last executing test programs: 11.253031879s ago: executing program 2 (id=1797): socket$nl_generic(0x10, 0x3, 0x10) r0 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x7fff, 0x48b03) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x9, 0x3cf683) r3 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r4) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, 0x0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x2) ioctl$SNDRV_TIMER_IOCTL_INFO(r5, 0x80e85411, 0x0) sched_setattr(0x0, &(0x7f0000000340)={0x38, 0x0, 0x1000002d, 0x12000, 0x299c0, 0x7, 0x395400000000000, 0xfc5, 0x3, 0x5517}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000022fb040d80408fdb159000000010902240001080000000904b109020a5f8e400905080aff03f70709090587"], 0x0) syz_80211_join_ibss(&(0x7f0000000200)='wlan0\x00', &(0x7f00000002c0)=@default_ibss_ssid, 0x6, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r6, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000000306010400000000000000000200e704050001000700000030692b5aebac0cd17186e7779be9ab9e218cc6ca0af0bd83226a6865a9f66727"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, 0x0, &(0x7f0000000180)='%(/c\xbe\xfbL:', 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r7 = msgget(0x1, 0x448) msgctl$MSG_INFO(r7, 0xc, &(0x7f0000000000)=""/21) socket$nl_generic(0x10, 0x3, 0x10) 10.330321383s ago: executing program 0 (id=1800): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f00000047c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)={0x18, 0x6a, 0x601, 0x0, 0x0, "", [@typed={0x8, 0x42, 0x0, 0x0, @pid}]}, 0x18}], 0x1}, 0x0) r1 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000140)=@rxrpc=@in4={0x21, 0x3, 0x2d, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0}, 0x4000000) 10.266775853s ago: executing program 0 (id=1801): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x24, 0x65, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x4004014}, 0x40004) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r3 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x270}}, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000001380)=[{{&(0x7f0000000600)=@llc, 0x80, &(0x7f0000000780)=[{&(0x7f0000000b00)=""/152, 0x98}, {&(0x7f0000000800)=""/89, 0x59}, {&(0x7f0000000400)=""/7, 0x7}, {&(0x7f0000001400)=""/202, 0xca}], 0x4, &(0x7f0000000c00)=""/28, 0x1c}, 0x800}, {{&(0x7f0000000c40)=@xdp, 0x80, &(0x7f0000000e80), 0x0, &(0x7f0000000ec0)=""/239, 0xef}, 0xf1}, {{&(0x7f0000000fc0)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000001240)=[{&(0x7f0000001040)=""/94, 0x5e}, {&(0x7f00000010c0)=""/201, 0xc9}, {&(0x7f00000011c0)=""/92, 0x5c}], 0x3, &(0x7f0000000cc0)=""/205, 0xcd}, 0x8}], 0x3, 0x22, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = fanotify_init(0x200, 0x0) r6 = dup(r5) write$sndseq(r6, &(0x7f0000000440)=[{0x9, 0x0, 0x6, 0xc0, @time={0x2, 0xdaac}, {0xff, 0x3}, {0x3, 0x3}, @quote={{0x4, 0x4}, 0x6c95}}], 0x15) read$dsp(r4, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000002e000900fefffffffddbdf2504000000c9b5debc85775e131fc8788253f279db86f92d57e6af9555a511cbc66f0700efddffb0d13c6354a69a140be8357c802f35363f8300a0e9a8f36299e57d6a615ee0b880ab54d2e384f7ffffffffffffff1cd9d78a3a8b1fd4bff9e4f7680374c4e875d9710c300cc35937d5f23499a6910f904ae630928924cae1c9ff854df6b2355c4bf56b2cd47f827d3aac88a656681ebe85216a7c1097f0f51027fb5b2dba7ba0f16ff6afe19a067158662fa8deffede2c003359620f576bdc4ff9c20492c0bda20147d9b74e54ceddfe6d5e6997052db4016e0492d60cfba52db6b385ea33fadb3b53cf2e5b29399c6e20cb0ea1fe3753e806c21abd49e64ab8fa937c0a5cb837386bdd66aec303614ae574d8170536f"], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_usb_connect(0x1, 0x3d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r8, &(0x7f0000002140)={0x2020}, 0x2020) io_uring_enter(r8, 0x3a55, 0x8e3b, 0x68, &(0x7f0000000240)={[0x6, 0xe]}, 0x8) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r8, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x28, 0x1410, 0x400, 0x70bd29, 0x25dfdbf9, "", [@RDMA_NLDEV_ATTR_STAT_AUTO_MODE_MASK={0x8, 0x4c, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40080}, 0x10) getsockopt(r1, 0x5, 0xe, &(0x7f00000001c0)=""/97, &(0x7f00000000c0)=0x61) writev(r9, &(0x7f0000000000)=[{0x0}, {&(0x7f0000019080)='\x00\x00', 0x2}], 0x50) 7.927572104s ago: executing program 2 (id=1804): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x6, 0x6, @remote}, 0x14) sendmmsg$sock(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40500f0) 7.693416198s ago: executing program 2 (id=1806): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='$'], 0x24}}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000001c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0xd4}, 0x9c) r3 = openat$hwrng(0xffffff9c, &(0x7f0000000000), 0x20402, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) r7 = syz_usb_connect$uac1(0x2, 0xa6, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000106b1d01010000000003010902940003010040000904000000010100000a2401000000020102132406000006000000281ab0ab2c90619b34000000000000000000000924030000000000000924050000f8211cfd0924030500000004000724050401"], 0x0) syz_usb_control_io$uac1(r7, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)={0x0, 0x3, 0x4, @string={0x4, 0x3, "5af9"}}}, 0x0) ioctl$DRM_IOCTL_MODE_GETENCODER(r6, 0xc01464a6, &(0x7f0000000140)) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)={0x24, r5, 0x4, 0x70bd27, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x2}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) sendmsg$NL80211_CMD_SET_COALESCE(r4, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r5, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r8}, @void}}}, 0x28}}, 0x0) inotify_init1(0x800) getsockopt$inet6_opts(r3, 0x29, 0x36, &(0x7f0000000040)=""/19, &(0x7f0000000080)=0x13) 7.009773602s ago: executing program 0 (id=1812): socket$nl_generic(0x10, 0x3, 0x10) r0 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x7fff, 0x48b03) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x9, 0x3cf683) r3 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r4) r5 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x2) ioctl$SNDRV_TIMER_IOCTL_INFO(r6, 0x80e85411, 0x0) ioctl$KDFONTOP_GET(r5, 0x4b72, 0x0) sched_setattr(0x0, &(0x7f0000000340)={0x38, 0x0, 0x1000002d, 0x12000, 0x299c0, 0x7, 0x395400000000000, 0xfc5, 0x3, 0x5517}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000022fb040d80408fdb159000000010902240001080000000904b109020a5f8e400905080aff03f70709090587"], 0x0) syz_80211_join_ibss(&(0x7f0000000200)='wlan0\x00', &(0x7f00000002c0)=@default_ibss_ssid, 0x6, 0x1) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r7, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000000306010400000000000000000200e704050001000700000030692b5aebac0cd17186e7779be9ab9e218cc6ca0af0bd83226a6865a9f66727"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, 0x0, &(0x7f0000000180)='%(/c\xbe\xfbL:', 0x0) r8 = msgget(0x1, 0x448) msgctl$MSG_INFO(r8, 0xc, &(0x7f0000000000)=""/21) socket$nl_generic(0x10, 0x3, 0x10) 6.567387629s ago: executing program 3 (id=1815): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x200000000) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000004c0)={0x4, 0x0, [{0x8000000, 0xfe, &(0x7f00000003c0)=""/254}, {0x0, 0x35, &(0x7f0000000300)=""/53}, {0xfec00000, 0x27, &(0x7f0000000100)=""/39}, {0xe000, 0x1000, &(0x7f0000000f00)=""/4096}]}) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000040)={0x0, r2}) ioctl$VHOST_RESET_OWNER(r0, 0x8008af83, 0x0) 6.364625046s ago: executing program 3 (id=1817): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x2, 0x4, 0x2, 0xfff, 0x100, 0x1000, 0xf7, 0x9, 0x3}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@getchain={0x24, 0x66, 0xfff1, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xe}, {0x4, 0xfff1}, {0x9, 0x1ffef}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x800) 5.982815942s ago: executing program 3 (id=1818): socket$nl_generic(0x10, 0x3, 0x10) r0 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x7fff, 0x48b03) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x9, 0x3cf683) r3 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r4) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, 0x0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x2) ioctl$SNDRV_TIMER_IOCTL_INFO(r5, 0x80e85411, 0x0) sched_setattr(0x0, &(0x7f0000000340)={0x38, 0x0, 0x1000002d, 0x12000, 0x299c0, 0x7, 0x395400000000000, 0xfc5, 0x3, 0x5517}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000022fb040d80408fdb159000000010902240001080000000904b109020a5f8e400905080aff03f70709090587"], 0x0) syz_80211_join_ibss(&(0x7f0000000200)='wlan0\x00', &(0x7f00000002c0)=@default_ibss_ssid, 0x6, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r6, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000000306010400000000000000000200e704050001000700000030692b5aebac0cd17186e7779be9ab9e218cc6ca0af0bd83226a6865a9f66727"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, 0x0, &(0x7f0000000180)='%(/c\xbe\xfbL:', 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r7 = msgget(0x1, 0x448) msgctl$MSG_INFO(r7, 0xc, &(0x7f0000000000)=""/21) socket$nl_generic(0x10, 0x3, 0x10) 5.777514743s ago: executing program 2 (id=1820): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00'}) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000000c0)={r2, 0x1, 0x6, @local}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x2008, 0x5, 0x11) r6 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x1, 0x0) fchdir(r7) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) openat(0xffffffffffffff9c, &(0x7f0000001740)='.\x00', 0x515001, 0x408) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r8, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xfffffffc, 0xff, 0x80000000}, 0x1c) r9 = socket$netlink(0x10, 0x3, 0x4) write(r9, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0x27) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TIOCSETD(r10, 0x5423, &(0x7f0000000040)=0xd) ioctl$FIONREAD(r10, 0x541b, &(0x7f00000001c0)) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x400, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 5.379401987s ago: executing program 1 (id=1822): r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x7, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0x9]}}) r1 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b16abf8d77f0", 0x9, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='bridge0\x00', 0x10) sendto$inet(r0, &(0x7f0000000040)="255f5a03204f8e0b", 0xdd86, 0x804, &(0x7f0000000080)={0x2, 0x4e22, @multicast1=0xe000000d}, 0x10) 5.204688821s ago: executing program 2 (id=1823): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x24, 0x65, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x4004014}, 0x40004) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r3 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x270}}, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000001380)=[{{&(0x7f0000000600)=@llc, 0x80, &(0x7f0000000780)=[{&(0x7f0000000b00)=""/152, 0x98}, {&(0x7f0000000800)=""/89, 0x59}, {&(0x7f0000000400)=""/7, 0x7}, {&(0x7f0000001400)=""/202, 0xca}], 0x4, &(0x7f0000000c00)=""/28, 0x1c}, 0x800}, {{&(0x7f0000000c40)=@xdp, 0x80, &(0x7f0000000e80), 0x0, &(0x7f0000000ec0)=""/239, 0xef}, 0xf1}, {{&(0x7f0000000fc0)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000001240)=[{&(0x7f0000001040)=""/94, 0x5e}, {&(0x7f00000010c0)=""/201, 0xc9}, {&(0x7f00000011c0)=""/92, 0x5c}], 0x3, &(0x7f0000000cc0)=""/205, 0xcd}, 0x8}], 0x3, 0x22, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x200000, 0x0, 0xb49, 0x9, 0xc, 0x0, 0x1}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = fanotify_init(0x200, 0x0) r6 = dup(r5) write$sndseq(r6, &(0x7f0000000440)=[{0x9, 0x0, 0x6, 0xc0, @time={0x2, 0xdaac}, {0xff, 0x3}, {0x3, 0x3}, @quote={{0x4, 0x4}, 0x6c95}}], 0x15) read$dsp(r4, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000002e000900fefffffffddbdf2504000000c9b5debc85775e131fc8788253f279db86f92d57e6af9555a511cbc66f0700efddffb0d13c6354a69a140be8357c802f35363f8300a0e9a8f36299e57d6a615ee0b880ab54d2e384f7ffffffffffffff1cd9d78a3a8b1fd4bff9e4f7680374c4e875d9710c300cc35937d5f23499a6910f904ae630928924cae1c9ff854df6b2355c4bf56b2cd47f827d3aac88a656681ebe85216a7c1097f0f51027fb5b2dba7ba0f16ff6afe19a067158662fa8deffede2c003359620f576bdc4ff9c20492c0bda20147d9b74e54ceddfe6d5e6997052db4016e0492d60cfba52db6b385ea33fadb3b53cf2e5b29399c6e20cb0ea1fe3753e806c21abd49e64ab8fa937c0a5cb837386bdd66aec303614ae574d8170536f"], 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x0) syz_usb_connect(0x1, 0x3d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r8, &(0x7f0000002140)={0x2020}, 0x2020) io_uring_enter(r8, 0x3a55, 0x8e3b, 0x68, &(0x7f0000000240)={[0x6, 0xe]}, 0x8) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r8, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x28, 0x1410, 0x400, 0x70bd29, 0x25dfdbf9, "", [@RDMA_NLDEV_ATTR_STAT_AUTO_MODE_MASK={0x8, 0x4c, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40080}, 0x10) getsockopt(r1, 0x5, 0xe, &(0x7f00000001c0)=""/97, &(0x7f00000000c0)=0x61) writev(r9, &(0x7f0000000000)=[{0x0}, {&(0x7f0000019080)='\x00\x00', 0x2}], 0x50) 4.986210431s ago: executing program 1 (id=1824): r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf900000080149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d665f985881a350000ddffffff00", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "715237601a8ca5b07dcc141802c4dacf162e43ac61f7ad330000000000a04100", [0xfffffffffffffce8, 0xa]}}) 4.717334728s ago: executing program 1 (id=1825): syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="0430f5c7c90034d9493ad3c6a2247a769bcc8203a462b70ef8f6102c57f4c6078eb7680df7ef6363d4"], 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000040)={{{@in=@rand_addr=0x64010100, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e23, 0x0, 0xffff, 0x8000, 0x2}, {0x0, 0x1, 0x0, 0x1000000000000, 0x5, 0xfffffffffffffffa}, {0x0, 0x0, 0x0, 0x2}, 0x8, 0x0, 0x1, 0x0, 0x3}, {{@in=@empty, 0x0, 0x33}, 0xa, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x3507, 0x4, 0x1, 0x0, 0x0, 0x7c, 0xfffffffe}}, 0xe8) connect$inet6(r1, 0x0, 0x0) 4.541992902s ago: executing program 1 (id=1826): socket$nl_generic(0x10, 0x3, 0x10) fsopen(&(0x7f0000000040)='afs\x00', 0x0) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$video4linux(0x0, 0x7fff, 0x48b03) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x9, 0x3cf683) r2 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r3) r4 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r2, 0xc01064c8, 0x0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x2) ioctl$SNDRV_TIMER_IOCTL_INFO(r5, 0x80e85411, 0x0) ioctl$KDFONTOP_GET(r4, 0x4b72, 0x0) sched_setattr(0x0, &(0x7f0000000340)={0x38, 0x0, 0x1000002d, 0x12000, 0x299c0, 0x7, 0x395400000000000, 0xfc5, 0x3, 0x5517}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000022fb040d80408fdb159000000010902240001080000000904b109020a5f8e400905080aff03f70709090587"], 0x0) syz_80211_join_ibss(&(0x7f0000000200)='wlan0\x00', &(0x7f00000002c0)=@default_ibss_ssid, 0x6, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r6, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c0000000306010400000000000000000200e704050001000700000030692b5aebac0cd17186e7779be9ab9e218cc6ca0af0bd83226a6865a9f66727"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r7 = msgget(0x1, 0x448) msgctl$MSG_INFO(r7, 0xc, &(0x7f0000000000)=""/21) socket$nl_generic(0x10, 0x3, 0x10) 3.387309553s ago: executing program 0 (id=1827): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)={0x5c, 0x2, 0x6, 0x5, 0xa, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x8cff}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x74}]}]}, 0x5c}}, 0x0) 3.042985567s ago: executing program 0 (id=1828): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x2, 0x4, 0x2, 0xfff, 0x100, 0x1000, 0xf7, 0x9, 0x3}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@getchain={0x24, 0x66, 0xfff1, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xe}, {0x4, 0xfff1}, {0x9, 0x1ffef}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x800) 2.090096199s ago: executing program 4 (id=1830): ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f00000008c0)={0xc0}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_COMPAT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c000000000b00020000000020000000030000050500010000000000081c000240000000030800024000000002553ffc"], 0x2c}, 0x1, 0x0, 0x0, 0x4094}, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x400020) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f0000000000)) 1.81824457s ago: executing program 4 (id=1831): r0 = socket(0x400000000010, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=@newtfilter={0x98, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfa, {0x0, 0x0, 0x0, r6, {0x0, 0x2}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_matchall={{0xd}, {0x64, 0x2, [@TCA_MATCHALL_ACT={0x60, 0x2, [@m_vlan={0x5c, 0x1, 0x0, 0x0, {{0x9}, {0x30, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x670, 0x81, 0xffffffffdffffffb, 0x7, 0x10000}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x1}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xa14}]}, {0xfffffffffffffd45}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x24000810}, 0x0) (fail_nth: 9) 1.372334904s ago: executing program 0 (id=1832): r0 = syz_usb_connect(0x5, 0x239, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e388d640697a01006ba8010203010902270201020010000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000040)={0x0}) 1.265358881s ago: executing program 3 (id=1833): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00'}) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000000c0)={r2, 0x1, 0x6, @local}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x2008, 0x5, 0x11) r6 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x1, 0x0) fchdir(r7) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) openat(0xffffffffffffff9c, &(0x7f0000001740)='.\x00', 0x515001, 0x408) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r8, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xfffffffc, 0xff, 0x80000000}, 0x1c) r9 = socket$netlink(0x10, 0x3, 0x4) write(r9, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0x27) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TIOCSETD(r10, 0x5423, &(0x7f0000000040)=0xd) ioctl$FIONREAD(r10, 0x541b, &(0x7f00000001c0)) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x400, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 1.094350164s ago: executing program 4 (id=1834): r0 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r0, &(0x7f0000019440)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471", 0x36}], 0x1) 1.040678727s ago: executing program 3 (id=1835): r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf900000080149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d665f985881a350000ddffffff00", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "715237601a8ca5b07dcc141802c4dacf162e43ac61f7ad330000000000a04100", [0xfffffffffffffce8, 0xa]}}) 981.407546ms ago: executing program 4 (id=1836): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000021007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000300)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000180)='kfree\x00', r1, 0x0, 0x1}, 0x18) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000400)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x2000008, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}, {0x0, 0xc}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0x40}}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='workqueue_queue_work\x00', r5}, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r6, &(0x7f0000000f00)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, @in={0x2, 0x4e23, @loopback}, @in={0x2, 0x4e20, @multicast1}}}, 0x118) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r7, 0x80e85411, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x64, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x9}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xff}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x64}}, 0x0) r9 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f00000004c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r9, &(0x7f0000000280)={0xa, 0x4, 0xfa00, {r10}}, 0xc) write$RDMA_USER_CM_CMD_LISTEN(r6, &(0x7f0000000040)={0x7, 0x8, 0xfa00, {r10, 0x2}}, 0x10) r11 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x3, 0x4, 0x4, 0x9}, 0x50) r12 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r12, 0x89e0, &(0x7f0000000000)={r12}) r13 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r13, 0xffffffffffffffff, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000000)=0x9) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xd, 0x6, 0x4, 0x3, 0x0, r11}, 0x50) 786.267801ms ago: executing program 3 (id=1837): openat2(0xffffffffffffff9c, 0x0, &(0x7f0000005740)={0x81b3a847f3c7f216, 0x1}, 0x18) syz_usb_connect(0x3, 0x24, &(0x7f0000000200)={{0x12, 0x1, 0x69b, 0x7c, 0xbd, 0xb4, 0x20, 0xb48, 0x300d, 0x16c8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x8, 0xe8, 0xe, [{{0x9, 0x4, 0x88, 0xb, 0x0, 0xc3, 0x51, 0x2, 0x9}}]}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x60, 0x0, 0x64}) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000240)={&(0x7f0000000340)=[{0x1000, 0x14201, 0x0, 0x0}], 0x1}) 745.255446ms ago: executing program 4 (id=1838): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)={0x5c, 0x2, 0x6, 0x5, 0xa, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x8cff}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x74}]}]}, 0x5c}}, 0x0) 653.956539ms ago: executing program 4 (id=1839): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000180)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x64) r0 = syz_open_dev$usbfs(&(0x7f00000003c0), 0x16b5, 0x41) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000180)={0x80, 0x6, 0x102, 0x0, 0x4b, 0x6, 0x0}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000001f00)=0x4, 0x4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), r1) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r5, 0x0, 0x80, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x1000000, 0x80000580, 0x800005b0, 0x800005e0, 0x1000000], 0x0, 0x0, &(0x7f0000002180)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000009b83c6657fd6ecf9a0377e2000000000000000000000088cd000000feffffff0000000000000000000000000000000000000000000000000000000001000000f2ffffff0000000000000000ffbfffff00000000cc54e9f7dab9560940ccd315cc77bfc9e07c9061684ac67cc8ae9504e446a42f61ba6d393c71364e84cf448ea81cadadcf8f8ae0af7398158b1ca42b9701e4d1d03a70aa87fd22ae4c4d8437702be7d8028c44ffaad5fdc6d27c8fe7290f9031e1cf86532ddd2c15466879a7ca6faf77d58d454ed3241d003ff27568160202088bce27cd573dbe308dd6152be7e21f96362ee625ac521520d49f65846402dd426b4d92fd16839d515ad9ef23e09602155341e784094913188c98eea2efd7ca18323e982bc86ef693ba33371e50404f0df5f9cddb40c1b701505cb836dc31f2c13775dd49cc1404c91aed01cd669b1d6f9698bcabdbabfb99d90e3bc3bbd5daa72728985973b20b8a976f9b230505bc4efb05d57d5e0be3e045348d0b12360000"]}, 0x20c) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[], 0x5c}}, 0x4000) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000001f80)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x8, @local, 0xfffffff7}, {0xa, 0x4e20, 0x527bf76a, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xb62a}, 0xffffffffffffffff, 0xfffffc01}}, 0x48) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, 0xffffffffffffffff, 0x20) r7 = socket$rxrpc(0x21, 0x2, 0xa) sendmsg$inet(r7, &(0x7f0000000180)={0x0, 0xfffffffffffffd7d, 0x0, 0x0, &(0x7f00000004c0)=[@ip_pktinfo={{0x18, 0x0, 0x8, {0x0, @rand_addr=0x64010102, @private=0xa0100ff}}}, @ip_tos_int={{0x10, 0x110, 0xd}}], 0x28, 0x4c00}, 0x10) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000600)={{0x1, 0x1, 0x18, r6, {0x4, 0xd7}}, './file0\x00'}) fcntl$setpipe(r8, 0x407, 0xc0000000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="4275c936", @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r9, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) socket$inet6(0xa, 0x80006, 0x3) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000100)={'wg1\x00'}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmmsg$sock(r8, &(0x7f0000001ec0)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000680)="2aca3decad6760010197eabb1e4a46b0bd721625600195aa9969bfc03fc0cb1d716c85842548ea", 0x27}, {&(0x7f00000007c0)="560475018e4e5860204c9c55d9125d471fa66ce38200b0a754adca40d706b38044c3122dbd861c6561094025524687c74736400a7baf0fd74c69201674414ce51d459c5e70a584bad0726a3655aacdd8944bdffc7b4fa59bf68b56398dfbb43cc9f78428254a9ac43bb01bee1328861c298b9d2e21b1e86ced2d641d92a9dee68c78f470c34868c37813c929d9adf3e4a261c80cdac0f47d70442e4f2524e050d7c2793901b9d8df0eb1c370a60c755595ce8be0234f6355dab3678c03ba1b92267360106db6c51c97393d11d1825e7339f9f6ea26974ec0392b1581c6227a3f9ffa3960945226c074f0c3106dc258be5259fabf07c8809999b7da0370557bb8e1ce6410f3546d0df9e81aa26be06c1d1e40fa9491a398885d4b518f4de22156cd307570539f5e5051c94108f578b91ca9b6be9001cfb6129615182dfb357f1e2a7aba953911f753912d8debf014e17bfb83d8fe6cd687e437abb0871dce49c395bfe0818cd3d121739c05479a5b1728253887c971226998af9c20ce5031e19add35b11bf4ac301bf1a762ff098203aed7b42848fbce24cf40b14264b2dfe05b758d51883a17625f8e51cf8655b20c09cfceaf6cd6a24d29d2f9e7f63166358d9dc5be2704d989bd0f0ddeb73d6f0c1946dcb080441315dde604ebc6a1ac6595ac415f69a6ccf4bb70106198819e2260d81ed8d6c61265379a4793f172289503817960e6b1f90ae5ed3646fe3d1bdfb6c11d9ce72e1df7a9b27506deb962af8b936cdf9c46d1213adecfc752e407da3240516046977d699c3dff31a209f70fa4d8c7000540bf42cd37f616aed7949e3edf693a86b3aa7d7dd7b67577ea355d38807084664cc436a730d3018a9a7b15696902a262823c7b25ce3ddcdd4d4ddc5beb386544508e87caa1f0c17215d8f929d11e3f2ccb04847d8511bed640556720f3741399ed7f89f542aae7970e80b875a6548accd8e0b258ebe58b5d810aeed60053f7d4b6706688daede7fa1eb8825f183af3dfd9ec4676ea742a70601c5598913a4d74c8acd68ef0b02ec473949008f6754d39299a4964009e5f87bc61eefa235257d9909ef273e95eb83afde87e2bd10c5a8336144fe49954c34ab859ae0629212d0a9ef3398fe2f086d76017d5e9858a56053395925b66f4508e745e467a2c7ab1f499bd3ede8c000f9e6562b562fdd28608cdc158dc8411fa8703524d800d447a2edb20b87765f159e05756537b787a051509e44d93f382634e6cbbd2e399de72f601e18dcdef1046d15507698512aac8671407a01ee0ba1dbda894f724a38bb3783ec35715aa12fcaeeb22d162a4cc727f6f7564c1a0f232056558434d3587d516a0a90125f4f12c26b89932140e881d68f61f081625fabc382c00526094ca56e88b0a08371e4d7434f363ca2d4dba824842ec7c163f3314e0a454ef069548fd88508bf9d8b6cf25b539c96abec9d2be2e7cdec8c46cd054eaa033761bf08f345e5dc0d15ef2770b00b9c572f4e3daa2711db3d01f94cdb62784c5ad822ae5f3fdd12750026bc88cd12c97bf1f9805507707fef4d9251ff182c7fb6536db5eb93701d8a64613ca1038a3e3090e9da92ba84cd2c96aed6bd0124207e2e6e757164be72b1f2c62bbd4475647ee1234fa250a746b7dcacc20b24fc964ab414c12af092657d4d715f769f45247d2d68dde126623bb402fcb1f89e6e4495a52d22832bf44a51d9495a27dcc817ac1ac4fd8ea58531ccfd063d0ce797394f51e4c74cd6ef77eeaaa06e66dd1102629237ed3f721ec0f878e48dc24b5895a84bda2615470c8cce1bfc027ca23605cc9965a2015d56803e4e5bd422ca7bf279f6b11c0a7749ee367a2b254cb73a222928f56e36f0d4ba337bcd31de86c1c0f5e042f304e6a1ef341c1cfc29229bc15cda3f7781e1d971b8c50a1ca5049321b92e371f0dfe116fa72dd37dd59ef6a4526374336e1ef4c50bc409bd615c99151e93330cbb3c99b8562ac5a7443302a18f167703e5c4ae179868621b34949a69cc11b8de6efbfc7b24909cbdcbe17b27fc6a914d31a7dca7f3358e9107e6c479fc8e01b070ced87db33a6202500e13d37c5d3cdd83e3ca392391016f9f0ea88545e5b8bc2ceec39e1e9bee0a9a22481dd1907c815dce275979dcb6523a41666084acdaf324c35e4432532a0458b10d75bbc288915e0c3e52c8e82b1f22d2f7ba3a9ff1d3036b57f6a29d9d6e968e540f13caef42f299e94a7f98c9d6e8cf874f5832659accbfa1853da550a4851dbd0e63cabbeb17990579b0a81f4e4a3377eac1b63ecf5006fa991f34320c67f89129dd95bb62f1e5bbfdfbedfae8cc7fa23e06116c778943eaf1eafafb7a7d6cf8f0445cc0dd23dd07d6ca5f679119cc8f6d79b1b4c643b2e72317cf14fad8476e066bc5a21dd5ef6bebc8b6f28bc5e861318b5a208cd0b1b5571c64723fa48214f51ad668946b058c050462112f13743e91f1ead2ae4242567c3bf9bccea40473276679355b1cc4357b6acb6df93f96c892d1f6619781e0339496fb3c2ce18f65e38dfd8abc2996ff02573f1522a2c705931ad8f51bcd4256902c023242fbfaeaa3d50f9d707888ad24e3b8da9a563db7935108823c19d211c7f52ff730b409d1e9e1901fa50cdb80a9fe223322ffddb3554a4de0c1222415d385acba8be0703934842758301ca68738d76b1854c6d3fb1b208eb1c5da4bd3e268270337a006a1db570b7fa3686dfe2e7da83cda013f2deed0875fd5b3c5cc4be2d75b80c3b58ddc47b92936b81d34afe821ebc9ff6b79172492d4a00be75f0309ac34d82acc9cc394ff9d9eabc576c12b1611d38c3da733884dd313d104bde22fca1955621615cda868fec872e059fed49e04e1633e7e3f392f479447094f6a1bf77929eabaceb50d6333933f5e9836da258c3403a60962618fae0b7af204b24cb9316520c69a81e047a678ff877b7a213d71c151a47030898dcbba5f3c26cbb0c1b364ccae4b9933dd89effa313b8ba4ab7231722a6a6686bc8334685b2fc30d28269be3fd437f27d2ef3edd6076debbb0cbdd5ee83a73d4760a5bab74ad39c664c9bed32ae30ed60fc1a45fb396537b220dfbf72745fa0dcc963c6319e33bc3ce5cb1e7ce3d91b99c62676ec94f7ce3f22595c44b905f827678894da2a643e41a2e53b2809546bceff5c695b7d54af0f4950157dcfaa2d5016716d296c751cc16909f40752deb90591b06e0d8db7831876b2311e1838f7f6d2f427b6a0361cde988dd38c144da04db3d2d83b2e518110e834f124bec4a1f3de00444f4a5b49b4c5530c628ab1438ca24190106f719145de854d96f588c7cb2f5e8cb55f3b763de0c15d5c4cbe6a9bed8d88e84b781872ecaf30b85311d8f95650bd02dd5d286d0c853b0e80df8540178accb676d76f2124ad952f9805e582ceeac8133f0a2e0fe03c7d8499c0f8371e682e4589980e2910f1ffc8abe4417684beb86617b8b737252b1f5d901278a2d61a317e3c3d15e06f14c8fab2387dfaa6d949b749cd529ae8e06160d701486eab6853fd4eb8daefc6ef537bdabb5d56ea5c01269aa4d62042c3507f9a851ae54b4df74d0b5350a08e0a1ce7e640e62e02ececcbd24ce5f9d183ed8afcdcb48a8a3e75fa009fb93a9b38848b1e8797cd98b3904d2c5fec455e6be0bbf0f8149accc9bd9bbc5c0cabd2fe16e6d6c33521bedf51dbee916e32db34a6aff2d00f56b7b68d91554d85578cf6f545403f505f1532fd1ddeec388f058a5bdca3a4e80c338a46a6854bff81304dc09ca4a7f88020cf3aed019ba3033777b9ffd7b70a5fea5ee240cbe11e052bf556c487a158d4f3c35cf0b145a52a605dbbe3823f211a158362cc1fd2036e5a3d4ec603f87e41d51da0e37a6c1098492e539c31a4b6abee93af512535885f57bdcfe4071548a81366209dd0ea1f278bb42101acc71c5a7130583a8bd256f6ff0235c4de3a62e449117e9581c890356bad8600c001d9ad5578d981c2a18c07522dc7a78ff4031b121e18a05f3ee05b1fd7608de08956972a010f0ea2db6f359573e8b0651e482b0c3af22911d91e76b4c60569c58fc8c7d12dedde9372aae4e50c53bee8eac6e24adf6d2dc8712c1de460830a92e08d0431ee6d2c6f60fd20c4f6ae19a04597c70c77da9101cfffc4d43cb04a4de8349ac1b1dfaa5e92e18288850daf889f8239be7613427b421fffc78852a282f23d46617baca869c9b791d990160ff55a39786bd2863f29483f10f4964bcfa5883995cca2d316bbe98d3446df5deba217268496b6a7ef5c5344689bd44268a4004c661142aca936de1430198a7dcde5ed3ea0182a9770f343097c221f60c6d756dc39fe7a90bad397a8004a34a838383dfb7f879e30224e153b74e8b38d9fa8d762af84651b6759392ea74a72523b493de040f32b28aab279fcb2f9e5f28236800393780387fd7d6179ad80d1adeca9acbdcbb4bef8c02a786b7c68d3964f9a9c755020c0da6dcc81abc75569eca1922aad26b8c13b998c5ba65b8ca4b29e11b4df6490c91396ed0e7ad2c2ea23860e8309f37a128dce3bccc5bcb62e34007f97f53af04b08688f0099acf5bdcd93e2d35153785f998b95a159bc1c356cbab3de666c02b1780c8a28c96f5db532ef769d085a640690d4b15fecc5ab00df35a3ac7611e379f672d07a586f5ef199c90afcd43f2a6e325deedc09748dd56eff0c070753247af6b742f6b263b971e563be5597b2569e5e0a27e330f22e9dd1daddefe9e91337ef5558d6749332b79895b5f0807615a403ec517861b95c6b74fe03659851714c65b47c096ffbb42faad1bd98654ca5f69909c60d97e55b07d16dee835a12448d3fbb61b780bea9307a26449eb8886f396139acadddcb9eb6f7cc2be8c1d828c8d0de75fb913bce755518bc5adfeb9e83f324700c842f98c854e915d74bdb2067f12041e6b1aac80aed1ceb467a401a5d79d0d9bb1e7e0c79c7607370d78241e58c08ec92c21db3ca4e0dff4ba673e3dd427adb8aed9dac0e0080d8aa38ca0b44b0ef6792e1744ab9af67d425e53587f6bb71b4ef7920f8b1941bbc484336bbd6169b27a66de305a4e4645a457f7225abb91fff8106a6fa04408becf8eb63552ab519f4b41776d28c8974f104737fa0ba264ba89c3f0f6874203c96025792b9c24e39ca66a87a43d93859eb4106b07c08bc59f78586921b15f582279ad163c735b16ca06e0de11904400aabea02e1b074b08dd09d2b687237d022fda74e3dee8aa0ba73da55273df0f1400a0c29b5035072835771ad8a21c1f88b98c0ed58ef26807085e9ba050046b5fe95d3a2ff9919271c99ad621a7d5f5988b960979a01f4ca4552858274e7f91b5a8b21968f447c7f186392ee4ec2656960c2deb0373df6743088565cb088d0950e04e29db2dc9812ecbb2c4f97a37fb92fffca60d6818f5f4b714d9b6fddc64476ee0d9bbb965462ac3d81628918725e9842c1b282239eb84448c8f1645c2cf4b628f5524f6ae6fe6778e17ac376b1c22c20681557f9962cf6c6010c9d00013e2b396a418100eb1f3c15d4db364fb2d84561f2952b2a72bffe4fa9e93f030078b4d8bf4d28022540d850d0613c7eebde1ef995d41518a0c9086444315d200acd85137e1d64e2f176f232d494b193b1eef4a6a25e9a016905ef8dc66d62bacc92b523fd0d924f882f467d1dce160dd1b4a381f0e5e68cd9d489d3196b0c4af7869d2771e906d3622e77f32f50212adec646424cfabf57155bf514f5cebdc3177d26bba2ca4eba", 0x1000}, {&(0x7f00000017c0)="3d0d85f579dcb9aae54fbdbe1acdb954d26dd617a2919ba476790b7a33fa60390790cba8e9a527b8e6c590dca1225d4f3fff9f1654677f5de4e9349660661893ce35669d735cadcc6161bf5e941ad565fa5956c47c26189752069d9d4db407e0e63f21054e951dfa737ca1fd58178747e283b7e0da3416328be064bbd7e491bf7f5650e344438c65acc323a352b83f348d684733c9085fd0236d1574d03eeb72a5a35399d2404763876a10d626302b4158db4ed78acc0bda36ac53daa3bdc2fc7513598977af4eba50f461d4c801f5d0b58bfee81a4ddb5f8d83d1965a3c67a526fe81de", 0xe4}, {&(0x7f00000006c0)="844475afd791741ca25149578e111c1fd0536c02fd10ca98b267", 0x1a}, {&(0x7f00000018c0)="7fbba316e6a9fab9753ba0a1cef713853b2edb4f7d884e57d741e9520135875377fb1a55050d130c6ffe40b2bf8904b3a204ffb2da7d55d459203bc1e12d4e617bbdc8413c9420718dd496a0ea2be6ee6e086ab1affe139bf7a707909249f1fa4336561862b2dc1f2cad00792e82afffcb920b0c070e383752bbc3c4c8450dcf5239cd59f43d6388598f29d98771bbac1038fab55aff138d89511fb816072bbee48b34803838c40e0afc35b173b141549b106b81cec9ec11c2456c401633119e8963116ccccbd87d4c62bc12a55e525c89f06326799d1d64fa08d945a017c87dd3f96bd5f56199ea362445cce9575ca1", 0xf0}, {&(0x7f00000019c0)="2d0262d991c908664e76e5faeb3f0011c573b106046615b92579d5243abc1171c613f33c4941a4821ebe9c0d2057efd25c40636edb31accbbc6c6d41d24bfd9942c6ef14e76e9e7534e20fab2f92684b42ffd43cace9b4164fb6b0eb1179f9e383e307e3daa2a8b9d3ae70205fcb28b250006cbc2e69b0fbdafe6860938cdfdbcc916d2d10198ce70709f92b98a4f34bf2d297ebd95aaf0a03c4685b6137d296", 0xa0}], 0x6, &(0x7f0000000740)=[@txtime={{0x14, 0x1, 0x3d, 0x68d4}}, @timestamping={{0x10, 0x1, 0x25, 0x2}}, @mark={{0x10, 0x1, 0x24, 0x5}}], 0x34}}, {{&(0x7f0000001a80)=@qipcrtr={0x2a, 0xffffffffffffffff, 0x7fff}, 0x80, &(0x7f0000001e00), 0x0, &(0x7f0000000400)=[@mark={{0x10, 0x1, 0x24, 0x8}}, @mark={{0x10}}, @timestamping={{0x10, 0x1, 0x25, 0xd0}}, @txtime={{0x14, 0x1, 0x3d, 0x8}}], 0x44}}], 0x2, 0x4000000) syz_usb_connect$cdc_ecm(0x2, 0x6d, &(0x7f0000000080)=ANY=[@ANYBLOB="12015002020000082505a1a440000102030109025b0001019e40fd317d008002020600d80724060000c0f8052400ff000d000f0025010800060424020206241a06000004240203072414019b798352666886e6534300050009058103000410fa0409058202400002000e090503020002070b0b"], &(0x7f00000005c0)={0xa, &(0x7f0000000280)={0xa, 0x6, 0x310, 0x9, 0x3, 0x40, 0x20, 0x5}, 0xca, &(0x7f0000002000)=ANY=[@ANYBLOB="050fca0006141004014f28bf2d41d467430b56c4e27e25a98d0a10030007000706ea71701003afe1ce06313957fd23a75f2803ddf5c45d007255fe3115c5b6b3d3aae967592e7a397b40b98728341e1afbffbc2724630abf2a8f05734e38d612d87d78efa1e078d7dce0ba231d7261fca0e99c03de139ac224c8b91b637163984e12ef7396e1e89b3858d4a034a7f2f5fd979518100afe030002000f0008e1b2b1d000bf1fff00303f00000fff0000fc100b1c100a01845d01000fff080030ff0000cf000000f0c0ff00"], 0x3, [{0x61, &(0x7f0000002100)=ANY=[@ANYBLOB="61031eb914c00b267ec68b713284ba359aecef5acff128b0548a0adc677c382e9a8905330690eaf0bf2e3da16b11e18a58068de8297ef6ecf29ca19351f2ea3532c1698dbfa12fef9c23b6395aba332b50b06b52fdb3b63c1f34a50000ca6cb189", @ANYRESHEX=r6]}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x80c}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x1404}}]}) openat$procfs(0xffffff9c, &(0x7f0000000200)='/proc/key-users\x00', 0x0, 0x0) fcntl$addseals(r6, 0x409, 0xc) sched_getattr(r2, &(0x7f00000001c0)={0x38}, 0x38, 0x0) 638.283681ms ago: executing program 2 (id=1840): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='status\x00') preadv(r2, &(0x7f0000000000)=[{&(0x7f0000000240)=""/135, 0x87}], 0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) io_uring_setup(0x115c, &(0x7f0000000440)={0x0, 0x8270, 0x40, 0x3, 0x117}) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x80}) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(r3, 0xc028aa03, 0x0) socket$netlink(0x10, 0x3, 0x0) fstat(r4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_GETINFO(r1, 0xffffffff80000500, r5, &(0x7f0000000200)) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0xf8, 0x19, 0x1, 0x0, 0x1, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x7, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x2000000000}}, [@tmpl={0x44, 0x5, [{{@in6=@remote, 0x0, 0x33}, 0x0, @in=@broadcast, 0x0, 0x2, 0x0, 0x0, 0xffffffff, 0x0, 0x40}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x8011}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="0c04000010000104000000000000000000480000", @ANYRES32=r7, @ANYBLOB="101000000000000008000d0005000000e4031680a40001800c00070000000000adffffff0c00", @ANYRES16=r7, @ANYBLOB="4b7656da"], 0x40c}}, 0x0) 344.167412ms ago: executing program 1 (id=1841): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r6 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r6, &(0x7f0000019440)=[{&(0x7f0000000200)}], 0x1) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0500008b0000000000000600000008000300", @ANYRES32=r7, @ANYBLOB="0800050003000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r4, 0x0, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008000}, 0x80) sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x40) 0s ago: executing program 1 (id=1842): socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_io_uring_setup(0x50fb, &(0x7f00000002c0)={0x0, 0x7d4d, 0x200, 0x0, 0xa}, &(0x7f00000003c0), &(0x7f0000000440)) mmap$IORING_OFF_SQ_RING(&(0x7f00005d2000/0x4000)=nil, 0x4000, 0x1, 0x50, r0, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) rt_tgsigqueueinfo(0x0, 0x0, 0x5, &(0x7f0000000000)={0x0, 0x2, 0x6}) connect$unix(r1, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f000000cec0)=[{{0x0, 0x0, &(0x7f0000003e00)=[{&(0x7f0000004200)=""/4096, 0x1000}], 0x1}}, {{0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000006200)=""/4096, 0x1000}], 0x1}}], 0x2, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x224}, 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x122) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000480)=ANY=[@ANYBLOB="0e000000050000000e806c00faf87ccd471fa181336284f47817f04d0cb6ea48528f87"], 0x78) socket$nl_generic(0x10, 0x3, 0x10) bind$packet(0xffffffffffffffff, &(0x7f0000000180), 0x14) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) kernel console output (not intermixed with test programs): g 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 490.701207][T11091] binder: 11089:11091 ioctl c04064a0 80000940 returned -22 [ 490.724602][T11091] binder: 11089:11091 ioctl c04064a0 80000ac0 returned -22 [ 490.732060][ T5900] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 490.734600][T11091] binder: 11089:11091 ioctl c04064a0 80000c40 returned -22 [ 490.762949][ T5900] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 490.772265][ T5900] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.839257][T11091] binder: 11089:11091 ioctl c01064c8 80000d00 returned -22 [ 490.849646][T11091] binder: 11089:11091 ioctl c04064a0 80000e40 returned -22 [ 490.864374][T11091] binder: 11089:11091 ioctl c06864a2 80000e80 returned -22 [ 490.988798][ T5907] usb 4-1: USB disconnect, device number 67 [ 491.014055][ T5907] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 491.049629][T11075] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.065549][T11098] loop2: detected capacity change from 0 to 7 [ 491.072170][T11075] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.091108][T11098] loop2: [ 491.104436][T11101] netlink: 260 bytes leftover after parsing attributes in process `syz.3.1516'. [ 491.116026][T11098] loop2: partition table partially beyond EOD, truncated [ 491.126135][T11075] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.150305][T11101] netlink: 256 bytes leftover after parsing attributes in process `syz.3.1516'. [ 491.168073][T11075] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.195838][ T5900] usb 2-1: usb_control_msg returned -32 [ 491.204377][T11101] unsupported nlmsg_type 40 [ 491.220151][ T5900] usbtmc 2-1:16.0: can't read capabilities [ 491.560840][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 491.601282][T11112] usbtmc 2-1:16.0: Unable to send data, error -71 [ 492.129398][T11121] netlink: 136 bytes leftover after parsing attributes in process `syz.3.1521'. [ 492.197062][T11123] kvm: user requested TSC rate below hardware speed [ 492.219868][T11122] kvm: user requested TSC rate below hardware speed [ 492.470325][T11127] syzkaller0: entered promiscuous mode [ 492.493864][T11127] syzkaller0: entered allmulticast mode [ 493.074273][T11135] loop2: detected capacity change from 0 to 7 [ 493.105331][T11135] loop2: [ 493.121910][T11135] loop2: partition table partially beyond EOD, truncated [ 493.138671][ T5893] usb 2-1: USB disconnect, device number 82 [ 493.416365][T11144] netlink: 'syz.4.1530': attribute type 61 has an invalid length. [ 493.624812][ T5961] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 493.805258][ T5961] usb 2-1: Using ep0 maxpacket: 32 [ 493.821263][ T5961] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 493.875435][ T5961] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.959670][ T5961] usb 2-1: config 0 descriptor?? [ 494.009686][ T5961] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 494.545402][T11156] binder: 11155:11156 ioctl c018620c 0 returned -14 [ 494.875255][ T5961] gspca_vc032x: reg_w err -71 [ 494.895447][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 494.919532][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 494.945645][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 494.970418][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 494.990715][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.011021][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.023630][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.033756][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.049443][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.061886][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.074917][T11160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.095553][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.105148][T11160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.115648][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.121064][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.164642][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.169992][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.211990][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.242451][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.279109][ T5961] gspca_vc032x: I2c Bus Busy Wait 00 [ 495.324526][ T5961] gspca_vc032x: Unknown sensor... [ 495.329690][ T5961] vc032x 2-1:0.0: probe with driver vc032x failed with error -22 [ 495.419610][ T5961] usb 2-1: USB disconnect, device number 83 [ 495.840242][T11179] FAULT_INJECTION: forcing a failure. [ 495.840242][T11179] name failslab, interval 1, probability 0, space 0, times 0 [ 495.883246][T11179] CPU: 0 UID: 0 PID: 11179 Comm: syz.1.1539 Tainted: G L syzkaller #0 PREEMPT(full) [ 495.883284][T11179] Tainted: [L]=SOFTLOCKUP [ 495.883289][T11179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 495.883299][T11179] Call Trace: [ 495.883305][T11179] [ 495.883311][T11179] dump_stack_lvl+0xe8/0x150 [ 495.883333][T11179] should_fail_ex+0x414/0x560 [ 495.883361][T11179] should_failslab+0xa8/0x100 [ 495.883380][T11179] kmem_cache_alloc_lru_noprof+0x8d/0x6e0 [ 495.883403][T11179] ? __d_alloc+0x37/0x6f0 [ 495.883426][T11179] __d_alloc+0x37/0x6f0 [ 495.883449][T11179] d_alloc+0x4b/0x190 [ 495.883466][T11179] ? lookup_one_qstr_excl+0xc8/0x360 [ 495.883486][T11179] lookup_one_qstr_excl+0xdc/0x360 [ 495.883505][T11179] ? lookup_noperm_common+0x245/0x430 [ 495.883526][T11179] start_dirop+0x5c/0x90 [ 495.883544][T11179] simple_start_creating+0xc4/0x100 [ 495.883564][T11179] ? __pfx_simple_start_creating+0x10/0x10 [ 495.883583][T11179] ? do_raw_spin_unlock+0x122/0x240 [ 495.883608][T11179] ? mntput+0x65/0xc0 [ 495.883625][T11179] debugfs_start_creating+0xdb/0x1a0 [ 495.883641][T11179] __debugfs_create_file+0x6f/0x400 [ 495.883659][T11179] debugfs_create_file_full+0x3f/0x60 [ 495.883676][T11179] ref_tracker_dir_debugfs+0x14e/0x2d0 [ 495.883692][T11179] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 495.883724][T11179] ? trace_kmalloc+0x1f/0xb0 [ 495.883735][T11179] ? __kvmalloc_node_noprof+0x5f5/0x920 [ 495.883754][T11179] ? __raw_spin_lock_init+0x45/0x100 [ 495.883775][T11179] alloc_netdev_mqs+0x272/0x11b0 [ 495.883795][T11179] ? __pfx_geneve_setup+0x10/0x10 [ 495.883820][T11179] rtnl_create_link+0x31f/0xcf0 [ 495.883846][T11179] rtnl_newlink_create+0x25c/0xb00 [ 495.883873][T11179] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 495.883893][T11179] ? __pfx___mutex_lock+0x10/0x10 [ 495.883917][T11179] ? ns_capable+0x8a/0xf0 [ 495.883933][T11179] rtnl_newlink+0x16e7/0x1c90 [ 495.883960][T11179] ? __pfx_rtnl_newlink+0x10/0x10 [ 495.883974][T11179] ? __do_fast_syscall_32+0x1dc/0x570 [ 495.883990][T11179] ? do_fast_syscall_32+0x34/0x80 [ 495.884005][T11179] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 495.884046][T11179] ? kasan_quarantine_put+0xbb/0x1f0 [ 495.884060][T11179] ? lockdep_hardirqs_on+0x7b/0x110 [ 495.884078][T11179] ? kmem_cache_free+0x197/0x620 [ 495.884091][T11179] ? nlmon_xmit+0xb0/0x100 [ 495.884116][T11179] ? __lock_acquire+0x6b6/0x2cf0 [ 495.884136][T11179] ? __local_bh_enable_ip+0xd0/0x130 [ 495.884151][T11179] ? lockdep_hardirqs_on+0x7b/0x110 [ 495.884165][T11179] ? __dev_queue_xmit+0x289/0x31c0 [ 495.884184][T11179] ? __local_bh_enable_ip+0xd0/0x130 [ 495.884197][T11179] ? __dev_queue_xmit+0x289/0x31c0 [ 495.884220][T11179] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 495.884246][T11179] ? __pfx_rtnl_newlink+0x10/0x10 [ 495.884261][T11179] rtnetlink_rcv_msg+0x7cf/0xb70 [ 495.884280][T11179] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 495.884316][T11179] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 495.884338][T11179] ? ref_tracker_free+0x63a/0x7d0 [ 495.884359][T11179] ? __asan_memcpy+0x40/0x70 [ 495.884390][T11179] ? __pfx_ref_tracker_free+0x10/0x10 [ 495.884403][T11179] ? __skb_clone+0x63/0x7a0 [ 495.884426][T11179] netlink_rcv_skb+0x208/0x470 [ 495.884446][T11179] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 495.884481][T11179] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 495.884520][T11179] ? netlink_deliver_tap+0x2e/0x1b0 [ 495.884552][T11179] netlink_unicast+0x82f/0x9e0 [ 495.884575][T11179] ? __pfx_netlink_unicast+0x10/0x10 [ 495.884590][T11179] ? __alloc_skb+0x198/0x3a0 [ 495.884610][T11179] ? netlink_sendmsg+0x642/0xb30 [ 495.884628][T11179] ? skb_put+0x11b/0x210 [ 495.884646][T11179] netlink_sendmsg+0x805/0xb30 [ 495.884671][T11179] ? __pfx_netlink_sendmsg+0x10/0x10 [ 495.884692][T11179] ? __import_iovec+0x5d4/0x7f0 [ 495.884708][T11179] ? aa_sock_msg_perm+0xf1/0x1b0 [ 495.884727][T11179] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 495.884740][T11179] ? __pfx_netlink_sendmsg+0x10/0x10 [ 495.884760][T11179] __sock_sendmsg+0x21c/0x270 [ 495.884784][T11179] ____sys_sendmsg+0x505/0x820 [ 495.884806][T11179] ? __pfx_____sys_sendmsg+0x10/0x10 [ 495.884827][T11179] ? kstrtouint+0x6e/0xe0 [ 495.884853][T11179] ___sys_sendmsg+0x21f/0x2a0 [ 495.884872][T11179] ? __pfx____sys_sendmsg+0x10/0x10 [ 495.884889][T11179] ? get_pid_task+0x20/0x1f0 [ 495.884906][T11179] ? get_pid_task+0x20/0x1f0 [ 495.884922][T11179] ? get_pid_task+0x20/0x1f0 [ 495.884960][T11179] ? __fget_files+0x2a/0x420 [ 495.884976][T11179] ? __fget_files+0x3a0/0x420 [ 495.885000][T11179] __sys_sendmsg+0x164/0x220 [ 495.885019][T11179] ? __pfx___sys_sendmsg+0x10/0x10 [ 495.885043][T11179] ? __pfx_ksys_write+0x10/0x10 [ 495.885065][T11179] __do_fast_syscall_32+0x1dc/0x570 [ 495.885080][T11179] ? lockdep_hardirqs_on+0x7b/0x110 [ 495.885094][T11179] ? do_fast_syscall_32+0x34/0x80 [ 495.885110][T11179] ? irqentry_exit+0x10f/0x670 [ 495.885127][T11179] do_fast_syscall_32+0x34/0x80 [ 495.885143][T11179] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 495.885160][T11179] RIP: 0023:0xf700d539 [ 495.885173][T11179] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 495.885185][T11179] RSP: 002b:00000000f53fd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 495.885217][T11179] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 495.885227][T11179] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 495.885235][T11179] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 495.885244][T11179] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 495.885252][T11179] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 495.885273][T11179] [ 497.106991][T11183] loop2: detected capacity change from 0 to 7 [ 497.137190][T11183] loop2: [ 497.140253][T11183] loop2: partition table partially beyond EOD, truncated [ 497.534593][ T5961] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 497.574748][ T5907] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 497.694717][ T5961] usb 2-1: Using ep0 maxpacket: 16 [ 497.710055][ T5961] usb 2-1: config 0 has an invalid interface number: 194 but max is 0 [ 497.729764][ T5961] usb 2-1: config 0 has no interface number 0 [ 497.756260][ T5907] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 497.776739][ T5961] usb 2-1: New USB device found, idVendor=0a2c, idProduct=0008, bcdDevice=b4.25 [ 497.777471][ T5907] usb 3-1: config 2 has 0 interfaces, different from the descriptor's value: 1 [ 497.809858][ T5961] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.829949][ T5961] usb 2-1: Product: syz [ 497.837588][ T5961] usb 2-1: Manufacturer: syz [ 497.851654][ T5961] usb 2-1: SerialNumber: syz [ 497.860698][ T5907] usb 3-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 497.883648][ T5961] usb 2-1: config 0 descriptor?? [ 497.904661][ T5893] usb 4-1: new full-speed USB device number 68 using dummy_hcd [ 497.913885][ T5961] cypress_cy7c63 2-1:0.194: Cypress CY7C63xxx device now attached [ 497.917962][ T5907] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.974011][ T5907] usb 3-1: Product: syz [ 497.996337][ T5907] usb 3-1: Manufacturer: syz [ 498.029742][ T5907] usb 3-1: SerialNumber: syz [ 498.137514][ T5893] usb 4-1: config 0 interface 0 altsetting 251 has an endpoint descriptor with address 0x43, changing to 0x3 [ 498.161305][T11197] netlink: 'syz.0.1545': attribute type 10 has an invalid length. [ 498.173792][T11189] netlink: 'syz.1.1540': attribute type 16 has an invalid length. [ 498.181850][ T5893] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x3 has invalid maxpacket 65, setting to 64 [ 498.212366][T11189] netlink: 'syz.1.1540': attribute type 17 has an invalid length. [ 498.234051][T11189] lo: entered promiscuous mode [ 498.244001][ T5893] usb 4-1: config 0 interface 0 has no altsetting 0 [ 498.253132][T11189] lo: entered allmulticast mode [ 498.293642][T11189] tunl0: entered promiscuous mode [ 498.306922][T11189] tunl0: entered allmulticast mode [ 498.321958][T11189] gre0: entered promiscuous mode [ 498.328041][T11189] gre0: entered allmulticast mode [ 498.338659][T11189] gretap0: entered promiscuous mode [ 498.344096][T11189] gretap0: entered allmulticast mode [ 498.357819][ T5893] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 498.382643][ T5893] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 498.416329][T11203] FAULT_INJECTION: forcing a failure. [ 498.416329][T11203] name failslab, interval 1, probability 0, space 0, times 0 [ 498.437592][T11189] erspan0: entered promiscuous mode [ 498.443164][T11189] erspan0: entered allmulticast mode [ 498.450082][ T5893] usb 4-1: Product: syz [ 498.461217][ T5893] usb 4-1: Manufacturer: syz [ 498.469169][T11189] ip_vti0: entered promiscuous mode [ 498.475980][ T5893] usb 4-1: SerialNumber: syz [ 498.481466][T11203] CPU: 1 UID: 0 PID: 11203 Comm: syz.0.1547 Tainted: G L syzkaller #0 PREEMPT(full) [ 498.481501][T11203] Tainted: [L]=SOFTLOCKUP [ 498.481507][T11203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 498.481516][T11203] Call Trace: [ 498.481522][T11203] [ 498.481529][T11203] dump_stack_lvl+0xe8/0x150 [ 498.481552][T11203] should_fail_ex+0x414/0x560 [ 498.481580][T11203] should_failslab+0xa8/0x100 [ 498.481599][T11203] kmem_cache_alloc_noprof+0x88/0x710 [ 498.481642][T11203] ? dst_alloc+0x105/0x170 [ 498.481668][T11203] dst_alloc+0x105/0x170 [ 498.481693][T11203] ip_route_output_key_hash_rcu+0x1560/0x23e0 [ 498.481712][T11203] ? ip_route_output_key_hash_rcu+0x1391/0x23e0 [ 498.481735][T11203] ? ip_route_output_key_hash+0xc1/0x280 [ 498.481754][T11203] ip_route_output_key_hash+0x174/0x280 [ 498.481774][T11203] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 498.481805][T11203] tcp_v4_connect+0x710/0x1a90 [ 498.481841][T11203] ? __pfx_tcp_v4_connect+0x10/0x10 [ 498.481869][T11203] mptcp_connect+0x56b/0x830 [ 498.481888][T11203] __inet_stream_connect+0x2ae/0xe70 [ 498.481919][T11203] ? __pfx___inet_stream_connect+0x10/0x10 [ 498.481940][T11203] ? __kasan_kmalloc+0x93/0xb0 [ 498.481958][T11203] ? __kmalloc_cache_noprof+0x3e2/0x700 [ 498.481979][T11203] tcp_sendmsg_fastopen+0x3a7/0x5e0 [ 498.482006][T11203] mptcp_sendmsg_fastopen+0x17d/0x580 [ 498.482029][T11203] mptcp_sendmsg+0x179f/0x19b0 [ 498.482055][T11203] ? aa_sk_perm+0x15f/0x920 [ 498.482075][T11203] ? aa_sk_perm+0x7ee/0x920 [ 498.482097][T11203] ? __pfx_aa_sk_perm+0x10/0x10 [ 498.482115][T11203] ? __pfx_mptcp_sendmsg+0x10/0x10 [ 498.482130][T11203] ? __asan_memset+0x22/0x50 [ 498.482152][T11203] ? sock_rps_record_flow+0x19/0x410 [ 498.482177][T11203] ? inet_sendmsg+0x2f4/0x370 [ 498.482201][T11203] __sock_sendmsg+0x19c/0x270 [ 498.482228][T11203] ____sys_sendmsg+0x52d/0x820 [ 498.482251][T11203] ? __pfx_____sys_sendmsg+0x10/0x10 [ 498.482283][T11203] ___sys_sendmsg+0x21f/0x2a0 [ 498.482304][T11203] ? __pfx____sys_sendmsg+0x10/0x10 [ 498.482323][T11203] ? kstrtoull+0x12f/0x1d0 [ 498.482349][T11203] ? kstrtouint+0x6e/0xe0 [ 498.482391][T11203] ? __fget_files+0x2a/0x420 [ 498.482416][T11203] ? __fget_files+0x3a0/0x420 [ 498.482443][T11203] __sys_sendmmsg+0x28e/0x430 [ 498.482472][T11203] ? __pfx___sys_sendmmsg+0x10/0x10 [ 498.482489][T11203] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 498.482537][T11203] ? ksys_write+0x22a/0x250 [ 498.482553][T11203] ? __pfx_ksys_write+0x10/0x10 [ 498.482573][T11203] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 498.482598][T11203] __do_fast_syscall_32+0x1dc/0x570 [ 498.482616][T11203] ? lockdep_hardirqs_on+0x7b/0x110 [ 498.482631][T11203] ? do_fast_syscall_32+0x34/0x80 [ 498.482649][T11203] ? irqentry_exit+0x10f/0x670 [ 498.482667][T11203] do_fast_syscall_32+0x34/0x80 [ 498.482686][T11203] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 498.482705][T11203] RIP: 0023:0xf708d539 [ 498.482719][T11203] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 498.482732][T11203] RSP: 002b:00000000f547d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 498.482748][T11203] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080004980 [ 498.482759][T11203] RDX: 0000000000000001 RSI: 0000000020008000 RDI: 0000000000000000 [ 498.482769][T11203] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 498.482777][T11203] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 498.482787][T11203] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 498.482809][T11203] [ 498.875219][T11189] ip_vti0: entered allmulticast mode [ 498.941215][T11189] ip6_vti0: entered promiscuous mode [ 498.948018][T11189] ip6_vti0: entered allmulticast mode [ 499.018440][T11189] sit0: entered promiscuous mode [ 499.024180][T11189] sit0: entered allmulticast mode [ 499.087855][T11189] ip6tnl0: entered promiscuous mode [ 499.094624][T11189] ip6tnl0: entered allmulticast mode [ 499.162653][T11189] ip6gre0: entered promiscuous mode [ 499.169426][T11189] ip6gre0: entered allmulticast mode [ 499.225896][ T5893] usb 4-1: config 0 descriptor?? [ 499.234108][T11195] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 499.259642][ T5893] usb 4-1: selecting invalid altsetting 0 [ 499.275014][T11189] syz_tun: entered promiscuous mode [ 499.280261][T11189] syz_tun: entered allmulticast mode [ 499.295656][T11189] ip6gretap0: entered promiscuous mode [ 499.301144][T11189] ip6gretap0: entered allmulticast mode [ 499.325419][T11189] bridge0: entered promiscuous mode [ 499.330658][T11189] bridge0: entered allmulticast mode [ 499.369979][T11189] vcan0: entered promiscuous mode [ 499.389915][T11189] vcan0: entered allmulticast mode [ 499.396462][T11189] bond0: entered promiscuous mode [ 499.401584][T11189] bond_slave_0: entered promiscuous mode [ 499.412613][T11189] bond_slave_1: entered promiscuous mode [ 499.419520][T11189] bond0: entered allmulticast mode [ 499.426608][T11189] bond_slave_0: entered allmulticast mode [ 499.432375][T11189] bond_slave_1: entered allmulticast mode [ 499.446389][T11189] team0: entered promiscuous mode [ 499.451911][T11189] team_slave_0: entered promiscuous mode [ 499.457874][T11189] team_slave_1: entered promiscuous mode [ 499.482057][T11189] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 499.492063][T11189] team0: entered allmulticast mode [ 499.499176][T11189] team_slave_0: entered allmulticast mode [ 499.506996][T11189] team_slave_1: entered allmulticast mode [ 499.518482][T11189] dummy0: entered promiscuous mode [ 499.524285][T11189] dummy0: entered allmulticast mode [ 499.539403][T11189] nlmon0: entered promiscuous mode [ 499.556919][T11189] nlmon0: entered allmulticast mode [ 499.726744][T11189] caif0: entered promiscuous mode [ 499.752319][T11189] caif0: entered allmulticast mode [ 499.763326][T11189] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 500.183376][T11194] usb 4-1: cannot submit urb 0, error -2: endpoint not enabled [ 500.314172][T11219] deleting an unspecified loop device is not supported. [ 500.485229][ T5907] usb 3-1: USB disconnect, device number 67 [ 500.594577][ T933] usb 1-1: new full-speed USB device number 76 using dummy_hcd [ 500.768315][ T933] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 500.805570][ T933] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 500.835514][ T933] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 500.866691][ T933] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 500.901795][ T933] usb 1-1: config 0 descriptor?? [ 500.931913][ T933] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 500.950659][ T933] dvb-usb: bulk message failed: -22 (3/0) [ 500.976845][ T933] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 500.999998][ T933] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 501.008120][ T933] usb 1-1: media controller created [ 501.015391][ T933] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 501.036572][ T933] dvb-usb: bulk message failed: -22 (6/0) [ 501.045555][ T933] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 501.067655][ T933] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input30 [ 501.100714][ T933] dvb-usb: schedule remote query interval to 150 msecs. [ 501.119696][ T933] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 501.222701][T11227] dvb-usb: bulk message failed: -22 (2/0) [ 501.265372][ T5961] usb 1-1: USB disconnect, device number 76 [ 501.276463][ T933] dvb-usb: bulk message failed: -22 (1/0) [ 501.309865][ T933] dvb-usb: error while querying for an remote control event. [ 501.326275][ T5907] usb 2-1: USB disconnect, device number 84 [ 501.348562][ T5907] cypress_cy7c63 2-1:0.194: Cypress CY7C63xxx device now disconnected [ 501.459758][ T5961] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 501.493755][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.500688][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.923742][T11237] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.959993][T11237] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 502.335439][ T5917] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 502.499929][ T5893] usb 4-1: USB disconnect, device number 68 [ 502.513808][ T5917] usb 1-1: config 0 interface 0 has no altsetting 0 [ 502.527334][ T5917] usb 1-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 502.541957][ T5917] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.558734][ T5917] usb 1-1: config 0 descriptor?? [ 502.984790][ T5893] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 503.120916][T11256] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 503.129932][T10868] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 503.139474][ T5893] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 503.154433][ T5893] usb 2-1: config 2 has 0 interfaces, different from the descriptor's value: 1 [ 503.167673][ T5893] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 503.178211][ T5893] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.190805][ T5893] usb 2-1: Product: syz [ 503.200756][ T5893] usb 2-1: Manufacturer: syz [ 503.212279][ T5893] usb 2-1: SerialNumber: syz [ 503.319177][T10868] usb 4-1: config 0 has an invalid interface number: 199 but max is 1 [ 503.327788][T10868] usb 4-1: config 0 has no interface number 1 [ 503.334284][T10868] usb 4-1: config 0 interface 199 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 503.345918][T10868] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 503.359835][T10868] usb 4-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 503.369581][T10868] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 503.379607][T10868] usb 4-1: SerialNumber: syz [ 503.393884][T10868] usb 4-1: config 0 descriptor?? [ 503.411883][ T5148] Bluetooth: hci0: unexpected event for opcode 0x0c5b [ 503.663544][T11259] program syz.3.1561 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 503.697036][T10868] uvcvideo 4-1:0.199: Found UVC 0.00 device (0002:0000) [ 503.715489][T10868] uvcvideo 4-1:0.199: No valid video chain found. [ 503.740739][T10868] usb 4-1: USB disconnect, device number 69 [ 503.924929][ T5917] video4linux radio48: keene_cmd_set failed (-110) [ 503.936445][ T5917] radio-keene 1-1:0.0: V4L2 device registered as radio48 [ 504.150738][ T5907] usb 1-1: USB disconnect, device number 77 [ 504.594724][ T5907] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 504.614686][ T5917] usb 3-1: new full-speed USB device number 68 using dummy_hcd [ 504.758063][ T5907] usb 4-1: unable to get BOS descriptor or descriptor too short [ 504.767805][ T5907] usb 4-1: config 0 has an invalid descriptor of length 90, skipping remainder of the config [ 504.778424][ T5907] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 504.791066][ T5907] usb 4-1: New USB device found, idVendor=04e6, idProduct=5591, bcdDevice=b5.39 [ 504.800638][ T5907] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.809240][ T5907] usb 4-1: Product: syz [ 504.811681][ T5917] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 504.825017][ T5907] usb 4-1: Manufacturer: syz [ 504.829898][ T5907] usb 4-1: SerialNumber: syz [ 504.836514][ T5917] usb 3-1: can't read configurations, error -71 [ 504.845391][ T5907] usb 4-1: config 0 descriptor?? [ 505.057104][T10868] usb 4-1: USB disconnect, device number 70 [ 505.168890][T11283] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.203660][T11283] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.801105][ T5907] usb 2-1: USB disconnect, device number 85 [ 505.894690][ T5917] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 505.940586][T11304] FAULT_INJECTION: forcing a failure. [ 505.940586][T11304] name failslab, interval 1, probability 0, space 0, times 0 [ 505.968301][T11304] CPU: 0 UID: 0 PID: 11304 Comm: syz.1.1578 Tainted: G L syzkaller #0 PREEMPT(full) [ 505.968333][T11304] Tainted: [L]=SOFTLOCKUP [ 505.968341][T11304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 505.968353][T11304] Call Trace: [ 505.968361][T11304] [ 505.968372][T11304] dump_stack_lvl+0xe8/0x150 [ 505.968401][T11304] should_fail_ex+0x414/0x560 [ 505.968426][T11304] should_failslab+0xa8/0x100 [ 505.968445][T11304] kmem_cache_alloc_noprof+0x88/0x710 [ 505.968467][T11304] ? security_inode_alloc+0x39/0x330 [ 505.968489][T11304] security_inode_alloc+0x39/0x330 [ 505.968508][T11304] inode_init_always_gfp+0x9ed/0xdc0 [ 505.968529][T11304] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 505.968551][T11304] alloc_inode+0x82/0x1b0 [ 505.968568][T11304] new_inode+0x22/0x170 [ 505.968589][T11304] __debugfs_create_file+0xb8/0x400 [ 505.968607][T11304] debugfs_create_file_full+0x3f/0x60 [ 505.968624][T11304] ref_tracker_dir_debugfs+0x14e/0x2d0 [ 505.968640][T11304] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 505.968678][T11304] ? trace_kmalloc+0x1f/0xb0 [ 505.968689][T11304] ? __kvmalloc_node_noprof+0x5f5/0x920 [ 505.968707][T11304] ? __raw_spin_lock_init+0x45/0x100 [ 505.968728][T11304] alloc_netdev_mqs+0x272/0x11b0 [ 505.968749][T11304] ? __pfx_ip6gre_tap_setup+0x10/0x10 [ 505.968771][T11304] rtnl_create_link+0x31f/0xcf0 [ 505.968796][T11304] rtnl_newlink_create+0x25c/0xb00 [ 505.968823][T11304] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 505.968843][T11304] ? __pfx___mutex_lock+0x10/0x10 [ 505.968866][T11304] ? ns_capable+0x8a/0xf0 [ 505.968883][T11304] rtnl_newlink+0x16e7/0x1c90 [ 505.968911][T11304] ? __pfx_rtnl_newlink+0x10/0x10 [ 505.968925][T11304] ? __do_fast_syscall_32+0x1dc/0x570 [ 505.968941][T11304] ? do_fast_syscall_32+0x34/0x80 [ 505.968956][T11304] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 505.969022][T11304] ? kasan_quarantine_put+0xbb/0x1f0 [ 505.969043][T11304] ? lockdep_hardirqs_on+0x7b/0x110 [ 505.969074][T11304] ? kmem_cache_free+0x197/0x620 [ 505.969088][T11304] ? nlmon_xmit+0xb0/0x100 [ 505.969113][T11304] ? __lock_acquire+0x6b6/0x2cf0 [ 505.969134][T11304] ? __local_bh_enable_ip+0xd0/0x130 [ 505.969148][T11304] ? lockdep_hardirqs_on+0x7b/0x110 [ 505.969162][T11304] ? __dev_queue_xmit+0x289/0x31c0 [ 505.969180][T11304] ? __local_bh_enable_ip+0xd0/0x130 [ 505.969193][T11304] ? __dev_queue_xmit+0x289/0x31c0 [ 505.969217][T11304] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 505.969243][T11304] ? __pfx_rtnl_newlink+0x10/0x10 [ 505.969258][T11304] rtnetlink_rcv_msg+0x7cf/0xb70 [ 505.969277][T11304] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 505.969292][T11304] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 505.969306][T11304] ? ref_tracker_free+0x63a/0x7d0 [ 505.969321][T11304] ? __asan_memcpy+0x40/0x70 [ 505.969360][T11304] ? __pfx_ref_tracker_free+0x10/0x10 [ 505.969379][T11304] ? __skb_clone+0x63/0x7a0 [ 505.969419][T11304] netlink_rcv_skb+0x208/0x470 [ 505.969439][T11304] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 505.969456][T11304] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 505.969483][T11304] ? netlink_deliver_tap+0x2e/0x1b0 [ 505.969506][T11304] netlink_unicast+0x82f/0x9e0 [ 505.969529][T11304] ? __pfx_netlink_unicast+0x10/0x10 [ 505.969544][T11304] ? __alloc_skb+0x198/0x3a0 [ 505.969559][T11304] ? netlink_sendmsg+0x642/0xb30 [ 505.969577][T11304] ? skb_put+0x11b/0x210 [ 505.969595][T11304] netlink_sendmsg+0x805/0xb30 [ 505.969620][T11304] ? __pfx_netlink_sendmsg+0x10/0x10 [ 505.969640][T11304] ? __import_iovec+0x5d4/0x7f0 [ 505.969660][T11304] ? aa_sock_msg_perm+0xf1/0x1b0 [ 505.969680][T11304] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 505.969693][T11304] ? __pfx_netlink_sendmsg+0x10/0x10 [ 505.969715][T11304] __sock_sendmsg+0x21c/0x270 [ 505.969740][T11304] ____sys_sendmsg+0x505/0x820 [ 505.969766][T11304] ? __pfx_____sys_sendmsg+0x10/0x10 [ 505.969787][T11304] ? kstrtouint+0x6e/0xe0 [ 505.969816][T11304] ___sys_sendmsg+0x21f/0x2a0 [ 505.969835][T11304] ? __pfx____sys_sendmsg+0x10/0x10 [ 505.969871][T11304] ? get_pid_task+0x20/0x1f0 [ 505.969889][T11304] ? get_pid_task+0x20/0x1f0 [ 505.969907][T11304] ? get_pid_task+0x20/0x1f0 [ 505.969949][T11304] ? __fget_files+0x2a/0x420 [ 505.969967][T11304] ? __fget_files+0x3a0/0x420 [ 505.969993][T11304] __sys_sendmsg+0x164/0x220 [ 505.970013][T11304] ? __pfx___sys_sendmsg+0x10/0x10 [ 505.970039][T11304] ? __pfx_ksys_write+0x10/0x10 [ 505.970078][T11304] __do_fast_syscall_32+0x1dc/0x570 [ 505.970102][T11304] ? lockdep_hardirqs_on+0x7b/0x110 [ 505.970123][T11304] ? do_fast_syscall_32+0x34/0x80 [ 505.970147][T11304] ? irqentry_exit+0x10f/0x670 [ 505.970177][T11304] do_fast_syscall_32+0x34/0x80 [ 505.970195][T11304] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 505.970213][T11304] RIP: 0023:0xf700d539 [ 505.970226][T11304] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 505.970239][T11304] RSP: 002b:00000000f53fd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 505.970254][T11304] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 505.970265][T11304] RDX: 0000000008000014 RSI: 0000000000000000 RDI: 0000000000000000 [ 505.970274][T11304] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 505.970282][T11304] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 505.970291][T11304] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 505.970313][T11304] [ 505.972583][T11304] debugfs: out of free dentries, can not create file 'netdev@ffff88807cdb4618' [ 506.707586][ T5917] usb 3-1: Using ep0 maxpacket: 16 [ 506.882536][ T5893] usb 1-1: new full-speed USB device number 78 using dummy_hcd [ 506.957211][ T5917] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 507.014814][ T5917] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 507.039181][ T5917] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 507.069234][ T5917] usb 3-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice=f6.59 [ 507.084606][ T5917] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.094382][ T5917] usb 3-1: Product: syz [ 507.098735][ T5917] usb 3-1: Manufacturer: syz [ 507.103387][ T5917] usb 3-1: SerialNumber: syz [ 507.127049][ T5917] usb 3-1: config 0 descriptor?? [ 507.142279][ T5917] peak_usb 3-1:0.0 can0: sending cmd f=0x6 n=0x1 failure: -8 [ 507.156423][ T5917] peak_usb 3-1:0.0: unable to read PCAN-USB serial number (err -8) [ 507.166249][ T5893] usb 1-1: New USB device found, idVendor=10b8, idProduct=1bb4, bcdDevice=34.65 [ 507.178295][ T5893] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=67 [ 507.195608][ T5893] usb 1-1: Product: syz [ 507.206002][ T5893] usb 1-1: Manufacturer: syz [ 507.241914][ T5893] usb 1-1: SerialNumber: syz [ 507.263557][ T5893] usb 1-1: config 0 descriptor?? [ 507.270742][ T5917] peak_usb 3-1:0.0: probe with driver peak_usb failed with error -8 [ 507.303036][T11308] batadv_slave_1: entered promiscuous mode [ 507.399783][T11307] batadv_slave_1: left promiscuous mode [ 507.418737][ T933] usb 3-1: USB disconnect, device number 69 [ 507.449809][T11310] netlink: 'syz.3.1581': attribute type 10 has an invalid length. [ 507.471358][T11310] bond0: (slave wlan1): Opening slave failed [ 507.504220][ T5893] dvb-usb: found a 'DiBcom TFE7090PVR reference design' in warm state. [ 507.534036][ T5893] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 507.565701][ T5893] dvbdev: DVB: registering new adapter (DiBcom TFE7090PVR reference design) [ 507.578632][ T5893] usb 1-1: media controller created [ 507.591667][ T5893] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 507.659818][ T5893] DVB: Unable to find symbol dib7000p_attach() [ 507.671224][ T5893] dvb-usb: no frontend was attached by 'DiBcom TFE7090PVR reference design' [ 507.682953][ T5893] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 507.692470][ T5893] dvbdev: DVB: registering new adapter (DiBcom TFE7090PVR reference design) [ 507.701819][ T5893] usb 1-1: media controller created [ 507.710358][ T5893] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 507.755837][ T5893] dib0700: the master dib7090 has to be initialized first [ 507.798316][ T5893] dvb-usb: no frontend was attached by 'DiBcom TFE7090PVR reference design' [ 507.822649][T11322] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1582'. [ 507.904601][ T5893] rc_core: IR keymap rc-dib0700-rc5 not found [ 507.921789][ T5893] Registered IR keymap rc-empty [ 507.931051][ T5893] dvb-usb: could not initialize remote control. [ 507.937663][ T5893] dvb-usb: DiBcom TFE7090PVR reference design successfully initialized and connected. [ 507.967666][ T5893] usb 1-1: USB disconnect, device number 78 [ 508.057037][ T5893] dvb-usb: DiBcom TFE7090PVR reference design successfully deinitialized and disconnected. [ 508.193780][T11327] FAULT_INJECTION: forcing a failure. [ 508.193780][T11327] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 508.234956][T11327] CPU: 0 UID: 0 PID: 11327 Comm: syz.2.1584 Tainted: G L syzkaller #0 PREEMPT(full) [ 508.234990][T11327] Tainted: [L]=SOFTLOCKUP [ 508.234998][T11327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 508.235016][T11327] Call Trace: [ 508.235023][T11327] [ 508.235030][T11327] dump_stack_lvl+0xe8/0x150 [ 508.235054][T11327] should_fail_ex+0x414/0x560 [ 508.235082][T11327] _copy_from_user+0x2d/0xb0 [ 508.235101][T11327] kstrtouint_from_user+0xc4/0x170 [ 508.235119][T11327] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 508.235145][T11327] proc_fail_nth_write+0x88/0x200 [ 508.235162][T11327] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 508.235181][T11327] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 508.235198][T11327] vfs_write+0x27e/0xb30 [ 508.235218][T11327] ? __pfx_vfs_write+0x10/0x10 [ 508.235233][T11327] ? __fget_files+0x2a/0x420 [ 508.235254][T11327] ? __fget_files+0x3a0/0x420 [ 508.235271][T11327] ? __fget_files+0x2a/0x420 [ 508.235296][T11327] ksys_write+0x145/0x250 [ 508.235311][T11327] ? __pfx_ksys_write+0x10/0x10 [ 508.235333][T11327] __do_fast_syscall_32+0x1dc/0x570 [ 508.235351][T11327] ? lockdep_hardirqs_on+0x7b/0x110 [ 508.235366][T11327] ? do_fast_syscall_32+0x34/0x80 [ 508.235382][T11327] ? irqentry_exit+0x10f/0x670 [ 508.235401][T11327] do_fast_syscall_32+0x34/0x80 [ 508.235418][T11327] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 508.235436][T11327] RIP: 0023:0xf7f77539 [ 508.235449][T11327] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 508.235462][T11327] RSP: 002b:00000000f5466590 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 508.235483][T11327] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f5466620 [ 508.235494][T11327] RDX: 0000000000000001 RSI: 00000000f7406ff4 RDI: 0000000000000000 [ 508.235503][T11327] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 508.235512][T11327] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 508.235521][T11327] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 508.235542][T11327] [ 509.186208][T11340] FAULT_INJECTION: forcing a failure. [ 509.186208][T11340] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 509.201316][T11340] CPU: 0 UID: 0 PID: 11340 Comm: syz.4.1589 Tainted: G L syzkaller #0 PREEMPT(full) [ 509.201348][T11340] Tainted: [L]=SOFTLOCKUP [ 509.201357][T11340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 509.201369][T11340] Call Trace: [ 509.201377][T11340] [ 509.201387][T11340] dump_stack_lvl+0xe8/0x150 [ 509.201417][T11340] should_fail_ex+0x414/0x560 [ 509.201455][T11340] _copy_to_user+0x31/0xb0 [ 509.201482][T11340] simple_read_from_buffer+0xe1/0x170 [ 509.201512][T11340] proc_fail_nth_read+0x1b3/0x220 [ 509.201536][T11340] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 509.201560][T11340] ? rw_verify_area+0x2a6/0x4d0 [ 509.201591][T11340] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 509.201640][T11340] vfs_read+0x200/0xa30 [ 509.201659][T11340] ? fdget_pos+0x247/0x320 [ 509.201710][T11340] ? __pfx___mutex_lock+0x10/0x10 [ 509.201737][T11340] ? __pfx_vfs_read+0x10/0x10 [ 509.201759][T11340] ? __fget_files+0x2a/0x420 [ 509.201791][T11340] ? __fget_files+0x3a0/0x420 [ 509.201817][T11340] ? __fget_files+0x2a/0x420 [ 509.201855][T11340] ksys_read+0x145/0x250 [ 509.201878][T11340] ? __pfx_ksys_read+0x10/0x10 [ 509.201912][T11340] __do_fast_syscall_32+0x1dc/0x570 [ 509.201938][T11340] ? lockdep_hardirqs_on+0x7b/0x110 [ 509.201960][T11340] ? do_fast_syscall_32+0x34/0x80 [ 509.201985][T11340] ? irqentry_exit+0x10f/0x670 [ 509.202013][T11340] do_fast_syscall_32+0x34/0x80 [ 509.202040][T11340] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 509.202066][T11340] RIP: 0023:0xf704d539 [ 509.202086][T11340] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 509.202105][T11340] RSP: 002b:00000000f543d590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 509.202129][T11340] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000f543d620 [ 509.202144][T11340] RDX: 000000000000000f RSI: 00000000f73e6ff4 RDI: 0000000000000000 [ 509.202158][T11340] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 509.202171][T11340] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 509.202185][T11340] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 509.202218][T11340] [ 509.659924][T11343] netlink: 'syz.3.1590': attribute type 1 has an invalid length. [ 509.664917][ T5917] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 509.678049][T11345] batadv_slave_1: entered promiscuous mode [ 509.687623][T11343] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1590'. [ 509.748711][T11344] batadv_slave_1: left promiscuous mode [ 509.827336][ T5917] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 509.858777][ T5917] usb 1-1: config 2 has 0 interfaces, different from the descriptor's value: 1 [ 509.921015][ T5917] usb 1-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 509.954984][ T5917] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.963048][ T5917] usb 1-1: Product: syz [ 509.975659][ T5917] usb 1-1: Manufacturer: syz [ 509.980439][ T5917] usb 1-1: SerialNumber: syz [ 509.988006][T11350] loop2: detected capacity change from 0 to 7 [ 510.004796][T11350] loop2: [ 510.008884][T11350] loop2: partition table partially beyond EOD, truncated [ 510.153337][T11358] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 510.344616][ T5917] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 510.511767][ T5917] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 510.523381][ T5917] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 510.575033][ T5893] usb 4-1: new full-speed USB device number 71 using dummy_hcd [ 510.587637][ T5917] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 510.609161][ T5917] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 510.632124][ T5917] usb 2-1: SerialNumber: syz [ 510.744575][ T933] usb 3-1: new full-speed USB device number 70 using dummy_hcd [ 510.755769][ T5893] usb 4-1: config 8 has an invalid interface number: 177 but max is 0 [ 510.771539][ T5893] usb 4-1: config 8 has no interface number 0 [ 510.786359][ T5893] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 510.814010][ T5893] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 510.844112][ T5893] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 510.873468][T11376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.900776][ T5893] usb 4-1: config 8 interface 177 has no altsetting 0 [ 510.913893][T11376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 510.927318][ T933] usb 3-1: not running at top speed; connect to a high speed hub [ 510.937055][ T933] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 510.948415][ T933] usb 3-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 510.961370][ T933] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 510.972960][ T5917] usb 2-1: 0:2 : does not exist [ 510.978071][ T5893] usb 4-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 510.987763][ T5917] usb 2-1: unit 5: unexpected type 0x09 [ 510.997815][ T5893] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 511.006965][ T933] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 511.017198][ T933] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 511.025481][ T933] usb 3-1: Product: ࠧ [ 511.030003][ T933] usb 3-1: Manufacturer: ࠔ [ 511.039653][ T933] usb 3-1: SerialNumber: 㐉 [ 511.053483][ T5917] usb 2-1: USB disconnect, device number 86 [ 511.067635][T11366] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 511.455707][ T933] usb 3-1: 0:2 : does not exist [ 511.552388][ T933] usb 3-1: USB disconnect, device number 70 [ 511.582647][T11381] batadv_slave_1: entered promiscuous mode [ 511.636119][ T6083] udevd[6083]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 511.700255][T11380] batadv_slave_1: left promiscuous mode [ 511.735707][ T5929] udevd[5929]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 512.170406][ T5917] usb 1-1: USB disconnect, device number 79 [ 512.399011][T11392] loop2: detected capacity change from 0 to 7 [ 512.406727][T11392] loop2: [ 512.409938][T11392] loop2: partition table partially beyond EOD, truncated [ 512.470214][T11394] FAULT_INJECTION: forcing a failure. [ 512.470214][T11394] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 512.484709][T11394] CPU: 0 UID: 0 PID: 11394 Comm: syz.1.1611 Tainted: G L syzkaller #0 PREEMPT(full) [ 512.484732][T11394] Tainted: [L]=SOFTLOCKUP [ 512.484738][T11394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 512.484747][T11394] Call Trace: [ 512.484753][T11394] [ 512.484759][T11394] dump_stack_lvl+0xe8/0x150 [ 512.484781][T11394] should_fail_ex+0x414/0x560 [ 512.484807][T11394] _copy_from_user+0x2d/0xb0 [ 512.484828][T11394] memdup_user+0x5e/0xd0 [ 512.484845][T11394] strndup_user+0x68/0xd0 [ 512.484880][T11394] __se_sys_fsconfig+0x4ce/0x8d0 [ 512.484899][T11394] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 512.484913][T11394] ? ksys_write+0x22a/0x250 [ 512.484942][T11394] ? __pfx_ksys_write+0x10/0x10 [ 512.484959][T11394] ? __ia32_sys_fsconfig+0x20/0xc0 [ 512.484975][T11394] __do_fast_syscall_32+0x1dc/0x570 [ 512.484991][T11394] ? lockdep_hardirqs_on+0x7b/0x110 [ 512.485005][T11394] ? do_fast_syscall_32+0x34/0x80 [ 512.485020][T11394] ? irqentry_exit+0x10f/0x670 [ 512.485036][T11394] do_fast_syscall_32+0x34/0x80 [ 512.485052][T11394] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 512.485069][T11394] RIP: 0023:0xf700d539 [ 512.485082][T11394] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 512.485093][T11394] RSP: 002b:00000000f53fd55c EFLAGS: 00000206 ORIG_RAX: 00000000000001af [ 512.485108][T11394] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000001 [ 512.485117][T11394] RDX: 0000000080000000 RSI: 0000000080000080 RDI: 0000000000000000 [ 512.485126][T11394] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 512.485134][T11394] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 512.485142][T11394] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 512.485160][T11394] [ 512.870790][T11402] netlink: 'syz.0.1613': attribute type 10 has an invalid length. [ 512.945020][ T5900] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 513.038328][T11406] syzkaller0: entered promiscuous mode [ 513.044881][T11406] syzkaller0: entered allmulticast mode [ 513.115057][ T5900] usb 3-1: Using ep0 maxpacket: 16 [ 513.154384][ T5900] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 513.177215][ T5900] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 513.186906][ T5900] usb 3-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 513.198216][ T5900] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 513.214659][ T5900] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 513.224813][ T5900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.228417][T11408] batadv_slave_1: entered promiscuous mode [ 513.233111][ T5900] usb 3-1: Product: syz [ 513.245137][ T5900] usb 3-1: Manufacturer: syz [ 513.249880][ T5900] usb 3-1: SerialNumber: syz [ 513.277427][T11407] batadv_slave_1: left promiscuous mode [ 513.594654][ T933] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 513.767784][ T933] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 513.798571][ T933] usb 1-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 513.845486][ T933] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.856861][ T933] usb 1-1: Product: syz [ 513.861190][ T933] usb 1-1: Manufacturer: syz [ 513.866809][ T933] usb 1-1: SerialNumber: syz [ 513.899322][ T933] usb 1-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 514.012866][ T5893] usb 4-1: string descriptor 0 read error: -71 [ 514.063493][ T5893] ir_toy 4-1:8.177: required endpoints not found [ 514.072655][T11421] sctp: [Deprecated]: syz.4.1619 (pid 11421) Use of int in max_burst socket option deprecated. [ 514.072655][T11421] Use struct sctp_assoc_value instead [ 514.148575][ T5893] usb 4-1: USB disconnect, device number 71 [ 514.356828][ T933] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 514.371550][ T933] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 514.381550][ T933] usb 1-1: media controller created [ 514.513335][ T933] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 514.732337][T11429] loop2: detected capacity change from 0 to 7 [ 514.768414][T11429] loop2: [ 514.771447][T11429] loop2: partition table partially beyond EOD, truncated [ 515.000367][ T933] usb 1-1: USB disconnect, device number 80 [ 515.149925][T11436] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1624'. [ 515.328840][T11441] netlink: 'syz.1.1626': attribute type 10 has an invalid length. [ 515.363796][T11441] bond0: (slave wlan1): Opening slave failed [ 515.486891][T11444] batadv_slave_1: entered promiscuous mode [ 515.531776][T11442] batadv_slave_1: left promiscuous mode [ 515.646692][T11452] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 515.760072][T11456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.864308][ T5900] usb 3-1: 0:2 : does not exist [ 515.871862][T11460] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1627'. [ 515.881640][T11456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.951484][ T5900] usb 3-1: USB disconnect, device number 71 [ 516.052691][ T6083] udevd[6083]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 516.227558][T11472] netlink: 'syz.0.1631': attribute type 10 has an invalid length. [ 516.435818][T11476] netlink: 'syz.2.1633': attribute type 10 has an invalid length. [ 516.906324][T11476] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 516.930743][T11476] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 517.222736][T11485] loop2: detected capacity change from 0 to 7 [ 517.238800][T11485] loop2: [ 517.244831][T11485] loop2: partition table partially beyond EOD, truncated [ 517.685119][T10868] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 517.856600][T10868] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 517.883593][T10868] usb 4-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 517.904347][T10868] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.923717][T10868] usb 4-1: Product: syz [ 517.932874][T10868] usb 4-1: Manufacturer: syz [ 517.945499][T10868] usb 4-1: SerialNumber: syz [ 517.962907][T10868] usb 4-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 518.258193][T11508] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1639'. [ 518.314769][ T5917] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 518.381277][T10868] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 518.403482][T10868] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 518.421532][T10868] usb 4-1: media controller created [ 518.453855][T10868] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 518.464367][ T5917] usb 3-1: device descriptor read/64, error -71 [ 518.654792][T10868] usb 4-1: USB disconnect, device number 72 [ 518.724599][ T5917] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 518.874653][ T5917] usb 3-1: device descriptor read/64, error -71 [ 518.984927][ T5917] usb usb3-port1: attempt power cycle [ 519.255298][T10868] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 519.283024][ T30] kauditd_printk_skb: 74 callbacks suppressed [ 519.283038][ T30] audit: type=1326 audit(1768460287.623:430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11523 comm="syz.0.1648" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf708d539 code=0x0 [ 519.334668][ T5917] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 519.368978][ T5917] usb 3-1: device descriptor read/8, error -71 [ 519.383809][T11529] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1649'. [ 519.464818][T10868] usb 4-1: Using ep0 maxpacket: 16 [ 519.472368][T10868] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 23, changing to 8 [ 519.484654][T10868] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 519.505979][T10868] usb 4-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 519.518700][T10868] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.532666][T10868] usb 4-1: config 0 descriptor?? [ 519.635398][ T5917] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 519.663281][T11533] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 519.674316][ T5917] usb 3-1: device descriptor read/8, error -71 [ 519.684137][T11533] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 519.695717][T11533] netlink: 'syz.4.1650': attribute type 10 has an invalid length. [ 519.704102][T11533] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 519.785293][ T5917] usb usb3-port1: unable to enumerate USB device [ 520.964417][T11545] FAULT_INJECTION: forcing a failure. [ 520.964417][T11545] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 521.011011][T10868] usbhid 4-1:0.0: can't add hid device: -71 [ 521.023228][T11545] CPU: 1 UID: 0 PID: 11545 Comm: syz.0.1654 Tainted: G L syzkaller #0 PREEMPT(full) [ 521.023261][T11545] Tainted: [L]=SOFTLOCKUP [ 521.023269][T11545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 521.023281][T11545] Call Trace: [ 521.023289][T11545] [ 521.023298][T11545] dump_stack_lvl+0xe8/0x150 [ 521.023327][T11545] should_fail_ex+0x414/0x560 [ 521.023363][T11545] _copy_from_user+0x2d/0xb0 [ 521.023389][T11545] copy_ctl_value_from_user+0x37/0x610 [ 521.023419][T11545] ? snd_ctl_ioctl_compat+0x32b/0xe00 [ 521.023448][T11545] snd_ctl_ioctl_compat+0x36a/0xe00 [ 521.023478][T11545] ? __pfx_snd_ctl_ioctl_compat+0x10/0x10 [ 521.023501][T11545] ? __fget_files+0x2a/0x420 [ 521.023514][T10868] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 521.023530][T11545] ? __fget_files+0x3a0/0x420 [ 521.023553][T11545] ? __fget_files+0x2a/0x420 [ 521.023640][T11545] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 521.023788][T11545] __ia32_compat_sys_ioctl+0x543/0x840 [ 521.023869][T11545] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 521.023921][T11545] ? __fget_files+0x3a0/0x420 [ 521.024004][T11545] ? fput+0xa0/0xd0 [ 521.024074][T11545] ? ksys_write+0x22a/0x250 [ 521.024143][T11545] ? __pfx_ksys_write+0x10/0x10 [ 521.024219][T11545] __do_fast_syscall_32+0x1dc/0x570 [ 521.024287][T11545] ? lockdep_hardirqs_on+0x7b/0x110 [ 521.024337][T11545] ? do_fast_syscall_32+0x34/0x80 [ 521.024411][T11545] ? irqentry_exit+0x10f/0x670 [ 521.024479][T11545] do_fast_syscall_32+0x34/0x80 [ 521.024541][T11545] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 521.024602][T11545] RIP: 0023:0xf708d539 [ 521.024646][T11545] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 521.024696][T11545] RSP: 002b:00000000f545c55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 521.024757][T11545] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c2c45512 [ 521.024798][T11545] RDX: 0000000080000640 RSI: 0000000000000000 RDI: 0000000000000000 [ 521.024829][T11545] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 521.024868][T11545] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 521.024899][T11545] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 521.024980][T11545] [ 521.289847][T10868] usb 4-1: USB disconnect, device number 73 [ 521.392955][T11548] netlink: 'syz.1.1656': attribute type 10 has an invalid length. [ 521.413809][T11548] bond0: (slave wlan1): Opening slave failed [ 522.065008][ T933] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 522.194624][ T5900] usb 2-1: new low-speed USB device number 87 using dummy_hcd [ 522.224533][ T933] usb 1-1: Using ep0 maxpacket: 8 [ 522.231292][ T933] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 522.239739][ T933] usb 1-1: config 0 has no interface number 0 [ 522.246315][ T933] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 522.257253][ T933] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 522.268954][ T933] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 522.280707][ T933] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 522.293962][ T933] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 522.303101][ T933] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 522.313461][ T933] usb 1-1: config 0 descriptor?? [ 522.324828][ T933] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 522.366698][ T5900] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 522.375255][ T5900] usb 2-1: config 0 has no interface number 0 [ 522.381382][ T5900] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 522.392348][ T5900] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 522.403142][ T5900] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 522.415020][ T5900] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 522.426274][ T5900] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 522.437201][ T5900] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 522.450408][ T5900] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 522.467290][ T5900] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 522.479419][ T5900] usb 2-1: config 0 descriptor?? [ 522.493569][T11564] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 522.502091][T11564] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 522.518346][ T5900] ldusb 2-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 523.084690][ T5900] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 523.172025][T11562] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 523.195167][T11562] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 523.269068][ T5900] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 523.296419][ T5900] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.333861][ T5900] usb 3-1: config 0 descriptor?? [ 523.389777][ T5900] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 523.803092][ T5900] gspca_stv06xx: I2C: Read error writing address: -71 [ 523.823146][ T5900] usb 3-1: USB disconnect, device number 76 [ 523.904734][T10868] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 524.070116][T10868] usb 4-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 524.079496][T10868] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 524.088001][T10868] usb 4-1: Product: syz [ 524.092936][T10868] usb 4-1: Manufacturer: syz [ 524.097839][T10868] usb 4-1: SerialNumber: syz [ 524.113377][T10868] usb 4-1: config 0 descriptor?? [ 524.140108][T10868] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 524.168251][T10868] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 524.183911][T10868] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 524.203119][T10868] usb 4-1: media controller created [ 524.225493][T10868] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 524.303798][T10868] DVB: Unable to find symbol mt352_attach() [ 524.399572][T10868] DVB: Unable to find symbol nxt6000_attach() [ 524.420257][T10868] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 524.470921][T10868] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input32 [ 524.500246][T10868] dvb-usb: schedule remote query interval to 1000 msecs. [ 524.516283][T10868] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 524.539052][T10868] dvb-usb: bulk message failed: -22 (7/0) [ 524.552707][T10868] dvb-usb: bulk message failed: -22 (7/0) [ 525.079033][T10868] usb 1-1: USB disconnect, device number 81 [ 525.118551][T10868] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 525.184773][T11597] FAULT_INJECTION: forcing a failure. [ 525.184773][T11597] name failslab, interval 1, probability 0, space 0, times 0 [ 525.197623][T11597] CPU: 0 UID: 0 PID: 11597 Comm: syz.4.1669 Tainted: G L syzkaller #0 PREEMPT(full) [ 525.197655][T11597] Tainted: [L]=SOFTLOCKUP [ 525.197664][T11597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 525.197678][T11597] Call Trace: [ 525.197687][T11597] [ 525.197696][T11597] dump_stack_lvl+0xe8/0x150 [ 525.197728][T11597] should_fail_ex+0x414/0x560 [ 525.197766][T11597] should_failslab+0xa8/0x100 [ 525.197794][T11597] __kmalloc_noprof+0xdf/0x800 [ 525.197814][T11597] ? kfree+0x4d/0x660 [ 525.197841][T11597] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 525.197877][T11597] tomoyo_realpath_from_path+0xe3/0x5d0 [ 525.197909][T11597] ? tomoyo_domain+0xd8/0x130 [ 525.197944][T11597] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 525.197969][T11597] tomoyo_path_number_perm+0x1e8/0x5a0 [ 525.197996][T11597] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 525.198021][T11597] ? __lock_acquire+0x6b6/0x2cf0 [ 525.198045][T11597] ? get_pid_task+0x20/0x1f0 [ 525.198082][T11597] ? get_pid_task+0x20/0x1f0 [ 525.198128][T11597] ? __fget_files+0x2a/0x420 [ 525.198159][T11597] ? __fget_files+0x3a0/0x420 [ 525.198185][T11597] ? __fget_files+0x2a/0x420 [ 525.198215][T11597] security_file_ioctl_compat+0xcb/0x2d0 [ 525.198249][T11597] __ia32_compat_sys_ioctl+0x128/0x840 [ 525.198274][T11597] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 525.198297][T11597] ? __fget_files+0x3a0/0x420 [ 525.198330][T11597] ? fput+0xa0/0xd0 [ 525.198359][T11597] ? ksys_write+0x22a/0x250 [ 525.198381][T11597] ? __pfx_ksys_write+0x10/0x10 [ 525.198414][T11597] __do_fast_syscall_32+0x1dc/0x570 [ 525.198440][T11597] ? lockdep_hardirqs_on+0x7b/0x110 [ 525.198461][T11597] ? do_fast_syscall_32+0x34/0x80 [ 525.198486][T11597] ? irqentry_exit+0x10f/0x670 [ 525.198513][T11597] do_fast_syscall_32+0x34/0x80 [ 525.198538][T11597] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 525.198564][T11597] RIP: 0023:0xf704d539 [ 525.198582][T11597] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 525.198602][T11597] RSP: 002b:00000000f53fb55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 525.198624][T11597] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000004b72 [ 525.198639][T11597] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 525.198653][T11597] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 525.198665][T11597] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 525.198678][T11597] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 525.198709][T11597] [ 525.461205][T11597] ERROR: Out of memory at tomoyo_realpath_from_path. [ 525.564746][T10868] dvb-usb: bulk message failed: -22 (7/0) [ 525.570945][T10868] dvb-usb: error while querying for an remote control event. [ 525.717080][T11602] netlink: 'syz.0.1670': attribute type 7 has an invalid length. [ 525.740829][T11602] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1670'. [ 526.368526][T11610] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1672'. [ 526.480961][T11611] netlink: 'syz.4.1672': attribute type 10 has an invalid length. [ 526.533693][T11611] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 526.604599][T10868] dvb-usb: bulk message failed: -22 (7/0) [ 526.629722][T10868] dvb-usb: error while querying for an remote control event. [ 526.648538][ T5900] usb 4-1: USB disconnect, device number 74 [ 526.908597][T10868] usb 2-1: USB disconnect, device number 87 [ 526.928896][T10868] ldusb 2-1:0.55: LD USB Device #1 now disconnected [ 526.955857][ T5900] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 527.132711][ T5907] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 527.324708][ T5900] usb 4-1: new low-speed USB device number 75 using dummy_hcd [ 527.344781][ T5907] usb 1-1: Using ep0 maxpacket: 32 [ 527.354333][ T5907] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 527.385096][ T5907] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 527.406865][T11625] netlink: 'syz.4.1676': attribute type 2 has an invalid length. [ 527.408737][ T5907] usb 1-1: New USB device found, idVendor=0925, idProduct=8866, bcdDevice= 0.00 [ 527.429256][ T5907] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.455476][ T5907] usb 1-1: config 0 descriptor?? [ 527.497078][ T5900] usb 4-1: unable to get BOS descriptor or descriptor too short [ 527.512516][T11628] netlink: 'syz.1.1678': attribute type 10 has an invalid length. [ 527.522164][ T5900] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 is Bulk; changing to Interrupt [ 527.555844][T11628] bond0: (slave wlan1): Opening slave failed [ 527.556446][ T5900] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt [ 527.615430][ T5900] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 527.629288][T11633] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1680'. [ 527.639096][ T5900] usb 4-1: string descriptor 0 read error: -22 [ 527.645818][ T5900] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 527.656018][ T5900] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.664706][T11633] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1680'. [ 527.674841][T11617] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 527.682334][T11617] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 527.697964][ T5900] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 527.716938][T11638] FAULT_INJECTION: forcing a failure. [ 527.716938][T11638] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 527.730267][T11638] CPU: 0 UID: 0 PID: 11638 Comm: syz.1.1681 Tainted: G L syzkaller #0 PREEMPT(full) [ 527.730296][T11638] Tainted: [L]=SOFTLOCKUP [ 527.730305][T11638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 527.730317][T11638] Call Trace: [ 527.730325][T11638] [ 527.730333][T11638] dump_stack_lvl+0xe8/0x150 [ 527.730363][T11638] should_fail_ex+0x414/0x560 [ 527.730397][T11638] _copy_to_user+0x31/0xb0 [ 527.730422][T11638] simple_read_from_buffer+0xe1/0x170 [ 527.730450][T11638] proc_fail_nth_read+0x1b3/0x220 [ 527.730473][T11638] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 527.730496][T11638] ? rw_verify_area+0x2a6/0x4d0 [ 527.730524][T11638] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 527.730545][T11638] vfs_read+0x200/0xa30 [ 527.730561][T11638] ? fdget_pos+0x247/0x320 [ 527.730589][T11638] ? __pfx___mutex_lock+0x10/0x10 [ 527.730612][T11638] ? __pfx_vfs_read+0x10/0x10 [ 527.730631][T11638] ? __fget_files+0x2a/0x420 [ 527.730657][T11638] ? __fget_files+0x3a0/0x420 [ 527.730679][T11638] ? __fget_files+0x2a/0x420 [ 527.730710][T11638] ksys_read+0x145/0x250 [ 527.730730][T11638] ? __pfx_ksys_read+0x10/0x10 [ 527.730759][T11638] __do_fast_syscall_32+0x1dc/0x570 [ 527.730780][T11638] ? lockdep_hardirqs_on+0x7b/0x110 [ 527.730798][T11638] ? do_fast_syscall_32+0x34/0x80 [ 527.730820][T11638] ? irqentry_exit+0x10f/0x670 [ 527.730843][T11638] do_fast_syscall_32+0x34/0x80 [ 527.730865][T11638] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 527.730888][T11638] RIP: 0023:0xf700d539 [ 527.730904][T11638] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 527.730921][T11638] RSP: 002b:00000000f53fd590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 527.730941][T11638] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53fd620 [ 527.730954][T11638] RDX: 000000000000000f RSI: 00000000f73a6ff4 RDI: 0000000000000000 [ 527.730965][T11638] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 527.730976][T11638] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 527.730987][T11638] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 527.731015][T11638] [ 527.995927][T11619] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 528.030062][ T5900] usb 4-1: USB disconnect, device number 75 [ 528.101854][T11643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 528.161145][T11643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.217451][ T5907] usbhid 1-1:0.0: can't add hid device: -71 [ 528.223506][ T5907] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 528.266342][ T5907] usb 1-1: USB disconnect, device number 82 [ 528.708381][T11659] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1687'. [ 528.778623][T11655] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1683'. [ 528.836321][T11662] netlink: 'syz.3.1687': attribute type 10 has an invalid length. [ 528.874084][T11662] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 528.894614][ T5900] usb 2-1: new full-speed USB device number 88 using dummy_hcd [ 528.930423][T11662] bond0: (slave batadv_slave_0): Enslaving as an active interface with an up link [ 529.167931][ T5900] usb 2-1: config 8 has an invalid interface number: 177 but max is 0 [ 529.244636][ T5900] usb 2-1: config 8 has no interface number 0 [ 529.274603][T10868] usb 1-1: new low-speed USB device number 83 using dummy_hcd [ 529.287675][ T5900] usb 2-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 529.335043][ T5900] usb 2-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 529.382908][ T5900] usb 2-1: config 8 interface 177 has no altsetting 0 [ 529.417053][ T5900] usb 2-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 529.456994][T10868] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 529.466222][T10868] usb 1-1: config 0 has no interface number 0 [ 529.472410][ T5900] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 529.512344][T10868] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 529.555969][T11657] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 529.574126][T10868] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 529.629354][T10868] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 529.713224][T10868] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 529.777963][T10868] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 529.826303][T10868] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 529.899640][T10868] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 529.950175][T10868] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 530.239491][T10868] usb 1-1: config 0 descriptor?? [ 530.296251][T11670] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 530.337272][T11670] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 530.427116][T10868] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 530.736784][T11670] ldusb 1-1:0.55: Write buffer overflow, 1685414111 bytes dropped [ 531.767158][ T5900] usb 2-1: string descriptor 0 read error: -71 [ 531.817499][ T5900] ir_toy 2-1:8.177: required endpoints not found [ 531.939996][ T5900] usb 2-1: USB disconnect, device number 88 [ 532.064564][T10868] usb 3-1: new full-speed USB device number 77 using dummy_hcd [ 532.099050][ C0] raw-gadget.0 gadget.2: ignoring, device is not running [ 532.245323][T10868] usb 3-1: device descriptor read/64, error -32 [ 532.351420][T11693] lo: left promiscuous mode [ 532.369765][T11693] lo: left allmulticast mode [ 532.387594][T11693] tunl0: left promiscuous mode [ 532.392437][T11693] tunl0: left allmulticast mode [ 532.403503][T11693] gre0: left promiscuous mode [ 532.414646][T11693] gre0: left allmulticast mode [ 532.439719][T11693] gretap0: left promiscuous mode [ 532.455148][T11693] gretap0: left allmulticast mode [ 532.494889][T10868] usb 3-1: new full-speed USB device number 78 using dummy_hcd [ 532.525820][T11693] erspan0: left promiscuous mode [ 532.531095][T11693] erspan0: left allmulticast mode [ 532.562392][T11693] ip_vti0: left promiscuous mode [ 532.577076][T11693] ip_vti0: left allmulticast mode [ 532.594931][T11693] ip6_vti0: left promiscuous mode [ 532.600381][T11693] ip6_vti0: left allmulticast mode [ 532.668160][T11693] sit0: left promiscuous mode [ 532.673166][T11693] sit0: left allmulticast mode [ 532.689294][T11693] ip6tnl0: left promiscuous mode [ 532.698569][T11693] ip6tnl0: left allmulticast mode [ 532.757675][T11693] ip6gre0: left promiscuous mode [ 532.762810][T11693] ip6gre0: left allmulticast mode [ 532.822237][T11693] syz_tun: left promiscuous mode [ 532.827541][T11693] syz_tun: left allmulticast mode [ 532.834412][T11693] ip6gretap0: left promiscuous mode [ 532.841128][T11693] ip6gretap0: left allmulticast mode [ 532.848061][T11693] bridge0: left promiscuous mode [ 532.853473][T11693] bridge0: left allmulticast mode [ 532.862257][T11693] vcan0: left promiscuous mode [ 532.867206][T11693] vcan0: left allmulticast mode [ 532.875215][T11693] bond0: left promiscuous mode [ 532.880129][T11693] bond_slave_0: left promiscuous mode [ 532.895020][T11693] bond_slave_1: left promiscuous mode [ 532.901580][T11693] bond0: left allmulticast mode [ 532.907276][T11693] bond_slave_0: left allmulticast mode [ 532.914102][T11693] bond_slave_1: left allmulticast mode [ 532.921766][T11693] team0: left promiscuous mode [ 532.928961][T11693] team_slave_0: left promiscuous mode [ 532.942802][T11693] team_slave_1: left promiscuous mode [ 532.949512][T11693] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 532.957556][T11693] team0: left allmulticast mode [ 532.962667][T11693] team_slave_0: left allmulticast mode [ 532.968821][T11693] team_slave_1: left allmulticast mode [ 532.976963][T11693] dummy0: left promiscuous mode [ 532.982250][T11693] dummy0: left allmulticast mode [ 532.991712][T11693] nlmon0: left promiscuous mode [ 533.005623][T11693] nlmon0: left allmulticast mode [ 533.041828][T11693] caif0: left promiscuous mode [ 533.067551][T11693] caif0: left allmulticast mode [ 533.078753][T11693] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 533.248743][T10868] usb 3-1: config 8 has an invalid interface number: 177 but max is 0 [ 533.260061][T10868] usb 3-1: config 8 has no interface number 0 [ 533.284606][T10868] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 533.321496][T10868] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 533.358469][T10868] usb 3-1: config 8 interface 177 has no altsetting 0 [ 533.383771][T10868] usb 3-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 533.455081][T10868] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.496875][T11685] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 534.058420][T11710] loop2: detected capacity change from 0 to 7 [ 534.123646][T11710] Dev loop2: unable to read RDB block 7 [ 534.131805][T11710] loop2: AHDI p1 p2 p3 [ 534.182125][T11710] loop2: partition table partially beyond EOD, truncated [ 534.244779][T11710] loop2: p1 start 1601398130 is beyond EOD, truncated [ 534.251709][T11710] loop2: p2 start 1702059890 is beyond EOD, truncated [ 534.783051][ T5907] usb 1-1: USB disconnect, device number 83 [ 534.796241][ T5907] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 534.945377][ T933] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 535.055855][T11722] loop2: detected capacity change from 0 to 7 [ 535.063790][T11722] loop2: [ 535.066983][T11722] loop2: partition table partially beyond EOD, truncated [ 535.103457][T11720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 535.136262][ T933] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 535.150404][T11720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 535.165153][ T933] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 535.180431][ T933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.189033][ T933] usb 2-1: Product: syz [ 535.193321][ T933] usb 2-1: Manufacturer: syz [ 535.210535][ T933] usb 2-1: SerialNumber: syz [ 535.233076][ T933] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 535.328447][T11724] batadv_slave_1: entered promiscuous mode [ 535.377194][T11723] batadv_slave_1: left promiscuous mode [ 535.737572][ T933] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 535.748762][ T933] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 535.772154][ T933] usb 2-1: media controller created [ 535.777605][ T5900] usb 1-1: new full-speed USB device number 84 using dummy_hcd [ 535.831863][ T933] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 535.948547][ T5900] usb 1-1: config 8 has an invalid interface number: 177 but max is 0 [ 535.965294][ T5900] usb 1-1: config 8 has no interface number 0 [ 535.984162][ T5900] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 536.035909][ T5900] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 536.053278][ T933] usb 2-1: USB disconnect, device number 89 [ 536.111820][ T5900] usb 1-1: config 8 interface 177 has no altsetting 0 [ 536.167106][ T5900] usb 1-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 536.199725][ T5900] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 536.229758][T11732] raw-gadget.4 gadget.0: fail, usb_ep_enable returned -22 [ 536.804697][ T5907] usb 2-1: new full-speed USB device number 90 using dummy_hcd [ 536.966913][ T5907] usb 2-1: descriptor type invalid, skip [ 536.973337][ T5907] usb 2-1: descriptor type invalid, skip [ 536.984596][ T5907] usb 2-1: not running at top speed; connect to a high speed hub [ 536.996057][ T5907] usb 2-1: config 1 has an invalid descriptor of length 121, skipping remainder of the config [ 537.009151][ T5907] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 537.027412][ T5907] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 537.043145][ T5907] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.063036][ T5907] usb 2-1: Product: ᐄ [ 537.072731][ T5907] usb 2-1: Manufacturer: ࠌ [ 537.082844][ T5907] usb 2-1: SerialNumber: syz [ 537.110418][ T5907] usb 2-1: rejected 1 configuration due to insufficient available bus power [ 537.132942][ T5907] usb 2-1: no configuration chosen from 1 choice [ 537.154600][ T5893] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 537.372761][ T5893] usb 4-1: no configurations [ 537.377575][ T5893] usb 4-1: can't read configurations, error -22 [ 537.514601][ T5893] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 537.695085][ T5893] usb 4-1: no configurations [ 537.703281][ T5893] usb 4-1: can't read configurations, error -22 [ 537.717672][ T5893] usb usb4-port1: attempt power cycle [ 537.773224][T10868] usb 3-1: string descriptor 0 read error: -71 [ 537.787711][T10868] ir_toy 3-1:8.177: required endpoints not found [ 537.806601][T10868] usb 3-1: USB disconnect, device number 78 [ 538.064696][ T5893] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 538.086283][ T5893] usb 4-1: no configurations [ 538.091068][ T5893] usb 4-1: can't read configurations, error -22 [ 538.234609][ T5893] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 538.267868][ T5893] usb 4-1: no configurations [ 538.272561][ T5893] usb 4-1: can't read configurations, error -22 [ 538.279278][ T5893] usb usb4-port1: unable to enumerate USB device [ 538.823261][ T5900] usb 1-1: string descriptor 0 read error: -71 [ 538.833641][ T5900] ir_toy 1-1:8.177: required endpoints not found [ 538.848317][ T5900] usb 1-1: USB disconnect, device number 84 [ 539.468925][ T5900] usb 2-1: USB disconnect, device number 90 [ 539.944652][ T5893] usb 4-1: new low-speed USB device number 80 using dummy_hcd [ 540.121477][ T5893] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 540.165271][ T5893] usb 4-1: config 0 has no interface number 0 [ 540.210286][ T5893] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 540.247851][ T5893] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 540.280725][ T5893] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 540.308152][ T5893] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 540.323549][ T5893] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 540.357062][ T5893] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 540.429428][ T5893] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 540.440144][ T5893] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 540.457900][ T5893] usb 4-1: config 0 descriptor?? [ 540.486769][T11767] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 540.529981][T11767] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 540.570687][T11775] batadv_slave_1: entered promiscuous mode [ 540.588831][ T5893] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 540.614322][T11773] batadv_slave_1: left promiscuous mode [ 540.935717][T11765] ldusb 4-1:0.55: Write buffer overflow, 1685414111 bytes dropped [ 541.097907][ T5900] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 541.297109][ T5900] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 541.341114][ T5900] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 541.359453][T11788] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1719'. [ 541.374858][ T5900] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.393599][ T5900] usb 2-1: Product: syz [ 541.407781][ T5900] usb 2-1: Manufacturer: syz [ 541.415284][ T5900] usb 2-1: SerialNumber: syz [ 541.474839][ T5900] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 541.874902][T10868] usb 3-1: new full-speed USB device number 79 using dummy_hcd [ 541.911950][ T5900] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 542.052148][ T5900] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 542.057232][T11796] netlink: 'syz.4.1723': attribute type 10 has an invalid length. [ 542.075385][ T5900] usb 2-1: media controller created [ 542.109628][T11796] bond0: (slave wlan1): Opening slave failed [ 542.411534][ T5900] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 542.751347][T11803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 542.820171][T11803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 542.859273][T10868] usb 3-1: config 8 has an invalid interface number: 177 but max is 0 [ 542.892859][T10868] usb 3-1: config 8 has no interface number 0 [ 542.932458][T10868] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 542.982369][T10868] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 543.045860][T10868] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 543.082458][T10868] usb 3-1: config 8 interface 177 has no altsetting 0 [ 543.106450][T10868] usb 3-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 543.136185][T10868] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.316206][ T5900] usb 2-1: USB disconnect, device number 91 [ 543.425856][T11794] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 544.065099][ T5900] usb 4-1: USB disconnect, device number 80 [ 544.076017][ T5900] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 544.276883][T11819] batadv_slave_1: entered promiscuous mode [ 544.326262][T11817] batadv_slave_1: left promiscuous mode [ 544.797753][T11831] netlink: 'syz.1.1733': attribute type 1 has an invalid length. [ 544.855143][T11831] 8021q: adding VLAN 0 to HW filter on device bond1 [ 544.878152][T11833] team0: entered promiscuous mode [ 544.893791][T11833] team_slave_0: entered promiscuous mode [ 544.901076][T11833] team_slave_1: entered promiscuous mode [ 544.910498][T11833] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 544.935310][T11833] 8021q: adding VLAN 0 to HW filter on device team0 [ 544.948642][T11833] bond1: (slave team0): making interface the new active one [ 544.959497][T11833] bond1: (slave team0): Enslaving as an active interface with an up link [ 544.983753][T11831] macvlan0: entered promiscuous mode [ 544.990066][T11831] macvlan0: entered allmulticast mode [ 544.998718][T11831] bond1: entered promiscuous mode [ 545.006332][T11831] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 545.015182][ T5917] usb 4-1: new full-speed USB device number 81 using dummy_hcd [ 545.043565][T11831] bond1: (slave macvlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 545.079384][T11831] bond1: left promiscuous mode [ 545.223968][ T5917] usb 4-1: config 8 has an invalid interface number: 177 but max is 0 [ 545.232965][ T5917] usb 4-1: config 8 has no interface number 0 [ 545.253763][ T5917] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 545.270338][ T5917] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 545.282347][ T5917] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 545.293085][ T5917] usb 4-1: config 8 interface 177 has no altsetting 0 [ 545.330231][ T5917] usb 4-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 545.373717][ T5917] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 545.411807][T11829] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 545.554885][T11839] netlink: 'syz.0.1736': attribute type 10 has an invalid length. [ 545.654646][ T5893] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 545.807297][ T5893] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 545.825951][ T5893] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 545.835895][ T5893] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 545.844257][ T5893] usb 2-1: Product: syz [ 545.849298][ T5893] usb 2-1: Manufacturer: syz [ 545.854101][ T5893] usb 2-1: SerialNumber: syz [ 545.872108][ T5893] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 546.022207][T10868] usb 3-1: string descriptor 0 read error: -71 [ 546.030628][T10868] ir_toy 3-1:8.177: required endpoints not found [ 546.055049][T10868] usb 3-1: USB disconnect, device number 79 [ 546.244651][ T5900] usb 1-1: new low-speed USB device number 85 using dummy_hcd [ 546.290217][ T5893] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 546.321446][ T5893] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 546.333796][ T5893] usb 2-1: media controller created [ 546.389492][ T5893] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 546.426418][ T5900] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 546.448829][ T5900] usb 1-1: config 0 has no interface number 0 [ 546.489937][ T5900] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 546.528072][ T5900] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 546.551208][ T5900] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 546.603639][ T5900] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 546.629320][T11860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 546.672925][T11860] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 546.693407][ T5900] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 546.739120][ T5900] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 546.788952][ T5900] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 546.800497][ T933] usb 3-1: new full-speed USB device number 80 using dummy_hcd [ 546.820458][ T5900] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 546.845762][ T5900] usb 1-1: config 0 descriptor?? [ 546.875773][T11848] raw-gadget.5 gadget.0: fail, usb_ep_enable returned -22 [ 546.887583][T11848] raw-gadget.5 gadget.0: fail, usb_ep_enable returned -22 [ 546.956158][ T5900] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 546.987539][ T933] usb 3-1: descriptor type invalid, skip [ 547.002773][ T933] usb 3-1: descriptor type invalid, skip [ 547.034306][ T933] usb 3-1: not running at top speed; connect to a high speed hub [ 547.067406][ T933] usb 3-1: config 1 has an invalid descriptor of length 121, skipping remainder of the config [ 547.091466][ T5893] usb 2-1: USB disconnect, device number 92 [ 547.109433][ T933] usb 3-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 547.161208][T11862] batadv_slave_1: entered promiscuous mode [ 547.186843][ T933] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 547.223727][ T933] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.256712][ T933] usb 3-1: Product: ᐄ [ 547.280825][ T933] usb 3-1: Manufacturer: ࠌ [ 547.292472][T11861] batadv_slave_1: left promiscuous mode [ 547.311328][ T933] usb 3-1: SerialNumber: syz [ 547.355932][T11847] ldusb 1-1:0.55: Write buffer overflow, 1685414111 bytes dropped [ 547.363868][ T933] usb 3-1: rejected 1 configuration due to insufficient available bus power [ 547.438638][ T933] usb 3-1: no configuration chosen from 1 choice [ 548.044653][ T5893] usb 2-1: new full-speed USB device number 93 using dummy_hcd [ 548.066641][ C0] raw-gadget.4 gadget.1: ignoring, device is not running [ 548.214753][ T5893] usb 2-1: device descriptor read/64, error -32 [ 548.464852][ T5893] usb 2-1: new full-speed USB device number 94 using dummy_hcd [ 548.647848][ T5893] usb 2-1: config 8 has an invalid interface number: 177 but max is 0 [ 548.656902][ T5893] usb 2-1: config 8 has no interface number 0 [ 548.663241][ T5893] usb 2-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 548.677670][ T5893] usb 2-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 548.689213][ T5893] usb 2-1: config 8 interface 177 has no altsetting 0 [ 548.696709][ T5893] usb 2-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 548.707116][ T5893] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 548.733484][T11866] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 548.817735][ T5917] usb 4-1: string descriptor 0 read error: -71 [ 548.826995][ T5917] ir_toy 4-1:8.177: required endpoints not found [ 548.851463][ T5917] usb 4-1: USB disconnect, device number 81 [ 549.032919][T10868] usb 1-1: USB disconnect, device number 85 [ 549.045005][T10868] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 549.151835][T11870] openvswitch: netlink: Missing valid actions attribute. [ 549.165096][T11870] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 549.442565][ T933] usb 3-1: USB disconnect, device number 80 [ 549.466151][T11876] netlink: 'syz.0.1747': attribute type 10 has an invalid length. [ 549.622967][T11878] batadv_slave_1: entered promiscuous mode [ 549.702914][T11877] batadv_slave_1: left promiscuous mode [ 549.861139][T11882] loop2: detected capacity change from 0 to 7 [ 549.877819][ T6083] loop2: [ 549.881269][ T6083] loop2: partition table partially beyond EOD, truncated [ 549.896454][T11882] loop2: [ 549.901552][T11882] loop2: partition table partially beyond EOD, truncated [ 549.927453][T11887] batadv_slave_1: entered promiscuous mode [ 550.084882][ T5917] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 550.125015][T11886] batadv_slave_1: left promiscuous mode [ 550.246604][ T5917] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 550.283222][ T5917] usb 1-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 550.294047][ T5917] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 550.302348][ T5917] usb 1-1: Product: syz [ 550.306907][ T5917] usb 1-1: Manufacturer: syz [ 550.311810][ T5917] usb 1-1: SerialNumber: syz [ 550.335656][ T5917] usb 1-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 550.759441][ T5917] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 550.774972][T11902] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 550.807316][T11902] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 550.830976][ T5917] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 550.847378][ T5900] usb 3-1: new full-speed USB device number 81 using dummy_hcd [ 550.882856][ T5917] usb 1-1: media controller created [ 550.941441][ T5917] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 551.047861][ T5900] usb 3-1: config 8 has an invalid interface number: 177 but max is 0 [ 551.074716][ T5900] usb 3-1: config 8 has no interface number 0 [ 551.092382][ T5900] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 551.121870][ T5900] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 551.176957][ T5900] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 551.228912][ T5900] usb 3-1: config 8 interface 177 has no altsetting 0 [ 551.255813][ T5900] usb 3-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 551.312129][ T5900] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 551.371571][ T5917] usb 1-1: USB disconnect, device number 86 [ 551.596491][T11898] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 551.758664][ T5893] usb 2-1: string descriptor 0 read error: -71 [ 551.769462][ T5893] ir_toy 2-1:8.177: required endpoints not found [ 551.793747][ T5893] usb 2-1: USB disconnect, device number 94 [ 551.944753][ T5917] usb 1-1: new full-speed USB device number 87 using dummy_hcd [ 552.104581][ T5961] usb 4-1: new full-speed USB device number 82 using dummy_hcd [ 552.115327][ T5917] usb 1-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 552.145228][ T5917] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.192892][ T5917] usb 1-1: config 0 descriptor?? [ 552.453895][ T5961] usb 4-1: config 8 has an invalid interface number: 177 but max is 0 [ 552.466990][ T5961] usb 4-1: config 8 has no interface number 0 [ 552.473616][ T5961] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 552.492337][ T5961] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 552.527436][ T5961] usb 4-1: config 8 interface 177 has no altsetting 0 [ 552.553685][ T5961] usb 4-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 552.588335][ T5961] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.623593][T11909] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 552.855928][ T5917] pegasus 1-1:0.0: probe with driver pegasus failed with error -121 [ 553.129478][T11918] netlink: 'syz.1.1761': attribute type 10 has an invalid length. [ 553.139687][T11918] bond0: (slave wlan1): Opening slave failed [ 553.290372][ T933] usb 1-1: USB disconnect, device number 87 [ 553.758762][ T5900] usb 3-1: string descriptor 0 read error: -71 [ 553.774814][ T933] usb 2-1: new full-speed USB device number 95 using dummy_hcd [ 553.786984][ T5900] ir_toy 3-1:8.177: required endpoints not found [ 553.841532][ T5900] usb 3-1: USB disconnect, device number 81 [ 553.902070][T11932] batadv_slave_1: entered promiscuous mode [ 553.957040][ T933] usb 2-1: descriptor type invalid, skip [ 553.976352][T11934] batadv_slave_1: entered promiscuous mode [ 553.989863][ T933] usb 2-1: descriptor type invalid, skip [ 554.015894][ T933] usb 2-1: not running at top speed; connect to a high speed hub [ 554.051197][ T933] usb 2-1: config 1 has an invalid descriptor of length 121, skipping remainder of the config [ 554.076435][T11929] batadv_slave_1: left promiscuous mode [ 554.087786][ T933] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 554.099042][T11933] batadv_slave_1: left promiscuous mode [ 554.113506][ T933] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 554.129449][ T933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.157716][ T933] usb 2-1: Product: ᐄ [ 554.177990][ T933] usb 2-1: Manufacturer: ࠌ [ 554.196282][ T933] usb 2-1: SerialNumber: syz [ 554.226741][ T933] usb 2-1: rejected 1 configuration due to insufficient available bus power [ 554.258289][ T933] usb 2-1: no configuration chosen from 1 choice [ 554.466546][T11943] FAULT_INJECTION: forcing a failure. [ 554.466546][T11943] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 554.506866][T11943] CPU: 0 UID: 0 PID: 11943 Comm: syz.4.1770 Tainted: G L syzkaller #0 PREEMPT(full) [ 554.506891][T11943] Tainted: [L]=SOFTLOCKUP [ 554.506896][T11943] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 554.506905][T11943] Call Trace: [ 554.506911][T11943] [ 554.506918][T11943] dump_stack_lvl+0xe8/0x150 [ 554.506941][T11943] should_fail_ex+0x414/0x560 [ 554.506971][T11943] _copy_to_user+0x31/0xb0 [ 554.506991][T11943] simple_read_from_buffer+0xe1/0x170 [ 554.507012][T11943] proc_fail_nth_read+0x1b3/0x220 [ 554.507029][T11943] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 554.507048][T11943] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 554.507064][T11943] vfs_read+0x200/0xa30 [ 554.507077][T11943] ? fdget_pos+0x247/0x320 [ 554.507097][T11943] ? __pfx___mutex_lock+0x10/0x10 [ 554.507116][T11943] ? __pfx_vfs_read+0x10/0x10 [ 554.507130][T11943] ? __fget_files+0x2a/0x420 [ 554.507150][T11943] ? __fget_files+0x3a0/0x420 [ 554.507166][T11943] ? __fget_files+0x2a/0x420 [ 554.507189][T11943] ksys_read+0x145/0x250 [ 554.507204][T11943] ? __pfx_ksys_read+0x10/0x10 [ 554.507225][T11943] __do_fast_syscall_32+0x1dc/0x570 [ 554.507242][T11943] ? lockdep_hardirqs_on+0x7b/0x110 [ 554.507255][T11943] ? do_fast_syscall_32+0x34/0x80 [ 554.507271][T11943] ? irqentry_exit+0x10f/0x670 [ 554.507288][T11943] do_fast_syscall_32+0x34/0x80 [ 554.507304][T11943] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 554.507322][T11943] RIP: 0023:0xf704d539 [ 554.507334][T11943] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 554.507347][T11943] RSP: 002b:00000000f543d590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 554.507367][T11943] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f543d620 [ 554.507377][T11943] RDX: 000000000000000f RSI: 00000000f73e6ff4 RDI: 0000000000000000 [ 554.507386][T11943] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 554.507394][T11943] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 554.507403][T11943] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 554.507448][T11943] [ 554.745603][T11945] tipc: Enabling of bearer rejected, failed to enable media [ 554.781711][ T5893] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 554.954015][ T5893] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 554.967011][ T5893] usb 1-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 554.976398][ T5893] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.984528][ T5893] usb 1-1: Product: syz [ 554.988832][ T5893] usb 1-1: Manufacturer: syz [ 554.993499][ T5893] usb 1-1: SerialNumber: syz [ 555.050366][ T5893] usb 1-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 555.126613][ T5961] usb 4-1: string descriptor 0 read error: -71 [ 555.135106][ T5961] ir_toy 4-1:8.177: required endpoints not found [ 555.169980][ T5961] usb 4-1: USB disconnect, device number 82 [ 555.194957][T11952] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 555.218294][T11952] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 555.449332][ T5893] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 555.470470][ T5893] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 555.483019][ T5893] usb 1-1: media controller created [ 555.506492][ T5893] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 555.655517][ T5893] usb 1-1: USB disconnect, device number 88 [ 556.404393][ T5893] usb 2-1: USB disconnect, device number 95 [ 556.595312][ T933] usb 1-1: new full-speed USB device number 89 using dummy_hcd [ 557.074023][ T933] usb 1-1: config 8 has an invalid interface number: 177 but max is 0 [ 557.086251][ T933] usb 1-1: config 8 has no interface number 0 [ 557.092740][ T933] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 557.105233][ T933] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 557.123359][ T933] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 557.144888][ T933] usb 1-1: config 8 interface 177 has no altsetting 0 [ 557.174618][ T933] usb 1-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 557.183898][ T933] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 557.284404][T11969] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 557.804672][ T5893] usb 4-1: new full-speed USB device number 83 using dummy_hcd [ 557.825006][T11988] fuse: Bad value for 'fd' [ 558.062316][ T5893] usb 4-1: config 8 has an invalid interface number: 177 but max is 0 [ 558.106179][ T5893] usb 4-1: config 8 has no interface number 0 [ 558.136853][ T5893] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 558.191894][T11993] loop2: detected capacity change from 0 to 7 [ 558.202954][ T5893] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 558.231334][T11993] loop2: [ 558.242379][T11993] loop2: partition table partially beyond EOD, truncated [ 558.265140][ T5893] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 558.325881][ T5893] usb 4-1: config 8 interface 177 has no altsetting 0 [ 558.360001][ T5893] usb 4-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 558.408638][ T5893] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 558.464307][T11985] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 558.582943][T11997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.627420][T11997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.864805][ T5907] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 559.031777][ T5907] usb 3-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 559.068127][ T5907] usb 3-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 559.079099][ T5907] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.093411][ T5907] usb 3-1: Product: syz [ 559.099726][ T5907] usb 3-1: Manufacturer: syz [ 559.104918][ T5907] usb 3-1: SerialNumber: syz [ 559.129018][ T5907] usb 3-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 559.431157][ T933] usb 1-1: string descriptor 0 read error: -71 [ 559.440005][ T933] ir_toy 1-1:8.177: required endpoints not found [ 559.501468][ T933] usb 1-1: USB disconnect, device number 89 [ 559.559484][ T5907] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 559.600383][ T5907] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 559.636582][ T5907] usb 3-1: media controller created [ 559.703363][ T5907] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 559.997748][ T5907] usb 3-1: USB disconnect, device number 82 [ 560.324603][ T5961] usb 2-1: new full-speed USB device number 96 using dummy_hcd [ 560.490241][ T5961] usb 2-1: descriptor type invalid, skip [ 560.502205][ T5961] usb 2-1: descriptor type invalid, skip [ 560.518391][ T5961] usb 2-1: not running at top speed; connect to a high speed hub [ 560.548957][ T5961] usb 2-1: config 1 has an invalid descriptor of length 121, skipping remainder of the config [ 560.579493][ T5961] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 560.611344][ T5961] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 560.631149][ T5961] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.664636][ T5961] usb 2-1: Product: ᐄ [ 560.701585][ T5961] usb 2-1: Manufacturer: ࠌ [ 560.756808][ T5893] usb 4-1: string descriptor 0 read error: -71 [ 560.765107][ T5961] usb 2-1: SerialNumber: syz [ 560.815206][ T5893] ir_toy 4-1:8.177: required endpoints not found [ 560.833641][ T5961] usb 2-1: rejected 1 configuration due to insufficient available bus power [ 560.865022][ T5917] usb 3-1: new full-speed USB device number 83 using dummy_hcd [ 560.897679][ T5893] usb 4-1: USB disconnect, device number 83 [ 560.903624][ T5961] usb 2-1: no configuration chosen from 1 choice [ 561.066154][ T5917] usb 3-1: config 8 has an invalid interface number: 177 but max is 0 [ 561.094569][ T5917] usb 3-1: config 8 has no interface number 0 [ 561.141782][ T5917] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 561.195972][ T5917] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 561.233975][ T5917] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 561.263171][ T5917] usb 3-1: config 8 interface 177 has no altsetting 0 [ 561.281866][ T5917] usb 3-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 561.321463][ T5917] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.351627][T12031] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 561.514631][ T5907] usb 4-1: new full-speed USB device number 84 using dummy_hcd [ 561.729267][ T5907] usb 4-1: config 8 has an invalid interface number: 177 but max is 0 [ 561.750525][ T5907] usb 4-1: config 8 has no interface number 0 [ 561.765723][ T5907] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 561.793318][ T5907] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 561.806146][ T933] usb 1-1: new low-speed USB device number 90 using dummy_hcd [ 561.830352][ T5907] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 561.855639][ T5907] usb 4-1: config 8 interface 177 has no altsetting 0 [ 561.873102][ T5907] usb 4-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 561.895402][ T5907] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.934945][T12040] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 562.022144][ T933] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 562.046094][ T933] usb 1-1: config 0 has no interface number 0 [ 562.094528][ T933] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 562.159689][ T933] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 562.230599][ T933] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 562.242816][ T933] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 562.315599][ T933] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 562.347837][ T933] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 562.400274][ T933] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 562.415479][ T933] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.520075][ T933] usb 1-1: config 0 descriptor?? [ 562.556016][T12044] raw-gadget.5 gadget.0: fail, usb_ep_enable returned -22 [ 562.585069][T12044] raw-gadget.5 gadget.0: fail, usb_ep_enable returned -22 [ 562.626373][ T933] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 562.930520][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.940233][T12043] ldusb 1-1:0.55: Write buffer overflow, 1685414111 bytes dropped [ 562.944793][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.053813][ T5893] usb 2-1: USB disconnect, device number 96 [ 563.511932][ T5917] usb 3-1: string descriptor 0 read error: -71 [ 563.532172][ T5917] ir_toy 3-1:8.177: required endpoints not found [ 563.575906][ T5917] usb 3-1: USB disconnect, device number 83 [ 564.071037][T12059] batadv_slave_1: entered promiscuous mode [ 564.104659][ T5917] usb 3-1: new full-speed USB device number 84 using dummy_hcd [ 564.132640][T12058] batadv_slave_1: left promiscuous mode [ 564.164561][ T933] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 564.181635][ T5907] usb 4-1: string descriptor 0 read error: -71 [ 564.222935][ T5907] ir_toy 4-1:8.177: required endpoints not found [ 564.276591][ T5917] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 564.280477][ T5907] usb 4-1: USB disconnect, device number 84 [ 564.332496][ T5917] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 564.367538][ T933] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 564.375026][ T5917] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 564.425629][ T5914] usb 1-1: USB disconnect, device number 90 [ 564.440313][ T933] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 564.447383][ T5917] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 564.469941][ T5914] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 564.494942][ T933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.504572][ T5917] usb 3-1: SerialNumber: syz [ 564.509452][T12065] FAULT_INJECTION: forcing a failure. [ 564.509452][T12065] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 564.534730][ T933] usb 2-1: Product: syz [ 564.538949][ T933] usb 2-1: Manufacturer: syz [ 564.550081][ T5917] usb 3-1: 0:2 : does not exist [ 564.561063][T12065] CPU: 1 UID: 0 PID: 12065 Comm: syz.4.1811 Tainted: G L syzkaller #0 PREEMPT(full) [ 564.561097][T12065] Tainted: [L]=SOFTLOCKUP [ 564.561105][T12065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 564.561119][T12065] Call Trace: [ 564.561129][T12065] [ 564.561139][T12065] dump_stack_lvl+0xe8/0x150 [ 564.561173][T12065] should_fail_ex+0x414/0x560 [ 564.561213][T12065] _copy_from_user+0x2d/0xb0 [ 564.561241][T12065] kstrtouint_from_user+0xc4/0x170 [ 564.561266][T12065] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 564.561318][T12065] proc_fail_nth_write+0x88/0x200 [ 564.561341][T12065] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 564.561369][T12065] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 564.561392][T12065] vfs_write+0x27e/0xb30 [ 564.561419][T12065] ? __pfx_vfs_write+0x10/0x10 [ 564.561442][T12065] ? __fget_files+0x2a/0x420 [ 564.561471][T12065] ? __fget_files+0x3a0/0x420 [ 564.561495][T12065] ? __fget_files+0x2a/0x420 [ 564.561528][T12065] ksys_write+0x145/0x250 [ 564.561550][T12065] ? __pfx_ksys_write+0x10/0x10 [ 564.561592][T12065] __do_fast_syscall_32+0x1dc/0x570 [ 564.561617][T12065] ? lockdep_hardirqs_on+0x7b/0x110 [ 564.561655][T12065] ? do_fast_syscall_32+0x34/0x80 [ 564.561680][T12065] ? irqentry_exit+0x10f/0x670 [ 564.561708][T12065] do_fast_syscall_32+0x34/0x80 [ 564.561735][T12065] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 564.561766][T12065] RIP: 0023:0xf704d539 [ 564.561786][T12065] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 564.561806][T12065] RSP: 002b:00000000f543d590 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 564.561829][T12065] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f543d620 [ 564.561846][T12065] RDX: 0000000000000001 RSI: 00000000f73e6ff4 RDI: 0000000000000000 [ 564.561860][T12065] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 564.561873][T12065] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 564.561887][T12065] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 564.561920][T12065] [ 564.562380][ T933] usb 2-1: SerialNumber: syz [ 564.962350][T12055] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1806'. [ 564.979214][ T5917] usb 3-1: USB disconnect, device number 84 [ 564.997755][ T933] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 565.194559][ T5914] usb 1-1: new full-speed USB device number 91 using dummy_hcd [ 565.240247][T12079] loop2: detected capacity change from 0 to 7 [ 565.257960][ T6083] loop2: [ 565.261236][ T6083] loop2: partition table partially beyond EOD, truncated [ 565.281985][T12079] loop2: [ 565.288577][T12079] loop2: partition table partially beyond EOD, truncated [ 565.387698][ T933] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 565.429007][ T933] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 565.447634][ T933] usb 2-1: media controller created [ 565.466283][ T5914] usb 1-1: config 8 has an invalid interface number: 177 but max is 0 [ 565.488126][ T933] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 565.496538][ T5914] usb 1-1: config 8 has no interface number 0 [ 565.514569][ T5914] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 565.550222][ T5914] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 565.582460][ T5914] usb 1-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 565.603729][ T5914] usb 1-1: config 8 interface 177 has no altsetting 0 [ 565.641444][ T5914] usb 1-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 565.653569][ T5914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 565.693913][T12086] netlink: 'syz.4.1819': attribute type 10 has an invalid length. [ 565.719922][T12086] bond0: (slave wlan1): Opening slave failed [ 565.746585][T12072] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 565.798277][ T933] usb 2-1: USB disconnect, device number 97 [ 565.962094][T12093] batadv_slave_1: entered promiscuous mode [ 566.033468][T12091] batadv_slave_1: left promiscuous mode [ 566.062824][T12094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 566.124843][ T7441] usb 4-1: new full-speed USB device number 85 using dummy_hcd [ 566.172598][T12094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 566.296734][ T7441] usb 4-1: config 8 has an invalid interface number: 177 but max is 0 [ 566.305593][ T7441] usb 4-1: config 8 has no interface number 0 [ 566.381593][ T7441] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 566.438237][ T7441] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 566.459061][ T7441] usb 4-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 566.485640][ T7441] usb 4-1: config 8 interface 177 has no altsetting 0 [ 566.532430][ T7441] usb 4-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 566.577848][ T7441] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.643878][T12088] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 567.297325][ T5917] usb 3-1: new low-speed USB device number 85 using dummy_hcd [ 567.494218][ T5917] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 567.529568][ T5917] usb 3-1: config 0 has no interface number 0 [ 567.544541][ T933] usb 2-1: new full-speed USB device number 98 using dummy_hcd [ 567.563634][ T5917] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 567.608549][ T5917] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 567.651576][ T5917] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 567.695609][ T5917] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 567.749193][ T5917] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 567.802975][ T5917] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 567.835693][ T5917] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 567.864514][ T5917] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 567.878772][ T933] usb 2-1: config 8 has an invalid interface number: 177 but max is 0 [ 567.911013][ T5917] usb 3-1: config 0 descriptor?? [ 567.940371][T12106] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 567.948708][ T933] usb 2-1: config 8 has no interface number 0 [ 567.982480][ T933] usb 2-1: config 8 interface 177 altsetting 9 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 568.021499][ T5914] usb 1-1: string descriptor 0 read error: -71 [ 568.064375][ T5914] ir_toy 1-1:8.177: required endpoints not found [ 568.070898][ T933] usb 2-1: config 8 interface 177 altsetting 9 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 568.090682][T12106] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 568.139298][ T933] usb 2-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 568.187779][ T5914] usb 1-1: USB disconnect, device number 91 [ 568.193876][ T933] usb 2-1: config 8 interface 177 has no altsetting 0 [ 568.234845][ T5917] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 568.258917][ T933] usb 2-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 568.305887][ T933] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 568.370770][T12112] raw-gadget.5 gadget.1: fail, usb_ep_enable returned -22 [ 568.584740][T12106] ldusb 3-1:0.55: Write buffer overflow, 138595949 bytes dropped [ 570.217964][ T7441] usb 4-1: string descriptor 0 read error: -71 [ 570.241593][ T7441] ir_toy 4-1:8.177: required endpoints not found [ 570.270345][ T7441] usb 4-1: USB disconnect, device number 85 [ 570.319486][T12134] batadv_slave_1: entered promiscuous mode [ 570.369372][T12133] batadv_slave_1: left promiscuous mode [ 570.454633][ T5961] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 570.637243][ T5961] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 570.686084][ T5961] usb 1-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 570.720579][ T5961] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.721979][ T5900] usb 3-1: USB disconnect, device number 85 [ 570.747467][ T5900] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 570.754664][ T5961] usb 1-1: Product: syz [ 570.758865][ T5961] usb 1-1: Manufacturer: syz [ 570.763501][ T5961] usb 1-1: SerialNumber: syz [ 570.790314][ T5961] usb 1-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 570.938406][ T933] usb 2-1: string descriptor 0 read error: -71 [ 570.951005][ T933] ir_toy 2-1:8.177: required endpoints not found [ 570.965588][ T933] usb 2-1: USB disconnect, device number 98 [ 570.984554][ T7441] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 571.037563][T12154] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 571.067427][T12154] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 571.145566][ T7441] usb 4-1: Using ep0 maxpacket: 32 [ 571.187416][ T7441] usb 4-1: unable to get BOS descriptor or descriptor too short [ 571.212528][ T5961] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 571.230546][T12159] team0: left promiscuous mode [ 571.237223][ T5961] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 571.238618][ T7441] usb 4-1: config 4 has an invalid interface number: 136 but max is 0 [ 571.245661][T12159] team_slave_0: left promiscuous mode [ 571.254667][ T7441] usb 4-1: config 4 has no interface number 0 [ 571.264991][ T5961] usb 1-1: media controller created [ 571.273595][T12159] team_slave_1: left promiscuous mode [ 571.292731][ T7441] usb 4-1: config 4 interface 136 has no altsetting 0 [ 571.304194][T12159] netlink: 136 bytes leftover after parsing attributes in process `syz.2.1840'. [ 571.316553][ T7441] usb 4-1: string descriptor 0 read error: -22 [ 571.322881][ T7441] usb 4-1: New USB device found, idVendor=0b48, idProduct=300d, bcdDevice=16.c8 [ 571.332773][T12159] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 571.349061][ T5961] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 571.389610][T12158] netlink: 'syz.1.1841': attribute type 10 has an invalid length. [ 571.400105][ T7441] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.410268][T12158] bond0: (slave wlan1): Opening slave failed [ 571.446589][ T7441] dvb-usb: found a 'Technotrend TT-connect CT-3650' in warm state. [ 571.487477][ T7441] dvb-usb: bulk message failed: -22 (4/0) [ 571.494725][ T7441] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 571.530545][ T7441] dvb-usb: bulk message failed: -22 (5/0) [ 571.550624][ T7441] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 571.603307][ T7441] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 571.638673][T12143] ------------[ cut here ]------------ [ 571.645103][T12143] usb 1-1: BOGUS control dir, pipe 80005c80 doesn't match bRequestType c0 [ 571.653657][T12143] WARNING: drivers/usb/core/urb.c:414 at usb_submit_urb+0x105c/0x18d0, CPU#1: syz.3.1837/12143 [ 571.664174][T12143] Modules linked in: [ 571.668349][T12143] CPU: 1 UID: 0 PID: 12143 Comm: syz.3.1837 Tainted: G L syzkaller #0 PREEMPT(full) [ 571.679324][T12143] Tainted: [L]=SOFTLOCKUP [ 571.683645][T12143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 571.693739][T12143] RIP: 0010:usb_submit_urb+0x111c/0x18d0 [ 571.699405][T12143] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 b7 f2 ff ff 89 e9 [ 571.719382][T12143] RSP: 0018:ffffc900053cf6e0 EFLAGS: 00010246 [ 571.725772][T12143] RAX: 0000000000000000 RBX: ffff88801ab66300 RCX: 0000000080005c80 [ 571.733912][T12143] RDX: ffff888057f4f240 RSI: ffffffff8c140d20 RDI: ffffffff8f8ee740 [ 571.742030][T12143] RBP: 1ffff1102835e064 R08: 00000000000000c0 R09: 0000000000000000 [ 571.750164][T12143] R10: ffffc900053cf7e0 R11: fffff52000a79f08 R12: ffff888057d95100 [ 571.758194][T12143] R13: ffff888141af0320 R14: 0000000080005c80 R15: ffff888057f4f240 [ 571.766335][T12143] FS: 0000000000000000(0000) GS:ffff888125f1f000(0063) knlGS:00000000f548db40 [ 571.775306][T12143] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 571.782149][T12143] CR2: 000000000c2c7afc CR3: 0000000032b5c000 CR4: 00000000003526f0 [ 571.790177][T12143] Call Trace: [ 571.793466][T12143] [ 571.796439][T12143] ? __init_swait_queue_head+0xa9/0x150 [ 571.802031][T12143] usb_start_wait_urb+0x115/0x4f0 [ 571.807127][T12143] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 571.812705][T12143] usb_control_msg+0x232/0x3e0 [ 571.817506][T12143] gl861_ctrl_msg+0x207/0x420 [ 571.822221][T12143] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 571.827487][T12143] gl861_i2c_master_xfer+0x439/0x6a0 [ 571.832793][T12143] __i2c_transfer+0x79a/0x1f00 [ 571.837666][T12143] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 571.843479][T12143] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 571.849321][T12143] ? i2c_transfer+0xc8/0x2d0 [ 571.853948][T12143] i2c_transfer+0x1cc/0x2d0 [ 571.858477][T12143] i2cdev_ioctl_rdwr+0x460/0x740 [ 571.863440][T12143] compat_i2cdev_ioctl+0x5a8/0x5c0 [ 571.868610][T12143] ? __pfx_compat_i2cdev_ioctl+0x10/0x10 [ 571.874271][T12143] ? __fget_files+0x3a0/0x420 [ 571.878978][T12143] ? __fget_files+0x2a/0x420 [ 571.883573][T12143] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 571.889257][T12143] __ia32_compat_sys_ioctl+0x543/0x840 [ 571.894758][T12143] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 571.900764][T12143] ? __se_sys_futex_time32+0x360/0x3e0 [ 571.906276][T12143] ? __pfx_do_sys_openat2+0x10/0x10 [ 571.911484][T12143] ? rcu_is_watching+0x15/0xb0 [ 571.916276][T12143] __do_fast_syscall_32+0x1dc/0x570 [ 571.921498][T12143] ? lockdep_hardirqs_on+0x7b/0x110 [ 571.926712][T12143] ? do_fast_syscall_32+0x34/0x80 [ 571.931750][T12143] ? irqentry_exit+0x10f/0x670 [ 571.936595][T12143] do_fast_syscall_32+0x34/0x80 [ 571.941464][T12143] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 571.947840][T12143] RIP: 0023:0xf709d539 [ 571.951917][T12143] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 571.971585][T12143] RSP: 002b:00000000f548d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 571.980046][T12143] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000707 [ 571.988113][T12143] RDX: 0000000080000240 RSI: 0000000000000000 RDI: 0000000000000000 [ 571.996115][T12143] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 572.004105][T12143] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 572.012112][T12143] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 572.020140][T12143] [ 572.023162][T12143] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 572.030450][T12143] CPU: 1 UID: 0 PID: 12143 Comm: syz.3.1837 Tainted: G L syzkaller #0 PREEMPT(full) [ 572.041384][T12143] Tainted: [L]=SOFTLOCKUP [ 572.045715][T12143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 572.055790][T12143] Call Trace: [ 572.059068][T12143] [ 572.062088][T12143] vpanic+0x1e0/0x670 [ 572.066081][T12143] panic+0xb9/0xc0 [ 572.069810][T12143] ? __pfx_panic+0x10/0x10 [ 572.074236][T12143] __warn+0x317/0x4b0 [ 572.078236][T12143] ? usb_submit_urb+0x105c/0x18d0 [ 572.083265][T12143] ? usb_submit_urb+0x105c/0x18d0 [ 572.088374][T12143] __report_bug+0x288/0x500 [ 572.092893][T12143] ? usb_submit_urb+0x105c/0x18d0 [ 572.097918][T12143] ? __pfx___report_bug+0x10/0x10 [ 572.102944][T12143] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 572.108749][T12143] ? lockdep_hardirqs_on+0x7b/0x110 [ 572.113951][T12143] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 572.119754][T12143] ? stack_depot_save_flags+0x3f3/0x810 [ 572.125307][T12143] report_bug_entry+0x19a/0x290 [ 572.130259][T12143] ? usb_submit_urb+0x111c/0x18d0 [ 572.135296][T12143] ? usb_submit_urb+0x1121/0x18d0 [ 572.140334][T12143] handle_bug+0xca/0x200 [ 572.144620][T12143] exc_invalid_op+0x1a/0x50 [ 572.149163][T12143] asm_exc_invalid_op+0x1a/0x20 [ 572.154009][T12143] RIP: 0010:usb_submit_urb+0x111c/0x18d0 [ 572.159639][T12143] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 b7 f2 ff ff 89 e9 [ 572.179249][T12143] RSP: 0018:ffffc900053cf6e0 EFLAGS: 00010246 [ 572.185330][T12143] RAX: 0000000000000000 RBX: ffff88801ab66300 RCX: 0000000080005c80 [ 572.193311][T12143] RDX: ffff888057f4f240 RSI: ffffffff8c140d20 RDI: ffffffff8f8ee740 [ 572.201293][T12143] RBP: 1ffff1102835e064 R08: 00000000000000c0 R09: 0000000000000000 [ 572.209274][T12143] R10: ffffc900053cf7e0 R11: fffff52000a79f08 R12: ffff888057d95100 [ 572.217249][T12143] R13: ffff888141af0320 R14: 0000000080005c80 R15: ffff888057f4f240 [ 572.225264][T12143] ? __init_swait_queue_head+0xa9/0x150 [ 572.230819][T12143] usb_start_wait_urb+0x115/0x4f0 [ 572.235853][T12143] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 572.241413][T12143] usb_control_msg+0x232/0x3e0 [ 572.246197][T12143] gl861_ctrl_msg+0x207/0x420 [ 572.250897][T12143] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 572.256104][T12143] gl861_i2c_master_xfer+0x439/0x6a0 [ 572.261395][T12143] __i2c_transfer+0x79a/0x1f00 [ 572.266178][T12143] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 572.271982][T12143] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 572.277806][T12143] ? i2c_transfer+0xc8/0x2d0 [ 572.282414][T12143] i2c_transfer+0x1cc/0x2d0 [ 572.286935][T12143] i2cdev_ioctl_rdwr+0x460/0x740 [ 572.291888][T12143] compat_i2cdev_ioctl+0x5a8/0x5c0 [ 572.297007][T12143] ? __pfx_compat_i2cdev_ioctl+0x10/0x10 [ 572.302665][T12143] ? __fget_files+0x3a0/0x420 [ 572.307348][T12143] ? __fget_files+0x2a/0x420 [ 572.311949][T12143] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 572.317586][T12143] __ia32_compat_sys_ioctl+0x543/0x840 [ 572.323042][T12143] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 572.329032][T12143] ? __se_sys_futex_time32+0x360/0x3e0 [ 572.334494][T12143] ? __pfx_do_sys_openat2+0x10/0x10 [ 572.339734][T12143] ? rcu_is_watching+0x15/0xb0 [ 572.344544][T12143] __do_fast_syscall_32+0x1dc/0x570 [ 572.349767][T12143] ? lockdep_hardirqs_on+0x7b/0x110 [ 572.354970][T12143] ? do_fast_syscall_32+0x34/0x80 [ 572.360017][T12143] ? irqentry_exit+0x10f/0x670 [ 572.364790][T12143] do_fast_syscall_32+0x34/0x80 [ 572.369640][T12143] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 572.375965][T12143] RIP: 0023:0xf709d539 [ 572.380036][T12143] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 572.400078][T12143] RSP: 002b:00000000f548d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 572.408503][T12143] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000707 [ 572.416488][T12143] RDX: 0000000080000240 RSI: 0000000000000000 RDI: 0000000000000000 [ 572.424486][T12143] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 572.432478][T12143] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 572.440447][T12143] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 572.448429][T12143] [ 572.452072][T12143] Kernel Offset: disabled [ 572.456407][T12143] Rebooting in 86400 seconds..