8, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r9, 0x107, 0xc, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r11], 0x54}, 0x1, 0x0, 0x0, 0x4048011}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) 1.863909721s ago: executing program 4 (id=1626): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x5, 0xfe, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x1003, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xd, 0x1, 0x1}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000500)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00221b000000a3797915170818"], 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) 1.8370131s ago: executing program 3 (id=1627): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1b1c, 0x1b23, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x2}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x3}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) gettid() (async) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) set_mempolicy(0x4000, &(0x7f00000000c0), 0xfffffff8) (async) set_mempolicy(0x4000, &(0x7f00000000c0), 0xfffffff8) openat$fb0(0xffffffffffffff9c, 0x0, 0x22902, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @random="8f4961884fc4", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x8, 0x3a, 0xff, @dev, @mcast2, {[], @echo_reply={0x81, 0x0, 0x0, 0x4, 0x3}}}}}}, 0x0) (async) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @random="8f4961884fc4", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x8, 0x3a, 0xff, @dev, @mcast2, {[], @echo_reply={0x81, 0x0, 0x0, 0x4, 0x3}}}}}}, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000, 0x4, &(0x7f0000005000/0x3000)=nil) (async) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000, 0x4, &(0x7f0000005000/0x3000)=nil) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000340)={@ifindex, 0xffffffffffffffff, 0x1a}, 0x20) getuid() syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x22, 0x2, {[@main=@item_012={0x1, 0x0, 0x7, "a4"}]}}, 0x0}, 0x0) 1.706472257s ago: executing program 0 (id=1628): r0 = syz_open_dev$loop(&(0x7f0000000140), 0x8, 0x711180) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000200)={0xd, 0xffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) r2 = dup(r1) r3 = syz_io_uring_setup(0x4e1, &(0x7f0000000380)={0x0, 0x33f8, 0x10100}, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_enter(r3, 0x708, 0x41e3, 0x0, 0x0, 0x0) clock_nanosleep(0xfffffff2, 0xca9a3b, &(0x7f0000000000)={0x77359400}, 0xfffffffffffffffe) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) syz_open_procfs(0x0, &(0x7f0000000080)='timerslack_ns\x00') openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0185647, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 1.280705317s ago: executing program 2 (id=1629): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'syzkaller1\x00', 0xc201}) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x101343) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) bind$inet6(0xffffffffffffffff, 0x0, 0x0) chdir(0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) open_by_handle_at(r1, &(0x7f0000000040)=@reiserfs_2={0x8, 0xfe, {0xb}}, 0xfe) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) splice(r1, &(0x7f0000000140)=0x8c, 0xffffffffffffffff, &(0x7f00000002c0)=0x6cd, 0x9, 0xc) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000000000000000003000000400001802c00040014000100020000007f00000100000000000000001400020002000000e000000200000000000000000d0001007564703a73797a30000000009fc6a73a68b861ec134aa0cba062981d4178a165d8a0cac955bb577057145a2ce80fa3e2158067bff94f40ef30049973c2225bd62c4a52735650695d313a7c5da43013e4b2fb96f5ccf2911ac4aef896333f59c279fc4e61cac325924e66c79acc024b8210a65205f5c4ddc7255a9677e183a8c2b856a6eeb06632692c05d5b9edd12cfd6964cd741770841739cc88fceb453864b5cae3b7f431f312cf4f3e40b00588c6d8f9e6103c9d489e2af0811efece79d77217a0c9cb83fe5d5535c834c332c348303b8f5f2c01c040611c830957e373c2a0beff89a3b03ac651f934429fe32a060cca7254c51d5c2bd26f31c4c01f19a51acd5716f6faede97a84"], 0x54}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)={0x34, r3, 0x1, 0x0, 0x0, {{}, {}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}}, 0x0) (fail_nth: 2) 715.189249ms ago: executing program 2 (id=1630): gettid() r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, 0x0, 0x0, 0x4) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c00000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0401010000000000140003006970366772653000000000000000000008000a00", @ANYRES32=r2], 0x3c}}, 0x0) 508.097892ms ago: executing program 2 (id=1631): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001780), r0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x1fd, 0x1, 0xeeeeb002, 0x2000, &(0x7f0000b07000/0x2000)=nil}) (async) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r4, 0x4048aecb, &(0x7f0000000000)) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) (async) close_range(r0, 0xffffffffffffffff, 0x0) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000001380)={'dummy0\x00', &(0x7f0000001340)=@ethtool_ts_info}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x2, 0x2, 0x204}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1c, 0x14, &(0x7f0000000200)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffe01, 0x0, 0x0, 0x0, 0xb}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@map_idx={0x18, 0xb, 0x5, 0x0, 0x6}, @generic={0x8, 0x8, 0x1, 0xe7, 0xffff}, @jmp={0x5, 0x1, 0x5, 0x0, 0x9, 0xfffffffffffffffe, 0xffffffffffffffff}, @ldst={0x2, 0x2, 0x4, 0xb, 0x8, 0xfffffffffffffffe, 0xfffffffffffffff0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000080)='GPL\x00', 0x2, 0x1000, &(0x7f0000001940)=""/4096, 0x41000, 0x40, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0xa, 0x4}, 0x8, 0x10, &(0x7f00000002c0)={0x3, 0xa, 0x2fb, 0x4}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x4, &(0x7f0000000300)=[r6, r4], &(0x7f0000000340)=[{0x1, 0x1, 0x4}, {0x2, 0x3, 0x8, 0x4}, {0x5, 0x1, 0x2, 0x12}, {0x0, 0x3, 0xe, 0x1}], 0x10, 0x2}, 0x94) bpf$PROG_LOAD(0x2, &(0x7f0000000140)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r0, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001880)={0x14, r1, 0x925, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4801}, 0x80) (async) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) (async) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x64) (async) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) clock_nanosleep(0x0, 0x1, &(0x7f0000000000)={0x0, 0x3938700}, &(0x7f0000000040)) 488.724781ms ago: executing program 0 (id=1632): socket(0x1e, 0x4, 0x0) r0 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100, 0x4}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r4, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="201109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r5, 0x720, &(0x7f0000000200)={0x1, 0xd9, 0x3, &(0x7f0000000040)={0xa, "810556c721393f4084cc9efc7ddb01702fb9a7f77d040b00"}}) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000002e00090027bd70000000000004000000050018000800000004001e00b2caa151fac23e6ef29f64c147027c9d"], 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x20, 0x0, @fd_index=0x3}) io_uring_enter(r0, 0x2def, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r0, 0x18, &(0x7f0000000180)={0x5, r0, 0x15, {0x6, 0x3}, 0x7f}, 0x1) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4d8, 0xdd, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x7}}}}}]}}]}}, 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r6, 0x720, &(0x7f0000000980)={0x0, 0x70, 0x6, &(0x7f0000000280)={0x1b, "79b8142115db2c05f171e2306c0c14f1e37ef9335b502c1502568e77a025abe98e"}}) 295.748753ms ago: executing program 2 (id=1633): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x18, r1, 0x4c1dad3e3d6a7499, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000080}, 0x2400c000) 290.113539ms ago: executing program 2 (id=1634): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) signalfd4(r0, &(0x7f0000000080)={[0xe, 0x2]}, 0x8, 0x80000) r1 = getpgid(0x0) prlimit64(r1, 0x0, &(0x7f00000001c0)={0x8001, 0x9}, &(0x7f0000000200)) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/pm_print_times', 0x169a82, 0x0) sendfile(r2, r2, 0x0, 0x7) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000180)={'veth1_virt_wifi\x00'}) r3 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000040)={0x10000011}) fstatat64(0xffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x100) 235.929962ms ago: executing program 2 (id=1635): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000018c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x79, 0x1846, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0xb}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x80}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000640)={0x14, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0x7, {[@main=@item_012={0x0, 0x0, 0xa}, @local=@item_4={0x3, 0x2, 0x1, "d7adfa4e"}, @global=@item_012={0x0, 0x1, 0xb}]}}, 0x0}, 0x0) 75.585943ms ago: executing program 3 (id=1636): gettid() r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, 0x0, 0x0, 0x4) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="3c00000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0401010000000000140003006970366772653000000000000000000008000a00", @ANYRES32=r2], 0x3c}}, 0x0) (fail_nth: 3) 0s ago: executing program 3 (id=1637): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000680)={0x10000000}) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x3000) ioctl$TCGETS(r5, 0x5401, &(0x7f0000000040)) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xf8, 0x19, 0x1, 0x0, 0x25dfdbfc, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0xffffffffffffffff, 0x4, 0x0, 0x0, 0xffffffffffffffff, 0x1}, {0x0, 0x4000000000000000, 0x200000000000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@empty, 0x2, 0x2b}, 0xa, @in6=@local, 0x0, 0x4}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) pipe(0x0) bind$inet(r6, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) r8 = socket$kcm(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) sendmsg$tipc(r9, &(0x7f0000000140)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x4}}, 0x10, &(0x7f0000000180)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0xfffffffffffffec6}], 0x4, 0x0, 0x0, 0x880}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/config', 0x0, 0x0) recvmsg(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000b80)=""/4096, 0x1000}], 0x8}, 0x0) setsockopt$sock_int(r6, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r6, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r6, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf00) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(0xffffffffffffffff, 0xc0605345, &(0x7f00000000c0)={0x0, 0x1, {0x1, 0x0, 0xc00000, 0x1, 0xe5}, 0xffff}) write(r5, &(0x7f00000002c0)="c714176c91dfa539425200d69960776ff6d7255c9274f492a8462559896e813a34f6fe7bc5d77c59490594628ef2bebeaa07e5d8c0336cbb0a79850acaefb37d329b4f42b4a3a5e5d4e84595f6221a43ffb2ddad4edbb38f435e799abeba54", 0x5f) kernel console output (not intermixed with test programs): he interface descriptor's value: 3 [ 392.963101][ T131] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 392.972446][ T131] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 392.980541][ T131] usb 1-1: Product: syz [ 392.984819][ T131] usb 1-1: Manufacturer: syz [ 392.989433][ T131] usb 1-1: SerialNumber: syz [ 392.996481][ T131] usb 1-1: config 0 descriptor?? [ 393.060849][ T5891] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 393.093838][ T107] radio-si470x 4-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 393.100897][ T107] radio-si470x 4-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 393.207251][ T131] radio-si470x 1-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 393.210828][ T5891] usb 5-1: Using ep0 maxpacket: 32 [ 393.214399][ T131] radio-si470x 1-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 393.222598][ T5891] usb 5-1: unable to get BOS descriptor or descriptor too short [ 393.241156][ T5891] usb 5-1: config 7 has an invalid interface number: 187 but max is 0 [ 393.249452][ T5891] usb 5-1: config 7 has no interface number 0 [ 393.255817][ T5891] usb 5-1: config 7 interface 187 has no altsetting 0 [ 393.265371][ T5891] usb 5-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 393.274881][ T5891] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.283092][ T5891] usb 5-1: Product: syz [ 393.287297][ T5891] usb 5-1: Manufacturer: syz [ 393.292246][ T5891] usb 5-1: SerialNumber: syz [ 393.297098][ T107] radio-si470x 4-1:0.0: software version 0, hardware version 0 [ 393.306660][ T107] radio-si470x 4-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 393.329844][ T107] radio-si470x 4-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 393.415175][ T131] radio-si470x 1-1:0.0: software version 0, hardware version 0 [ 393.423281][ T131] radio-si470x 1-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 393.438896][ T131] radio-si470x 1-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 393.502951][ T107] radio-si470x 4-1:0.0: submitting int urb failed (-90) [ 393.524585][T11156] netlink: 'syz.4.1425': attribute type 12 has an invalid length. [ 393.533094][T11156] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1425'. [ 393.600007][ T5891] usb 5-1: Limiting number of CPorts to U8_MAX [ 393.608409][ T5891] usb 5-1: Not enough endpoints found in device, aborting! [ 393.647029][ T131] radio-si470x 1-1:0.0: submitting int urb failed (-90) [ 393.826045][ T5891] usb 5-1: USB disconnect, device number 61 [ 393.841521][ T5967] az6027: usb out operation failed. (-110) [ 393.853491][ T5967] az6027: usb out operation failed. (-32) [ 393.859301][ T5967] stb0899_attach: Driver disabled by Kconfig [ 393.868266][ T5967] az6027: no front-end attached [ 393.868266][ T5967] [ 393.875855][ T5967] az6027: usb out operation failed. (-32) [ 393.883104][ T5967] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 393.892722][ T5967] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input75 [ 393.906461][ T5967] dvb-usb: schedule remote query interval to 400 msecs. [ 393.917216][ T5967] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 393.990192][ T8784] usb 3-1: USB disconnect, device number 71 [ 394.054097][ T30] kauditd_printk_skb: 88 callbacks suppressed [ 394.054115][ T30] audit: type=1326 audit(1766819776.109:696): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11148 comm="syz.0.1423" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 394.086594][ T8784] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 394.098735][ T30] audit: type=1326 audit(1766819776.139:697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11148 comm="syz.0.1423" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 394.132453][ T30] audit: type=1326 audit(1766819776.149:698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11148 comm="syz.0.1423" exe="/root/syz-executor" sig=0 arch=40000003 syscall=316 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 394.155966][ T30] audit: type=1326 audit(1766819776.149:699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11148 comm="syz.0.1423" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 394.186709][ T30] audit: type=1326 audit(1766819776.149:700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11148 comm="syz.0.1423" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 394.208887][ T30] audit: type=1326 audit(1766819776.149:701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11148 comm="syz.0.1423" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 394.231364][ T30] audit: type=1326 audit(1766819776.149:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11148 comm="syz.0.1423" exe="/root/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 394.253617][ T30] audit: type=1326 audit(1766819776.169:703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11146 comm="syz.3.1422" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 394.276143][ T30] audit: type=1326 audit(1766819776.169:704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11146 comm="syz.3.1422" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 394.298749][ T30] audit: type=1326 audit(1766819776.169:705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11146 comm="syz.3.1422" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 394.325951][ T107] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 394.350561][ T107] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -22 [ 394.382612][ T107] usb 4-1: USB disconnect, device number 79 [ 394.413201][T11165] netlink: 9 bytes leftover after parsing attributes in process `syz.4.1428'. [ 394.423148][ T5891] usb 2-1: new full-speed USB device number 72 using dummy_hcd [ 394.462391][ T8784] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 394.582776][ T5891] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 394.594321][ T5891] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 394.607931][ T5891] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 394.619667][ T5891] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 394.630408][ T5891] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 394.649387][ T5891] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 394.651245][ T8784] usb 3-1: Using ep0 maxpacket: 8 [ 394.659651][ T5891] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 394.670854][ T8784] usb 3-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 394.672049][ T5891] usb 2-1: Product: syz [ 394.681776][ T8784] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 394.685382][ T5891] usb 2-1: Manufacturer: syz [ 394.693786][ T8784] usb 3-1: Product: syz [ 394.698167][ T5891] usb 2-1: SerialNumber: syz [ 394.707845][ T8784] usb 3-1: Manufacturer: syz [ 394.712884][ T8784] usb 3-1: SerialNumber: syz [ 394.719089][ T5891] usb 2-1: config 0 descriptor?? [ 394.729687][ T131] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 394.743489][ T8784] usb 3-1: config 0 descriptor?? [ 394.751212][ T8784] gspca_main: sq930x-2.14.0 probing 2770:930c [ 394.758322][ T131] radio-si470x 1-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 394.778651][ T131] usb 1-1: USB disconnect, device number 76 [ 394.931433][ T5891] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 394.946658][ T5891] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 394.980243][T11172] netlink: zone id is out of range [ 394.985680][T11172] netlink: zone id is out of range [ 394.991459][T11172] netlink: zone id is out of range [ 394.996635][T11172] netlink: zone id is out of range [ 395.002509][T11172] netlink: zone id is out of range [ 395.007999][T11172] netlink: zone id is out of range [ 395.013571][T11172] netlink: zone id is out of range [ 395.018904][T11172] netlink: zone id is out of range [ 395.024124][T11172] netlink: zone id is out of range [ 395.029565][T11172] netlink: zone id is out of range [ 395.035476][T11173] netlink: 'syz.3.1430': attribute type 21 has an invalid length. [ 395.044075][T11173] netlink: 'syz.3.1430': attribute type 1 has an invalid length. [ 395.052064][T11173] netlink: 144 bytes leftover after parsing attributes in process `syz.3.1430'. [ 395.132602][ T5891] radio-si470x 2-1:0.0: software version 0, hardware version 0 [ 395.140513][ T5891] radio-si470x 2-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 395.153119][ T5891] radio-si470x 2-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 395.299782][T11178] netlink: 'syz.3.1431': attribute type 2 has an invalid length. [ 395.376395][T11178] : entered promiscuous mode [ 395.405061][ T5891] radio-si470x 2-1:0.0: submitting int urb failed (-90) [ 395.478415][ T8784] gspca_sq930x: ucbus_write failed -110 [ 395.493258][ T8784] sq930x 3-1:0.0: probe with driver sq930x failed with error -110 [ 395.900839][ T107] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 396.132500][T11191] netlink: 'syz.4.1434': attribute type 2 has an invalid length. [ 396.159132][T11191] : entered promiscuous mode [ 396.262976][ T107] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 396.277071][ T107] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 396.290891][ T107] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 396.300144][ T107] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 396.308276][ T107] usb 1-1: Manufacturer: syz [ 396.320481][ T107] usb 1-1: config 0 descriptor?? [ 396.390798][ T107] rc_core: IR keymap rc-hauppauge not found [ 396.396854][ T107] Registered IR keymap rc-empty [ 396.402930][ T107] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 396.426016][ T107] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input76 [ 396.537834][ C1] igorplugusb 1-1:0.0: Error: urb status = -32 [ 396.939979][ T5891] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 396.960365][ T5891] radio-si470x 2-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 397.036091][ T5891] usb 2-1: USB disconnect, device number 72 [ 397.185657][ T107] usb 3-1: USB disconnect, device number 72 [ 397.239138][T11197] bridge0: left allmulticast mode [ 397.510818][ T8784] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 397.531647][T11204] netlink: 'syz.2.1437': attribute type 4 has an invalid length. [ 397.670815][ T8784] usb 4-1: Using ep0 maxpacket: 32 [ 397.678796][ T8784] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 397.688467][ T8784] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.715419][ T8784] usb 4-1: config 0 descriptor?? [ 397.934748][ T8784] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 397.945486][ T8784] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 397.957258][ T8784] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 397.965913][ T8784] usb 4-1: media controller created [ 397.985250][ T8784] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 398.010818][ T107] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 398.137836][T11199] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 398.146823][T11199] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 398.166947][T11199] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 398.182912][ T107] usb 2-1: Using ep0 maxpacket: 32 [ 398.198604][T11199] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 398.201489][ T107] usb 2-1: unable to get BOS descriptor or descriptor too short [ 398.227729][ T107] usb 2-1: config 7 has an invalid interface number: 187 but max is 0 [ 398.240310][ T107] usb 2-1: config 7 has no interface number 0 [ 398.248125][ T107] usb 2-1: config 7 interface 187 has no altsetting 0 [ 398.262641][ T107] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 398.273142][ T107] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.281527][ T107] usb 2-1: Product: syz [ 398.286311][ T107] usb 2-1: Manufacturer: syz [ 398.298647][ T107] usb 2-1: SerialNumber: syz [ 398.520060][T11208] netlink: 'syz.1.1439': attribute type 12 has an invalid length. [ 398.528202][T11208] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1439'. [ 398.603272][ T131] usb 3-1: new full-speed USB device number 73 using dummy_hcd [ 398.608881][ T107] usb 2-1: Limiting number of CPorts to U8_MAX [ 398.619991][ T107] usb 2-1: Not enough endpoints found in device, aborting! [ 398.642757][ T5891] usb 1-1: USB disconnect, device number 77 [ 398.762716][ T131] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 398.773192][ T131] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 398.785439][ T131] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 398.796773][ T131] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 398.808546][ T131] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 398.833179][ T5927] usb 2-1: USB disconnect, device number 73 [ 398.849834][ T131] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 398.860212][ T131] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 398.868565][ T131] usb 3-1: Product: syz [ 398.873865][ T131] usb 3-1: Manufacturer: syz [ 398.878499][ T131] usb 3-1: SerialNumber: syz [ 398.886913][ T131] usb 3-1: config 0 descriptor?? [ 399.097091][ T131] radio-si470x 3-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 399.104499][ T131] radio-si470x 3-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 399.305247][ T131] radio-si470x 3-1:0.0: software version 0, hardware version 0 [ 399.320967][ T131] radio-si470x 3-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 399.334022][ T131] radio-si470x 3-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 399.506587][ T30] kauditd_printk_skb: 62 callbacks suppressed [ 399.506607][ T30] audit: type=1326 audit(1766819781.559:768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11214 comm="syz.2.1441" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 399.541731][ T131] radio-si470x 3-1:0.0: submitting int urb failed (-90) [ 399.549281][ T30] audit: type=1326 audit(1766819781.589:769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11214 comm="syz.2.1441" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 399.591039][ T30] audit: type=1326 audit(1766819781.589:770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11214 comm="syz.2.1441" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 399.613664][ T30] audit: type=1326 audit(1766819781.589:771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11214 comm="syz.2.1441" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 399.637719][ T30] audit: type=1326 audit(1766819781.589:772): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11214 comm="syz.2.1441" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 399.641789][ T5891] usb 5-1: new full-speed USB device number 62 using dummy_hcd [ 399.676683][ T30] audit: type=1326 audit(1766819781.589:773): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11214 comm="syz.2.1441" exe="/root/syz-executor" sig=0 arch=40000003 syscall=300 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 399.705833][ T30] audit: type=1326 audit(1766819781.589:774): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11214 comm="syz.2.1441" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 399.728856][ T30] audit: type=1326 audit(1766819781.599:775): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11214 comm="syz.2.1441" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 399.755003][ T30] audit: type=1326 audit(1766819781.599:776): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11214 comm="syz.2.1441" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 399.799992][ T30] audit: type=1326 audit(1766819781.599:777): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11214 comm="syz.2.1441" exe="/root/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 399.833158][ T5891] usb 5-1: too many endpoints for config 0 interface 0 altsetting 5: 254, using maximum allowed: 30 [ 399.847163][ T5891] usb 5-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 399.858151][ T5891] usb 5-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 399.871999][ T5891] usb 5-1: config 0 interface 0 has no altsetting 0 [ 399.878654][ T5891] usb 5-1: New USB device found, idVendor=5543, idProduct=0081, bcdDevice= 0.00 [ 399.888381][ T5891] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 399.899639][ T5891] usb 5-1: config 0 descriptor?? [ 400.050954][ T5927] usb 2-1: new full-speed USB device number 74 using dummy_hcd [ 400.091148][ T8784] az6027: usb out operation failed. (-110) [ 400.097684][ T8784] az6027: usb out operation failed. (-32) [ 400.103634][ T8784] stb0899_attach: Driver disabled by Kconfig [ 400.110208][ T8784] az6027: no front-end attached [ 400.110208][ T8784] [ 400.119250][ T8784] az6027: usb out operation failed. (-32) [ 400.126121][ T8784] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 400.136183][ T8784] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input77 [ 400.152468][ T8784] dvb-usb: schedule remote query interval to 400 msecs. [ 400.159889][ T8784] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 400.203449][ T5927] usb 2-1: too many endpoints for config 0 interface 0 altsetting 5: 254, using maximum allowed: 30 [ 400.214853][ T5927] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 400.225117][ T5927] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 400.239005][ T5927] usb 2-1: config 0 interface 0 has no altsetting 0 [ 400.245949][ T5927] usb 2-1: New USB device found, idVendor=5543, idProduct=0081, bcdDevice= 0.00 [ 400.260852][ T5927] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.283729][ T5927] usb 2-1: config 0 descriptor?? [ 400.295988][ T8784] usb 4-1: USB disconnect, device number 80 [ 400.376895][ T131] radio-si470x 3-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 400.386220][ T131] radio-si470x 3-1:0.0: probe with driver radio-si470x failed with error -22 [ 400.398670][ T8784] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 400.417808][ T131] usb 3-1: USB disconnect, device number 73 [ 400.525461][ T5891] usb 5-1: string descriptor 0 read error: -71 [ 400.549390][ T5891] uclogic 0003:5543:0081.001D: failed retrieving string descriptor #200: -71 [ 400.559668][ T5891] uclogic 0003:5543:0081.001D: failed retrieving pen parameters: -71 [ 400.569836][ T5891] uclogic 0003:5543:0081.001D: failed probing pen v2 parameters: -71 [ 400.578247][ T5891] uclogic 0003:5543:0081.001D: failed probing parameters: -71 [ 400.588541][ T5891] uclogic 0003:5543:0081.001D: probe with driver uclogic failed with error -71 [ 400.608262][ T5891] usb 5-1: USB disconnect, device number 62 [ 400.760967][ T8784] usb 4-1: new full-speed USB device number 81 using dummy_hcd [ 400.801142][T11247] sctp: [Deprecated]: syz.0.1451 (pid 11247) Use of int in max_burst socket option. [ 400.801142][T11247] Use struct sctp_assoc_value instead [ 400.932438][ T8784] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 400.942961][ T8784] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 400.954830][ T8784] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 400.970850][ T5927] usb 2-1: string descriptor 0 read error: -71 [ 400.980536][ T5927] uclogic 0003:5543:0081.001E: failed retrieving string descriptor #200: -71 [ 401.016537][ T5927] uclogic 0003:5543:0081.001E: failed retrieving pen parameters: -71 [ 401.024995][ T8784] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 401.037726][ T5927] uclogic 0003:5543:0081.001E: failed probing pen v2 parameters: -71 [ 401.046716][ T8784] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 401.060114][ T5927] uclogic 0003:5543:0081.001E: failed probing parameters: -71 [ 401.069847][ T5927] uclogic 0003:5543:0081.001E: probe with driver uclogic failed with error -71 [ 401.082594][ T8784] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 401.092599][ T8784] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 401.111580][ T5927] usb 2-1: USB disconnect, device number 74 [ 401.118966][ T8784] usb 4-1: Product: syz [ 401.130890][ T8784] usb 4-1: Manufacturer: syz [ 401.146598][ T8784] usb 4-1: SerialNumber: syz [ 401.163754][ T8784] usb 4-1: config 0 descriptor?? [ 401.252084][ T5891] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 401.345673][T11258] input: syz0 as /devices/virtual/input/input78 [ 401.372795][ T8784] radio-si470x 4-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 401.387137][ T8784] radio-si470x 4-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 401.414346][ T5891] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 401.430154][ T5891] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 401.442787][ T5891] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 401.452026][ T107] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 401.459847][ T5891] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 401.471498][ T5891] usb 1-1: Manufacturer: syz [ 401.479350][ T5891] usb 1-1: config 0 descriptor?? [ 401.551057][ T5891] rc_core: IR keymap rc-hauppauge not found [ 401.557033][ T5891] Registered IR keymap rc-empty [ 401.566965][ T5891] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 401.579114][ T5891] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input79 [ 401.593821][ T8784] radio-si470x 4-1:0.0: software version 0, hardware version 0 [ 401.604710][ T8784] radio-si470x 4-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 401.617822][ T8784] radio-si470x 4-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 401.620820][ T107] usb 3-1: Using ep0 maxpacket: 16 [ 401.656484][ T107] usb 3-1: config 222 has an invalid interface number: 31 but max is 0 [ 401.675138][ T107] usb 3-1: config 222 has no interface number 0 [ 401.691509][ T107] usb 3-1: config 222 interface 31 altsetting 11 endpoint 0xE has an invalid bInterval 255, changing to 11 [ 401.703384][ T107] usb 3-1: config 222 interface 31 altsetting 11 endpoint 0xE has invalid maxpacket 59391, setting to 1024 [ 401.722839][ C1] igorplugusb 1-1:0.0: Error: urb status = -32 [ 401.743895][ T107] usb 3-1: config 222 interface 31 has no altsetting 0 [ 401.763290][ T107] usb 3-1: New USB device found, idVendor=0f11, idProduct=2030, bcdDevice=a9.fd [ 401.784561][ T107] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.798361][ T8784] radio-si470x 4-1:0.0: submitting int urb failed (-90) [ 401.805960][ T107] usb 3-1: Product: syz [ 401.810278][ T107] usb 3-1: Manufacturer: syz [ 401.818542][ T107] usb 3-1: SerialNumber: syz [ 401.834078][T11254] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 402.040280][T11269] netlink: 'syz.1.1458': attribute type 2 has an invalid length. [ 402.076361][ T107] ldusb 3-1:222.31: LD USB Device #0 now attached to major 180 minor 0 [ 402.111229][ T107] usb 3-1: USB disconnect, device number 74 [ 402.137503][ T107] ldusb 3-1:222.31: LD USB Device #0 now disconnected [ 402.948121][T11276] veth1_to_team: entered allmulticast mode [ 403.000911][ T5927] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 403.031102][ T8784] radio-si470x 4-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 403.045998][ T8784] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 403.073166][ T8784] usb 4-1: USB disconnect, device number 81 [ 403.160966][ T5927] usb 3-1: Using ep0 maxpacket: 32 [ 403.168464][ T5927] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 403.177989][ T5927] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 403.188667][ T5927] usb 3-1: config 0 descriptor?? [ 403.403055][ T5927] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 403.414754][ T5927] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 403.428743][ T5927] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 403.437390][ T5927] usb 3-1: media controller created [ 403.456784][ T5927] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 403.613604][T11274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.628618][T11274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.645216][T11274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 403.662307][T11274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.690809][ T8784] usb 5-1: new full-speed USB device number 63 using dummy_hcd [ 403.846498][ T8784] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 403.864406][ T8784] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 403.891792][ T8784] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 403.921913][ T8784] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 403.947817][ T8784] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 403.982982][ T107] usb 1-1: USB disconnect, device number 78 [ 403.994479][ T8784] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 404.020792][ T8784] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 404.029240][ T8784] usb 5-1: Product: syz [ 404.056924][ T8784] usb 5-1: Manufacturer: syz [ 404.083679][ T8784] usb 5-1: SerialNumber: syz [ 404.102097][ T8784] usb 5-1: config 0 descriptor?? [ 404.313704][ T8784] radio-si470x 5-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 404.321497][ T8784] radio-si470x 5-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 404.390894][ T131] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 404.514377][ T8784] radio-si470x 5-1:0.0: software version 0, hardware version 0 [ 404.522314][ T8784] radio-si470x 5-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 404.535113][ T8784] radio-si470x 5-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 404.552179][ T131] usb 2-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 404.565329][ T131] usb 2-1: config 1 interface 0 has no altsetting 0 [ 404.574585][ T131] usb 2-1: New USB device found, idVendor=0eef, idProduct=0001, bcdDevice= 0.40 [ 404.583948][ T131] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.592017][ T131] usb 2-1: Product: syz [ 404.596437][ T131] usb 2-1: Manufacturer: syz [ 404.601165][ T131] usb 2-1: SerialNumber: syz [ 404.715391][ T30] kauditd_printk_skb: 67 callbacks suppressed [ 404.715407][ T30] audit: type=1326 audit(1766819786.769:845): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11283 comm="syz.4.1464" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 404.746030][ T8784] radio-si470x 5-1:0.0: submitting int urb failed (-90) [ 404.746206][ T30] audit: type=1326 audit(1766819786.769:846): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11283 comm="syz.4.1464" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 404.823640][ T30] audit: type=1326 audit(1766819786.769:847): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11283 comm="syz.4.1464" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 404.850974][ T30] audit: type=1326 audit(1766819786.769:848): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11283 comm="syz.4.1464" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 404.874738][ T30] audit: type=1326 audit(1766819786.769:849): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11283 comm="syz.4.1464" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 404.901683][ T30] audit: type=1326 audit(1766819786.769:850): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11283 comm="syz.4.1464" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 404.924295][ T30] audit: type=1326 audit(1766819786.769:851): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11283 comm="syz.4.1464" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 404.973385][ T30] audit: type=1326 audit(1766819786.769:852): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11283 comm="syz.4.1464" exe="/root/syz-executor" sig=0 arch=40000003 syscall=300 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 404.999396][ T30] audit: type=1326 audit(1766819786.769:853): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11283 comm="syz.4.1464" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 405.025020][ T30] audit: type=1326 audit(1766819786.769:854): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11283 comm="syz.4.1464" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 405.277069][T11307] FAULT_INJECTION: forcing a failure. [ 405.277069][T11307] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 405.291632][T11307] CPU: 0 UID: 0 PID: 11307 Comm: syz.0.1472 Tainted: G L syzkaller #0 PREEMPT(full) [ 405.291663][T11307] Tainted: [L]=SOFTLOCKUP [ 405.291671][T11307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 405.291683][T11307] Call Trace: [ 405.291691][T11307] [ 405.291700][T11307] dump_stack_lvl+0xe8/0x150 [ 405.291735][T11307] should_fail_ex+0x414/0x560 [ 405.291769][T11307] _copy_from_user+0x2d/0xb0 [ 405.291794][T11307] get_old_timespec32+0x88/0x130 [ 405.291817][T11307] ? __pfx_get_old_timespec32+0x10/0x10 [ 405.291841][T11307] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 405.291877][T11307] __se_sys_clock_nanosleep_time32+0x1b3/0x390 [ 405.291906][T11307] ? __pfx___se_sys_clock_nanosleep_time32+0x10/0x10 [ 405.291931][T11307] ? asm_int80_emulation+0x1a/0x20 [ 405.291954][T11307] ? asm_int80_emulation+0x1a/0x20 [ 405.291972][T11307] do_int80_emulation+0x11b/0x420 [ 405.291996][T11307] ? clear_bhb_loop+0x60/0xb0 [ 405.292015][T11307] ? clear_bhb_loop+0x60/0xb0 [ 405.292038][T11307] asm_int80_emulation+0x1a/0x20 [ 405.292057][T11307] RIP: 0023:0xf7fe4539 [ 405.292075][T11307] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 405.292093][T11307] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 000000000000010b [ 405.292115][T11307] RAX: ffffffffffffffda RBX: 00000000fffffff2 RCX: 0000000000ca9a3b [ 405.292130][T11307] RDX: 0000000080000000 RSI: 0000000099999999 RDI: 0000000000000000 [ 405.292143][T11307] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 405.292167][T11307] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 405.292179][T11307] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 405.292208][T11307] [ 405.523112][ T5927] az6027: usb out operation failed. (-110) [ 405.529486][ T5927] az6027: usb out operation failed. (-32) [ 405.535473][ T5927] stb0899_attach: Driver disabled by Kconfig [ 405.541920][ T5927] az6027: no front-end attached [ 405.541920][ T5927] [ 405.549401][ T5927] az6027: usb out operation failed. (-32) [ 405.555573][ T5927] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 405.564627][ T5927] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input80 [ 405.579876][ T5927] dvb-usb: schedule remote query interval to 400 msecs. [ 405.588032][ T5927] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 405.686217][ T8784] radio-si470x 5-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 405.697869][ T8784] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -22 [ 405.728423][ T8784] usb 5-1: USB disconnect, device number 63 [ 405.775138][ T7014] usb 3-1: USB disconnect, device number 75 [ 405.883552][ T7014] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 406.354470][T11324] netlink: 'syz.0.1475': attribute type 2 has an invalid length. [ 406.661047][ T7014] usb 3-1: new full-speed USB device number 76 using dummy_hcd [ 406.812706][ T7014] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 406.823329][ T7014] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 406.844701][ T7014] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 406.887528][ T7014] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 406.912585][ T7014] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 407.017564][ T7014] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 407.440856][ T7014] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 407.451229][ T7014] usb 3-1: Product: syz [ 407.464933][ T7014] usb 3-1: Manufacturer: syz [ 407.472461][ T7014] usb 3-1: SerialNumber: syz [ 407.502833][ T7014] usb 3-1: config 0 descriptor?? [ 407.588349][ T131] usbhid 2-1:1.0: can't add hid device: -71 [ 407.645341][ T131] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 407.696649][ T131] usb 2-1: USB disconnect, device number 75 [ 407.731162][ T7014] radio-si470x 3-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 407.762029][ T7014] radio-si470x 3-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 408.207350][ T7014] radio-si470x 3-1:0.0: software version 0, hardware version 0 [ 408.217447][ T7014] radio-si470x 3-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 408.234433][ T7014] radio-si470x 3-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 408.311882][ T131] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 408.371692][T11343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1483'. [ 408.405382][ T7014] radio-si470x 3-1:0.0: submitting int urb failed (-90) [ 408.423168][T11343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1483'. [ 408.460863][T11343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1483'. [ 408.490835][ T131] usb 2-1: Using ep0 maxpacket: 32 [ 408.502837][ T131] usb 2-1: unable to get BOS descriptor or descriptor too short [ 408.521493][ T131] usb 2-1: config 7 has an invalid interface number: 187 but max is 0 [ 408.529864][ T131] usb 2-1: config 7 has no interface number 0 [ 408.551808][ T131] usb 2-1: config 7 interface 187 has no altsetting 0 [ 408.560400][T11343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1483'. [ 408.569923][T11343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1483'. [ 408.585521][ T131] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 408.594737][ T131] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.602946][T11343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1483'. [ 408.614388][ T131] usb 2-1: Product: syz [ 408.618577][ T131] usb 2-1: Manufacturer: syz [ 408.624018][ T131] usb 2-1: SerialNumber: syz [ 408.861578][T11335] netlink: 'syz.1.1481': attribute type 12 has an invalid length. [ 408.882818][T11343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1483'. [ 408.894313][T11335] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1481'. [ 408.903693][T11343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1483'. [ 408.915563][T11343] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1483'. [ 408.973822][ T131] usb 2-1: Limiting number of CPorts to U8_MAX [ 409.011421][ T131] usb 2-1: Not enough endpoints found in device, aborting! [ 409.021001][ T8784] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 409.171130][ T8784] usb 5-1: Using ep0 maxpacket: 32 [ 409.187937][ T131] usb 2-1: USB disconnect, device number 76 [ 409.195841][ T8784] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 409.206685][ T8784] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 409.219759][ T8784] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 409.266689][ T8784] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 409.281100][ T8784] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 409.291670][ T8784] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 409.305173][ T8784] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 409.315015][ T8784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 409.327080][ T8784] usb 5-1: config 0 descriptor?? [ 409.434077][ T7014] radio-si470x 3-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 409.459117][ T7014] radio-si470x 3-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 409.491041][ T7014] usb 3-1: USB disconnect, device number 76 [ 409.538805][ T8784] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 64 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 409.572676][ T8784] usb 5-1: USB disconnect, device number 64 [ 409.584209][ T8784] usblp0: removed [ 410.031356][ T8784] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 410.040821][ T131] usb 1-1: new full-speed USB device number 79 using dummy_hcd [ 410.101738][ T5927] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 410.125051][ T52] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 410.160866][ T7014] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 410.182313][ T8784] usb 5-1: Using ep0 maxpacket: 32 [ 410.189130][ T8784] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 410.198449][ T8784] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 410.207468][ T8784] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 410.217051][ T131] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 410.227701][ T8784] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 410.237887][ T131] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 410.250641][ T8784] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 410.265243][ T131] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 410.277481][ T5927] usb 4-1: config 0 has no interfaces? [ 410.283210][ T8784] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 410.296715][ T5927] usb 4-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 410.306411][ T131] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 410.311081][ T7014] usb 2-1: Using ep0 maxpacket: 32 [ 410.316338][ T5927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.330226][ T8784] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 410.332172][ T7014] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 410.352341][ T131] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 410.353418][ T7014] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 410.368281][ T8784] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.378973][ T7014] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 8960, setting to 1024 [ 410.398250][ T7014] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 7 [ 410.399025][ T5927] usb 4-1: config 0 descriptor?? [ 410.410284][ T7014] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 410.422307][ T131] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 410.439160][ T8784] usb 5-1: config 0 descriptor?? [ 410.457102][ T7014] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 410.467092][ T7014] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.469303][ T131] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 410.480500][ T7014] usb 2-1: Product: syz [ 410.484423][ T131] usb 1-1: Product: syz [ 410.488741][ T7014] usb 2-1: Manufacturer: syz [ 410.492366][ T131] usb 1-1: Manufacturer: syz [ 410.492386][ T131] usb 1-1: SerialNumber: syz [ 410.507784][ T131] usb 1-1: config 0 descriptor?? [ 410.508007][ T7014] usb 2-1: SerialNumber: syz [ 410.525233][ T7014] usb 2-1: config 0 descriptor?? [ 410.662475][ T8784] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 65 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 410.695567][ T5927] usb 4-1: USB disconnect, device number 82 [ 410.728211][ T131] radio-si470x 1-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 410.740875][ T30] kauditd_printk_skb: 68 callbacks suppressed [ 410.740897][ T30] audit: type=1326 audit(1766819792.789:923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11362 comm="syz.3.1488" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0xffff0000 [ 410.779761][ T131] radio-si470x 1-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 410.819552][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 410.834592][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 410.842184][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 410.849142][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 410.866944][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 410.875367][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 410.884472][ C0] usblp0: nonzero read bulk status received: -71 [ 410.884683][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 410.891931][ T8784] usb 5-1: USB disconnect, device number 65 [ 410.920967][ T131] radio-si470x 1-1:0.0: software version 0, hardware version 0 [ 410.927807][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 410.930830][ T131] radio-si470x 1-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 410.948032][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 410.961457][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 410.968025][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 410.974424][ T131] radio-si470x 1-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 410.991170][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 411.000101][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 411.007362][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 411.022014][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 411.028713][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 411.050487][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 411.069500][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 411.077317][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 411.089857][ T7014] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 411.097793][ T7014] input input81: Timeout waiting for response from device. [ 411.112136][T11348] usblp0: removed [ 411.121942][ T30] audit: type=1326 audit(1766819793.179:924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11364 comm="syz.0.1489" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 411.149225][ T7014] usb 2-1: USB disconnect, device number 77 [ 411.160940][ T131] radio-si470x 1-1:0.0: submitting int urb failed (-90) [ 411.216002][ T30] audit: type=1326 audit(1766819793.199:925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11364 comm="syz.0.1489" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 411.270873][ T30] audit: type=1326 audit(1766819793.199:926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11364 comm="syz.0.1489" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 411.310878][ T30] audit: type=1326 audit(1766819793.199:927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11364 comm="syz.0.1489" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 411.361066][ T30] audit: type=1326 audit(1766819793.199:928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11364 comm="syz.0.1489" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 411.410799][ T30] audit: type=1326 audit(1766819793.199:929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11364 comm="syz.0.1489" exe="/root/syz-executor" sig=0 arch=40000003 syscall=300 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 411.435399][ T30] audit: type=1326 audit(1766819793.199:930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11364 comm="syz.0.1489" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 411.519182][ T30] audit: type=1326 audit(1766819793.199:931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11364 comm="syz.0.1489" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 411.547123][ T30] audit: type=1326 audit(1766819793.199:932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11364 comm="syz.0.1489" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7fe4539 code=0x7ffc0000 [ 412.180510][ T131] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 412.190300][ T131] radio-si470x 1-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 412.237378][ T131] usb 1-1: USB disconnect, device number 79 [ 412.340857][ T7014] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 412.400918][ T8784] usb 2-1: new full-speed USB device number 78 using dummy_hcd [ 412.503056][ T7014] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 412.521074][ T7014] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 412.563521][ T7014] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 412.591515][ T7014] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 412.617667][ T7014] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 412.623287][ T8784] usb 2-1: not running at top speed; connect to a high speed hub [ 412.634893][ T7014] usb 3-1: config 0 descriptor?? [ 412.670299][ T8784] usb 2-1: config 95 has an invalid interface number: 1 but max is 0 [ 412.698165][ T8784] usb 2-1: config 95 has no interface number 0 [ 412.708227][ T8784] usb 2-1: config 95 interface 1 has no altsetting 0 [ 412.725703][ T8784] usb 2-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice=ad.3f [ 412.735361][ T8784] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.744457][ T8784] usb 2-1: Product: syz [ 412.748877][ T8784] usb 2-1: Manufacturer: syz [ 412.753643][ T8784] usb 2-1: SerialNumber: syz [ 412.910531][ T7014] usbhid 3-1:0.0: can't add hid device: -71 [ 412.931001][ T5927] usb 5-1: new full-speed USB device number 66 using dummy_hcd [ 412.939425][ T7014] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 412.964465][ T7014] usb 3-1: USB disconnect, device number 77 [ 413.113657][ T5927] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 413.138765][ T5927] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 413.160967][ T5927] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 413.192085][ T5927] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 413.211081][T11402] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.213184][ T5927] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 413.254974][T11402] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.259771][ T5927] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 413.286886][ T5927] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 413.321214][ T5927] usb 5-1: Product: syz [ 413.331265][ T5927] usb 5-1: Manufacturer: syz [ 413.355720][ T5927] usb 5-1: SerialNumber: syz [ 413.407198][ T5927] usb 5-1: config 0 descriptor?? [ 413.566549][T11425] ptrace attach of "./syz-executor exec"[5844] was attempted by "./syz-executor exec"[11425] [ 413.616938][T11425] netlink: 'syz.3.1504': attribute type 1 has an invalid length. [ 413.649305][T11425] 8021q: adding VLAN 0 to HW filter on device bond2 [ 413.671739][T11425] bond2: (slave ip6erspan0): making interface the new active one [ 413.682132][T11425] bond2: (slave ip6erspan0): Enslaving as an active interface with an up link [ 413.728576][ T5927] radio-si470x 5-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 413.738153][ T5927] radio-si470x 5-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 413.770891][ T131] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 413.933654][ T131] usb 3-1: Using ep0 maxpacket: 32 [ 413.939579][ T5927] radio-si470x 5-1:0.0: software version 0, hardware version 0 [ 413.950485][ T131] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 413.963411][ T5927] radio-si470x 5-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 413.976181][ T131] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 413.988185][ T5927] radio-si470x 5-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 414.002443][ T131] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 8960, setting to 1024 [ 414.021350][ T131] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 7 [ 414.041332][ T131] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 414.058603][ T131] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 414.068913][ T131] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.079327][ T131] usb 3-1: Product: syz [ 414.084806][ T131] usb 3-1: Manufacturer: syz [ 414.089601][ T131] usb 3-1: SerialNumber: syz [ 414.109266][ T131] usb 3-1: config 0 descriptor?? [ 414.148034][ T5927] radio-si470x 5-1:0.0: submitting int urb failed (-90) [ 414.331502][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.338437][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.345870][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.352982][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.359677][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.366986][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.374550][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.381760][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.388821][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.396097][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.403815][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.411561][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.418345][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.425104][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.431894][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.438419][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.445434][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.452010][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.458846][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.465509][ T131] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 414.471603][ T131] input input82: Timeout waiting for response from device. [ 414.483886][ T131] usb 3-1: USB disconnect, device number 78 [ 414.973748][T11447] sg_write: data in/out 65489/10 bytes for SCSI command 0xfc-- guessing data in; [ 414.973748][T11447] program syz.2.1514 not setting count and/or reply_len properly [ 415.096084][ T107] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 415.142710][ T8784] usb 2-1: USB disconnect, device number 78 [ 415.206184][ T7691] udevd[7691]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:95.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 415.223305][ T5927] radio-si470x 5-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 415.267409][ T107] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 415.270118][ T5927] radio-si470x 5-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 415.309316][ T107] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 415.337636][ T5927] usb 5-1: USB disconnect, device number 66 [ 415.391849][ T107] usb 4-1: config 0 descriptor?? [ 415.400839][ T7014] usb 3-1: new full-speed USB device number 79 using dummy_hcd [ 415.428485][ T107] cp210x 4-1:0.0: cp210x converter detected [ 415.630375][ T107] usb 4-1: cp210x converter now attached to ttyUSB0 [ 415.653614][ T7014] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 415.664971][ T7014] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 415.697207][ T7014] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 415.771467][ T7014] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 415.843778][T11445] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.866182][ T7014] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 415.891255][T11445] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.901491][ T7014] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 415.912889][ T7014] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 415.922467][ T7014] usb 3-1: Product: syz [ 415.926952][ T7014] usb 3-1: Manufacturer: syz [ 415.931977][ T7014] usb 3-1: SerialNumber: syz [ 415.949840][ T7014] usb 3-1: config 0 descriptor?? [ 416.201097][ T7014] radio-si470x 3-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 416.208545][ T7014] radio-si470x 3-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 416.376928][ T7014] radio-si470x 3-1:0.0: software version 0, hardware version 0 [ 416.385334][ T7014] radio-si470x 3-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 416.398894][ T7014] radio-si470x 3-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 416.577824][ T30] kauditd_printk_skb: 67 callbacks suppressed [ 416.577838][ T30] audit: type=1326 audit(1766819798.629:1000): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11449 comm="syz.2.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 416.612308][ T7014] radio-si470x 3-1:0.0: submitting int urb failed (-90) [ 416.692501][ T30] audit: type=1326 audit(1766819798.659:1001): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11449 comm="syz.2.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 416.754433][ T30] audit: type=1326 audit(1766819798.659:1002): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11449 comm="syz.2.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 416.820835][ T107] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 416.835459][ T30] audit: type=1326 audit(1766819798.659:1003): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11449 comm="syz.2.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 416.890522][ T30] audit: type=1326 audit(1766819798.659:1004): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11449 comm="syz.2.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 416.938029][ T30] audit: type=1326 audit(1766819798.659:1005): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11449 comm="syz.2.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=300 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 416.961275][ T30] audit: type=1326 audit(1766819798.659:1006): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11449 comm="syz.2.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 417.013860][ T107] usb 5-1: config 0 has no interfaces? [ 417.019459][ T107] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 417.028591][ T30] audit: type=1326 audit(1766819798.659:1007): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11449 comm="syz.2.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 417.029316][ T107] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.148906][ T30] audit: type=1326 audit(1766819798.669:1008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11449 comm="syz.2.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 417.179049][ T30] audit: type=1326 audit(1766819798.669:1009): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11449 comm="syz.2.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 417.180207][ T107] usb 5-1: config 0 descriptor?? [ 417.663949][ T107] usb 5-1: USB disconnect, device number 67 [ 417.694184][ T7014] radio-si470x 3-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 417.708533][ T7014] radio-si470x 3-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 417.740235][ T7014] usb 3-1: USB disconnect, device number 79 [ 417.875529][ T5927] usb 4-1: USB disconnect, device number 83 [ 417.889089][ T5927] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 417.909774][ T5927] cp210x 4-1:0.0: device disconnected [ 417.960653][T11473] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1521'. [ 418.421148][ T5927] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 418.542659][T11487] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1526'. [ 418.590800][ T5927] usb 4-1: Using ep0 maxpacket: 32 [ 418.597809][ T5927] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 418.609869][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 418.621167][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 8960, setting to 1024 [ 418.640931][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 7 [ 418.652347][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 418.673196][ T5927] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 418.682596][ T5927] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.702662][ T5927] usb 4-1: Product: syz [ 418.710774][ T5927] usb 4-1: Manufacturer: syz [ 418.715436][ T5927] usb 4-1: SerialNumber: syz [ 418.742483][ T5927] usb 4-1: config 0 descriptor?? [ 418.965301][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 418.981310][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 418.998336][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.010999][ T7014] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 419.011286][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.036950][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.046129][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.052687][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.059379][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.066085][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.075333][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.082215][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.098332][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.121232][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.130639][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.141314][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.148082][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.157095][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.164755][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.171295][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.172012][ T7014] usb 3-1: Using ep0 maxpacket: 16 [ 419.177838][ T5927] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 419.188944][ T5927] input input83: Timeout waiting for response from device. [ 419.202027][ T7014] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 419.216538][ T5927] usb 4-1: USB disconnect, device number 84 [ 419.224259][ T7014] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 419.251835][ T7014] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 419.281330][ T7014] usb 3-1: config 0 interface 0 has no altsetting 0 [ 419.294707][ T7014] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 419.314558][ T7014] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.341582][ T7014] usb 3-1: config 0 descriptor?? [ 419.957447][T11490] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.966455][T11490] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 420.275350][T11516] netlink: 'syz.4.1530': attribute type 2 has an invalid length. [ 420.860812][ T5927] usb 4-1: new full-speed USB device number 85 using dummy_hcd [ 420.930792][ T5983] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 421.032932][ T5927] usb 4-1: too many endpoints for config 0 interface 0 altsetting 5: 254, using maximum allowed: 30 [ 421.046146][ T5927] usb 4-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 421.085422][ T5927] usb 4-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 421.110817][ T5983] usb 1-1: Using ep0 maxpacket: 32 [ 421.120257][ T5983] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 421.140954][ T5927] usb 4-1: config 0 interface 0 has no altsetting 0 [ 421.155407][ T5983] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.165433][ T5927] usb 4-1: New USB device found, idVendor=5543, idProduct=0081, bcdDevice= 0.00 [ 421.180800][ T5983] usb 1-1: config 0 descriptor?? [ 421.186022][ T5927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.216100][ T5927] usb 4-1: config 0 descriptor?? [ 421.370967][ T107] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 421.406413][ T5983] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 421.429639][ T5983] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 421.444628][ T5983] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 421.454911][ T5983] usb 1-1: media controller created [ 421.474379][ T5983] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 421.550872][ T107] usb 2-1: Using ep0 maxpacket: 8 [ 421.558701][ T107] usb 2-1: unable to get BOS descriptor or descriptor too short [ 421.568353][ T107] usb 2-1: config 0 has an invalid interface number: 88 but max is 0 [ 421.576924][ T107] usb 2-1: config 0 has no interface number 0 [ 421.583201][ T107] usb 2-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 421.594565][ T107] usb 2-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid wMaxPacketSize 0 [ 421.605027][ T107] usb 2-1: config 0 interface 88 has no altsetting 0 [ 421.617003][ T107] usb 2-1: string descriptor 0 read error: -22 [ 421.618570][T11524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 421.623789][ T107] usb 2-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 421.641685][ T107] usb 2-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 421.660539][T11524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 421.661143][ T107] usb 2-1: config 0 descriptor?? [ 421.678666][T11524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 421.692684][T11524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 421.701029][ T107] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.88/input/input84 [ 421.772417][ T5836] udevd[5836]: Error opening device "/dev/input/event4": Input/output error [ 421.782053][ T5836] udevd[5836]: Unable to EVIOCGABS device "/dev/input/event4" [ 421.789755][ T5836] udevd[5836]: Unable to EVIOCGABS device "/dev/input/event4" [ 421.860876][ T5927] usb 4-1: string descriptor 0 read error: -71 [ 421.890867][ T5927] uclogic 0003:5543:0081.001F: failed retrieving string descriptor #200: -71 [ 421.900029][ T5927] uclogic 0003:5543:0081.001F: failed retrieving pen parameters: -71 [ 421.921907][ T7014] usbhid 3-1:0.0: can't add hid device: -71 [ 421.929129][ T7014] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 421.933639][ T5927] uclogic 0003:5543:0081.001F: failed probing pen v2 parameters: -71 [ 421.947973][ T5927] uclogic 0003:5543:0081.001F: failed probing parameters: -71 [ 421.958401][ T107] usb 2-1: USB disconnect, device number 79 [ 421.963944][ T5927] uclogic 0003:5543:0081.001F: probe with driver uclogic failed with error -71 [ 421.966103][ T7014] usb 3-1: USB disconnect, device number 80 [ 422.024284][ T5927] usb 4-1: USB disconnect, device number 85 [ 422.136404][T11536] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 422.146673][T11536] syzkaller0: entered promiscuous mode [ 422.157067][T11536] syzkaller0: entered allmulticast mode [ 422.166202][T11536] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 422.186566][T11536] FAULT_INJECTION: forcing a failure. [ 422.186566][T11536] name failslab, interval 1, probability 0, space 0, times 0 [ 422.199614][T11536] CPU: 1 UID: 0 PID: 11536 Comm: syz.4.1540 Tainted: G L syzkaller #0 PREEMPT(full) [ 422.199641][T11536] Tainted: [L]=SOFTLOCKUP [ 422.199645][T11536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 422.199652][T11536] Call Trace: [ 422.199657][T11536] [ 422.199663][T11536] dump_stack_lvl+0xe8/0x150 [ 422.199682][T11536] should_fail_ex+0x414/0x560 [ 422.199709][T11536] should_failslab+0xa8/0x100 [ 422.199741][T11536] __kmalloc_noprof+0xdf/0x800 [ 422.199762][T11536] ? kfree+0x4d/0x660 [ 422.199785][T11536] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 422.199802][T11536] tomoyo_realpath_from_path+0xe3/0x5d0 [ 422.199817][T11536] ? tomoyo_domain+0xd8/0x130 [ 422.199833][T11536] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 422.199846][T11536] tomoyo_path_number_perm+0x1e8/0x5a0 [ 422.199871][T11536] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 422.199893][T11536] ? __lock_acquire+0x6b6/0x2cf0 [ 422.199917][T11536] ? get_pid_task+0x20/0x1f0 [ 422.199942][T11536] ? get_pid_task+0x20/0x1f0 [ 422.199964][T11536] ? __fget_files+0x2a/0x420 [ 422.199978][T11536] ? __fget_files+0x3a0/0x420 [ 422.199991][T11536] ? __fget_files+0x2a/0x420 [ 422.200017][T11536] security_file_ioctl_compat+0xcb/0x2d0 [ 422.200040][T11536] __ia32_compat_sys_ioctl+0x128/0x840 [ 422.200062][T11536] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 422.200082][T11536] ? __fget_files+0x3a0/0x420 [ 422.200113][T11536] ? fput+0xa0/0xd0 [ 422.200131][T11536] ? ksys_write+0x22a/0x250 [ 422.200142][T11536] ? __pfx_ksys_write+0x10/0x10 [ 422.200164][T11536] __do_fast_syscall_32+0x1dc/0x560 [ 422.200195][T11536] ? lockdep_hardirqs_on+0x7b/0x110 [ 422.200214][T11536] ? do_fast_syscall_32+0x34/0x80 [ 422.200236][T11536] ? irqentry_exit+0x10f/0x660 [ 422.200251][T11536] do_fast_syscall_32+0x34/0x80 [ 422.200263][T11536] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 422.200276][T11536] RIP: 0023:0xf7f86539 [ 422.200286][T11536] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 422.200295][T11536] RSP: 002b:00000000f547655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 422.200313][T11536] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000008922 [ 422.200327][T11536] RDX: 0000000080002280 RSI: 0000000000000000 RDI: 0000000000000000 [ 422.200339][T11536] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 422.200352][T11536] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 422.200364][T11536] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 422.200393][T11536] [ 422.200399][T11536] ERROR: Out of memory at tomoyo_realpath_from_path. [ 422.609422][T11538] mmap: syz.1.1542 (11538): VmData 37765120 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 422.661546][T11544] trusted_key: encrypted_key: keylen parameter is missing [ 422.731829][ T7014] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 422.762904][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 422.762925][ T30] audit: type=1800 audit(1766819804.819:1033): pid=11546 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1544" name="bus" dev="ramfs" ino=37697 res=0 errno=0 [ 422.886686][ T7014] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 422.906788][ T7014] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 422.926468][ T7014] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 422.946249][ T7014] usb 3-1: config 0 interface 0 has no altsetting 0 [ 422.954847][ T7014] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 422.967397][ T7014] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 422.980534][ T7014] usb 3-1: config 0 interface 0 has no altsetting 0 [ 422.989141][ T7014] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 422.998901][ T7014] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 423.010235][ T7014] usb 3-1: config 0 interface 0 has no altsetting 0 [ 423.019163][ T7014] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 423.028469][ T7014] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 423.039698][ T7014] usb 3-1: config 0 interface 0 has no altsetting 0 [ 423.049316][ T7014] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 423.058822][ T7014] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 423.069933][ T7014] usb 3-1: config 0 interface 0 has no altsetting 0 [ 423.078914][ T7014] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 423.088395][ T7014] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 423.103603][ T7014] usb 3-1: config 0 interface 0 has no altsetting 0 [ 423.111998][ T7014] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 423.122597][ T7014] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 423.134069][ T7014] usb 3-1: config 0 interface 0 has no altsetting 0 [ 423.142978][ T7014] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 423.152364][ T7014] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 423.163528][ T7014] usb 3-1: config 0 interface 0 has no altsetting 0 [ 423.171061][ T5927] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 423.181728][ T7014] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 423.190864][ T7014] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 423.199225][ T7014] usb 3-1: Product: syz [ 423.203615][ T107] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 423.212140][ T7014] usb 3-1: Manufacturer: syz [ 423.218066][ T7014] usb 3-1: SerialNumber: syz [ 423.225947][ T7014] usb 3-1: config 0 descriptor?? [ 423.236086][ T7014] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 423.343882][ T5927] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 423.352633][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 423.365049][ T5927] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 423.374880][ T5927] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 423.374880][ T107] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 423.374909][ T107] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 423.383754][ T5927] usb 4-1: Manufacturer: syz [ 423.396662][ T107] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 423.408757][ T5927] usb 4-1: config 0 descriptor?? [ 423.419964][ T107] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 423.449684][ T107] usb 2-1: Manufacturer: syz [ 423.458289][ T8784] usb 3-1: USB disconnect, device number 81 [ 423.468869][ T107] usb 2-1: config 0 descriptor?? [ 423.469671][ T8784] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 423.521064][ T5983] az6027: usb out operation failed. (-110) [ 423.527315][ T5983] az6027: usb out operation failed. (-32) [ 423.535766][ T5983] stb0899_attach: Driver disabled by Kconfig [ 423.541838][ T5983] az6027: no front-end attached [ 423.541838][ T5983] [ 423.549517][ T5983] az6027: usb out operation failed. (-32) [ 423.555583][ T5983] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 423.564769][ T5983] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input86 [ 423.580986][ T5927] rc_core: IR keymap rc-hauppauge not found [ 423.586933][ T5927] Registered IR keymap rc-empty [ 423.593769][ T5983] dvb-usb: schedule remote query interval to 400 msecs. [ 423.601443][ T5983] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 423.618911][ T5927] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 423.632623][ T5927] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input85 [ 423.656640][T11537] tipc: Bearer : already 2 bearers with priority 10 [ 423.666375][T11537] tipc: Bearer : trying with adjusted priority [ 423.674414][T11537] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 423.691449][T11537] syzkaller0: entered promiscuous mode [ 423.697413][T11537] syzkaller0: entered allmulticast mode [ 423.740098][ C0] igorplugusb 4-1:0.0: Error: urb status = -32 [ 423.766111][ T5927] usb 1-1: USB disconnect, device number 80 [ 423.826831][ T5927] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 424.075341][ T30] audit: type=1326 audit(1766819806.129:1034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11565 comm="syz.4.1551" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 424.099895][ C1] raw-gadget.2 gadget.1: ignoring, device is not running [ 424.107900][ T30] audit: type=1326 audit(1766819806.129:1035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11565 comm="syz.4.1551" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 424.130420][ C1] raw-gadget.2 gadget.1: ignoring, device is not running [ 424.137950][ T107] usbhid 2-1:0.0: can't add hid device: -32 [ 424.149824][ T107] usbhid 2-1:0.0: probe with driver usbhid failed with error -32 [ 424.162312][ T107] usb 2-1: USB disconnect, device number 80 [ 424.170972][ T30] audit: type=1326 audit(1766819806.199:1036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11565 comm="syz.4.1551" exe="/root/syz-executor" sig=0 arch=40000003 syscall=136 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 424.203501][ T30] audit: type=1326 audit(1766819806.199:1037): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11565 comm="syz.4.1551" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 424.270430][ T30] audit: type=1326 audit(1766819806.199:1038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11565 comm="syz.4.1551" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 424.294677][ T30] audit: type=1326 audit(1766819806.219:1039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11565 comm="syz.4.1551" exe="/root/syz-executor" sig=0 arch=40000003 syscall=4 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 424.349922][ T30] audit: type=1326 audit(1766819806.219:1040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11565 comm="syz.4.1551" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 424.384305][ T30] audit: type=1326 audit(1766819806.219:1041): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11565 comm="syz.4.1551" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 424.409078][ T30] audit: type=1326 audit(1766819806.219:1042): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11565 comm="syz.4.1551" exe="/root/syz-executor" sig=0 arch=40000003 syscall=228 compat=1 ip=0xf7f86539 code=0x7ffc0000 [ 424.869277][ T107] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 425.030833][ T107] usb 1-1: Using ep0 maxpacket: 32 [ 425.067300][ T107] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 425.083417][ T107] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 425.095009][ T107] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 8960, setting to 1024 [ 425.281287][ T107] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 7 [ 425.292598][ T107] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 425.355589][ T8784] usb 2-1: new full-speed USB device number 81 using dummy_hcd [ 425.425825][ T107] usb 1-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 425.437670][ T107] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.473915][ T107] usb 1-1: Product: syz [ 425.480549][ T107] usb 1-1: Manufacturer: syz [ 425.486012][ T107] usb 1-1: SerialNumber: syz [ 425.497728][ T107] usb 1-1: config 0 descriptor?? [ 425.526375][ T8784] usb 2-1: too many endpoints for config 0 interface 0 altsetting 5: 254, using maximum allowed: 30 [ 425.541215][ T8784] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 425.563819][ T8784] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 425.603477][ T8784] usb 2-1: config 0 interface 0 has no altsetting 0 [ 425.610914][ T8784] usb 2-1: New USB device found, idVendor=5543, idProduct=0081, bcdDevice= 0.00 [ 425.622603][ T8784] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.643943][ T8784] usb 2-1: config 0 descriptor?? [ 426.051730][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.416407][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.439911][ T7037] usb 4-1: USB disconnect, device number 86 [ 426.477346][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.495037][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.511128][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.513600][ T8784] usb 2-1: string descriptor 0 read error: -71 [ 426.517557][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.527486][ T8784] uclogic 0003:5543:0081.0020: failed retrieving string descriptor #200: -71 [ 426.542881][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.559751][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.571091][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.577806][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.585125][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.592211][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.595192][ T8784] uclogic 0003:5543:0081.0020: failed retrieving pen parameters: -71 [ 426.598639][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.655038][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.661577][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.769955][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.777046][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.803514][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.818979][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.837608][ T107] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 426.846167][ T107] input input87: Timeout waiting for response from device. [ 426.860895][ T8784] uclogic 0003:5543:0081.0020: failed probing pen v2 parameters: -71 [ 426.872420][ T107] usb 1-1: USB disconnect, device number 81 [ 426.956137][ T7037] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 426.975561][ T8784] uclogic 0003:5543:0081.0020: failed probing parameters: -71 [ 426.994708][ T8784] uclogic 0003:5543:0081.0020: probe with driver uclogic failed with error -71 [ 427.039496][ T8784] usb 2-1: USB disconnect, device number 81 [ 427.110866][ T7037] usb 4-1: device descriptor read/64, error -71 [ 427.404588][ T7037] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 427.581044][ T7037] usb 4-1: device descriptor read/64, error -71 [ 427.701102][ T7037] usb usb4-port1: attempt power cycle [ 427.770950][ T8784] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 427.860800][ T5983] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 427.933186][ T8784] usb 2-1: Using ep0 maxpacket: 32 [ 427.940668][ T8784] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 427.950118][ T8784] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.968786][ T8784] usb 2-1: config 0 descriptor?? [ 428.011217][ T5983] usb 3-1: Using ep0 maxpacket: 32 [ 428.022463][ T5983] usb 3-1: unable to get BOS descriptor or descriptor too short [ 428.031201][ T5983] usb 3-1: config 7 has an invalid interface number: 187 but max is 0 [ 428.039383][ T5983] usb 3-1: config 7 has no interface number 0 [ 428.045861][ T5983] usb 3-1: config 7 interface 187 has no altsetting 0 [ 428.050824][ T7037] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 428.055088][ T5983] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 428.069517][ T5983] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.077615][ T5983] usb 3-1: Product: syz [ 428.083066][ T5983] usb 3-1: Manufacturer: syz [ 428.087997][ T5983] usb 3-1: SerialNumber: syz [ 428.088155][ T7037] usb 4-1: device descriptor read/8, error -71 [ 428.176937][ T8784] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 428.186402][ T8784] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 428.196952][ T8784] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 428.204807][ T8784] usb 2-1: media controller created [ 428.218421][ T8784] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 428.308407][T11609] netlink: 'syz.2.1562': attribute type 12 has an invalid length. [ 428.316743][T11609] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1562'. [ 428.342309][ T7037] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 428.371665][ T7037] usb 4-1: device descriptor read/8, error -71 [ 428.384181][ T5983] usb 3-1: Limiting number of CPorts to U8_MAX [ 428.387129][T11607] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.399176][ T5983] usb 3-1: Not enough endpoints found in device, aborting! [ 428.401982][T11607] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.422297][T11607] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.435571][T11607] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.447039][ T8784] az6027: usb out operation failed. (-71) [ 428.460669][ T8784] az6027: usb out operation failed. (-71) [ 428.467163][ T8784] stb0899_attach: Driver disabled by Kconfig [ 428.473760][ T8784] az6027: no front-end attached [ 428.473760][ T8784] [ 428.481312][ T8784] az6027: usb out operation failed. (-71) [ 428.487032][ T8784] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 428.491205][ T7037] usb usb4-port1: unable to enumerate USB device [ 428.497959][ T8784] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input88 [ 428.514659][ T8784] dvb-usb: schedule remote query interval to 400 msecs. [ 428.523057][ T8784] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 428.538510][ T8784] usb 2-1: USB disconnect, device number 82 [ 428.579289][ T8784] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 428.667841][ T7037] usb 3-1: USB disconnect, device number 82 [ 428.842647][T11619] netlink: 'syz.0.1564': attribute type 2 has an invalid length. [ 429.250858][ T7037] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 429.402662][ T7037] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 429.413862][ T7037] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 429.423692][ T7037] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 429.436839][ T7037] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 429.446313][ T7037] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.458845][ T7037] usb 2-1: config 0 descriptor?? [ 429.581680][ T8784] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 429.685378][ T7037] usbhid 2-1:0.0: can't add hid device: -71 [ 429.703501][ T7037] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 429.712779][T11639] FAULT_INJECTION: forcing a failure. [ 429.712779][T11639] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 429.728783][ T7037] usb 2-1: USB disconnect, device number 83 [ 429.743995][T11639] CPU: 1 UID: 0 PID: 11639 Comm: syz.0.1571 Tainted: G L syzkaller #0 PREEMPT(full) [ 429.744015][T11639] Tainted: [L]=SOFTLOCKUP [ 429.744020][T11639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 429.744027][T11639] Call Trace: [ 429.744032][T11639] [ 429.744037][T11639] dump_stack_lvl+0xe8/0x150 [ 429.744067][T11639] should_fail_ex+0x414/0x560 [ 429.744101][T11639] _copy_from_iter+0x1cd/0x1630 [ 429.744121][T11639] ? __pfx__copy_from_iter+0x10/0x10 [ 429.744132][T11639] ? __build_skb_around+0x22d/0x3c0 [ 429.744145][T11639] ? __alloc_skb+0x198/0x3a0 [ 429.744155][T11639] ? netlink_sendmsg+0x642/0xb30 [ 429.744168][T11639] ? skb_put+0x11b/0x210 [ 429.744180][T11639] netlink_sendmsg+0x6b2/0xb30 [ 429.744201][T11639] ? __pfx_netlink_sendmsg+0x10/0x10 [ 429.744235][T11639] ? __import_iovec+0x5d4/0x7f0 [ 429.744256][T11639] ? aa_sock_msg_perm+0xf1/0x1b0 [ 429.744278][T11639] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 429.744289][T11639] ? __pfx_netlink_sendmsg+0x10/0x10 [ 429.744302][T11639] __sock_sendmsg+0x21c/0x270 [ 429.744324][T11639] ____sys_sendmsg+0x505/0x820 [ 429.744340][T11639] ? __pfx_____sys_sendmsg+0x10/0x10 [ 429.744366][T11639] ? kstrtouint+0x6e/0xe0 [ 429.744401][T11639] ___sys_sendmsg+0x21f/0x2a0 [ 429.744430][T11639] ? __pfx____sys_sendmsg+0x10/0x10 [ 429.744444][T11639] ? get_pid_task+0x20/0x1f0 [ 429.744457][T11639] ? get_pid_task+0x20/0x1f0 [ 429.744468][T11639] ? get_pid_task+0x20/0x1f0 [ 429.744496][T11639] ? __fget_files+0x2a/0x420 [ 429.744520][T11639] ? __fget_files+0x3a0/0x420 [ 429.744554][T11639] __sys_sendmsg+0x164/0x220 [ 429.744579][T11639] ? __pfx___sys_sendmsg+0x10/0x10 [ 429.744597][T11639] ? __pfx_ksys_write+0x10/0x10 [ 429.744613][T11639] __do_fast_syscall_32+0x1dc/0x560 [ 429.744625][T11639] ? lockdep_hardirqs_on+0x7b/0x110 [ 429.744635][T11639] ? do_fast_syscall_32+0x34/0x80 [ 429.744651][T11639] ? irqentry_exit+0x10f/0x660 [ 429.744675][T11639] do_fast_syscall_32+0x34/0x80 [ 429.744698][T11639] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 429.744722][T11639] RIP: 0023:0xf7fe4539 [ 429.744735][T11639] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 429.744744][T11639] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 429.744757][T11639] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000008000c2c0 [ 429.744765][T11639] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 429.744771][T11639] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 429.744777][T11639] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 429.744783][T11639] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 429.744807][T11639] [ 429.746351][ T8784] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 430.008697][ T107] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 430.045857][ T8784] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 430.220812][ T107] usb 4-1: Using ep0 maxpacket: 32 [ 430.226936][ T8784] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 430.258503][ T8784] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 430.266948][ T8784] usb 3-1: Manufacturer: syz [ 430.272112][ T5983] usb 2-1: new full-speed USB device number 84 using dummy_hcd [ 430.280125][ T107] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 430.331635][ T107] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 430.359126][ T107] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 8960, setting to 1024 [ 430.393561][T11648] netlink: 'syz.0.1573': attribute type 10 has an invalid length. [ 430.403267][T11648] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 430.411627][ T107] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 7 [ 430.430853][ T107] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 430.464409][ T107] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 430.470516][ T5983] usb 2-1: too many endpoints for config 0 interface 0 altsetting 5: 254, using maximum allowed: 30 [ 430.474054][ T107] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.484763][ T5983] usb 2-1: config 0 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 430.494341][T11648] team0: Port device netdevsim0 added [ 430.508786][ T107] usb 4-1: Product: syz [ 430.509709][ T8784] usb 3-1: config 0 descriptor?? [ 430.513354][ T107] usb 4-1: Manufacturer: syz [ 430.541041][ T5983] usb 2-1: config 0 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 430.598470][ T107] usb 4-1: SerialNumber: syz [ 430.609232][ T5983] usb 2-1: config 0 interface 0 has no altsetting 0 [ 430.612546][ T107] usb 4-1: config 0 descriptor?? [ 430.631827][T11652] netlink: 'syz.0.1573': attribute type 10 has an invalid length. [ 430.667133][T11652] team0: Port device netdevsim0 removed [ 430.700023][T11652] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 430.736531][ T5983] usb 2-1: New USB device found, idVendor=5543, idProduct=0081, bcdDevice= 0.00 [ 430.775026][ T5983] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.800610][ T5983] usb 2-1: config 0 descriptor?? [ 430.843068][ T8784] rc_core: IR keymap rc-hauppauge not found [ 430.849356][ T8784] Registered IR keymap rc-empty [ 430.858377][ T8784] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 430.884068][ T8784] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input89 [ 430.917803][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 430.925669][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 430.932911][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 430.941512][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.031525][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.038905][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.046122][ C0] igorplugusb 3-1:0.0: Error: urb status = -32 [ 431.057374][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.064127][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.070850][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.077511][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.089153][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.113634][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.133894][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.149931][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.165848][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.179352][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.210877][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.231972][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.253280][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.260105][ T107] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 431.284418][ T107] input input90: Timeout waiting for response from device. [ 431.352660][ T107] usb 4-1: USB disconnect, device number 91 [ 431.508260][ T5983] usb 2-1: string descriptor 0 read error: -71 [ 431.531867][ T5983] uclogic 0003:5543:0081.0021: failed retrieving string descriptor #200: -71 [ 431.552091][ T5983] uclogic 0003:5543:0081.0021: failed retrieving pen parameters: -71 [ 431.572366][ T5983] uclogic 0003:5543:0081.0021: failed probing pen v2 parameters: -71 [ 431.615876][ T5983] uclogic 0003:5543:0081.0021: failed probing parameters: -71 [ 431.661834][ T5983] uclogic 0003:5543:0081.0021: probe with driver uclogic failed with error -71 [ 431.710348][ T5983] usb 2-1: USB disconnect, device number 84 [ 431.776365][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 431.776383][ T30] audit: type=1326 audit(1766819813.829:1074): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11666 comm="syz.0.1577" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fe4539 code=0x0 [ 431.890941][ T8784] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 432.161155][ T8784] usb 4-1: Using ep0 maxpacket: 32 [ 432.187231][ T8784] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 432.196692][ T8784] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.223596][ T8784] usb 4-1: config 0 descriptor?? [ 432.361878][ T5983] usb 3-1: USB disconnect, device number 83 [ 432.393835][ T30] audit: type=1326 audit(1766819814.449:1075): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11685 comm="syz.2.1581" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ff00000 [ 432.450916][ T8784] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 432.643541][ T8784] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 432.669492][T11665] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 432.680017][ T8784] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 432.689549][T11665] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 432.722939][T11688] netlink: 'syz.4.1579': attribute type 2 has an invalid length. [ 432.764934][T11665] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 432.770951][ T8784] usb 4-1: media controller created [ 432.991591][ T8784] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 433.006428][T11665] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 433.192521][ T30] audit: type=1326 audit(1766819814.479:1076): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11685 comm="syz.2.1581" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ff00000 [ 433.215341][ T8784] az6027: usb out operation failed. (-71) [ 433.222010][ T8784] az6027: usb out operation failed. (-71) [ 433.227808][ T8784] stb0899_attach: Driver disabled by Kconfig [ 433.234423][ T8784] az6027: no front-end attached [ 433.234423][ T8784] [ 433.241948][ T30] audit: type=1326 audit(1766819814.479:1077): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11685 comm="syz.2.1581" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ff00000 [ 433.271013][ T8784] az6027: usb out operation failed. (-71) [ 433.277020][ T8784] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 433.292089][ T8784] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input91 [ 433.312810][ T30] audit: type=1326 audit(1766819814.479:1078): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11685 comm="syz.2.1581" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ff00000 [ 433.340903][ T8784] dvb-usb: schedule remote query interval to 400 msecs. [ 433.357151][ T8784] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 433.407952][ T8784] usb 4-1: USB disconnect, device number 92 [ 433.414626][ T30] audit: type=1326 audit(1766819814.479:1079): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11685 comm="syz.2.1581" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ff00000 [ 433.582120][ T30] audit: type=1326 audit(1766819814.479:1080): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11685 comm="syz.2.1581" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ff00000 [ 433.773113][ T8784] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 433.790841][ T30] audit: type=1326 audit(1766819814.479:1081): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11685 comm="syz.2.1581" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ff00000 [ 433.824915][ T30] audit: type=1326 audit(1766819814.479:1082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11685 comm="syz.2.1581" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ff00000 [ 433.849641][ T30] audit: type=1326 audit(1766819814.479:1083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11685 comm="syz.2.1581" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ff00000 [ 434.130175][T11697] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1583'. [ 434.473411][T11705] netlink: 'syz.3.1585': attribute type 4 has an invalid length. [ 434.491851][ T7014] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 434.680877][ T7014] usb 2-1: Using ep0 maxpacket: 32 [ 434.688327][ T7014] usb 2-1: unable to get BOS descriptor or descriptor too short [ 434.698185][ T7014] usb 2-1: config 7 has an invalid interface number: 187 but max is 0 [ 434.713118][ T7014] usb 2-1: config 7 has no interface number 0 [ 434.737084][ T7014] usb 2-1: config 7 interface 187 has no altsetting 0 [ 434.760201][ T7014] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 434.775124][ T7014] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.799553][ T7014] usb 2-1: Product: syz [ 434.808173][ T7014] usb 2-1: Manufacturer: syz [ 434.818446][ T7014] usb 2-1: SerialNumber: syz [ 435.071377][T11699] netlink: 'syz.1.1584': attribute type 12 has an invalid length. [ 435.079568][T11699] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1584'. [ 435.156558][ T7014] usb 2-1: Limiting number of CPorts to U8_MAX [ 435.223890][ T7014] usb 2-1: Not enough endpoints found in device, aborting! [ 435.370598][T11714] usb usb8: usbfs: process 11714 (syz.0.1587) did not claim interface 0 before use [ 435.499504][T11717] CUSE: info not properly terminated [ 435.547821][T11720] netlink: 'syz.0.1589': attribute type 11 has an invalid length. [ 435.558215][T11720] netlink: 'syz.0.1589': attribute type 4 has an invalid length. [ 435.567380][T11720] netlink: 199768 bytes leftover after parsing attributes in process `syz.0.1589'. [ 435.716773][ T8784] usb 2-1: USB disconnect, device number 85 [ 436.158753][T11738] netlink: 'syz.3.1593': attribute type 2 has an invalid length. [ 436.250818][ T8784] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 436.420845][ T8784] usb 3-1: Using ep0 maxpacket: 32 [ 436.429699][ T8784] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 436.446852][ T8784] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.467292][ T8784] usb 3-1: config 0 descriptor?? [ 436.631639][T11744] binder: 11743:11744 ioctl 4018620d 0 returned -22 [ 436.684714][ T8784] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 436.705089][ T8784] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 436.725138][ T8784] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 436.736906][ T8784] usb 3-1: media controller created [ 436.759717][ T8784] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 436.890224][T11735] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.903423][T11735] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.918120][ T8784] az6027: usb out operation failed. (-71) [ 436.938536][ T8784] az6027: usb out operation failed. (-71) [ 436.950676][ T8784] stb0899_attach: Driver disabled by Kconfig [ 436.964272][ T8784] az6027: no front-end attached [ 436.964272][ T8784] [ 436.978739][ T8784] az6027: usb out operation failed. (-71) [ 436.984757][ T8784] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 437.001096][ T8784] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input92 [ 437.023604][ T8784] dvb-usb: schedule remote query interval to 400 msecs. [ 437.035874][ T8784] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 437.049843][ T8784] usb 3-1: USB disconnect, device number 84 [ 437.084456][ T8784] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 437.210941][ T5983] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 437.371494][ T5983] usb 4-1: Using ep0 maxpacket: 32 [ 437.467224][ T5983] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 437.478587][ T5983] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 437.494063][ T5983] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 437.505993][ T5983] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 437.514670][ T5983] usb 4-1: Product: syz [ 437.519100][ T5983] usb 4-1: Manufacturer: syz [ 437.536559][ T5983] hub 4-1:4.0: USB hub found [ 437.738333][ T5983] hub 4-1:4.0: 5 ports detected [ 437.760385][ T5983] hub 4-1:4.0: insufficient power available to use all downstream ports [ 438.011303][ T7014] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 438.049795][ T5983] hub 4-1:4.0: hub_hub_status failed (err = -71) [ 438.059834][ T5983] hub 4-1:4.0: config failed, can't get hub status (err -71) [ 438.192436][ T7014] usb 1-1: Using ep0 maxpacket: 16 [ 438.202663][ T7014] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 438.214655][ T107] usb 3-1: new full-speed USB device number 85 using dummy_hcd [ 438.248669][ T7014] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.452794][ T7014] usb 1-1: config 0 descriptor?? [ 438.492308][ T5983] usb 4-1: USB disconnect, device number 93 [ 438.547090][ T7014] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 438.599076][ T107] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 438.618590][ T107] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 438.638759][ T107] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 438.657219][ T107] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 438.675895][ T7014] usb 1-1: Detected FT232B [ 438.680451][ T107] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 438.695864][ T107] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 438.705460][ T107] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 438.714623][ T107] usb 3-1: Product: syz [ 438.720404][ T107] usb 3-1: Manufacturer: syz [ 438.726960][ T107] usb 3-1: SerialNumber: syz [ 438.744086][ T107] usb 3-1: config 0 descriptor?? [ 438.871357][ T5983] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 438.961118][ T107] radio-si470x 3-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 438.972530][ T107] radio-si470x 3-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 439.031089][ T5983] usb 2-1: Using ep0 maxpacket: 32 [ 439.038426][ T5983] usb 2-1: unable to get BOS descriptor or descriptor too short [ 439.071429][ T5983] usb 2-1: config 7 has an invalid interface number: 187 but max is 0 [ 439.079652][ T5983] usb 2-1: config 7 has no interface number 0 [ 439.101683][ T5983] usb 2-1: config 7 interface 187 has no altsetting 0 [ 439.109087][ T7014] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 439.122426][ T5983] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 439.152914][ T5983] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.171853][ T107] radio-si470x 3-1:0.0: software version 0, hardware version 0 [ 439.184871][ T5983] usb 2-1: Product: syz [ 439.185821][ T107] radio-si470x 3-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 439.189161][ T5983] usb 2-1: Manufacturer: syz [ 439.189179][ T5983] usb 2-1: SerialNumber: syz [ 439.224419][ T107] radio-si470x 3-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 439.308861][ T8784] usb 1-1: USB disconnect, device number 82 [ 439.318346][ T8784] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 439.335049][ T8784] ftdi_sio 1-1:0.0: device disconnected [ 439.373032][ T30] kauditd_printk_skb: 2932 callbacks suppressed [ 439.373049][ T30] audit: type=1326 audit(1766819821.429:4016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11763 comm="syz.2.1603" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 439.377126][ T107] radio-si470x 3-1:0.0: submitting int urb failed (-90) [ 439.379415][ T30] audit: type=1326 audit(1766819821.429:4017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11763 comm="syz.2.1603" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 439.447171][ T30] audit: type=1326 audit(1766819821.429:4018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11763 comm="syz.2.1603" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 439.451407][T11772] netlink: 'syz.1.1605': attribute type 12 has an invalid length. [ 439.469948][ T30] audit: type=1326 audit(1766819821.429:4019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11763 comm="syz.2.1603" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 439.480609][T11772] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1605'. [ 439.518631][ T30] audit: type=1326 audit(1766819821.429:4020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11763 comm="syz.2.1603" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 439.601256][ T30] audit: type=1326 audit(1766819821.429:4021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11763 comm="syz.2.1603" exe="/root/syz-executor" sig=0 arch=40000003 syscall=300 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 439.638757][ T30] audit: type=1326 audit(1766819821.429:4022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11763 comm="syz.2.1603" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 439.663335][ T30] audit: type=1326 audit(1766819821.429:4023): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11763 comm="syz.2.1603" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 439.686608][ T30] audit: type=1326 audit(1766819821.429:4024): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11763 comm="syz.2.1603" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 439.709767][ T5983] usb 2-1: Limiting number of CPorts to U8_MAX [ 439.716873][ T5983] usb 2-1: Not enough endpoints found in device, aborting! [ 439.744925][ T30] audit: type=1326 audit(1766819821.429:4025): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11763 comm="syz.2.1603" exe="/root/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 439.916154][ T5967] usb 2-1: USB disconnect, device number 86 [ 440.062718][T11790] netlink: 'syz.0.1608': attribute type 2 has an invalid length. [ 440.079729][T11789] binder: 11788:11789 ioctl 4018620d 0 returned -22 [ 440.093683][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.110612][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.191114][ T107] radio-si470x 3-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 440.213950][ T107] radio-si470x 3-1:0.0: probe with driver radio-si470x failed with error -22 [ 440.274553][ T107] usb 3-1: USB disconnect, device number 85 [ 441.012428][T11805] FAULT_INJECTION: forcing a failure. [ 441.012428][T11805] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 441.069363][T11805] CPU: 0 UID: 0 PID: 11805 Comm: syz.0.1614 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.069396][T11805] Tainted: [L]=SOFTLOCKUP [ 441.069402][T11805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 441.069413][T11805] Call Trace: [ 441.069421][T11805] [ 441.069429][T11805] dump_stack_lvl+0xe8/0x150 [ 441.069460][T11805] should_fail_ex+0x414/0x560 [ 441.069498][T11805] _copy_from_user+0x2d/0xb0 [ 441.069523][T11805] get_compat_msghdr+0xad/0x4a0 [ 441.069556][T11805] ? __pfx_get_compat_msghdr+0x10/0x10 [ 441.069573][T11805] ? kstrtouint+0x6e/0xe0 [ 441.069590][T11805] ___sys_sendmsg+0x193/0x2a0 [ 441.069611][T11805] ? __pfx____sys_sendmsg+0x10/0x10 [ 441.069622][T11805] ? get_pid_task+0x20/0x1f0 [ 441.069635][T11805] ? get_pid_task+0x20/0x1f0 [ 441.069646][T11805] ? get_pid_task+0x20/0x1f0 [ 441.069673][T11805] ? __fget_files+0x2a/0x420 [ 441.069685][T11805] ? __fget_files+0x3a0/0x420 [ 441.069702][T11805] __sys_sendmsg+0x164/0x220 [ 441.069719][T11805] ? __pfx___sys_sendmsg+0x10/0x10 [ 441.069735][T11805] ? __pfx_ksys_write+0x10/0x10 [ 441.069751][T11805] __do_fast_syscall_32+0x1dc/0x560 [ 441.069763][T11805] ? lockdep_hardirqs_on+0x7b/0x110 [ 441.069773][T11805] ? do_fast_syscall_32+0x34/0x80 [ 441.069784][T11805] ? irqentry_exit+0x10f/0x660 [ 441.069796][T11805] do_fast_syscall_32+0x34/0x80 [ 441.069808][T11805] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 441.069822][T11805] RIP: 0023:0xf7fe4539 [ 441.069832][T11805] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 441.069842][T11805] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 441.069855][T11805] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001200 [ 441.069863][T11805] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 441.069869][T11805] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 441.069875][T11805] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 441.069882][T11805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 441.069897][T11805] [ 441.381015][ T5983] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 441.433597][T11811] lo: entered promiscuous mode [ 441.438943][T11811] tunl0: entered promiscuous mode [ 441.445479][T11811] gre0: entered promiscuous mode [ 441.453700][T11811] gretap0: entered promiscuous mode [ 441.472238][T11811] erspan0: entered promiscuous mode [ 441.478891][T11811] ip_vti0: entered promiscuous mode [ 441.485941][T11811] ip6_vti0: entered promiscuous mode [ 441.493832][T11811] sit0: entered promiscuous mode [ 441.505041][T11811] ip6tnl0: entered promiscuous mode [ 441.513697][T11811] syz_tun: entered promiscuous mode [ 441.520594][T11811] ip6gretap0: entered promiscuous mode [ 441.530960][ T5983] usb 3-1: device descriptor read/64, error -71 [ 441.537861][T11811] bridge0: entered promiscuous mode [ 441.548452][T11811] vcan0: entered promiscuous mode [ 441.555777][T11811] bond0: entered promiscuous mode [ 441.560986][ T8784] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 441.570658][T11811] 8021q: adding VLAN 0 to HW filter on device bond0 [ 441.580234][T11811] team0: entered promiscuous mode [ 441.587344][T11811] 8021q: adding VLAN 0 to HW filter on device team0 [ 441.600396][T11811] tipc: Resetting bearer [ 441.628202][T11811] tipc: Resetting bearer [ 441.638425][T11811] dummy0: entered promiscuous mode [ 441.678357][T11811] nlmon0: entered promiscuous mode [ 441.698551][T11811] caif0: entered promiscuous mode [ 441.705064][T11811] net_ratelimit: 6 callbacks suppressed [ 441.705080][T11811] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 441.728154][ T8784] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 441.749258][ T8784] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 441.767406][ T8784] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 441.780763][ T5983] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 441.799534][ T8784] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 441.810782][ T8784] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.830242][ T8784] usb 1-1: config 0 descriptor?? [ 441.921134][ T5983] usb 3-1: device descriptor read/64, error -71 [ 442.041667][ T5983] usb usb3-port1: attempt power cycle [ 442.155312][T11816] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1617'. [ 442.249433][ T8784] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0 [ 442.257168][ T8784] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0 [ 442.267381][ T8784] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0 [ 442.278970][ T8784] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0 [ 442.297702][ T8784] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0 [ 442.315663][ T8784] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0 [ 442.331226][ T8784] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0 [ 442.345927][ T8784] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0 [ 442.354042][ T8784] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0 [ 442.362011][ T8784] plantronics 0003:047F:FFFF.0022: unknown main item tag 0x0 [ 442.393496][ T8784] plantronics 0003:047F:FFFF.0022: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 442.406615][ T5983] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 442.431537][ T5983] usb 3-1: device descriptor read/8, error -71 [ 442.529937][T11823] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1618'. [ 442.542528][T11823] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 442.691494][ T5983] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 442.711410][ T5983] usb 3-1: device descriptor read/8, error -71 [ 442.821930][ T5983] usb usb3-port1: unable to enumerate USB device [ 443.086729][ T8784] usb 1-1: USB disconnect, device number 83 [ 443.845867][T11844] binder: 11843:11844 ioctl 4018620d 0 returned -22 [ 444.212879][T11850] netlink: 'syz.2.1625': attribute type 2 has an invalid length. [ 444.920804][ T5983] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 445.110809][ T5983] usb 4-1: Using ep0 maxpacket: 32 [ 445.117983][ T5983] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1b23, bcdDevice= 0.00 [ 445.127569][ T5983] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.150619][ T5983] usb 4-1: config 0 descriptor?? [ 445.195744][T11860] tipc: Enabling of bearer rejected, already enabled [ 445.210398][T11860] FAULT_INJECTION: forcing a failure. [ 445.210398][T11860] name failslab, interval 1, probability 0, space 0, times 0 [ 445.229045][T11860] CPU: 0 UID: 0 PID: 11860 Comm: syz.2.1629 Tainted: G L syzkaller #0 PREEMPT(full) [ 445.229082][T11860] Tainted: [L]=SOFTLOCKUP [ 445.229092][T11860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 445.229104][T11860] Call Trace: [ 445.229111][T11860] [ 445.229121][T11860] dump_stack_lvl+0xe8/0x150 [ 445.229145][T11860] should_fail_ex+0x414/0x560 [ 445.229165][T11860] should_failslab+0xa8/0x100 [ 445.229179][T11860] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 445.229195][T11860] ? __alloc_skb+0x198/0x3a0 [ 445.229207][T11860] ? __alloc_skb+0x1dc/0x3a0 [ 445.229216][T11860] ? __local_bh_enable_ip+0xd0/0x130 [ 445.229228][T11860] ? __alloc_skb+0x198/0x3a0 [ 445.229238][T11860] __alloc_skb+0x1dc/0x3a0 [ 445.229251][T11860] netlink_sendmsg+0x5c6/0xb30 [ 445.229269][T11860] ? __pfx_netlink_sendmsg+0x10/0x10 [ 445.229284][T11860] ? __import_iovec+0x5d4/0x7f0 [ 445.229295][T11860] ? aa_sock_msg_perm+0xf1/0x1b0 [ 445.229309][T11860] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 445.229319][T11860] ? __pfx_netlink_sendmsg+0x10/0x10 [ 445.229333][T11860] __sock_sendmsg+0x21c/0x270 [ 445.229350][T11860] ____sys_sendmsg+0x505/0x820 [ 445.229365][T11860] ? __pfx_____sys_sendmsg+0x10/0x10 [ 445.229379][T11860] ? kstrtouint+0x6e/0xe0 [ 445.229398][T11860] ___sys_sendmsg+0x21f/0x2a0 [ 445.229411][T11860] ? __pfx____sys_sendmsg+0x10/0x10 [ 445.229422][T11860] ? get_pid_task+0x20/0x1f0 [ 445.229435][T11860] ? get_pid_task+0x20/0x1f0 [ 445.229446][T11860] ? get_pid_task+0x20/0x1f0 [ 445.229472][T11860] ? __fget_files+0x2a/0x420 [ 445.229485][T11860] ? __fget_files+0x3a0/0x420 [ 445.229503][T11860] __sys_sendmsg+0x164/0x220 [ 445.229515][T11860] ? __pfx___sys_sendmsg+0x10/0x10 [ 445.229587][T11860] ? __pfx_ksys_write+0x10/0x10 [ 445.229602][T11860] __do_fast_syscall_32+0x1dc/0x560 [ 445.229620][T11860] ? lockdep_hardirqs_on+0x7b/0x110 [ 445.229629][T11860] ? do_fast_syscall_32+0x34/0x80 [ 445.229651][T11860] ? irqentry_exit+0x10f/0x660 [ 445.229663][T11860] do_fast_syscall_32+0x34/0x80 [ 445.229675][T11860] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 445.229689][T11860] RIP: 0023:0xf70cd539 [ 445.229703][T11860] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 445.229723][T11860] RSP: 002b:00000000f54bd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 445.229744][T11860] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000440 [ 445.229758][T11860] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 445.229766][T11860] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 445.229772][T11860] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 445.229779][T11860] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 445.229794][T11860] [ 445.673304][T11865] team0: Port device ip6gre0 removed [ 445.732993][T11865] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 445.762623][ T5983] usbhid 4-1:0.0: can't add hid device: -71 [ 445.768878][ T5983] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 445.779507][ T5983] usb 4-1: USB disconnect, device number 94 [ 445.808757][T11865] team0: Port device ip6gre0 added [ 446.210873][ T107] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 446.306007][T11881] team0: Port device ip6gre0 removed [ 446.312917][T11881] tipc: Resetting bearer [ 446.318970][T11881] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 446.337741][ T2994] tipc: Resetting bearer [ 446.351242][ T8784] skbuff: skb_under_panic: text:ffffffff8a25ea68 len:116 put:40 head:ffff888076c75000 data:ffff888076c74fe8 tail:0x5c end:0x6c0 dev:team0 [ 446.370796][ T107] usb 1-1: Using ep0 maxpacket: 32 [ 446.371674][ T8784] ------------[ cut here ]------------ [ 446.381463][ T8784] kernel BUG at net/core/skbuff.c:213! [ 446.391527][ T8784] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 446.397793][ T8784] CPU: 0 UID: 0 PID: 8784 Comm: kworker/0:10 Tainted: G L syzkaller #0 PREEMPT(full) [ 446.408804][ T8784] Tainted: [L]=SOFTLOCKUP [ 446.413126][ T8784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 446.423358][ T8784] Workqueue: mld mld_ifc_work [ 446.428034][ T8784] RIP: 0010:skb_panic+0x157/0x160 [ 446.433050][ T8784] Code: c7 60 9c 6f 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 ce 6a f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 446.452731][ T8784] RSP: 0018:ffffc900033e7440 EFLAGS: 00010282 [ 446.458791][ T8784] RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 1968fc87821fdf00 [ 446.466748][ T8784] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 446.474704][ T8784] RBP: 00000000000006c0 R08: ffffc900033e71a7 R09: 1ffff9200067ce34 [ 446.482699][ T8784] R10: dffffc0000000000 R11: fffff5200067ce35 R12: ffff88802fc32010 [ 446.490672][ T8784] R13: ffff888076c75000 R14: ffff888076c74fe8 R15: 000000000000005c [ 446.498747][ T8784] FS: 0000000000000000(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 [ 446.507661][ T8784] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 446.514232][ T8784] CR2: 00000000f541cffc CR3: 0000000066e74000 CR4: 00000000003526f0 [ 446.522202][ T8784] Call Trace: [ 446.525478][ T8784] [ 446.528399][ T8784] ? ip6gre_header+0xc8/0x790 [ 446.533068][ T8784] ? ip6gre_header+0xc8/0x790 [ 446.537730][ T8784] skb_push+0xc3/0xe0 [ 446.541698][ T8784] ip6gre_header+0xc8/0x790 [ 446.546197][ T8784] ? __pfx_ip6gre_header+0x10/0x10 [ 446.551363][ T8784] ? neigh_connected_output+0x1ea/0x460 [ 446.556907][ T8784] ? read_seqbegin+0xac/0x180 [ 446.561582][ T8784] ? lockdep_hardirqs_on+0x7b/0x110 [ 446.566773][ T8784] ? __pfx_ip6gre_header+0x10/0x10 [ 446.571970][ T8784] neigh_connected_output+0x286/0x460 [ 446.577352][ T8784] ? ip6_output+0x126/0x550 [ 446.581872][ T8784] ip6_output+0x340/0x550 [ 446.586210][ T8784] NF_HOOK+0x9e/0x380 [ 446.590191][ T8784] ? NF_HOOK+0x101/0x380 [ 446.594421][ T8784] ? __pfx_NF_HOOK+0x10/0x10 [ 446.599001][ T8784] ? __pfx_dst_output+0x10/0x10 [ 446.603844][ T8784] ? lockdep_hardirqs_on+0x7b/0x110 [ 446.609030][ T8784] ? __local_bh_enable_ip+0xd0/0x130 [ 446.614315][ T8784] ? icmp6_dst_alloc+0x3a5/0x420 [ 446.619247][ T8784] mld_sendpack+0x8d4/0xe60 [ 446.623748][ T8784] ? mld_sendpack+0x1e7/0xe60 [ 446.628416][ T8784] ? __pfx_mld_sendpack+0x10/0x10 [ 446.633467][ T8784] mld_ifc_work+0x83e/0xd60 [ 446.637956][ T8784] ? process_scheduled_works+0x9ef/0x1770 [ 446.643666][ T8784] process_scheduled_works+0xad1/0x1770 [ 446.649206][ T8784] ? __pfx_process_scheduled_works+0x10/0x10 [ 446.655166][ T8784] ? do_raw_spin_lock+0x121/0x290 [ 446.660181][ T8784] worker_thread+0x8a0/0xda0 [ 446.664756][ T8784] ? __kthread_parkme+0x7b/0x200 [ 446.669677][ T8784] kthread+0x711/0x8a0 [ 446.673737][ T8784] ? __pfx_worker_thread+0x10/0x10 [ 446.678836][ T8784] ? __pfx_kthread+0x10/0x10 [ 446.683407][ T8784] ? _raw_spin_unlock_irq+0x23/0x50 [ 446.688595][ T8784] ? __pfx_kthread+0x10/0x10 [ 446.693181][ T8784] ret_from_fork+0x510/0xa50 [ 446.697750][ T8784] ? __pfx_ret_from_fork+0x10/0x10 [ 446.702839][ T8784] ? __switch_to+0xc9e/0x1480 [ 446.707682][ T8784] ? __pfx_kthread+0x10/0x10 [ 446.712260][ T8784] ret_from_fork_asm+0x1a/0x30 [ 446.717180][ T8784] [ 446.720208][ T8784] Modules linked in: [ 446.725294][ T8784] ---[ end trace 0000000000000000 ]--- [ 446.742533][ T5983] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 446.752792][ T107] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 446.764355][ T8784] RIP: 0010:skb_panic+0x157/0x160 [ 446.769451][ T8784] Code: c7 60 9c 6f 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 ce 6a f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 446.789551][ T8784] RSP: 0018:ffffc900033e7440 EFLAGS: 00010282 [ 446.791265][ T107] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 446.807595][ T8784] RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 1968fc87821fdf00 [ 446.816171][ T8784] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 446.826257][ T107] usb 1-1: config 0 descriptor?? [ 446.828313][ T8784] RBP: 00000000000006c0 R08: ffffc900033e71a7 R09: 1ffff9200067ce34 [ 446.839817][ T8784] R10: dffffc0000000000 R11: fffff5200067ce35 R12: ffff88802fc32010 [ 446.862253][ T8784] R13: ffff888076c75000 R14: ffff888076c74fe8 R15: 000000000000005c [ 446.870408][ T8784] FS: 0000000000000000(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 [ 446.885507][ T8784] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 446.892300][ T8784] CR2: 000000000c2c926c CR3: 0000000032eca000 CR4: 00000000003526f0 [ 446.900440][ T8784] Kernel panic - not syncing: Fatal exception [ 446.906915][ T8784] Kernel Offset: disabled [ 446.911236][ T8784] Rebooting in 86400 seconds..