last executing test programs: 36.177572972s ago: executing program 3 (id=4759): r0 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a0003010000000904000000010100000a24010000000201020c24020000000000000800000524050000082407000000009e0c240700000000a3e82f07070d2407010604000000"], 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, 0x0, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x500a}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000001840)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000100)={0x14, &(0x7f00000004c0)={0x20, 0xa, 0xd4, {0xd4, 0x1, "b257ba7dc640dfdaeac733959e4b2ef38d366c6ce5cea7dc114a90140bdcad78217116c9b9791edbc6583a0c7140b57ff5e206c93c6482ee68b8803dd62ab339a3d614e0bcf1642117edb176a1828a6d26e027745e942fd38d29b61256fc548aa5b176ef3ecbd74eb682110b7bb97cebf2e6e4f26d80f725c29e142cfa64d4d81da0178459cb60f680c8b7a45ba1364487e742c5b6d01ea854a3d4c4d77c8217e5b47a9a46506e8d7b000c44d08b0193b77df4f9848c5f3e4ecd76c715004dcbebbc18634b4716717e035bcc3781c3723a69"}}, &(0x7f0000000040)={0x0, 0x3, 0x4, @string={0x4, 0x3, "cf22"}}}, &(0x7f0000000640)={0x44, &(0x7f0000000180)={0x40, 0x11, 0x1b, "3c6081ad90c63fc048060f560f5eeea868ab3b8fc26cd3cf62348c"}, &(0x7f00000001c0)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000200)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000002c0)={0x20, 0x81, 0x3, "c846b5"}, &(0x7f0000000300)={0x20, 0x82, 0x2, "b3aa"}, &(0x7f0000000340)={0x20, 0x83, 0x3, 'ZZW'}, &(0x7f0000000400)={0x20, 0x84, 0x2, "b950"}, &(0x7f0000000440)={0x20, 0x85, 0x3, '\aH{'}}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000005c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x81, 0x1, "9a"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, &(0x7f0000000000)={0x14, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) 32.709286498s ago: executing program 3 (id=4771): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110c230000) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110c230000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x40042) ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000000)) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r5) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = open(&(0x7f00000001c0)='./file0\x00', 0x80ff, 0x88) fcntl$setlease(r6, 0x400, 0x2) 31.414716584s ago: executing program 3 (id=4780): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0xb173, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000040)={0x3b, 0x1, 0x2, "4749570000000000000000000e1609d600", 0x20493859}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x48) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB="840100001000010025bd7000fcdbdf257f00000100000000002a0e00000000000014142a0000000000000000004e2100004e2000010a00002087000000000000", @ANYRES32=0x0, @ANYBLOB="20010000000000000000000000000002000004d233000000fe8000000000000000000000000000bb01000080000000000c082c500000000000000000000000000b00000000000000070000000000000005000000000000000600000000000000070000000000000001000100000000000300000000000000130d00000000000006000000000000000600000006000000d6a500002abd7000073500000a"], 0x184}, 0x1, 0x0, 0x0, 0x40000}, 0x4840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x0, 0xffffffff}, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f00006ef000/0x4000)=nil, 0x4000, 0x9, 0x10, 0xffffffffffffffff, 0x8000000) r5 = syz_open_dev$vim2m(&(0x7f0000000200), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000003c0)={0x2, 0x1, 0x1}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r10, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r10, 0x84, 0x9, &(0x7f0000000200)={r11, @in={{0x2, 0x4e23, @empty}}, 0x7, 0x400, 0x2, 0x41, 0x6, 0xffff, 0x10}, &(0x7f0000000080)=0x9c) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r9}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x24048180) sendmsg$TIPC_CMD_GET_NODES(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r7, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x880) ioctl$vim2m_VIDIOC_DQBUF(r5, 0xc0585611, &(0x7f0000000040)=@overlay={0x0, 0x1, 0x4, 0x0, 0xd, {}, {0x4, 0x0, 0x0, 0x1, 0x0, 0x0, "12848098"}, 0x3}) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0xffffffff, 0x1, 0x4, 0x0, 0x0, {}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, "a730b801"}, 0x0, 0x1, {0x0}}) openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) 29.847511507s ago: executing program 3 (id=4786): r0 = socket(0x2, 0x3, 0xff) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f0000000000)=0x2, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)={0x48, 0x3, 0x1, 0x3, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TUPLE_ORIG={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0xaf}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}]}, 0x48}}, 0x10) (async) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000500)={0x2c, r2, 0x1, 0x1, 0x25dfdbfd, {}, [@ETHTOOL_A_PRIVFLAGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}]}]}, 0x2c}}, 0x8000) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000080)={'wg1\x00', 0x0}) (rerun: 64) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x44, r2, 0x2, 0x70bd29, 0x25dfdbff, {}, [@HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x11}, 0x41) (async, rerun: 32) setsockopt$inet_int(r0, 0x0, 0x3, 0x0, 0x0) (async, rerun: 32) sendmmsg$inet(r0, &(0x7f0000001f80)=[{{&(0x7f00000000c0)={0x2, 0x4e22, @remote}, 0x10, 0x0}}, {{&(0x7f00000002c0)={0x2, 0x4e23, @multicast1}, 0x10, 0x0}}], 0x2, 0x4) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x29, &(0x7f0000000000)=0x800001, 0x4) bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) (async, rerun: 64) socket$inet6_tcp(0xa, 0x1, 0x0) (async, rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$inet(0x2, 0x4000000000000001, 0x0) (async, rerun: 32) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) (rerun: 32) r6 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r6, 0x891c, 0x0) (async, rerun: 32) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (rerun: 32) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="6000007110089600000000000300000000000000", @ANYRES32=0x0, @ANYBLOB="fab0817dbcb5f31a2c001280110001006272696467655f736c617665000000001400058005000500010000000500040001000000140003006272696467655f736c6176655f300000"], 0x60}}, 0x4040) socket$nl_netfilter(0x10, 0x3, 0xc) 29.775560289s ago: executing program 3 (id=4787): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x24, &(0x7f0000000100)=0x800, 0x4) r2 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r2, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x20000015) connect$tipc(0xffffffffffffffff, &(0x7f0000000080)=@id={0x1e, 0x3, 0x1, {0x4e22}}, 0x10) sendmsg$kcm(r2, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @dev, 0x4}, 0x80, 0x0}, 0xe07e872420dfef8a) r3 = socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x0, 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006d61637365630000140002800500"], 0x44}}, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r3) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40088a01, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000c40)={0x14, 0x24, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 29.237317204s ago: executing program 3 (id=4788): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$igmp(0x2, 0x3, 0x2) fcntl$setstatus(r1, 0x4, 0x42000) connect$unix(r0, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) r2 = syz_io_uring_setup(0x497, &(0x7f0000000000)={0x0, 0xf62c, 0x800, 0x3, 0x37d}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f0000000600)={0x6, 0x0, 0x4, 0x40, 0x2, 0x5e51, 0x40000000, 0x10000000000007}, 0x0, &(0x7f0000000680)={0x7ff, 0x4000007, 0x1, 0x7, 0x4, 0x4, 0x6, 0x5}, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r5 = getpid() syz_pidfd_open(r5, 0x0) r6 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x42e43) ioctl$VIDIOC_G_CROP(r6, 0xc014563b, &(0x7f0000000080)={0x9, {0x3, 0x8, 0x9, 0x200}}) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket(0x10, 0x80002, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da070000000000010902240001000000000904000009030000000921000000012222000905810308"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022220069dbab638a4e033e070c0000002a000003c46eace2830000000087ccb3b8720b5d8c3dda"], 0x0}, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) 17.707448958s ago: executing program 4 (id=4824): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0100000007000000008000000100000000000000", @ANYRES32, @ANYRESOCT, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ecffffffffffffff00edff001e00"/25], 0x50) ioctl$VIDIOC_QUERYCTRL(r1, 0xc0445624, &(0x7f0000000180)={0x2, 0x251, "19c700d5991d09be6641b0b626442c64daa5381b6159ce7fd73ea510595c52c1", 0x7, 0x80, 0x0, 0x81, 0x400012a0}) r4 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x203) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000080)={&(0x7f00000000c0)=[{0x7fff, 0x5850, 0x0, 0x0}], 0x1}) syz_usb_control_io$lan78xx(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000800)={0x18, &(0x7f0000000040)=ANY=[@ANYBLOB="200f0700b6ba6eb583afd8a7fc15bd55a904a3a5922b86aa38567623"], 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, 0x0, 0x9) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x200, 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x20081, 0x0) write$vga_arbiter(r5, &(0x7f0000001580)=ANY=[@ANYBLOB='target PCI:', @ANYRES8=r5], 0x13) 14.534003629s ago: executing program 1 (id=4832): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0xb173, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000040)={0x3b, 0x1, 0x2, "4749570000000000000000000e1609d600", 0x20493859}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x48) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="20010000000000000000000000000002000004d233000000fe8000000000000000000000000000bb01000080000000000c082c500000000000000000000000000b00000000000000070000000000000005000000000000000600000000000000070000000000000001000100000000000300000000000000130d00000000000006000000000000000600000006000000d6a500002abd7000073500000a"], 0x184}, 0x1, 0x0, 0x0, 0x40000}, 0x4840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x0, 0xffffffff}, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f00006ef000/0x4000)=nil, 0x4000, 0x9, 0x10, 0xffffffffffffffff, 0x8000000) r5 = syz_open_dev$vim2m(&(0x7f0000000200), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000003c0)={0x2, 0x1, 0x1}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r10, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r10, 0x84, 0x9, &(0x7f0000000200)={r11, @in={{0x2, 0x4e23, @empty}}, 0x7, 0x400, 0x2, 0x41, 0x6, 0xffff, 0x10}, &(0x7f0000000080)=0x9c) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r9}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x24048180) sendmsg$TIPC_CMD_GET_NODES(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r7, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x880) ioctl$vim2m_VIDIOC_DQBUF(r5, 0xc0585611, &(0x7f0000000040)=@overlay={0x0, 0x1, 0x4, 0x0, 0xd, {}, {0x4, 0x0, 0x0, 0x1, 0x0, 0x0, "12848098"}, 0x3}) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0xffffffff, 0x1, 0x4, 0x0, 0x0, {}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, "a730b801"}, 0x0, 0x1, {0x0}}) openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) 14.179057747s ago: executing program 32 (id=4788): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$igmp(0x2, 0x3, 0x2) fcntl$setstatus(r1, 0x4, 0x42000) connect$unix(r0, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) r2 = syz_io_uring_setup(0x497, &(0x7f0000000000)={0x0, 0xf62c, 0x800, 0x3, 0x37d}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f0000000600)={0x6, 0x0, 0x4, 0x40, 0x2, 0x5e51, 0x40000000, 0x10000000000007}, 0x0, &(0x7f0000000680)={0x7ff, 0x4000007, 0x1, 0x7, 0x4, 0x4, 0x6, 0x5}, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r5 = getpid() syz_pidfd_open(r5, 0x0) r6 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x42e43) ioctl$VIDIOC_G_CROP(r6, 0xc014563b, &(0x7f0000000080)={0x9, {0x3, 0x8, 0x9, 0x200}}) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket(0x10, 0x80002, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da070000000000010902240001000000000904000009030000000921000000012222000905810308"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022220069dbab638a4e033e070c0000002a000003c46eace2830000000087ccb3b8720b5d8c3dda"], 0x0}, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) 13.175874555s ago: executing program 4 (id=4838): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/wakeup_count', 0x181000, 0x21) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0x5, 0xffffffff}, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x89021080, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = userfaultfd(0x80001) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000340)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xd, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0xb2, 0x2, 0x7, 0x1, 0x2, 0x2a, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x4, 0x6, 0x7}}}}}]}}]}}, &(0x7f0000000700)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x200, 0x3, 0x80, 0x6, 0x40, 0x6}, 0x52, &(0x7f0000000500)={0x5, 0xf, 0x52, 0x6, [@wireless={0xb, 0x10, 0x1, 0x69280663dcd7bd82, 0x50, 0xe, 0x0, 0x9, 0x48}, @ssp_cap={0xc, 0x10, 0xa, 0x3, 0x0, 0x3, 0xf000, 0xf8d}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "f8314de0364efd9c1e2e926b755476d8"}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "cef13e5ecc1c4739c025c1cd00"}, @wireless={0xb, 0x10, 0x1, 0x8, 0xdb, 0x0, 0x3e, 0xa91, 0x4}, @ptm_cap={0x3}]}, 0x4, [{0x49, &(0x7f0000000580)=@string={0x49, 0x3, "37b91b4f0e8348a73a1833a50196252337e82802f07a169efaee0df7c291e40e5c754b67906c480aeb9712b2c34258953a6bc33f90d83dad678435a3c28583d6303fab4dfe07ca"}}, {0x25, &(0x7f0000000480)=ANY=[]}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x409}}, {0x8d, &(0x7f0000000640)=@string={0x8d, 0x3, "1632a15e1cb7e7507ef09f55487836200053dfac3324826270631195aa5fe088b2b38c0c2a7d5aa1f8e0d21bd65f53a35e0b2e5be6d5fde80c409d94830505b88bad3f223f8bd865efa20300d02853c994067446b7d3132c22f9dab057fc5f41153294ff3fa39c47ba3d161ae55f69f9d8016a4d8fc438c4e1ce6cfb56014a752855cb82d4ccb0555ae848"}}]}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x44440, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020b"], 0x10}}, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[], 0x48) splice(r1, 0x0, r3, 0x0, 0x3000, 0x100000000000000d) 12.366393155s ago: executing program 1 (id=4842): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x4c, 0xac, 0x20, 0x10, 0x458, 0x7005, 0x6d16, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xfc, 0x0, 0xe9fc732c90d681f3, 0x0, [{{0x9, 0x4, 0xd5, 0x7, 0x0, 0x85, 0xa1, 0xf2}}]}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f0000000200)={0x2c, &(0x7f00000000c0)={0x40, 0x3f, 0xb2, {0xb2, 0x7, "3cbd319b101ac649f1bbf1ad27c83b6396659447aca406888d73b386ca8ff4fefaf9682e6330e7f55b38d2ab6bc45dd785de7d15cd8dba056f9d790d27788731ccb4da64ef793624893be8c97cdd13034d4beb6795680cbcc31554d4e1418812afdb8f0a99361aafd2aa285ef8e2931af8db101ce4571c991c58b0d7b2d775a7cea47ed46e6146e7dc648c2fa349bdcd52a21a9ea765909413f880fcfb5eadcfe77d51a2cbe79e3b0355ff700e09b0fa"}}, &(0x7f0000000000)={0x0, 0x3, 0x2b, @string={0x2b, 0x3, "fa9c4c49b8cede48a47c9e9ee455cbb819418a0de643384e2f93a483c5e315ca095ed8375f8b9d6d44"}}, &(0x7f0000000040)={0x0, 0xf, 0x24, {0x5, 0xf, 0x24, 0x2, [@wireless={0xb, 0x10, 0x1, 0x4, 0x17, 0x9, 0x31, 0xe, 0x1}, @ss_container_id={0x14, 0x10, 0x4, 0x6, "0aa221d4aea54b1dce16dfc8ee55f709"}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x18, 0x10, 0x1, "30f4015a", "adec49b5"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x2, 0x9, 0x4, 0xb, 0x24f, 0x8}}}, &(0x7f0000000700)={0x84, &(0x7f0000000240)={0x40, 0x34, 0xb9, "cb52e22dbedd21ac519b9529ac8303d43dd239c606f905d892dc3c7e6dd98727a7f11ec494aee5a3285c4b4e30183d7a7e0b6e3432f9e7c928b3a6d5cc84da60b354c3a557ec003ed8a63085fe2539c7374cbfd3a18602216d8844ff063d41fa33bffdf896e48b53670e4231859e972c18e209100757e353d9032c03c5d091030e1e972f59ad88b605f51ddbc4f88a6e8961de48cbc6f5ba6e71c916d718f52eccd661677e8b46d9cdc6e9d0ca1f36adc56b3b60b6252af623"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x0, 0x4, {0x1, 0x1}}, &(0x7f0000000400)={0x20, 0x0, 0x8, {0xc0, 0x20, [0x0]}}, &(0x7f0000000440)={0x40, 0x7, 0x2, 0x9}, &(0x7f0000000480)={0x40, 0x9, 0x1, 0x9}, &(0x7f00000004c0)={0x40, 0xb, 0x2, "9bf0"}, &(0x7f0000000500)={0x40, 0xf, 0x2, 0x5}, &(0x7f0000000540)={0x40, 0x13, 0x6, @local}, &(0x7f0000000580)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, &(0x7f00000005c0)={0x40, 0x19, 0x2, 'Iu'}, &(0x7f0000000600)={0x40, 0x1a, 0x2, 0x4}, &(0x7f0000000640)={0x40, 0x1c, 0x1, 0x8}, &(0x7f0000000680)={0x40, 0x1e, 0x1, 0xfd}, &(0x7f00000006c0)={0x40, 0x21, 0x1, 0x1}}) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x44, &(0x7f00000003c0)={0x0, 0x17, 0x1, "ab"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 11.46907433s ago: executing program 1 (id=4843): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000012c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109024a0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e", @ANYRESHEX], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = fsopen(&(0x7f0000000040)='sysfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x5) mount_setattr(r2, &(0x7f0000000000)='.\x00', 0x0, &(0x7f0000000200)={0x85}, 0x20) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r3, 0x40015b19, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1}) write$char_usb(r3, &(0x7f0000002680)="e7", 0x1) r4 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50}, 0x0) recvmmsg$unix(r4, &(0x7f0000001800)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000004740)=""/199, 0xc7}, {&(0x7f0000001680)=""/249, 0xf9}, {&(0x7f0000004940)=""/255, 0xff}, {&(0x7f0000000480)=""/193, 0xc1}, {&(0x7f0000000580)=""/4072, 0xfe8}, {&(0x7f0000005c00)=""/253, 0xfd}, {&(0x7f0000001580)=""/226, 0xe2}], 0x7}}], 0x1, 0x0, 0x0) write(r4, &(0x7f0000000100), 0x0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000040), &(0x7f0000000080)=0x4) r5 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) r6 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e27, 0x1, @mcast2, 0xff7ffffd}}, {{0xa, 0xce07, 0x4, @empty, 0x4ed}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000380)={0x2, {{0xa, 0x4e20, 0x1, @mcast1, 0x1000}}, {{0xa, 0x4e22, 0x7, @empty, 0x3ff}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r6, 0x29, 0x30, &(0x7f00000004c0)={0x3, {{0xa, 0x5e22, 0xc, @mcast1, 0x408}}, 0x1, 0x1, [{{0xa, 0x4e24, 0xb, @mcast1, 0x2}}]}, 0x110) unshare(0x22020400) r7 = syz_clone3(&(0x7f0000001880)={0x100000200, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, 0x0}, 0x58) socket(0x3, 0x6, 0x0) tgkill(r7, r7, 0x11) ioctl$VIDIOC_S_OUTPUT(r5, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_ENUM_DV_TIMINGS(r5, 0xc0945662, &(0x7f00000000c0)={0x3ff, 0x0, '\x00', {0x0, @reserved}}) r8 = io_uring_setup(0x732d, &(0x7f0000000980)={0x0, 0x3ea, 0x0, 0x1, 0x98}) io_uring_register$IORING_UNREGISTER_NAPI(r8, 0x1c, 0x0, 0x7ffffffe) socket$rds(0x15, 0x5, 0x0) 10.94326036s ago: executing program 4 (id=4844): r0 = syz_open_dev$vbi(&(0x7f00000011c0), 0x1, 0x2) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000002c0)={0x0, 0x0, 0x0, 'queue1\x00'}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) r5 = fsopen(&(0x7f0000000140)='mqueue\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0xa) fchdir(r6) fspick(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)=""/202) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r7, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000}}], 0xf00, 0x4c42bb4f92, 0x0) shutdown(r7, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDCTL_TMR_TEMPO(r2, 0xc0045405, 0x0) write$sndseq(r1, 0x0, 0x0) ioctl$VIDIOC_S_AUDOUT(r0, 0x40345632, &(0x7f0000000040)={0x7, "dd6dffa7a007dea2beff7d46b100310e1b58500700000017ca6b7036418a2332", 0x3, 0x1}) 9.054676782s ago: executing program 0 (id=4849): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000000)={0x1, 0x0, [{0x0, 0x2, 0x1, 0x0, @msi={0xc, 0xc0000000, 0x6, 0x6}}]}) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f00000002c0)={0x0, 0x1}) 8.691097471s ago: executing program 4 (id=4851): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0xb173, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000040)={0x3b, 0x1, 0x2, "4749570000000000000000000e1609d600", 0x20493859}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x48) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="20010000000000000000000000000002000004d233000000fe8000000000000000000000000000bb01000080000000000c082c500000000000000000000000000b00000000000000070000000000000005000000000000000600000000000000070000000000000001000100000000000300000000000000130d00000000000006000000000000000600000006000000d6a500002abd7000073500000a"], 0x184}, 0x1, 0x0, 0x0, 0x40000}, 0x4840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x0, 0xffffffff}, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f00006ef000/0x4000)=nil, 0x4000, 0x9, 0x10, 0xffffffffffffffff, 0x8000000) r5 = syz_open_dev$vim2m(&(0x7f0000000200), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000003c0)={0x2, 0x1, 0x1}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r10, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r10, 0x84, 0x9, &(0x7f0000000200)={r11, @in={{0x2, 0x4e23, @empty}}, 0x7, 0x400, 0x2, 0x41, 0x6, 0xffff, 0x10}, &(0x7f0000000080)=0x9c) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r9}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x24048180) sendmsg$TIPC_CMD_GET_NODES(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r7, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x880) ioctl$vim2m_VIDIOC_DQBUF(r5, 0xc0585611, &(0x7f0000000040)=@overlay={0x0, 0x1, 0x4, 0x0, 0xd, {}, {0x4, 0x0, 0x0, 0x1, 0x0, 0x0, "12848098"}, 0x3}) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0xffffffff, 0x1, 0x4, 0x0, 0x0, {}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, "a730b801"}, 0x0, 0x1, {0x0}}) openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) 8.55153881s ago: executing program 0 (id=4853): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/wakeup_count', 0x181000, 0x21) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0x5, 0xffffffff}, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x89021080, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = userfaultfd(0x80001) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000340)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xd, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0xb2, 0x2, 0x7, 0x1, 0x2, 0x2a, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x4, 0x6, 0x7}}}}}]}}]}}, &(0x7f0000000700)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x200, 0x3, 0x80, 0x6, 0x40, 0x6}, 0x52, &(0x7f0000000500)={0x5, 0xf, 0x52, 0x6, [@wireless={0xb, 0x10, 0x1, 0x69280663dcd7bd82, 0x50, 0xe, 0x0, 0x9, 0x48}, @ssp_cap={0xc, 0x10, 0xa, 0x3, 0x0, 0x3, 0xf000, 0xf8d}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "f8314de0364efd9c1e2e926b755476d8"}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "cef13e5ecc1c4739c025c1cd00"}, @wireless={0xb, 0x10, 0x1, 0x8, 0xdb, 0x0, 0x3e, 0xa91, 0x4}, @ptm_cap={0x3}]}, 0x4, [{0x49, &(0x7f0000000580)=@string={0x49, 0x3, "37b91b4f0e8348a73a1833a50196252337e82802f07a169efaee0df7c291e40e5c754b67906c480aeb9712b2c34258953a6bc33f90d83dad678435a3c28583d6303fab4dfe07ca"}}, {0x25, &(0x7f0000000480)=ANY=[]}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x409}}, {0x8d, &(0x7f0000000640)=@string={0x8d, 0x3, "1632a15e1cb7e7507ef09f55487836200053dfac3324826270631195aa5fe088b2b38c0c2a7d5aa1f8e0d21bd65f53a35e0b2e5be6d5fde80c409d94830505b88bad3f223f8bd865efa20300d02853c994067446b7d3132c22f9dab057fc5f41153294ff3fa39c47ba3d161ae55f69f9d8016a4d8fc438c4e1ce6cfb56014a752855cb82d4ccb0555ae848"}}]}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x44440, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020b"], 0x10}}, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[], 0x48) splice(r1, 0x0, r3, 0x0, 0x3000, 0x100000000000000d) 8.473488487s ago: executing program 2 (id=4854): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474d, 0x4) connect$inet(r0, &(0x7f00000002c0)={0x2, 0xc22, @remote}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000080)=ANY=[], &(0x7f0000000000)=0x28) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r3 = syz_open_procfs$pagemap(0x0, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00'], 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x0) recvmmsg$unix(r4, 0x0, 0x0, 0x0, 0x0) write(r4, &(0x7f0000000100), 0x0) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, 0x0) r5 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, 0x0) ioctl$VIDIOC_PREPARE_BUF(r5, 0xc058565d, &(0x7f0000000500)=@userptr={0x6, 0xa, 0x4, 0x1, 0x0, {0x0, 0x2710}, {0x1, 0xc, 0xd2, 0x6, 0x77, 0x6, "0080ca6f"}, 0xff, 0x2, {&(0x7f00000002c0)}, 0x6}) r6 = syz_usb_connect(0x2, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001d9167204f17316a3f26010203010902120001000000000904"], 0x0) umount2(&(0x7f0000000040)='./file0\x00', 0x0) syz_usb_ep_write$ath9k_ep1(r6, 0x82, 0xb0, &(0x7f0000001580)={[{}, {0x75, 0x4e00, "11a9ecdc84ecf563b48503f2379eb70daa17bf511c2c78a8647c90bd1dc89e15e18eedfbe9997224454a0cbcf7751c495c791f696ea866b67fea29f8b51285a224fd21fa6e0794fe04c177ae96c4c9d5056f465b6db53a1de2ae5ddee649c880563165395710502ec60c816a8ed25283d30fc4f3a8"}, {0x2c, 0x4e00, "9bbf61f7054c7235b339dbb2fe32784c40a9cb1b5f06cac0da3ae81523de84c6e5499658e126e08a7b62bc33"}]}) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x20000023896) 8.195567142s ago: executing program 1 (id=4855): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x1) prctl$PR_SET_IO_FLUSHER(0x34, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000b00), 0x0, 0x400122a0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc674d000000f8f7", "c5991ee20139b401046a89606ffcf92e", "2c5be7c6", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r5, &(0x7f00000000c0)=""/3, 0x3, 0x300, 0x0, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)=0x0) timer_settime(r7, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) splice(r5, 0x0, r4, 0x0, 0x10000008ebc, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) 6.799514211s ago: executing program 0 (id=4856): openat$fb0(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) socket(0x1000000010, 0x80002, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) mmap$fb(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x3, 0x8010, r0, 0xc0000) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r3, 0x2) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xff}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x80000001}, 0x0, 0x0, 0x2, 0x1}}, 0xb8}}, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) r6 = io_uring_setup(0x4133, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r6, 0x18, &(0x7f0000000080)={0x4, r5, 0x2c, {0x6, 0xd377}, 0x43}, 0x1) ioctl$USBDEVFS_CONTROL(r5, 0xc0105500, &(0x7f00000003c0)={0x80, 0xa, 0x1, 0x3, 0x0, 0x7, 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=ANY=[], 0x2b30}, 0x1, 0x0, 0x0, 0x40000}, 0x4020) io_setup(0x2278, &(0x7f0000000180)) ioctl$sock_ifreq(0xffffffffffffffff, 0x8932, &(0x7f0000000040)={'veth0_to_team\x00', @ifru_data=0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000600)) 6.195200945s ago: executing program 4 (id=4857): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080)={0xa, 0xfffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r1 = fcntl$dupfd(r0, 0x0, r0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x0, 0x0, @local, 0x3}, {0xa, 0x4e21, 0x4, @mcast1}, 0xffffffffffffffff, 0x800}}, 0x48) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000240)=@gcm_256={{0x303}, "da8681654fb7962b", "637d80386da57daf27628d1068dc099ed3dd5d8792d5a26991d7ea2f6eab24ec", "d5dc4feb", "eafffffffdffffff"}, 0x38) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r3, 0xc0045516, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r3, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x7, 0xfffffffffffffffc, 0x0, 0x2, 0x0, 0x0, 0xa3, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff3e5, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0xd, 0x4, 0x8, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200000000, 0x1, 0x0, 0xfffffffffffffffe, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0xed9b, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x0, 0x4, 0x0, 0x4, 0x2000000005, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000009a65d0860040800dec30102030109021b050000000000090400000178eaf500090584"], 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00v\x00\t\x00'/20, @ANYRES32=0x0, @ANYBLOB="04000d80080001"], 0x24}, 0x1, 0x5502000000000000}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f0000000080)={'syztnl2\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x10, 0x7, 0x8, 0x6, {{0xa, 0x4, 0x2, 0x11, 0x28, 0x65, 0x0, 0x7f, 0x4, 0x0, @local, @broadcast, {[@rr={0x7, 0x13, 0x11, [@rand_addr=0x64010102, @rand_addr=0x64010100, @private=0xa010102, @broadcast]}, @noop]}}}}}) sendmmsg$inet(r2, &(0x7f0000001580)=[{{&(0x7f0000001280)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x41}}, 0x10, 0x0, 0x0, &(0x7f00000000c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @remote, @rand_addr=0x64010102}}}], 0x20}}], 0x1, 0x8000) 5.766765837s ago: executing program 1 (id=4858): accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000100)) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f00000000c0)="b11502e772034700a24251edc9654594e7efbb5be1c3e405000000000000006a", 0x20}], 0x1) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r4, 0x40000000af01, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r5, 0x107, 0x8, &(0x7f0000000240)=0x42, 0x4) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100}, 0x1c) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f0000000000)=@req3={0xad7f, 0x0, 0x2, 0x0, 0x43, 0x80000000, 0x80000001}, 0x1c) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, 0x0) dup(0xffffffffffffffff) add_key$user(&(0x7f00000006c0), &(0x7f0000000280)={'syz', 0x3}, &(0x7f00000008c0)="d3a24845fed3b644db111f6660fcd399052be391b829c18141634298ceeb56ee051e22d30dbb5f2c5ab2078c2c8cf5b9a0385ac162b836c7977ec2752acb894b12c965ca0e6ef3be0e26d7ce463ba7d45d493070046ee8bf617e890cd5321ff6387b3c061c485ebc22948c0292c94d7463b0a2daf8dd3e66c957e3aef3a4b95f4935d34e1bcbc49fc30eb919f98f0c8eeedbb598bc77f0ea766d13268eb19b0cfd6d9624efc20e49f72912e99e06f832a5d6a336636bcef1293071e0a88f8453a5e3f66a46bb0d1151d677b39ea96b1e0df37938a43869aff5ef6877c00111c7dac90bf140b2e8d7480538629ae1c49cdb837a0982effde78d4f7082d1dfb80a8f41721eec044f4790eb085ea33b852b9be529e6c61801bcf0fe530a3d2b1cb2d558411525eeafe4a910e61317eb7798c968ddd0c8855cbe842726dc0741707dd8e19707f6a2d21cc64134642ee1bae7a89e1774fc5e63d7e07610c78aaf4aefea35ac05112dccb45a19b01a16c6d7d5a710e1fda1b72947b1c859546f07373dc3c9e616f5f92090dfafd5f24579819f9988859e7b488420cd", 0x199, 0xffffffffffffffff) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="f9", 0x1, 0xfffffffffffffffe) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={'crc32c\x00'}}) ioctl$VHOST_NET_SET_BACKEND(r4, 0xaf02, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCINQ(r6, 0x541b, 0x0) 4.71410648s ago: executing program 2 (id=4859): sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r0 = add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000240)="f56ed761e9c8219d05f5e35c", 0xc, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, 0x0, 0x0, 0x0) (fail_nth: 4) 3.947480381s ago: executing program 5 (id=4835): ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mknodat$null(0xffffffffffffff9c, &(0x7f0000002440)='./file0\x00', 0x8000, 0x103) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002240), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002540)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000040)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x2000}}) read$FUSE(r1, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2092) syz_fuse_handle_req(r1, &(0x7f0000002580)="5536182daefa2fc6ee10a1b2d4e27cff3c3e628d4656f7b27979e371b15b420c01ae674ddb8fff7b2bc41e7c5927065cd32f2ff7908ef7dd74cdc82f3799ab12edbbfd0b8f6d2194d7f72aec3a136e25c7bf733436bf6cbfc94431ad053a2ec4ccac5aaada8a41ac38c0e1849e599dce84e431ac501db105b4484146b338c0ae9124877ccb8273c7fbb32603251e2d66c71398a7a715bcbe5c9d87e41af55f837e2931c4c1b6b7bbc30dfedfe6e61a39e28f66bbe56496745fbe03f6035183257edac4b0fe3087e7f3e79c2152a07341f3ae9ec68e78875b6e12b5a2a1abbcca4d7963be818a7a31290cad5a025ccd05b609c7ac49ea85d49f354c1e76091a917966665e77471005a46a195b290c01bb7ddf4709e94543471d87a0a5047d3631b00862e1e9a00c60b83371cc16ba087463122a892a1b21786fe3d450c7ba97799d88126f09a698a421242e9c67c981ebc576f57ba3df22e0071db74fa22e97b0fbe589894931a4c4e0eda8bb9533c4ce503fba218d0ae43ab4b4d0c705e04442d093ca5299ae8499c6db904bda6c68105bc2a1cd8e16067215476e573745d1e99daa73400567a9978dd7bffb21429479ace30c95afdfaebd7faf74343cd58e14ce6d2fada5a1c665049eeaa717ee681666c8b63c6d54e66df86144f85d80dcaa3ae7a13b58d5f2b607029efbbf8593afc75e0ce0a875a5fbedecb425a22624a0bb8e2fd06212a1fdafb92430d309f8f68504484fb1246f3d7b0893d3dc9d0b6c8d7476b6aea871eb4f32c283e22435fccb221484409cc28a6609dd869b99547fc81b2e517809a5b77783f9fc11b5fe584b9f64c0fec35d3db21ae30d0b8b88d722dea4a376d2a610f0a9d08b311e2ed3ef5d72d0e040e41d3dc45e5a17d740c67db88d95b18c8610fed3302aef0c3c1871ff8a5ae1908bf9668f0bc8e5867f56cc59cd303bafabde6a4034a96ba66b98a910dfaaff712673dcbf84c5354f066126068de620f08be67e6034138dd9a312f9ff197fca56a77bad46e59edfd79dfa3aee4582bfe01ce2201f6569178be7a4bdd28e495114944e538ee7b8f11e0812d9f822cd9760316809eccb9b0bbc5f0630224a1534f88600bbb2af2882562e76d149b44780380b62241829e5734fdfff1a2b3a052f3504dffe04d4632e9fef82762fe1950fbaceeb961464dfe2699f0a898fc8783cfdde45ecc3a16f052c4777beb1fddb080fc802a8cc760d1a0d4606b669e78ee9ba1ac398914ed5096850dedc513e5c71eca19d51af9075151f4ca3d8a841b7b1d205f5f3d223f7e48685daa0836f93017935ad1d942c7392667145ccc1d4700f5d8fb2fc218fd6d70357667d339a28dba3360761857b19f9f91e56a0e0281af1042a409a4e2839f3d21b73a5c352b22e4ff06e563e92c00b48e7f8bcdbbbd398c65331298f779dafe875854e301394b0faac2126138908fa8598b4f5e58ed1ac451eb0187e20077099d12d745fcff0b7fb5e8b9fa65ac617ea6c953e8786229b67a604c46810876650f919e6bc6792db22ec0be29cff94e9c24eb6e1830f890bb4b6bcd74b39060506095b99b95f2a8addfb8dfe11f47479fd23cc7c0701ae00774c430b3b9f52ab2579d47a2c2095365aa569f55a1431f93e651c01f0d67ff9337708a72e352c0e699f14bf07f9b9c056897c78edcf34ade3dfd17a04446d565fb6e7c701a237fe1a3d932371654a43b56e7f5ccdadc0f506d746c3f0047b69c0c174cbbfe092f139c09c0e2e76d9a777142813cb78174630ea8d73301e3343b94856fe610777468a9fb4518a0cf68243a4bd715e38e3431a811f962edb1306d76d89e0aad9be5800e7bebb82ccaec2382c9c114c91aee013acca2d8ddf99465e760bd185453a9eb4e5a78383094603b749c6242ad227124ef4b7ec7506b8a76f714099c954f0b2f2d427af0451a7ea3d1dbfa8a3e644c3640d397de3ce942311deb73fad3a76cba773f416314e81e70bda715b342113a18a249300b43250cb3b3aa46ecabe42d0e8c1dc4be286e539c71f0d1c0b0e1795ae7428a3887f36b79e9c76401a5dd460f45b9d8277e04c7c1e615fb33d0fbc444421f3fd0bff4e045d790610aaa2b62945e4b398024c75680b5e12235c35f5b23ddd99454fe527acad6d08fb37c35d9ecc0a8b10e2c31fac786666eb2ad499ddb7d06c7526fb1c5412f6a0df003410e69b81fe523057b6b73cdecf0e5bc4d3b87757889fe49dbdb3ec79c7eb3a868480fc87528e80400de837cccd4a6345508386ada1833f57a20c56e973569bc7821088d343e80009b7b35390975323d24e764aa6c90d3dd5fdec08ed363dc9ab57de949282994cd3858f829c7e5e9a745261383db27c9c53e9e98e109fda6cbb88649ba40b5067470d73b7471d406e5ea8041f9fa25f5b6c919aef84f7595511141e9f090ee103b20a13b22c9a88348ed6d284c0d7a58326e0c4c9626d9a5390bae2be199b201ea136a9aac76e6125db9bf58f61e6a46f8145a9df1305415989435f51529da03f09a67e3629e6f6cb6b70407d9d848f554f1a7e63602e678e62d3b41b4bf4ddda713ed2c291536d8cc12a16bde144ef56acc17778b1aa8eeeeeb60c781365b615be4435c7158d926351cdb46b89fa82acb384c7318dcb2e51db8bdb223aff2c8f36d9e6b1135ad18f7e0b9d91a76972c3140f8e21dc71422de12a4f5d08624bdaeb983619a5ff82cf788c6b8a5fbf0f78e61ae4058d6e03a3d5130646dfc13686e356a1325434caac94ced659529181561fee7ce4f7e1e7945f119ad8474ea6b00257ceb7af2d9b3f9ad5782cd986f1b097d61bf26a6c48c3ab597e4678d609f3050eec9f3bbea1bc67314407521950526e6d71e34e35392067ac84b66badc82a54bb0dc8ed2f1050711ef2d47af5252075c0441aad6900539fcc649c1b1ffc70a1cc39e0c2136c764ba718d50f4800dc29769c4bc9a2fd0f43eb6ffb717a473ccb14ccd58bd506c4e4a0f4ea1158b59b3d6bf1a2d010c456c1f099bff69add46cc60fd2d9779f603ebb943ab8eb02627ac8aebdd52f25b069f64a61e90fa9ac979cb4c6cf0ebcd070099a1a6e6a747e8989e84afe090390953f988f2dcee405086ce51b1d2d8d249f45899b4e862008d28efad8aa5abd0912fa456aa9d3a918a0dd3420d7c4b04b9e3d65c41a1548b7caeef5fbcededf64697786a0bae73d2c5352658b871c806bd150c91bbf8f4735dddee9cfd3e152b5d44cbcce912a2809760e225b9018fa498c86ccb2359cb0834bcefab92c0468522648fbefbe25cf8d82b897371b5369e8f2972502574c0a3235066969c4d5d67fc312d6631702f66a113d22063ba2ac7d9ab387ad1e115e9c98275f3e0dacd2e8f0843f24687b297bf42bca11b89c6db2fc7026d364486ef2d614bc45d5cff0758d69fd48ea06b8a97667e4d7d30bf7f1c30b62287637f50468bf144fd177fdabcbd0d12b50c9cbd052dcd66993c72f48bd6086412ed5f9af3d44dffdf7c012aadd5cf7bd3b314f236660fa1c0e4773a4e9ccc36fd130ffda59a9bf41f7fbf79e5e3333365a3ed2e7714e50805bc70bc6fd20203cacbbeecb8e01a2ce626756cdbd01c53717c2e7b56b47e21f13209c2bf2b1b251e7a93f8a085dcc61d9ae82303a962441372ff7c0b8b8ba75bbf5b861ff7ddbc9781d40c90ae467bdeddfdf949e9a8b8c9fb7db3a9323d05d15bef19ce2e7634b84ac082d50e84b66f99f34b2f852fefe67faa403e848f3de110eb1d9faefa176c3cacd20c7f87d74e858a1a7bfc2c9e895541f691f99a2b8771c8755300ee74e3d6a048b30d02ca16202ecfc207a0b29302aabc1c5b57c7d0d31d43be5cb1f7230dc238fb701e7037aa00c9b57c6fc85baccaa56754d27b975872051566187b0983d93b9ec052edf3b33f7ddab343eac6f7aed97771e708e40a4cc6797f85d91a0debd5c6169895e895f67a10685af5e0b80b0e728731cbffbff8be603469d03bd47dbca4456108c79c029af16482c5c2590c1e0673c7e943699ea107d906a3e667fe7b2afaeb489548b6a11d9862e86a0b549a42b607ffeda6e3ba0f567b63b0be6edb9098cf3a44e6864c5e99fa5f475acb57e2b7343eb7fe3e8c139b515348b188defd2d3021fd27950d822f6df5f9c93584fd95f3f88c85231943ed4d511249f96447f7903779e4d8c4a680661fe5133d415b862e668441e8077bfb827293a9eb733e914f37a19e01ad4b014ef87ed5a5817ab8123af9fd863090b8e9a50ce29cf706b2182fd79660cbdbb53ba71b750e71a21d0ed01db3335cad91d5cb4d4648f46468b6e51f63e4088386913ae6b6cbf103947c32d25a8a825118cd6ce23f53ffe3c087114700e9a5932faf3d844fc6b323b3e722ed3ed75037bd9a7fd9d256b2b9a168e66802e284853a0d6b47d39675900f02f005050425731f9c2cb329f70d7a5ce2ee256212bf8b2ba9ece0df39c58f0fbac06c4da946787abf19dadb536bddbf7e51d89f22413575e064c6482d936a89d48be159aeb5055feb0577ced6c5334411d1d58a7e6d02eca6164d90fda39685fd619269fea7f21db51f6aa6961250e03c9e00788c178dabeb68f13dea29f8cdcf30478dbca15c4519bb342ba8b201019061bf8317022dbc5673fb4ed92ef1a1dea0a1a00cb3cbca291f7ebcbec27ea5e824f04b82f5644d4368cdf8026550bc2f86b83da6a265357eb548a9eec6622204b3dcd22440fec0e12819ade4ba53b53b1e6ab906fe0cacabb9c15e8b657475a0dad62dbcb1037aa8617787abce24a0aa4cf1b5c85c030a14277832a95d8b29a4ea86fb80148ece147ce4bf386995ac28e1ad1e2072f3f4fce5c05d9bdd0af118815d6ee89aabfa3f8173e6fa59dfa4a8c1ba7641291b3c18c6ccc4c3588d56d169d397facb4e67485610cc68197b3a43fe78b9458dc47e5057d5bc6b8e3b65bf414818b65d41ed7cfd7a35fe79c9851ef39c3e059fb3dffe331a791ce75728efcd58dd9b3ed1c93b128469afa648f4f91de6e39d5bef7a0e69bdf5b2202682d857847a64b33432ea0f33bbfd1948ad0b6c66d853fef1e6c0d712b86c40f79ff4d125baebf2a4b32dfc8bed2a697f745cfeb16303b4f8e866ee0bb6a5eb6c6ce513b5cb84e2b44854c72ed0cf2e838245be8d098a6943d845f5a8c07c1036da86cab0d5be4ce29545fade4323acf2085b7645107dd12d5b3af7bb37be1b291cbd6fe297c4b4a2a23280358711be91f21305c035bf1f57467a1853c999b3fb478b11c49cfac66429a76099633a54689047d66fd8bd6eebea94fc8007d9e2765e2969608a78d0b96d6b30360e81fb9df5262c8ff15f2fd7000756d8cda1db3847d6f793bf803b159344c57b480c87702cb3d1260692a19ebdceb2e05a2fe2eb5ac5cfa76551a04795915bfaba9849a623e46ac1832157d0ea5255b5cacd4efa844b0ce5f2f0e1a9dc4fb115fce2640ec6d03c5fe15b4837bd6e6127349f2b6b0fd61c82c96531714f5b623ce4e4978c4a0c86b3c17f50acdd67d283ec934ed36ba7360a10ffeeb7864113eeaa25cccc66613e0757782381614b8da3cd0a85cef7bc384969517c920e8454a5a0f112d1653b2828e895d0614e5bf4dec0ec863432cce9337ce7c29affa7f29fff97bd54a6947cc68df8fed17850209242c1c67d0d7aced2efec4b3c006678bcb8716e8e9e40d78781fd6cc5b5522b8ed2ec8cecb677849b778c0a2a17817a3dd2278080e109906dd4e99b772d5911893fa09ade4296876921d1e009e714df7e4973ab1d2e593d88ecf2151e97ec66176549d3af66652c8377e162454ce7cc8ab34397d31978e84aea92a3c0a8106a2a31e33a8dfe942819fa1f2c1272d0f3cbd7dae820642cbc00202455ab7fb81857ef050a1965a291001874b38397ed9a8e8106dcfcdfd80d0f5d0ef0d5775e53cc5aeb1d6bc13886f8f3491cd6af5dd77ace3689fa2bf56e9b4d1e4964f8fd8f0a4a8b5d7fb678f0f3adcb4a19b5168ac5aeee6f087af15af3bde52a9be0f550b21b10ce98da70445284d9db9416732e63b6efb3ced984c0df50c11aa677f822af7ad39b8b4c0d236e4b36a00ff73587b39f917d7effbb37b95a96e350a430d544d68623c80bf2cd2d689b4dc41e8ef374c393092a2619055f268fbdcb9de494e6582be90a4798bac801bcac8389c823759860e7c9d692f41ee2a6b9624da3c09a2c8e7cdeaa100ba8ca25a737046d8bb237b9546641cfbb2eac9bbee9e125b14dfabac642e634d32151c06ceb3ddbb3d3f038ab2efdd063152270449ed5eca2655cd0016147ebbd00003eb8cd25297350afbffae43cfd9867543b81da4510850b1afaa199d0477837017e9098bf5b3973efe218a88b3d2bb172fe77278088997758fdc1dbb0b1fb6af2ab9db1ddf3e3fbd8e8dd35f918779ccba75b3cdfa317fc6e3cbeaa8b11ce2a30cc53292bcb9dc2a18ca400c674360c041c97ee6aec1448a025c6b04ae9efb3a01d31e3f897cfd5dc94dac95c88b95a26676cc6153e203535891116a5f4ebf54c71cbbe3215a04c57c7ba874a1e203bc66d8161d5b556f661244d9d405a2e6baaedd0d0e4c7e093c2ac0e5ee83b7ddf91669dd59016f7cb53d19896fcc838dc008da4a5fdc0a4fac1a6d7f49b24bcc01467df04d8a3f3181cc4e811942a53daf784b59186a17756a8f3a41ad93035a893a4ff60dd8f54a533e94cf87864169287804df3aa38dc5ce6021a06c58d48985c562a0f51d8b32879f9fb7d4a1d3d442626810f151b161b7e35f9a0b3bec05979e381140f31c03ee6f5549e6e7f116be5e87e0a9ab71ee632f837e9a0f9ad1b4979304c26bad6e84eff0b5b79b667e3d74e354d04f5b2c237102e41a1a4dcac99cbb911d9484aebe6ab2cb539a1db3e3302fb833a44a2d725e858ea9a65d43bb7661842b655c51a1ff25207956e8c6c71667c79975d69f688dfa34c59771488028e3d7500ba0cb71ae5751a51b568e67bdf2abb63838aba5e5cfbbeaf02285f6cbe58428a92a6fc25abb01f8d55ecbd7cc0ea69cdfb188b79048dbea488493681b0e70234463ca3e425d24e2ae4d800ce3adb04ce69428b5f884f8dc83392c22e456a2e195b86d717ac45003a99ae9a59c94167eb04aba3612528f94dad3360b46bc456fbb78072eb7f96418c71bec09831b0a63e83816ffde0d9909c06e765a666c2c41b20c339e0d39107311830ae9ad912f0a85f2ec5ca66a79798a568dae14f76b6d59e6c0bc0f9ebdff29c0fce58367c9705bd4323d3c3e125cdb13da6e58f3fdb2751401014e393e3fc688f04080a90430e531767a7c4f3187ccb7b90880955e766aba6091c4e8fed36482bb5a63372350dd08fe84bf5afd1a30a0f8f4de7a640fa84b9c0447073a0b39bf875d0377c8a572adefec3e033fb3dad91b22bfe22c01f23f27ab0c6a1ce19d2f4f4235281cbca15dafe50f383ba89a8c46a666b106c1ac534955df71f4c560010934fd3eb68eebd55487defa1e024f75ac30139cd190bde1dc8684936bc23a1882ae469fc4af8730d29658f996f71c219526497918e359228b55849d952f4b2996fe5f45a6cfdf87da93bfada579479b18d05c4e964c85b88a7bfc6e4f2b5d6e98e00635e8bd2ebb9eb40b99a9e9db2f688b2d94b8cc8c5fb2a1928624fa5df1c228e6499d992453772084bcd33dda984d97e3857b6fee43c6666b3206ccfe3af52debea4ee060c6edd194b90309213f5c4805f454c7e57bc759377aae9727e484391486be0849c5cdfa99c5a0d0687d6afdce97a32e01d45fef015e7c869ca190219a778b91d881a7b595313fb462e5bf78260c78285d6ccf5e4c50ed56ff28e3f49912773f0a58093f259b5cf4e7f607c51a81576fa95b97bf32d0e2e3511b5d784eba29a15246a97ccf608db456cd70adacc6c31913416f24f38dec3544ac2e88c409b5ff7771d873ea8d7a1868775c8b5502273c784cf945680fb14f143140b56462cd46874ffeacde7bf329fe8369df9c4b95a42535ea56ad6fa260f5c738eb9627f890f4a34f80bf3b8fe568d44c3895029b5f9557f17469a53fe4c0d581eb29029ff162ca906cd0e4bb81138be91a254752bf849232ed7042a82cda1e14dfbfdf74a09c17a9039749c789ab0242ed2d0249231c4ad70c23c805676968bdeb96c2d8886f784ecc3e42e6493e45aa20b6e8ede65c49136c9e9414a4371e3012bf596d55315be17ea9396b1df7f82db27f0d121f8aa66c40365fa686a46f430b4cd336da0d9937d5c26284bdcc6c4e0d5a6acc1be089e1a5d6ec422ad3961fb5c5c9836466c3366e6d3f2686b19b529549cacb6252b0d7a7f5df42ea2961ac59ba0b911311ccc4d83f8611f0c4b071544236037b2863d673303a4e3d428131b07f60eb2cd507dc43503456ce829aed8254bf0b51b38008d42e445acb0effc2ab7e4bc26ad76ffba1220f2e878fe9b5de39bf4f25a9ed468cdb100008ffac6bef401df4817b23463e771a3c834c32993274689c01004eb94b89bc44257b7d2b3936caab6d86937b5bb8f705d00fb6f091711222b6dc25eeaa0e350fe484337396162c86bf7d3a1ab82591ad35d393664617041142c0f8b528e947c092f28c3142493d056bd548910615e7300f041f5d01a2f00138ae5d7849244ef9215f5c9dd874e60ca4ad883f86e71690a510831e35c24de1e0d1261172bf4a8625af958febb7b109c5ca5bfffd4342c43ad02136c6eb117b4a6ea98c07a91279731c1228b01e6be755c1c1d095d3cdfe950ac32eee77327a0e7e342ccfc13c69ab6ab113b18c1abe72d39c03e351986cb3326b8b17ada5884aa7d0a553b0d35e32b8c09f1a4106f5d675a88a1508de4a0e9c598c082ae5b229b75579e39e297b225a852e3f6a7d0990a45fdf68771991acf9b7a5c04bc21a40c57817d500e8ebc6b5919219a4110395817c92bf9eb9c623606d4d98ed68dc0b51a0278b0addce8753f86316158bb4bd6a7a0c4c72b0d17b9545695e54826021a6ac44b4de1b4ea977b20af3c47b8860b0ed29a68c1a883777097d54b162cc58edc0f4de1afbbad7c340a5cd9f2f93133cb2a4babc2a688e2ddd580ef8d9d0846c269c265ce9d978aa233c73aa11eb78d3a67f4e7a3dd035ef5a1f832ada87c7dfa377b77215f8c23b1a78e4a7faa6d0c1a4a28a0ef7b32b36bd566d8c478d0133ab43f9c2a4829624eec535234eb89a177ca8d4e9d2d422f33a24d15044822e4a4c1bca5f470b8c8fde09fb69160297218398da27f4e80dbd480782ee75cecd20ad23fdbcc1d4a0acbc63241c1e2cf1a0b12949e42f707ba06b6fdbd8f336bd72d7f96ddf9ec2b5cfcc4c8da6e1ea573e97eeaea537511ac9fd2ae78eb18cb50c13b595f8b6d65ce8c08e9028fffff6b512080dbbd3fb5e5068538c05f73254969f9727db9bff0c6aeaaf83713812499308792a7fc8318e6b2996bcd1b072641be1eb8e028cbd6b0a5f1fa13bfe35b5cd0d2ca21d9cf8ed97f724ef73ab5a99d65befa38d636f2f827d229479377f25501f3a6ece12cb095549503b2299db7806d32751d4851d62b0c6a91e2e961d475d33a8874c96df52c75bb5a0569e892743937451f75345e0351bfa334d37aa43f01ad1ff984dec164faebc713de31470db5e536a0681a042ced0f9839d9ce89259349075961985171c27c410c99458d4c25614ea1d4252293c4f85b0d2ded9ac560cfd024c199d5f0f4bd47763690ba1bca88b8cc81059bb9fe82c955488523114db8c2caf8a63c0049e90ca524330b57edcf718f6a7aab0efe282079d198cc3c1294f35d1a1bf5f69a8838cfc5d4363f9ca9383f83e4f9576de3fac48866ddcde282e5e4ee3f852a063bd6423ac1fdc6201b1facd6c36609fa2faf96afc1c0b76fff27bce059ad6390fd1e3f735806ce654ed555a78ea8e59fb16ff5ac5ad183aab9de37c3d033b3018d591e7ff1a896de969f561260f797603df5fc232076ccdc2e1fe9fc789253a54af151dd50f89e777c2541591101720c893647bd4b3e6257de85251c9bcd700154e85db2a9e2c4d9d2e531a18bfaa05d16ce75f823e60416b3afebce16555536120d5f554fd13e861d74c4947a62d2d09473d8d75f03d354572b371b02e16f3976b1b0b235582ee38d938fe843b107c77c2acd88f34e1669816eb3867134b1c5fce5afad3c70f9bca972ed494577f2ba6362a6ee6b4720bd86938bb49490982a1b5ce6dd54b79f093ce27051530e1233f03d6641392d4fe7a1f7dcec8ba86d8f32f00f0ad50a29b1e17de07bd0205c0d893532c198f23656f7f5d178c0745b7e0b7e8afdd29c8fa1639a06039980d9a5fba11801db4e7868a9b77925a03a770aae3430b1ccbddb8bd766f51fef71ba25cf9184c9cfa6f9921d69066d09a656080f3c5fe475ccab94cdfccd76f3c7dada9236d1be861eb5fe6247ae9f97b7705bb71c375e8b98203c5bd224202c1aa714da47e0daf98fd3eca617f9a255df5dbe98a7520a1e6db9b88af893521f2ecf7fd2b08a7f3c5aeb77ebe6f52739b473840889c41315407477b82242d9a805f9aa200a129c4701d1c88ccd34871f356caf02da9937a88612a9755315914f4e8e1bf471a46c00650457cc06db168e5457fb3f9662994d901a1f58306156979aa795afacc1a7d6111cbea53e97fb71c7bbe44558fb06f8d78ee08e3678b5d218e13f79cf06f1da9f7e128647884589c487147b3edbdaffa16f9388568d3c8caa34a6b944e4f171842cdbb293474fcd5201b7440e05ddcf9e0b476773119516ef45077705e8bab5f877657205bf9eaaa7c86734b1b6c3661dfd4b9eb8590f962e17ad51b44058d558744e5b44cf9db280bff1062b2431d298064f11e7700ba4c8ece6f4df659d4880c4983db0152f1f903023672f6234620134bd5d1d888022da128a527d82e8fa1a562827a4f1592efe3b0bb78060626e8688ef3d5162afe9f1060123dbb1f93b7bdb6ad4ad6e1772bf8705cca424d9c42e4992eb5bef1ec7961bd4260d1e55e863fa9c8e0cb6d28b495fa37b5f59fd18cfcec6319288dd7363821e47ec46664e1994157319eb0d466b42fd9b5fac5ba979a9baf4f699dc539bf77852e18014074f88108b654219e4f9396696c94eb9fb9b360e59920f187029608bed76d09dd006f4033d384cd109726d51850202ba564599dbff7808591f834cc4084db29111de86a70217defa490e39c6e281650d15b1e44bb55164be0f6da58e838bf5f4d7cc2a23b818557ab1fad0fb2253c4da6af41591940b2608f6fa6bc25939ede95317ff96050bbc1f389235caa78adc0d801a56b2fb4cc41e73d5131552985b5af241722e0637f3b88e46b09ea875e5cf66f534666368ff8e46413e5ab557236134afa63478e18328d33b1a235deb2034955cdbb2bfd0e55fd885f380ae8efca1feea985a946519a712df1384f9e024efec61c30a6989aa3b5bd486366f3fccadc0add175c1cf0d2730ab97370eb47bcda4226ee140edbcd9b38b8ee913587125cb185adb4df18e80df2b0ea6e3e87dc8755fe6823ab5ee1feaebb1e6208cf3dd5ad5581f2388be92", 0x2000, &(0x7f0000002340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000002280)={0x18, 0x0, 0x10000, {0x7}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r1, &(0x7f00000046c0)={0x50, 0x0, r2, {0x7, 0x9, 0x4, 0x403a1810, 0xfffe, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100}}, 0x50) llistxattr(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000000, 0x11, 0xffffffffffffffff, 0x10000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r0, 0x0) openat$mice(0xffffffffffffff9c, 0x0, 0x101) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$video(&(0x7f0000000040), 0x8, 0x0) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, 0x0) migrate_pages(0x0, 0x9, &(0x7f0000000040)=0x4000000009, &(0x7f0000000380)=0x102) set_mempolicy(0x3, 0x0, 0x5) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x8) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) 3.881367145s ago: executing program 4 (id=4860): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r2, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f00000000c0)) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f00000000c0)={'\x00', 0x0, 0x9, 0x5, 0x0, 0x7043}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000140)={@remote}, 0x14) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0xc}, 0x44004) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581"], 0x0) rt_sigqueueinfo(0x0, 0x11, 0x0) ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0xc018480b, 0x0) renameat(r4, &(0x7f0000000180)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00') r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r8 = syz_open_dev$vim2m(&(0x7f0000000380), 0x7f, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000240)={0x1, @pix_mp={0x0, 0x0, 0x32314742, 0x0, 0x4, [{0x2000000}, {}, {}, {0x4}, {0x80000000}]}}) close_range(r7, 0xffffffffffffffff, 0x0) 3.818191876s ago: executing program 0 (id=4861): r0 = shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) shmctl$IPC_STAT(r0, 0x2, 0x0) 3.782647098s ago: executing program 2 (id=4862): sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r0 = add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000240)="f56ed761e9c8219d05f5e35c", 0xc, 0xfffffffffffffffe) timer_create(0x0, &(0x7f0000000040)={0x0, 0x5, 0x0, @thr={&(0x7f0000000280)="fba4d1203349aed26d4790f18c229117e0eb3d07e225583e235439d89a68f5719cbe5a1949cf1bf54fcd75e3409401fd433fa0e1728648cc894dcb046c66af1411a0bdcd96f4859c81d475498e71be26c1c49714d5c0af7e535bf248fab33a3d834824cda8cd4af077d41bf0c63d3a9c25d697a18aff725ead62b1aece38f1b89c8f8d1a9179a376159ab7d153e8360e42edbfe3ad2d70db7987dd89683e512bcee23013bc10e288f54c47e14456aad4fd17a1f2a723fb23e7e523f9b1ee3445095afac35cba29342306d8885b110e9a683a0535f52be08793e30c6a2aee2ede01d47b5ae92bd9d994", &(0x7f0000000480)="a076f35a6f2929eb8f0e4ba1fb12dccf417725063df2b0fe88d02119fa965f4330bcc896a1377e01ce4874cbd8fe8e0c079e7d4d2c8a9705ebc127a94c964e34b4ef9f268af022c98861183c923b5a3f8279ac4c615f8c0bb1cd82a0afdf1e722ee328d22fe7b2298b5a6e8e83e0291b7e5715c31f81ad119af380c4a40af0cb0477fbb40a70a213fa33c3540aa82607cb7e2af1fda96872571d38be56b8adfed32bb832ee06a6369d3209e1bd7f8c234a544711974395c9154a2429d817d09afb68e36d3be48b9890b119e58adcc9ee2f56828d4df5ad2d8fbfd5ff381dd4871bd9ee4593f2f1a4dc9fd0"}}, &(0x7f00000000c0)) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000200)=0x0) capget(&(0x7f0000000380)={0x19980330, r2}, &(0x7f0000000400)={0x879, 0x81, 0x5, 0x4, 0x9, 0x2}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000880)={0x0, @in6={{0x2, 0x4e22, 0x0, @empty, 0x1}}, 0x0, 0xeffc}, &(0x7f0000000300)=0x90) r3 = add_key$user(&(0x7f0000000100), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000580)="f8d41698ac693dfdd1f0385c57e75a792438af01c43a1a8b4b0387541275a5c65c2e1857abedbc2d4160dddd7f6180e3e1504935ef2a2ea08b0b2b116c1a19d1691b6f27ab4be7afa7b32bf2af8ac3d3aa9781f38309b4c8223661b26d53d05005c9aebe4d609bd9ceae7673dcb80fde711a9c0c473144cc23770108e572392cdcd513d1b53d106ef6ae5c889037f232a319dde28b34f9e99872648aece215291321808b679bcd7c6e309d8bdbf89feac20b21bc1965833fc9d2abd33c2b22ce8ab533c81a95097a08d62e586a8ac5c97785cb5fcb", 0xd5, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r3, r0}, 0x0, 0x0, 0x0) 3.433593986s ago: executing program 2 (id=4863): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x442, 0x0) readv(r0, &(0x7f00000014c0)=[{&(0x7f0000000380)=""/52, 0x34}], 0x35) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)=0x401) (fail_nth: 2) 3.429025083s ago: executing program 0 (id=4864): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000012c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109024a0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e", @ANYRESHEX], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = fsopen(&(0x7f0000000040)='sysfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x5) mount_setattr(r2, &(0x7f0000000000)='.\x00', 0x0, &(0x7f0000000200)={0x85}, 0x20) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r3, 0x40015b19, &(0x7f0000000000)={0xffffffff, 0xfffffffe, 0x7, 0xff, 0x1}) write$char_usb(r3, &(0x7f0000002680)="e7", 0x1) r4 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50}, 0x0) recvmmsg$unix(r4, &(0x7f0000001800)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000004740)=""/199, 0xc7}, {&(0x7f0000001680)=""/249, 0xf9}, {&(0x7f0000004940)=""/255, 0xff}, {&(0x7f0000000480)=""/193, 0xc1}, {&(0x7f0000000580)=""/4072, 0xfe8}, {&(0x7f0000005c00)=""/253, 0xfd}, {&(0x7f0000001580)=""/226, 0xe2}], 0x7}}], 0x1, 0x0, 0x0) write(r4, &(0x7f0000000100), 0x0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000040), &(0x7f0000000080)=0x4) r5 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) r6 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e27, 0x1, @mcast2, 0xff7ffffd}}, {{0xa, 0xce07, 0x4, @empty, 0x4ed}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000380)={0x2, {{0xa, 0x4e20, 0x1, @mcast1, 0x1000}}, {{0xa, 0x4e22, 0x7, @empty, 0x3ff}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r6, 0x29, 0x30, &(0x7f00000004c0)={0x3, {{0xa, 0x5e22, 0xc, @mcast1, 0x408}}, 0x1, 0x1, [{{0xa, 0x4e24, 0xb, @mcast1, 0x2}}]}, 0x110) unshare(0x22020400) r7 = syz_clone3(&(0x7f0000001880)={0x100000200, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, 0x0}, 0x58) socket(0x3, 0x6, 0x0) tgkill(r7, r7, 0x11) ioctl$VIDIOC_S_OUTPUT(r5, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_ENUM_DV_TIMINGS(r5, 0xc0945662, &(0x7f00000000c0)={0x3ff, 0x0, '\x00', {0x0, @reserved}}) r8 = io_uring_setup(0x732d, &(0x7f0000000980)={0x0, 0x3ea, 0x0, 0x1, 0x98}) io_uring_register$IORING_UNREGISTER_NAPI(r8, 0x1c, 0x0, 0x7ffffffe) socket$rds(0x15, 0x5, 0x0) 2.666319466s ago: executing program 2 (id=4865): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/wakeup_count', 0x181000, 0x21) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0x5, 0xffffffff}, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x89021080, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = userfaultfd(0x80001) syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000340)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xd, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0xb2, 0x2, 0x7, 0x1, 0x2, 0x2a, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x4, 0x6, 0x7}}}}}]}}]}}, &(0x7f0000000700)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x200, 0x3, 0x80, 0x6, 0x40, 0x6}, 0x52, &(0x7f0000000500)={0x5, 0xf, 0x52, 0x6, [@wireless={0xb, 0x10, 0x1, 0x69280663dcd7bd82, 0x50, 0xe, 0x0, 0x9, 0x48}, @ssp_cap={0xc, 0x10, 0xa, 0x3, 0x0, 0x3, 0xf000, 0xf8d}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "f8314de0364efd9c1e2e926b755476d8"}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "cef13e5ecc1c4739c025c1cd00"}, @wireless={0xb, 0x10, 0x1, 0x8, 0xdb, 0x0, 0x3e, 0xa91, 0x4}, @ptm_cap={0x3}]}, 0x4, [{0x49, &(0x7f0000000580)=@string={0x49, 0x3, "37b91b4f0e8348a73a1833a50196252337e82802f07a169efaee0df7c291e40e5c754b67906c480aeb9712b2c34258953a6bc33f90d83dad678435a3c28583d6303fab4dfe07ca"}}, {0x25, &(0x7f0000000480)=ANY=[]}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x409}}, {0x8d, &(0x7f0000000640)=@string={0x8d, 0x3, "1632a15e1cb7e7507ef09f55487836200053dfac3324826270631195aa5fe088b2b38c0c2a7d5aa1f8e0d21bd65f53a35e0b2e5be6d5fde80c409d94830505b88bad3f223f8bd865efa20300d02853c994067446b7d3132c22f9dab057fc5f41153294ff3fa39c47ba3d161ae55f69f9d8016a4d8fc438c4e1ce6cfb56014a752855cb82d4ccb0555ae848"}}]}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020b"], 0x10}}, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[], 0x48) splice(r1, 0x0, r3, 0x0, 0x3000, 0x100000000000000d) 2.513887366s ago: executing program 1 (id=4866): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0xb173, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000040)={0x3b, 0x1, 0x2, "4749570000000000000000000e1609d600", 0x20493859}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x48) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="20010000000000000000000000000002000004d233000000fe8000000000000000000000000000bb01000080000000000c082c500000000000000000000000000b00000000000000070000000000000005000000000000000600000000000000070000000000000001000100000000000300000000000000130d00000000000006000000000000000600000006000000d6a500002abd7000073500000a"], 0x184}, 0x1, 0x0, 0x0, 0x40000}, 0x4840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x0, 0xffffffff}, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f00006ef000/0x4000)=nil, 0x4000, 0x9, 0x10, 0xffffffffffffffff, 0x8000000) r5 = syz_open_dev$vim2m(&(0x7f0000000200), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000003c0)={0x2, 0x1, 0x1}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r10, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r10, 0x84, 0x9, &(0x7f0000000200)={r11, @in={{0x2, 0x4e23, @empty}}, 0x7, 0x400, 0x2, 0x41, 0x6, 0xffff, 0x10}, &(0x7f0000000080)=0x9c) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r9}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x24048180) sendmsg$TIPC_CMD_GET_NODES(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r7, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x880) ioctl$vim2m_VIDIOC_DQBUF(r5, 0xc0585611, &(0x7f0000000040)=@overlay={0x0, 0x1, 0x4, 0x0, 0xd, {}, {0x4, 0x0, 0x0, 0x1, 0x0, 0x0, "12848098"}, 0x3}) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0xffffffff, 0x1, 0x4, 0x0, 0x0, {}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, "a730b801"}, 0x0, 0x1, {0x0}}) openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) 1.617305902s ago: executing program 5 (id=4867): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r0, 0x29, 0x4a, 0xfffffffffffffffd, 0x0) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000080)=ANY=[@ANYBLOB="0600000004000000008000005c00000000000000", @ANYRES32, @ANYRESDEC=r0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000feffffff00"/28], 0x48) 1.225412852s ago: executing program 5 (id=4868): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474d, 0x4) connect$inet(r0, &(0x7f00000002c0)={0x2, 0xc22, @remote}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000080)=ANY=[], &(0x7f0000000000)=0x28) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) r3 = syz_open_procfs$pagemap(0x0, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00'], 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x0) recvmmsg$unix(r4, 0x0, 0x0, 0x0, 0x0) write(r4, &(0x7f0000000100), 0x0) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, 0x0) r5 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r5, 0xc0145608, 0x0) ioctl$VIDIOC_PREPARE_BUF(r5, 0xc058565d, &(0x7f0000000500)=@userptr={0x6, 0xa, 0x4, 0x1, 0x0, {0x0, 0x2710}, {0x1, 0xc, 0xd2, 0x6, 0x77, 0x6, "0080ca6f"}, 0xff, 0x2, {&(0x7f00000002c0)}, 0x6}) r6 = syz_usb_connect(0x2, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001d9167204f17316a3f26010203010902120001000000000904"], 0x0) umount2(&(0x7f0000000040)='./file0\x00', 0x0) syz_usb_ep_write$ath9k_ep1(r6, 0x82, 0xb0, &(0x7f0000001580)={[{}, {0x75, 0x4e00, "11a9ecdc84ecf563b48503f2379eb70daa17bf511c2c78a8647c90bd1dc89e15e18eedfbe9997224454a0cbcf7751c495c791f696ea866b67fea29f8b51285a224fd21fa6e0794fe04c177ae96c4c9d5056f465b6db53a1de2ae5ddee649c880563165395710502ec60c816a8ed25283d30fc4f3a8"}, {0x2c, 0x4e00, "9bbf61f7054c7235b339dbb2fe32784c40a9cb1b5f06cac0da3ae81523de84c6e5499658e126e08a7b62bc33"}]}) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x20000023896) 568.018639ms ago: executing program 2 (id=4869): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000b00), 0x0, 0x400122a0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f0000000300)=@gcm_128={{0x303}, "fc674d000000f8f7", "c5991ee20139b401046a89606ffcf92e", "2c5be7c6", "a0ca05c0707e52f4"}, 0x28) recvfrom$inet6(r5, &(0x7f00000000c0)=""/3, 0x3, 0x300, 0x0, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)=0x0) timer_settime(r7, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) splice(r5, 0x0, r4, 0x0, 0x10000008ebc, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) 0s ago: executing program 0 (id=4870): syz_80211_join_ibss(&(0x7f0000000180)='wlan1\x00', &(0x7f0000000200)=@default_ibss_ssid, 0x6, 0x2) kernel console output (not intermixed with test programs): for writing: No such file or directory [ 1297.130948][ T1168] usbtmc 1-1:16.0: can't read capabilities [ 1297.159126][T13769] usb 4-1: device descriptor read/8, error -71 [ 1297.302614][T22670] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4515'. [ 1297.431717][T13769] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 1297.453580][T13769] usb 4-1: device descriptor read/8, error -71 [ 1297.476111][ C1] usbtmc 1-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1297.488194][T22673] usbtmc 1-1:16.0: Unable to send data, error -71 [ 1297.496023][T22673] usbtmc 1-1:16.0: usb_control_msg returned -32 [ 1297.571870][T13769] usb usb4-port1: unable to enumerate USB device [ 1297.621602][ T1168] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1297.688513][T22676] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4517'. [ 1297.846292][ T1168] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1297.871783][ T1168] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1297.897672][ T1168] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1297.924192][ T1168] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 1297.945105][ T1168] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1297.978837][ T1168] usb 3-1: config 0 descriptor?? [ 1298.109187][T22683] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4519'. [ 1298.120461][T22683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1298.130873][T22683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1298.203326][T22672] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1298.214843][T22687] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.4520'. [ 1298.217594][T22672] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1298.249170][T13789] usb 1-1: USB disconnect, device number 43 [ 1298.310272][ T1168] ath6kl: Failed to submit usb control message: -71 [ 1298.324228][ T1168] ath6kl: unable to send the bmi data to the device: -71 [ 1298.331605][ T1168] ath6kl: Unable to send get target info: -71 [ 1298.338934][ T1168] ath6kl: Failed to init ath6kl core: -71 [ 1298.346967][ T1168] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 1298.366305][ T1168] usb 3-1: USB disconnect, device number 30 [ 1298.799286][ T47] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 1298.971582][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 1298.978701][ T47] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1299.001622][T13769] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 1299.034755][ T47] usb 5-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 1299.045219][ T47] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1299.053924][ T47] usb 5-1: Product: syz [ 1299.058654][ T47] usb 5-1: Manufacturer: syz [ 1299.064954][ T47] usb 5-1: SerialNumber: syz [ 1299.076368][T22706] FAULT_INJECTION: forcing a failure. [ 1299.076368][T22706] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1299.092496][T22706] CPU: 1 UID: 0 PID: 22706 Comm: syz.2.4525 Tainted: G L syzkaller #0 PREEMPT(full) [ 1299.092539][T22706] Tainted: [L]=SOFTLOCKUP [ 1299.092545][T22706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1299.092556][T22706] Call Trace: [ 1299.092563][T22706] [ 1299.092571][T22706] dump_stack_lvl+0xe8/0x150 [ 1299.092602][T22706] should_fail_ex+0x412/0x560 [ 1299.092635][T22706] _copy_from_user+0x2d/0xb0 [ 1299.092658][T22706] __sys_sendto+0x2af/0x7a0 [ 1299.092687][T22706] ? __pfx___sys_sendto+0x10/0x10 [ 1299.092711][T22706] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1299.092749][T22706] ? __fget_files+0x3a0/0x420 [ 1299.092778][T22706] ? ksys_write+0x242/0x270 [ 1299.092808][T22706] ? __pfx_ksys_write+0x10/0x10 [ 1299.092840][T22706] __x64_sys_sendto+0xde/0x100 [ 1299.092870][T22706] do_syscall_64+0xe2/0xf80 [ 1299.092894][T22706] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1299.092913][T22706] ? trace_irq_disable+0x37/0x100 [ 1299.092931][T22706] ? clear_bhb_loop+0x60/0xb0 [ 1299.092955][T22706] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1299.092975][T22706] RIP: 0033:0x7f6753b9af79 [ 1299.092993][T22706] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1299.093011][T22706] RSP: 002b:00007f6754ae9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1299.093033][T22706] RAX: ffffffffffffffda RBX: 00007f6753e15fa0 RCX: 00007f6753b9af79 [ 1299.093049][T22706] RDX: 0000000000000036 RSI: 0000200000000100 RDI: 0000000000000003 [ 1299.093062][T22706] RBP: 00007f6754ae9090 R08: 0000200000000200 R09: 0000000000000014 [ 1299.093076][T22706] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1299.093088][T22706] R13: 00007f6753e16038 R14: 00007f6753e15fa0 R15: 00007f6753f3fa48 [ 1299.093121][T22706] [ 1299.094570][ T47] usb 5-1: config 0 descriptor?? [ 1299.461496][T13769] usb 4-1: Using ep0 maxpacket: 16 [ 1299.488819][T13769] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1299.510084][T22710] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4526'. [ 1299.564162][T13769] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1299.574179][T13769] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1299.582702][T13769] usb 4-1: Product: syz [ 1299.643506][T13769] usb 4-1: Manufacturer: syz [ 1299.648609][T13769] usb 4-1: SerialNumber: syz [ 1299.669591][T13769] usb 4-1: config 0 descriptor?? [ 1299.757593][T13769] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1299.768489][T13769] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 1300.324346][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.330832][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.332980][T13769] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1300.511625][ T5890] usb 1-1: new low-speed USB device number 44 using dummy_hcd [ 1300.680422][ T5890] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1300.710993][ T5890] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1300.731758][ T5890] usb 1-1: New USB device found, idVendor=258a, idProduct=0036, bcdDevice= 0.00 [ 1300.741275][ T5890] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1300.795316][ T5890] usb 1-1: config 0 descriptor?? [ 1300.809534][T13769] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1300.820356][T13769] em28xx 4-1:0.0: board has no eeprom [ 1301.024263][T22719] FAULT_INJECTION: forcing a failure. [ 1301.024263][T22719] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1301.041568][T22719] CPU: 1 UID: 0 PID: 22719 Comm: syz.1.4529 Tainted: G L syzkaller #0 PREEMPT(full) [ 1301.041608][T22719] Tainted: [L]=SOFTLOCKUP [ 1301.041616][T22719] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1301.041628][T22719] Call Trace: [ 1301.041637][T22719] [ 1301.041646][T22719] dump_stack_lvl+0xe8/0x150 [ 1301.041678][T22719] should_fail_ex+0x412/0x560 [ 1301.041711][T22719] _copy_from_user+0x2d/0xb0 [ 1301.041733][T22719] xfrm_user_policy+0x2e7/0x960 [ 1301.041760][T22719] ? __pfx_xfrm_user_policy+0x10/0x10 [ 1301.041778][T22719] ? apparmor_capable+0x137/0x1a0 [ 1301.041804][T22719] ? bpf_lsm_capable+0x9/0x20 [ 1301.041827][T22719] ? security_capable+0x7e/0x2c0 [ 1301.041862][T22719] do_ip_setsockopt+0x1aab/0x2ea0 [ 1301.041902][T22719] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 1301.041932][T22719] ? aa_sk_perm+0x82d/0x960 [ 1301.041959][T22719] ? __fget_files+0x2a/0x420 [ 1301.041986][T22719] ? __pfx_aa_sk_perm+0x10/0x10 [ 1301.042015][T22719] ? __fget_files+0x2a/0x420 [ 1301.042033][T22719] ? aa_sock_opt_perm+0xff/0x1a0 [ 1301.042063][T22719] ip_setsockopt+0x66/0x110 [ 1301.042080][T22719] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1301.042107][T22719] do_sock_setsockopt+0x17c/0x1b0 [ 1301.042140][T22719] __x64_sys_setsockopt+0x13d/0x1b0 [ 1301.042174][T22719] do_syscall_64+0xe2/0xf80 [ 1301.042197][T22719] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1301.042216][T22719] ? trace_irq_disable+0x37/0x100 [ 1301.042233][T22719] ? clear_bhb_loop+0x60/0xb0 [ 1301.042258][T22719] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1301.042277][T22719] RIP: 0033:0x7f822e99af79 [ 1301.042317][T22719] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1301.042333][T22719] RSP: 002b:00007f822f936028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1301.042356][T22719] RAX: ffffffffffffffda RBX: 00007f822ec15fa0 RCX: 00007f822e99af79 [ 1301.042372][T22719] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000003 [ 1301.042385][T22719] RBP: 00007f822f936090 R08: 00000000000000b8 R09: 0000000000000000 [ 1301.042398][T22719] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 1301.042411][T22719] R13: 00007f822ec16038 R14: 00007f822ec15fa0 R15: 00007f822ed3fa48 [ 1301.042532][T22719] [ 1301.393678][ T47] usb 5-1: USB disconnect, device number 51 [ 1301.407694][ T5890] usbhid 1-1:0.0: can't add hid device: -71 [ 1301.414332][ T5890] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1301.425835][ T5890] usb 1-1: USB disconnect, device number 44 [ 1301.555951][T13769] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1301.564272][T13769] em28xx 4-1:0.0: dvb set to bulk mode. [ 1301.570053][ T5883] em28xx 4-1:0.0: Binding DVB extension [ 1302.211577][ T5890] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 1302.407854][ T5890] usb 3-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1302.423529][ T5890] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1302.505028][T22758] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4541'. [ 1302.514209][ T47] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 1302.554427][ T5890] usb 3-1: Product: syz [ 1302.585275][ T5890] usb 3-1: Manufacturer: syz [ 1302.590059][ T5890] usb 3-1: SerialNumber: syz [ 1302.606714][ T5890] usb 3-1: config 0 descriptor?? [ 1302.643208][ T5890] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1302.681986][ T47] usb 1-1: Using ep0 maxpacket: 32 [ 1302.689000][ T47] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1302.697727][ T47] usb 1-1: config 0 has no interface number 0 [ 1302.707736][ T47] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1302.719404][ T47] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1302.739019][ T47] usb 1-1: Product: syz [ 1302.744000][T22696] em28xx 4-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 1302.767102][ T47] usb 1-1: Manufacturer: syz [ 1302.776598][ T47] usb 1-1: SerialNumber: syz [ 1302.807133][ T47] usb 1-1: config 0 descriptor?? [ 1302.858592][ T47] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1302.886113][ T47] usb 1-1: selecting invalid altsetting 1 [ 1302.908589][ T47] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1302.917872][ T5883] em28xx 4-1:0.0: Registering input extension [ 1302.972626][ T47] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1303.019439][ T47] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1303.047975][ T47] usb 1-1: media controller created [ 1303.100219][ T47] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1303.171871][ T5890] gspca_stk1135: reg_w 0x2 err -110 [ 1303.178597][ T5890] gspca_stk1135: serial bus timeout: status=0x00 [ 1303.185542][ T5890] gspca_stk1135: Sensor write failed [ 1303.194906][ T5890] gspca_stk1135: serial bus timeout: status=0x00 [ 1303.213519][ T5890] gspca_stk1135: Sensor write failed [ 1303.235741][ T5890] gspca_stk1135: serial bus timeout: status=0x00 [ 1303.255330][ T5890] gspca_stk1135: Sensor read failed [ 1303.267324][ T5890] gspca_stk1135: serial bus timeout: status=0x00 [ 1303.282780][ T5890] gspca_stk1135: Sensor read failed [ 1303.299731][ T5890] gspca_stk1135: Detected sensor type unknown (0x0) [ 1303.317482][ T5890] gspca_stk1135: serial bus timeout: status=0x00 [ 1303.331081][ T5890] gspca_stk1135: Sensor read failed [ 1303.345259][ T5890] gspca_stk1135: serial bus timeout: status=0x00 [ 1303.360644][ T5890] gspca_stk1135: Sensor read failed [ 1303.372575][ T5890] gspca_stk1135: serial bus timeout: status=0x00 [ 1303.389722][ T5890] gspca_stk1135: Sensor write failed [ 1303.398591][ T47] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1303.415048][ T5890] gspca_stk1135: serial bus timeout: status=0x00 [ 1303.436182][ T5890] gspca_stk1135: Sensor write failed [ 1303.447396][ T5890] stk1135 3-1:0.0: probe with driver stk1135 failed with error -110 [ 1303.506893][ T47] usb 1-1: USB disconnect, device number 45 [ 1303.616401][ T5890] usb 4-1: USB disconnect, device number 41 [ 1303.637783][ T5890] em28xx 4-1:0.0: Disconnecting em28xx [ 1303.680952][ T5890] em28xx 4-1:0.0: Closing input extension [ 1303.781990][ T5890] em28xx 4-1:0.0: Freeing device [ 1304.067294][T22771] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4544'. [ 1305.131986][T22778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1305.179771][T22778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1305.297526][T13789] usb 3-1: USB disconnect, device number 31 [ 1305.345974][T22783] FAULT_INJECTION: forcing a failure. [ 1305.345974][T22783] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1305.431345][T22783] CPU: 0 UID: 0 PID: 22783 Comm: syz.4.4548 Tainted: G L syzkaller #0 PREEMPT(full) [ 1305.431386][T22783] Tainted: [L]=SOFTLOCKUP [ 1305.431401][T22783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1305.431413][T22783] Call Trace: [ 1305.431422][T22783] [ 1305.431431][T22783] dump_stack_lvl+0xe8/0x150 [ 1305.431463][T22783] should_fail_ex+0x412/0x560 [ 1305.431495][T22783] _copy_from_user+0x2d/0xb0 [ 1305.431518][T22783] sk_setsockopt+0x2b3/0x2e80 [ 1305.431555][T22783] ? __pfx_sk_setsockopt+0x10/0x10 [ 1305.431579][T22783] ? aa_sk_perm+0x15a/0x960 [ 1305.431608][T22783] ? aa_sk_perm+0x82d/0x960 [ 1305.431642][T22783] ? __pfx_aa_sk_perm+0x10/0x10 [ 1305.431671][T22783] ? aa_sock_opt_perm+0xff/0x1a0 [ 1305.431703][T22783] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1305.431727][T22783] do_sock_setsockopt+0x11b/0x1b0 [ 1305.431760][T22783] __x64_sys_setsockopt+0x13d/0x1b0 [ 1305.431792][T22783] do_syscall_64+0xe2/0xf80 [ 1305.431816][T22783] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1305.431835][T22783] ? trace_irq_disable+0x37/0x100 [ 1305.431853][T22783] ? clear_bhb_loop+0x60/0xb0 [ 1305.431876][T22783] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1305.431896][T22783] RIP: 0033:0x7f03f4f9af79 [ 1305.431914][T22783] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1305.431932][T22783] RSP: 002b:00007f03f5da3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1305.431955][T22783] RAX: ffffffffffffffda RBX: 00007f03f5215fa0 RCX: 00007f03f4f9af79 [ 1305.431969][T22783] RDX: 000000000000003c RSI: 0000000000000001 RDI: 0000000000000003 [ 1305.431981][T22783] RBP: 00007f03f5da3090 R08: 0000000000000004 R09: 0000000000000000 [ 1305.431994][T22783] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1305.432007][T22783] R13: 00007f03f5216038 R14: 00007f03f5215fa0 R15: 00007f03f533fa48 [ 1305.432039][T22783] [ 1306.541285][T22812] syzkaller0: entered promiscuous mode [ 1306.550079][T22812] syzkaller0: entered allmulticast mode [ 1306.889848][ T5883] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 1307.164989][ T5883] usb 3-1: Using ep0 maxpacket: 32 [ 1307.293037][ T5883] usb 3-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 1307.312352][ T5883] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1307.471557][ T5883] usb 3-1: Product: syz [ 1307.538545][ T5883] usb 3-1: Manufacturer: syz [ 1307.560781][ T5883] usb 3-1: SerialNumber: syz [ 1307.587022][ T5883] usb 3-1: config 0 descriptor?? [ 1307.808505][T22812] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1307.818615][T22812] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1307.830298][ T5883] RobotFuzz Open Source InterFace, OSIF 3-1:0.0: failure sending bit rate [ 1307.844979][ T5883] RobotFuzz Open Source InterFace, OSIF 3-1:0.0: probe with driver RobotFuzz Open Source InterFace, OSIF failed with error -71 [ 1307.929502][ T5883] usb 3-1: USB disconnect, device number 32 [ 1307.961970][T22819] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4557'. [ 1307.972045][T22821] loop5: detected capacity change from 0 to 7 [ 1307.992080][T22821] Dev loop5: unable to read RDB block 7 [ 1308.034326][T22821] loop5: AHDI p1 [ 1308.039897][T22821] loop5: partition table partially beyond EOD, truncated [ 1308.348715][T21093] Bluetooth: hci3: unexpected event for opcode 0x041b [ 1308.494922][ T5883] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 1308.676589][ T5883] usb 4-1: Using ep0 maxpacket: 32 [ 1308.693817][ T5883] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1308.741565][ T5890] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 1308.779771][ T5883] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1308.859885][ T5883] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1308.870014][ T5883] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 1308.904152][ T5883] usb 4-1: Product: syz [ 1308.911782][ T5883] usb 4-1: Manufacturer: syz [ 1308.922150][ T5890] usb 1-1: Using ep0 maxpacket: 32 [ 1308.933729][ T5890] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1308.960365][ T5883] hub 4-1:4.0: USB hub found [ 1308.969433][ T5890] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1308.984368][ T5890] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1308.995858][ T5890] usb 1-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 1309.004855][ T5890] usb 1-1: Product: syz [ 1309.009604][ T5890] usb 1-1: Manufacturer: syz [ 1309.043770][ T5890] hub 1-1:4.0: USB hub found [ 1309.132059][ T1168] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 1309.180047][ T5883] hub 4-1:4.0: 2 ports detected [ 1309.197648][T22838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1309.223224][T22838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1309.257478][ T5890] hub 1-1:4.0: 2 ports detected [ 1309.281846][ T1168] usb 5-1: device descriptor read/64, error -71 [ 1309.382058][ T5883] hub 4-1:4.0: hub_hub_status failed (err = -71) [ 1309.388554][ T5883] hub 4-1:4.0: config failed, can't get hub status (err -71) [ 1309.423480][ T5883] usb 4-1: USB disconnect, device number 42 [ 1309.521902][ T1168] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 1309.568386][ T5890] hub 1-1:4.0: hub_hub_status failed (err = -71) [ 1309.596492][ T5890] hub 1-1:4.0: config failed, can't get hub status (err -71) [ 1309.632205][ T5890] usb 1-1: USB disconnect, device number 46 [ 1309.661788][ T1168] usb 5-1: device descriptor read/64, error -71 [ 1309.771995][ T1168] usb usb5-port1: attempt power cycle [ 1310.111589][ T1168] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 1310.120475][T22843] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1310.147274][T22843] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1310.167112][ T1168] usb 5-1: device descriptor read/8, error -71 [ 1310.335204][T22847] netlink: 148 bytes leftover after parsing attributes in process `syz.3.4566'. [ 1310.543059][ T1168] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 1310.672269][ T1168] usb 5-1: device descriptor read/8, error -71 [ 1310.745137][T13769] usb 3-1: new low-speed USB device number 33 using dummy_hcd [ 1310.782877][ T1168] usb usb5-port1: unable to enumerate USB device [ 1310.921747][T13769] usb 3-1: config 65 has an invalid interface number: 95 but max is 0 [ 1310.938346][T13769] usb 3-1: config 65 has no interface number 0 [ 1310.958283][T13769] usb 3-1: string descriptor 0 read error: -22 [ 1310.969614][T13769] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=6f.b6 [ 1310.992525][T13769] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1311.046386][T22860] netlink: 148 bytes leftover after parsing attributes in process `syz.1.4569'. [ 1311.126445][T13769] usbtest 3-1:65.95: Linux gadget zero [ 1311.150106][T13769] usbtest 3-1:65.95: low-speed {control in/out} tests (+alt) [ 1311.277573][T13769] usb 3-1: USB disconnect, device number 33 [ 1311.577768][T13789] IPVS: starting estimator thread 0... [ 1311.682258][T22868] IPVS: using max 51 ests per chain, 122400 per kthread [ 1311.711848][T13769] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 1311.861889][T13769] usb 1-1: Using ep0 maxpacket: 16 [ 1311.893738][T13769] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1311.921232][T13769] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1311.939817][T13769] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1311.947590][T13769] usb 1-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 1311.956993][T13769] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1311.972495][T13769] usb 1-1: config 0 descriptor?? [ 1312.171473][ T1168] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1312.190443][T22865] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1312.202228][T22865] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1312.323561][ T1168] usb 3-1: device descriptor read/64, error -71 [ 1312.422937][T21093] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 1312.434379][T21093] Bluetooth: hci3: Injecting HCI hardware error event [ 1312.444792][ T5144] Bluetooth: hci3: hardware error 0x00 [ 1312.504797][T13769] cougar 0003:060B:500A.0018: unknown main item tag 0x0 [ 1312.514430][T13769] cougar 0003:060B:500A.0018: unknown main item tag 0x0 [ 1312.523182][T13769] cougar 0003:060B:500A.0018: unknown main item tag 0x0 [ 1312.530489][T13769] cougar 0003:060B:500A.0018: unknown main item tag 0x0 [ 1312.541145][T13769] cougar 0003:060B:500A.0018: unknown main item tag 0x0 [ 1312.551278][T13769] cougar 0003:060B:500A.0018: unknown main item tag 0x0 [ 1312.562626][T13769] cougar 0003:060B:500A.0018: unknown main item tag 0x0 [ 1312.574559][T13769] cougar 0003:060B:500A.0018: unknown main item tag 0x0 [ 1312.583046][T13769] cougar 0003:060B:500A.0018: unknown main item tag 0x0 [ 1312.592212][T13769] cougar 0003:060B:500A.0018: unknown main item tag 0x0 [ 1312.592472][ T1168] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1312.604239][T13769] cougar 0003:060B:500A.0018: unexpected long global item [ 1312.787723][T13769] cougar 0003:060B:500A.0018: parse failed [ 1312.811752][T13769] cougar 0003:060B:500A.0018: probe with driver cougar failed with error -22 [ 1312.850769][ T982] usb 5-1: new low-speed USB device number 56 using dummy_hcd [ 1312.896662][T13769] usb 1-1: USB disconnect, device number 47 [ 1312.965820][ T1168] usb 3-1: device descriptor read/64, error -71 [ 1313.066940][ T982] usb 5-1: config 65 has an invalid interface number: 95 but max is 0 [ 1313.076602][ T982] usb 5-1: config 65 has no interface number 0 [ 1313.092206][ T1168] usb usb3-port1: attempt power cycle [ 1313.092334][ T982] usb 5-1: string descriptor 0 read error: -22 [ 1313.114393][ T982] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=6f.b6 [ 1313.130707][ T982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1313.166073][ T982] usbtest 5-1:65.95: Linux gadget zero [ 1313.172848][ T982] usbtest 5-1:65.95: low-speed {control in/out} tests (+alt) [ 1313.290611][T22893] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4580'. [ 1313.438633][ T982] usb 5-1: USB disconnect, device number 56 [ 1313.462427][ T1168] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 1313.554125][ T1168] usb 3-1: device descriptor read/8, error -71 [ 1313.803536][ T1168] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 1313.832257][ T1168] usb 3-1: device descriptor read/8, error -71 [ 1313.923331][T22905] netlink: 148 bytes leftover after parsing attributes in process `syz.1.4583'. [ 1313.977851][ T1168] usb usb3-port1: unable to enumerate USB device [ 1314.461616][ T5890] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 1314.502759][ T5144] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 1314.621732][ T5890] usb 5-1: Using ep0 maxpacket: 32 [ 1314.635079][ T5890] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1314.662552][ T5890] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1314.698900][ T5890] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1314.710805][ T5890] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1314.805552][ T5890] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1314.814971][ T5890] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1314.833248][ T5890] usb 5-1: Product: syz [ 1314.841571][ T5890] usb 5-1: Manufacturer: syz [ 1314.852380][ T5890] usb 5-1: SerialNumber: syz [ 1314.886948][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1314.930285][ T5890] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input74 [ 1315.042208][T13769] usb 1-1: new low-speed USB device number 48 using dummy_hcd [ 1315.126734][ T5890] imon:send_packet: packet tx failed (-71) [ 1315.171524][ T5890] imon 5-1:155.0: panel buttons/knobs setup failed [ 1315.179212][ T5890] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1315.212865][T22919] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4588'. [ 1315.248698][ T5890] (id 0x00) [ 1315.252347][T13769] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1315.351483][T13769] usb 1-1: config 0 has no interface number 0 [ 1315.367901][T13769] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1315.455338][T13769] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1315.494017][T13769] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1315.535102][ T5890] rc_core: IR keymap rc-imon-pad not found [ 1315.541185][T13769] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1315.553718][ T5890] Registered IR keymap rc-empty [ 1315.561301][ T5890] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1315.577066][T13769] usb 1-1: config 0 descriptor?? [ 1315.591908][T22915] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 1315.603046][ T5890] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1315.620822][T13769] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1315.661594][ T5890] imon:send_packet: packet tx failed (-71) [ 1315.724723][ T5890] imon 5-1:155.0: remote input dev register failed [ 1315.732030][ T5890] imon 5-1:155.0: imon_init_intf0: rc device setup failed [ 1315.836792][ T47] usb 1-1: USB disconnect, device number 48 [ 1315.887731][ T5890] imon 5-1:155.0: unable to initialize intf0, err 0 [ 1315.940126][ T5890] imon:imon_probe: failed to initialize context! [ 1315.963584][ T5890] imon 5-1:155.0: unable to register, err -19 [ 1315.994569][ T5890] usb 5-1: USB disconnect, device number 57 [ 1316.447233][ T5890] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 1316.621521][ T5890] usb 5-1: Using ep0 maxpacket: 8 [ 1316.628430][ T5890] usb 5-1: config index 0 descriptor too short (expected 74, got 45) [ 1316.691297][ T5890] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 1316.721730][ T5890] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1316.759541][ T5890] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 1316.889126][ T5890] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1316.919869][ T5890] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1316.958658][ T5890] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1316.974702][ T5890] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1317.476230][ T5890] usb 5-1: usb_control_msg returned -32 [ 1317.668132][ T5890] usbtmc 5-1:16.0: can't read capabilities [ 1317.851343][ C0] usbtmc 5-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1317.864334][T22939] usbtmc 5-1:16.0: Unable to send data, error -71 [ 1317.872471][T22939] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 1318.991520][ T982] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 1319.154459][ T982] usb 4-1: Using ep0 maxpacket: 8 [ 1319.160563][ T982] usb 4-1: no configurations [ 1319.165663][ T982] usb 4-1: can't read configurations, error -22 [ 1319.170105][T22960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1319.185546][T22960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1319.262456][T22963] loop3: detected capacity change from 0 to 8487 [ 1319.297803][ T5897] usb 5-1: USB disconnect, device number 58 [ 1319.313071][ T982] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 1319.340928][T12399] buffer_io_error: 11 callbacks suppressed [ 1319.340943][T12399] Buffer I/O error on dev loop3, logical block 1060, async page read [ 1319.358165][T22966] netlink: 148 bytes leftover after parsing attributes in process `syz.0.4600'. [ 1319.485816][T22965] loop3: detected capacity change from 8487 to 9135 [ 1319.510626][T22968] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4601'. [ 1319.571999][T12399] Buffer I/O error on dev loop3, logical block 1141, async page read [ 1319.641574][ T982] usb 4-1: Using ep0 maxpacket: 8 [ 1319.649132][ T982] usb 4-1: no configurations [ 1319.654032][ T982] usb 4-1: can't read configurations, error -22 [ 1319.661188][ T982] usb usb4-port1: attempt power cycle [ 1319.841578][ T47] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 1320.013449][ T47] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1320.038648][ T47] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1320.050976][ T47] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1320.064557][ T47] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 1320.074322][ T47] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1320.096188][ T47] usb 3-1: config 0 descriptor?? [ 1320.131989][ T982] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 1320.162651][ T982] usb 4-1: Using ep0 maxpacket: 8 [ 1320.181234][ T982] usb 4-1: no configurations [ 1320.189755][ T982] usb 4-1: can't read configurations, error -22 [ 1320.319758][T22971] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1320.330511][T22971] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1320.345242][ T47] ath6kl: Failed to submit usb control message: -71 [ 1320.362371][ T982] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 1320.379397][ T47] ath6kl: unable to send the bmi data to the device: -71 [ 1320.395117][ T47] ath6kl: Unable to send get target info: -71 [ 1320.419060][ T47] ath6kl: Failed to init ath6kl core: -71 [ 1320.429393][ T982] usb 4-1: Using ep0 maxpacket: 8 [ 1320.436078][ T47] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 1320.457345][ T982] usb 4-1: no configurations [ 1320.464193][ T982] usb 4-1: can't read configurations, error -22 [ 1320.476311][ T47] usb 3-1: USB disconnect, device number 38 [ 1320.488120][ T982] usb usb4-port1: unable to enumerate USB device [ 1320.749999][T22984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1320.778102][T22984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1320.911556][ T47] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 1320.920869][T22984] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1320.937157][T22984] 8021q: adding VLAN 0 to HW filter on device team0 [ 1320.972636][T22984] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1321.086247][T22995] bond0: (slave veth0_to_hsr): Error: Device can not be enslaved while up [ 1321.155807][ T47] usb 1-1: Using ep0 maxpacket: 8 [ 1321.170014][ T47] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 1321.186095][ T47] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1321.217920][ T47] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1321.240985][ T47] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1321.259518][ T47] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1321.282102][ T47] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1321.291851][ T47] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1321.412273][T13789] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 1321.584577][T13789] usb 3-1: config 0 has an invalid interface number: 117 but max is 0 [ 1321.595553][T13789] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1321.636230][T13789] usb 3-1: config 0 has no interface number 0 [ 1321.650502][T13789] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1321.665187][T13789] usb 3-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1321.695461][T13789] usb 3-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1321.704718][T13789] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1321.713792][T13789] usb 3-1: Product: syz [ 1321.718275][T13789] usb 3-1: Manufacturer: syz [ 1321.731588][T13789] usb 3-1: SerialNumber: syz [ 1321.752720][T13789] usb 3-1: config 0 descriptor?? [ 1322.166212][T23005] usbtmc 1-1:16.0: simple usb_control_msg returned 0 [ 1322.369528][ T47] usb 1-1: USB disconnect, device number 49 [ 1324.007204][T13789] usbtouchscreen 3-1:0.117: probe with driver usbtouchscreen failed with error -71 [ 1324.022002][T13789] usb 3-1: USB disconnect, device number 39 [ 1324.091585][ T47] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 1324.252209][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 1324.296941][ T47] usb 5-1: no configurations [ 1324.331569][ T47] usb 5-1: can't read configurations, error -22 [ 1324.611595][ T47] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 1324.816431][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 1324.848417][ T47] usb 5-1: no configurations [ 1324.861263][ T47] usb 5-1: can't read configurations, error -22 [ 1325.114791][ T47] usb usb5-port1: attempt power cycle [ 1325.346381][T23070] FAULT_INJECTION: forcing a failure. [ 1325.346381][T23070] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1325.359725][T23070] CPU: 0 UID: 0 PID: 23070 Comm: syz.0.4632 Tainted: G L syzkaller #0 PREEMPT(full) [ 1325.359757][T23070] Tainted: [L]=SOFTLOCKUP [ 1325.359764][T23070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1325.359775][T23070] Call Trace: [ 1325.359783][T23070] [ 1325.359791][T23070] dump_stack_lvl+0xe8/0x150 [ 1325.359824][T23070] should_fail_ex+0x412/0x560 [ 1325.359857][T23070] _copy_from_user+0x2d/0xb0 [ 1325.359880][T23070] ___sys_sendmsg+0x1c6/0x360 [ 1325.359908][T23070] ? __lock_acquire+0x6b5/0x2cf0 [ 1325.359942][T23070] ? __pfx____sys_sendmsg+0x10/0x10 [ 1325.359976][T23070] ? kstrtouint+0x6e/0xe0 [ 1325.360030][T23070] ? __fget_files+0x2a/0x420 [ 1325.360050][T23070] ? __fget_files+0x3a0/0x420 [ 1325.360081][T23070] __sys_sendmmsg+0x27c/0x4e0 [ 1325.360113][T23070] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1325.360138][T23070] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1325.360180][T23070] ? ksys_write+0x242/0x270 [ 1325.360202][T23070] ? __pfx_ksys_write+0x10/0x10 [ 1325.360227][T23070] __x64_sys_sendmmsg+0xa0/0xc0 [ 1325.360251][T23070] do_syscall_64+0xe2/0xf80 [ 1325.360269][T23070] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1325.360284][T23070] ? trace_irq_disable+0x37/0x100 [ 1325.360297][T23070] ? clear_bhb_loop+0x60/0xb0 [ 1325.360315][T23070] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1325.360329][T23070] RIP: 0033:0x7f5d4019af79 [ 1325.360344][T23070] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1325.360359][T23070] RSP: 002b:00007f5d40feb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1325.360378][T23070] RAX: ffffffffffffffda RBX: 00007f5d40416180 RCX: 00007f5d4019af79 [ 1325.360389][T23070] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000005 [ 1325.360399][T23070] RBP: 00007f5d40feb090 R08: 0000000000000000 R09: 0000000000000000 [ 1325.360408][T23070] R10: 000000000000001c R11: 0000000000000246 R12: 0000000000000001 [ 1325.360417][T23070] R13: 00007f5d40416218 R14: 00007f5d40416180 R15: 00007f5d4053fa48 [ 1325.360442][T23070] [ 1325.642609][ T47] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 1325.693427][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 1325.704191][ T47] usb 5-1: no configurations [ 1325.709032][ T47] usb 5-1: can't read configurations, error -22 [ 1325.890294][ T47] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 1326.037707][ T47] usb 5-1: Using ep0 maxpacket: 8 [ 1326.062600][ T47] usb 5-1: no configurations [ 1326.067762][ T47] usb 5-1: can't read configurations, error -22 [ 1326.082469][ T47] usb usb5-port1: unable to enumerate USB device [ 1326.261798][T23080] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1326.271500][ T1168] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1326.302073][T23080] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1326.424731][ T1168] usb 3-1: Using ep0 maxpacket: 32 [ 1326.439421][ T1168] usb 3-1: config 9 has an invalid descriptor of length 0, skipping remainder of the config [ 1326.456758][ T1168] usb 3-1: config 9 has 0 interfaces, different from the descriptor's value: 1 [ 1326.480401][ T1168] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1326.492968][ T1168] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1326.501357][ T1168] usb 3-1: Product: syz [ 1326.507666][ T1168] usb 3-1: Manufacturer: syz [ 1326.709688][ T1168] usb 3-1: SerialNumber: syz [ 1326.836704][T23090] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 1326.999884][T23078] netlink: 84 bytes leftover after parsing attributes in process `syz.2.4635'. [ 1327.021105][ T1168] usb 3-1: USB disconnect, device number 40 [ 1327.351832][T13789] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 1327.531533][T13789] usb 5-1: Using ep0 maxpacket: 32 [ 1327.538281][T13789] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1327.548627][T13789] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 1327.576424][T13789] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1327.591465][T13789] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1327.629506][T13789] usb 5-1: Product: syz [ 1327.649861][T13789] usb 5-1: Manufacturer: syz [ 1327.655776][T13789] usb 5-1: SerialNumber: syz [ 1327.682253][T13789] usb 5-1: config 0 descriptor?? [ 1327.704056][T13789] hub 5-1:0.0: bad descriptor, ignoring hub [ 1327.710039][T13789] hub 5-1:0.0: probe with driver hub failed with error -5 [ 1328.063342][T13789] usb 5-1: USB disconnect, device number 63 [ 1328.108283][T23105] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4641'. [ 1328.342192][T23107] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4640'. [ 1328.410550][T23107] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4640'. [ 1328.459259][T23107] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4640'. [ 1328.653542][T23112] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1328.676076][T23112] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1329.591731][ T1168] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 1329.752211][ T1168] usb 1-1: Using ep0 maxpacket: 16 [ 1329.808922][ T1168] usb 1-1: config 0 has an invalid interface number: 129 but max is 0 [ 1329.842286][ T1168] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1329.926898][ T1168] usb 1-1: config 0 has no interface number 0 [ 1329.946519][ T1168] usb 1-1: config 0 interface 129 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1330.198035][ T1168] usb 1-1: New USB device found, idVendor=19d2, idProduct=1165, bcdDevice=c1.d5 [ 1330.257868][ T1168] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1330.304972][ T1168] usb 1-1: Product: syz [ 1330.366850][ T1168] usb 1-1: Manufacturer: syz [ 1330.390335][ T1168] usb 1-1: SerialNumber: syz [ 1330.435673][ T1168] usb 1-1: config 0 descriptor?? [ 1330.479092][ T1168] option 1-1:0.129: GSM modem (1-port) converter detected [ 1330.841645][T13769] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 1331.001872][T13769] usb 3-1: Using ep0 maxpacket: 8 [ 1331.012833][T13769] usb 3-1: no configurations [ 1331.018988][T13769] usb 3-1: can't read configurations, error -22 [ 1331.172561][T13769] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 1331.172558][ T1168] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 1331.322006][T23140] netlink: 80 bytes leftover after parsing attributes in process `syz.4.4651'. [ 1331.332786][ T1168] usb 4-1: Using ep0 maxpacket: 32 [ 1331.368067][T13769] usb 3-1: Using ep0 maxpacket: 8 [ 1331.375433][T13769] usb 3-1: no configurations [ 1331.378174][ T1168] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1331.380193][T13769] usb 3-1: can't read configurations, error -22 [ 1331.397587][ T1168] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1331.428307][ T1168] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1331.437708][ T1168] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 1331.461548][ T1168] usb 4-1: Product: syz [ 1331.478643][ T1168] usb 4-1: Manufacturer: syz [ 1331.519078][ T1168] hub 4-1:4.0: USB hub found [ 1331.538175][T13769] usb usb3-port1: attempt power cycle [ 1331.744667][ T1168] hub 4-1:4.0: 2 ports detected [ 1331.941722][T13769] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 1332.042264][T13769] usb 3-1: Using ep0 maxpacket: 8 [ 1332.048254][T13769] usb 3-1: no configurations [ 1332.057645][T13769] usb 3-1: can't read configurations, error -22 [ 1332.231551][T13769] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 1332.274752][T13769] usb 3-1: Using ep0 maxpacket: 8 [ 1332.280957][T13769] usb 3-1: no configurations [ 1332.286108][T13769] usb 3-1: can't read configurations, error -22 [ 1332.340966][T13769] usb usb3-port1: unable to enumerate USB device [ 1332.392770][ T10] usb 1-1: USB disconnect, device number 50 [ 1332.401029][ T10] option 1-1:0.129: device disconnected [ 1332.823946][ T1168] hub 4-1:4.0: hub_hub_status failed (err = -32) [ 1332.837000][ T1168] hub 4-1:4.0: config failed, can't get hub status (err -32) [ 1332.892597][ T1168] usb 4-1: USB disconnect, device number 47 [ 1333.901913][T23166] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4657'. [ 1334.342901][T23170] FAULT_INJECTION: forcing a failure. [ 1334.342901][T23170] name failslab, interval 1, probability 0, space 0, times 0 [ 1334.361786][T23170] CPU: 1 UID: 0 PID: 23170 Comm: syz.1.4659 Tainted: G L syzkaller #0 PREEMPT(full) [ 1334.361822][T23170] Tainted: [L]=SOFTLOCKUP [ 1334.361830][T23170] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1334.361841][T23170] Call Trace: [ 1334.361849][T23170] [ 1334.361858][T23170] dump_stack_lvl+0xe8/0x150 [ 1334.361890][T23170] should_fail_ex+0x412/0x560 [ 1334.361921][T23170] should_failslab+0xa8/0x100 [ 1334.361944][T23170] kmem_cache_alloc_noprof+0x87/0x6e0 [ 1334.361971][T23170] ? alloc_pid+0x1a3/0x12b0 [ 1334.361997][T23170] alloc_pid+0x1a3/0x12b0 [ 1334.362026][T23170] ? __pfx_alloc_pid+0x10/0x10 [ 1334.362076][T23170] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1334.362100][T23170] ? lockdep_hardirqs_on+0x7a/0x110 [ 1334.362121][T23170] ? fpu_clone+0x347/0xb70 [ 1334.362160][T23170] ? __asan_memcpy+0x40/0x70 [ 1334.362187][T23170] ? copy_thread+0x74d/0x9a0 [ 1334.362216][T23170] copy_process+0x1aac/0x3bd0 [ 1334.362251][T23170] ? copy_process+0x91f/0x3bd0 [ 1334.362279][T23170] ? __pfx_copy_process+0x10/0x10 [ 1334.362308][T23170] ? mutex_init_lockep+0xf9/0x130 [ 1334.362330][T23170] vhost_task_create+0x1f9/0x380 [ 1334.362350][T23170] ? arch_stack_walk+0xfb/0x150 [ 1334.362370][T23170] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 1334.362393][T23170] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 1334.362417][T23170] ? __pfx_vhost_task_create+0x10/0x10 [ 1334.362446][T23170] ? __pfx_vhost_task_fn+0x10/0x10 [ 1334.362472][T23170] ? __lock_acquire+0x6b5/0x2cf0 [ 1334.362512][T23170] ? kasan_save_track+0x4f/0x80 [ 1334.362536][T23170] ? kasan_save_track+0x3e/0x80 [ 1334.362559][T23170] ? kasan_save_free_info+0x46/0x50 [ 1334.362587][T23170] kvm_mmu_post_init_vm+0x14c/0x300 [ 1334.362618][T23170] kvm_arch_vcpu_ioctl_run+0x106/0x20d0 [ 1334.362657][T23170] ? __mutex_trylock_common+0x158/0x260 [ 1334.362679][T23170] ? look_up_lock_class+0x57/0x110 [ 1334.362704][T23170] ? register_lock_class+0x31/0x2e0 [ 1334.362731][T23170] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 1334.362763][T23170] ? __lock_acquire+0x6b5/0x2cf0 [ 1334.362793][T23170] ? __mutex_lock+0x319/0x1300 [ 1334.362826][T23170] ? kasan_quarantine_put+0xbb/0x1f0 [ 1334.362869][T23170] ? do_raw_write_lock+0x11d/0x260 [ 1334.362911][T23170] kvm_vcpu_ioctl+0xa62/0xfd0 [ 1334.362946][T23170] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1334.362970][T23170] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1334.363019][T23170] ? __fget_files+0x2a/0x420 [ 1334.363044][T23170] ? __fget_files+0x2a/0x420 [ 1334.363063][T23170] ? __fget_files+0x3a0/0x420 [ 1334.363082][T23170] ? __fget_files+0x2a/0x420 [ 1334.363106][T23170] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1334.363129][T23170] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1334.363154][T23170] __se_sys_ioctl+0xfc/0x170 [ 1334.363184][T23170] do_syscall_64+0xe2/0xf80 [ 1334.363207][T23170] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1334.363226][T23170] ? trace_irq_disable+0x37/0x100 [ 1334.363243][T23170] ? clear_bhb_loop+0x60/0xb0 [ 1334.363268][T23170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1334.363287][T23170] RIP: 0033:0x7f822e99af79 [ 1334.363306][T23170] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1334.363323][T23170] RSP: 002b:00007f822f936028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1334.363346][T23170] RAX: ffffffffffffffda RBX: 00007f822ec15fa0 RCX: 00007f822e99af79 [ 1334.363361][T23170] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 1334.363374][T23170] RBP: 00007f822f936090 R08: 0000000000000000 R09: 0000000000000000 [ 1334.363387][T23170] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1334.363399][T23170] R13: 00007f822ec16038 R14: 00007f822ec15fa0 R15: 00007f822ed3fa48 [ 1334.363431][T23170] [ 1335.133950][T23180] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1335.206271][T23180] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1335.380916][T23189] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4664'. [ 1335.487854][T23190] openvswitch: netlink: Flow key attr not present in new flow. [ 1335.787245][T23198] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 1335.798561][T23198] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4665'. [ 1336.341036][T23204] loop5: detected capacity change from 0 to 7 [ 1336.386862][T23204] Dev loop5: unable to read RDB block 7 [ 1336.397024][T23204] loop5: unable to read partition table [ 1336.418384][T23204] loop5: partition table beyond EOD, truncated [ 1336.434634][ T5890] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 1336.461487][T23204] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1336.678223][ T5890] usb 1-1: Using ep0 maxpacket: 8 [ 1336.689710][ T5890] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1336.700226][ T5890] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1336.711694][ T5890] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1336.731189][ T5890] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1336.751521][ T5890] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1336.771151][ T5890] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1337.076218][ T5890] usb 1-1: GET_CAPABILITIES returned 0 [ 1337.083461][ T5890] usbtmc 1-1:16.0: can't read capabilities [ 1337.151501][T13769] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 1337.244200][T23216] openvswitch: : Dropping previously announced user features [ 1337.291555][ T1168] usb 1-1: USB disconnect, device number 51 [ 1337.305086][T13769] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1337.367277][T13769] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1337.394082][T13769] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1337.429679][T13769] usb 5-1: config 0 descriptor?? [ 1337.483624][T13769] pwc: Askey VC010 type 2 USB webcam detected. [ 1337.501879][T23217] fuse: Unknown parameter 'grˆ Rp_çSi00000000000000000000' [ 1338.621868][ T47] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 1338.791520][ T47] usb 1-1: Using ep0 maxpacket: 8 [ 1338.799897][ T47] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1338.810602][ T47] usb 1-1: config 0 has no interfaces? [ 1338.819632][ T47] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1338.830557][ T47] usb 1-1: config 0 has no interfaces? [ 1338.863667][ T47] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1338.883191][ T47] usb 1-1: config 0 has no interfaces? [ 1339.207564][ T47] usb 1-1: string descriptor 0 read error: -22 [ 1339.222428][ T47] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1339.242729][ T47] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1339.439601][ T47] usb 1-1: config 0 descriptor?? [ 1340.438933][T23241] FAULT_INJECTION: forcing a failure. [ 1340.438933][T23241] name failslab, interval 1, probability 0, space 0, times 0 [ 1340.489919][T23241] CPU: 0 UID: 0 PID: 23241 Comm: syz.2.4676 Tainted: G L syzkaller #0 PREEMPT(full) [ 1340.489945][T23241] Tainted: [L]=SOFTLOCKUP [ 1340.489953][T23241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1340.489965][T23241] Call Trace: [ 1340.489973][T23241] [ 1340.489982][T23241] dump_stack_lvl+0xe8/0x150 [ 1340.490013][T23241] should_fail_ex+0x412/0x560 [ 1340.490042][T23241] should_failslab+0xa8/0x100 [ 1340.490057][T23241] __kmalloc_cache_noprof+0x83/0x6e0 [ 1340.490073][T23241] ? __kmalloc_noprof+0x42d/0x7e0 [ 1340.490088][T23241] ? mpi_alloc+0x52/0x140 [ 1340.490111][T23241] mpi_alloc+0x52/0x140 [ 1340.490138][T23241] mpi_read_raw_data+0x139/0x970 [ 1340.490171][T23241] dh_set_secret+0x200/0x320 [ 1340.490197][T23241] ? crypto_create_tfm_node+0x83/0x3f0 [ 1340.490216][T23241] ? __pfx_dh_set_secret+0x10/0x10 [ 1340.490230][T23241] ? crypto_alloc_tfm_node+0x3c0/0x3f0 [ 1340.490245][T23241] ? __keyctl_dh_compute+0x3df/0xd10 [ 1340.490264][T23241] __keyctl_dh_compute+0x5ae/0xd10 [ 1340.490294][T23241] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 1340.490327][T23241] ? __might_fault+0xaf/0x130 [ 1340.490366][T23241] keyctl_dh_compute+0x124/0x180 [ 1340.490379][T23241] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 1340.490399][T23241] __se_sys_keyctl+0x44c/0x9e0 [ 1340.490418][T23241] ? __pfx___se_sys_keyctl+0x10/0x10 [ 1340.490445][T23241] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1340.490472][T23241] ? __fget_files+0x3a0/0x420 [ 1340.490497][T23241] ? fput+0xa0/0xd0 [ 1340.490517][T23241] ? ksys_write+0x242/0x270 [ 1340.490534][T23241] ? __pfx_ksys_write+0x10/0x10 [ 1340.490551][T23241] ? __x64_sys_keyctl+0x20/0xc0 [ 1340.490566][T23241] do_syscall_64+0xe2/0xf80 [ 1340.490585][T23241] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1340.490603][T23241] ? trace_irq_disable+0x37/0x100 [ 1340.490619][T23241] ? clear_bhb_loop+0x60/0xb0 [ 1340.490641][T23241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1340.490658][T23241] RIP: 0033:0x7f6753b9af79 [ 1340.490675][T23241] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1340.490685][T23241] RSP: 002b:00007f6754ae9028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1340.490700][T23241] RAX: ffffffffffffffda RBX: 00007f6753e15fa0 RCX: 00007f6753b9af79 [ 1340.490708][T23241] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000017 [ 1340.490716][T23241] RBP: 00007f6754ae9090 R08: 0000200000000180 R09: 0000000000000000 [ 1340.490724][T23241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1340.490735][T23241] R13: 00007f6753e16038 R14: 00007f6753e15fa0 R15: 00007f6753f3fa48 [ 1340.490766][T23241] [ 1340.856604][ T1168] usb 1-1: USB disconnect, device number 52 [ 1340.954159][T13769] pwc: recv_control_msg error -71 req 02 val 2b00 [ 1340.961084][T13769] pwc: recv_control_msg error -71 req 02 val 2700 [ 1340.968781][T13769] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1341.015586][T13769] pwc: recv_control_msg error -71 req 04 val 1000 [ 1341.034665][T13769] pwc: recv_control_msg error -71 req 04 val 1300 [ 1341.049906][T13769] pwc: recv_control_msg error -71 req 04 val 1400 [ 1341.073795][T13769] pwc: recv_control_msg error -71 req 02 val 2000 [ 1341.080891][T13769] pwc: recv_control_msg error -71 req 02 val 2100 [ 1341.102938][T13769] pwc: recv_control_msg error -71 req 04 val 1500 [ 1341.112928][T13769] pwc: recv_control_msg error -71 req 02 val 2500 [ 1341.132628][T13769] pwc: recv_control_msg error -71 req 02 val 2400 [ 1341.140850][T13769] pwc: recv_control_msg error -71 req 02 val 2600 [ 1341.148177][T13769] pwc: recv_control_msg error -71 req 02 val 2900 [ 1341.162087][T13769] pwc: recv_control_msg error -71 req 02 val 2800 [ 1341.171778][T13769] pwc: recv_control_msg error -71 req 04 val 1100 [ 1341.179100][T13769] pwc: recv_control_msg error -71 req 04 val 1200 [ 1341.214737][T13769] pwc: Registered as video103. [ 1341.241564][ T1168] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 1341.241954][T13769] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input77 [ 1341.315162][T13769] usb 5-1: USB disconnect, device number 64 [ 1341.424691][ T1168] usb 3-1: Using ep0 maxpacket: 16 [ 1341.438381][ T1168] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1341.459108][ T1168] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1341.475172][ T1168] usb 3-1: New USB device found, idVendor=0458, idProduct=0138, bcdDevice= 0.00 [ 1341.499338][ T1168] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1341.526773][ T1168] usb 3-1: config 0 descriptor?? [ 1341.573590][T23256] netlink: 148 bytes leftover after parsing attributes in process `syz.3.4680'. [ 1341.764410][T23245] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1341.782821][T23245] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1341.952631][T23257] netlink: 488 bytes leftover after parsing attributes in process `syz.0.4681'. [ 1342.403395][T23264] sch_fq: defrate 16 ignored. [ 1343.250416][T23273] loop5: detected capacity change from 0 to 7 [ 1343.262392][T12399] Dev loop5: unable to read RDB block 7 [ 1343.269704][T12399] loop5: unable to read partition table [ 1343.278499][T12399] loop5: partition table beyond EOD, truncated [ 1343.289976][T23273] Dev loop5: unable to read RDB block 7 [ 1343.296313][T23273] loop5: unable to read partition table [ 1343.338986][T23273] loop5: partition table beyond EOD, truncated [ 1343.369883][T23273] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1344.378859][T23296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1344.390439][T23296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1344.647043][ T1168] usbhid 3-1:0.0: can't add hid device: -71 [ 1344.662999][ T1168] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1344.708941][ T1168] usb 3-1: USB disconnect, device number 45 [ 1344.728332][T23303] netlink: 148 bytes leftover after parsing attributes in process `syz.0.4692'. [ 1345.531485][ T1168] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1345.813596][ T1168] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1345.831690][ T1168] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1345.843005][ T1168] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1345.856515][ T1168] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 1345.866373][ T1168] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1345.907661][ T1168] usb 5-1: config 0 descriptor?? [ 1345.932566][T23316] PKCS7: Unknown OID: [4] 5.25.287.112.81.102.117.87.150326315.2007.15776.1 [ 1345.942690][T23316] PKCS7: Only support pkcs7_signedData type [ 1346.193638][T23306] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1346.216150][T23306] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1346.245744][ T1168] ath6kl: Failed to submit usb control message: -71 [ 1346.299014][ T1168] ath6kl: unable to send the bmi data to the device: -71 [ 1346.331724][ T1168] ath6kl: Unable to send get target info: -71 [ 1346.350364][ T1168] ath6kl: Failed to init ath6kl core: -71 [ 1346.379627][ T1168] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 1346.449641][ T1168] usb 5-1: USB disconnect, device number 65 [ 1347.295684][T23329] fuse: Unknown parameter 'grˆ Rp_çSiid00000000000000000000' [ 1347.490817][ T29] kauditd_printk_skb: 51 callbacks suppressed [ 1347.490839][ T29] audit: type=1400 audit(1770700716.387:6983): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-22 profile="unconfined" name="&" pid=23324 comm="syz.2.4698" [ 1347.953057][T23339] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4699'. [ 1348.701658][ T5897] usb 4-1: new low-speed USB device number 48 using dummy_hcd [ 1348.821681][T13769] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 1348.892927][ T5897] usb 4-1: config 65 has an invalid interface number: 95 but max is 0 [ 1348.901323][ T5897] usb 4-1: config 65 has no interface number 0 [ 1348.924141][ T5897] usb 4-1: string descriptor 0 read error: -22 [ 1348.932928][ T5897] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=6f.b6 [ 1349.001614][T13769] usb 1-1: Using ep0 maxpacket: 8 [ 1349.014954][T13769] usb 1-1: config index 0 descriptor too short (expected 74, got 45) [ 1349.025835][T13769] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 1349.040817][T13769] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1349.058003][ T5897] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1349.089366][T13769] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 1349.101542][T13769] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1349.113157][T13769] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1349.128050][T13769] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1349.140440][T13769] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1349.153857][ T5897] usbtest 4-1:65.95: Linux gadget zero [ 1349.160756][ T5897] usbtest 4-1:65.95: low-speed {control in/out} tests (+alt) [ 1349.355790][ T126] usb 4-1: USB disconnect, device number 48 [ 1349.373275][T13769] usb 1-1: usb_control_msg returned -32 [ 1349.394497][T13769] usbtmc 1-1:16.0: can't read capabilities [ 1349.552015][T23352] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4703'. [ 1349.745120][ C1] usbtmc 1-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1349.754612][T23355] usbtmc 1-1:16.0: Unable to send data, error -71 [ 1349.761993][T23355] usbtmc 1-1:16.0: usb_control_msg returned -32 [ 1350.715353][T23372] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4707'. [ 1350.943553][ T126] usb 1-1: USB disconnect, device number 53 [ 1351.100155][T23373] fuse: Unknown parameter 'grˆ Rp_çSiid' [ 1351.711517][ T126] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 1351.734659][T23383] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1351.881839][ T126] usb 5-1: Using ep0 maxpacket: 16 [ 1351.896963][ T126] usb 5-1: New USB device found, idVendor=0644, idProduct=8021, bcdDevice=38.b7 [ 1351.920175][ T126] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1351.934007][ T126] usb 5-1: Product: syz [ 1351.938679][ T126] usb 5-1: Manufacturer: syz [ 1351.946687][ T126] usb 5-1: SerialNumber: syz [ 1351.955545][ T126] usb 5-1: config 0 descriptor?? [ 1351.985303][ T126] hub 5-1:0.0: bad descriptor, ignoring hub [ 1352.003846][ T126] hub 5-1:0.0: probe with driver hub failed with error -5 [ 1352.053943][T23393] netlink: 148 bytes leftover after parsing attributes in process `syz.1.4713'. [ 1352.433594][T23404] FAULT_INJECTION: forcing a failure. [ 1352.433594][T23404] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1352.486523][T23404] CPU: 0 UID: 0 PID: 23404 Comm: syz.2.4715 Tainted: G L syzkaller #0 PREEMPT(full) [ 1352.486548][T23404] Tainted: [L]=SOFTLOCKUP [ 1352.486552][T23404] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1352.486559][T23404] Call Trace: [ 1352.486565][T23404] [ 1352.486571][T23404] dump_stack_lvl+0xe8/0x150 [ 1352.486592][T23404] should_fail_ex+0x412/0x560 [ 1352.486611][T23404] _copy_from_user+0x2d/0xb0 [ 1352.486624][T23404] ___sys_sendmsg+0x1c6/0x360 [ 1352.486640][T23404] ? __lock_acquire+0x6b5/0x2cf0 [ 1352.486658][T23404] ? __pfx____sys_sendmsg+0x10/0x10 [ 1352.486692][T23404] ? __fget_files+0x2a/0x420 [ 1352.486703][T23404] ? __fget_files+0x3a0/0x420 [ 1352.486720][T23404] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1352.486737][T23404] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1352.486758][T23404] ? __pfx_ksys_write+0x10/0x10 [ 1352.486779][T23404] do_syscall_64+0xe2/0xf80 [ 1352.486792][T23404] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1352.486804][T23404] ? trace_irq_disable+0x37/0x100 [ 1352.486814][T23404] ? clear_bhb_loop+0x60/0xb0 [ 1352.486827][T23404] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1352.486838][T23404] RIP: 0033:0x7f6753b9af79 [ 1352.486849][T23404] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1352.486858][T23404] RSP: 002b:00007f6754ae9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1352.486873][T23404] RAX: ffffffffffffffda RBX: 00007f6753e15fa0 RCX: 00007f6753b9af79 [ 1352.486882][T23404] RDX: 0000000000000040 RSI: 0000200000009b40 RDI: 0000000000000003 [ 1352.486889][T23404] RBP: 00007f6754ae9090 R08: 0000000000000000 R09: 0000000000000000 [ 1352.486897][T23404] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1352.486904][T23404] R13: 00007f6753e16038 R14: 00007f6753e15fa0 R15: 00007f6753f3fa48 [ 1352.486922][T23404] [ 1353.141787][ T10] usb 4-1: new low-speed USB device number 49 using dummy_hcd [ 1353.313946][ T10] usb 4-1: config 65 has an invalid interface number: 95 but max is 0 [ 1353.323464][ T10] usb 4-1: config 65 has no interface number 0 [ 1353.358976][ T10] usb 4-1: string descriptor 0 read error: -22 [ 1353.365707][ T10] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=6f.b6 [ 1353.381320][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1353.414137][ T10] usbtest 4-1:65.95: Linux gadget zero [ 1353.422032][ T10] usbtest 4-1:65.95: low-speed {control in/out} tests (+alt) [ 1353.607828][ T126] usb 4-1: USB disconnect, device number 49 [ 1354.479607][T23432] ip6gre1: entered promiscuous mode [ 1354.486553][T23432] ip6gre1: entered allmulticast mode [ 1354.491807][ T10] usb 4-1: new full-speed USB device number 50 using dummy_hcd [ 1354.519026][T23434] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1354.528452][T23434] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1354.653687][ T10] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1354.663060][ T10] usb 4-1: not running at top speed; connect to a high speed hub [ 1354.676547][ T10] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 1354.690782][ T10] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1354.700352][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1354.708666][ T10] usb 4-1: Product: syz [ 1354.713853][ T10] usb 4-1: Manufacturer: syz [ 1354.718584][ T10] usb 4-1: SerialNumber: syz [ 1354.911930][T13789] usb 5-1: USB disconnect, device number 66 [ 1355.147489][ T10] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1355.175544][ T10] usb 4-1: USB disconnect, device number 50 [ 1355.211205][T12399] udevd[12399]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1356.125702][T23455] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1356.135041][T23455] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1356.145247][T23455] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1356.154879][T23455] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1356.182058][ T126] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 1356.271642][T13789] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 1356.341546][ T126] usb 5-1: Using ep0 maxpacket: 16 [ 1356.359374][ T126] usb 5-1: config 0 has no interfaces? [ 1356.367521][ T126] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1356.379549][T23459] netlink: 148 bytes leftover after parsing attributes in process `syz.0.4730'. [ 1356.401486][ T126] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1356.418287][ T126] usb 5-1: Manufacturer: syz [ 1356.427697][ T126] usb 5-1: config 0 descriptor?? [ 1356.462195][T13789] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1356.472922][T13789] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1356.484625][T13789] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1356.503577][T13789] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 1356.520908][T13789] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1356.548763][T13789] usb 3-1: config 0 descriptor?? [ 1356.783455][T23453] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1356.797888][T23453] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1356.833835][T13789] ath6kl: Failed to submit usb control message: -71 [ 1356.850406][T13789] ath6kl: unable to send the bmi data to the device: -71 [ 1356.866539][T13789] ath6kl: Unable to send get target info: -71 [ 1356.886833][T13789] ath6kl: Failed to init ath6kl core: -71 [ 1356.924824][T13789] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 1356.962584][T13789] usb 3-1: USB disconnect, device number 46 [ 1357.991567][ T126] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 1358.188000][ T126] usb 3-1: Using ep0 maxpacket: 16 [ 1358.217552][ T126] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 4.00 [ 1358.231510][ T126] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1358.282153][ T126] usb 3-1: Product: syz [ 1358.306794][ T126] usb 3-1: Manufacturer: syz [ 1358.339598][ T126] usb 3-1: SerialNumber: syz [ 1358.428978][ T126] usb 3-1: config 0 descriptor?? [ 1358.499613][ T126] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 1358.603272][ T126] usb 3-1: Detected FT232B [ 1358.853693][T13789] usb 5-1: USB disconnect, device number 67 [ 1358.948476][ T126] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 1359.032120][ T126] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 1359.145598][ T126] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1359.202738][ T126] usb 3-1: USB disconnect, device number 47 [ 1359.264144][ T126] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1359.313309][ T126] ftdi_sio 3-1:0.0: device disconnected [ 1359.404774][T23489] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4737'. [ 1359.428810][T23490] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4735'. [ 1359.596417][T23492] fuse: Unknown parameter 'grˆ Rp_çSiid' [ 1359.603307][T23489] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 1360.211509][ T10] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 1360.273302][T23508] netlink: 148 bytes leftover after parsing attributes in process `syz.1.4741'. [ 1360.464230][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 1360.484582][ T10] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1360.498072][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1360.677240][ T10] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1360.704132][ T10] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1360.715051][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1360.734611][ T10] usb 5-1: Product: syz [ 1360.749248][ T10] usb 5-1: Manufacturer: syz [ 1360.762781][ T10] usb 5-1: SerialNumber: syz [ 1361.215524][ T10] usb 5-1: 0:2 : does not exist [ 1361.709731][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.716348][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1362.143126][T23520] xt_TCPMSS: Only works on TCP SYN packets [ 1362.179411][T23520] sit1: entered allmulticast mode [ 1362.325915][T23524] netlink: 148 bytes leftover after parsing attributes in process `syz.1.4744'. [ 1363.137768][ T10] usb 5-1: USB disconnect, device number 68 [ 1363.733225][T23538] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4749'. [ 1364.084511][T23546] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4750'. [ 1364.431182][T23548] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4752'. [ 1364.463859][T23550] netlink: 124 bytes leftover after parsing attributes in process `syz.1.4753'. [ 1364.473572][ T5897] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 1364.688971][ T5897] usb 3-1: Using ep0 maxpacket: 16 [ 1364.703358][ T5897] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1364.727816][ T5897] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1364.751210][ T5897] usb 3-1: New USB device found, idVendor=0458, idProduct=0138, bcdDevice= 0.00 [ 1364.800668][ T5897] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1364.848483][ T5897] usb 3-1: config 0 descriptor?? [ 1365.094593][T23545] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1365.104233][T23545] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1365.851739][ T1168] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 1365.940496][T23575] FAULT_INJECTION: forcing a failure. [ 1365.940496][T23575] name failslab, interval 1, probability 0, space 0, times 0 [ 1365.983543][T23578] FAULT_INJECTION: forcing a failure. [ 1365.983543][T23578] name failslab, interval 1, probability 0, space 0, times 0 [ 1366.001735][T23578] CPU: 1 UID: 0 PID: 23578 Comm: syz.4.4762 Tainted: G L syzkaller #0 PREEMPT(full) [ 1366.001767][T23578] Tainted: [L]=SOFTLOCKUP [ 1366.001774][T23578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1366.001786][T23578] Call Trace: [ 1366.001794][T23578] [ 1366.001804][T23578] dump_stack_lvl+0xe8/0x150 [ 1366.001859][T23578] should_fail_ex+0x412/0x560 [ 1366.001891][T23578] should_failslab+0xa8/0x100 [ 1366.001915][T23578] kmem_cache_alloc_noprof+0x87/0x6e0 [ 1366.001942][T23578] ? vm_area_alloc+0x24/0x140 [ 1366.001965][T23578] vm_area_alloc+0x24/0x140 [ 1366.001986][T23578] mmap_region+0xf85/0x1f40 [ 1366.002028][T23578] ? __pfx_mmap_region+0x10/0x10 [ 1366.002118][T23578] ? vm_unmapped_area+0xde/0x210 [ 1366.002146][T23578] ? arch_get_unmapped_area_topdown+0x9ed/0xb60 [ 1366.002206][T23578] ? bpf_lsm_mmap_addr+0x9/0x20 [ 1366.002227][T23578] ? security_mmap_addr+0x71/0x240 [ 1366.002260][T23578] do_mmap+0xc39/0x10c0 [ 1366.002296][T23578] ? __pfx_do_mmap+0x10/0x10 [ 1366.002317][T23578] ? down_write_killable+0x180/0x240 [ 1366.002348][T23578] ? __pfx_down_write_killable+0x10/0x10 [ 1366.002373][T23578] ? lock_vma_under_rcu+0x45a/0x500 [ 1366.002400][T23578] ? apparmor_mmap_file+0x1d3/0x2b0 [ 1366.002420][T23578] ? security_mmap_file+0x4df/0xa20 [ 1366.002448][T23578] vm_mmap_pgoff+0x2c9/0x4f0 [ 1366.002481][T23578] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1366.002502][T23578] ? exc_page_fault+0x6a/0xc0 [ 1366.002534][T23578] ? ksys_mmap_pgoff+0xf3/0x760 [ 1366.002559][T23578] ? __x64_sys_mmap+0x7f/0x140 [ 1366.002581][T23578] do_syscall_64+0xe2/0xf80 [ 1366.002604][T23578] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1366.002622][T23578] ? trace_irq_disable+0x37/0x100 [ 1366.002639][T23578] ? clear_bhb_loop+0x60/0xb0 [ 1366.002662][T23578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1366.002687][T23578] RIP: 0033:0x7f03f4f9ace2 [ 1366.002705][T23578] Code: 4f 01 00 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 3b 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6e 5b 5d c3 0f 1f 00 48 c7 c0 e8 ff ff ff 64 [ 1366.002721][T23578] RSP: 002b:00007f03f5da1d08 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1366.002744][T23578] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f03f4f9ace2 [ 1366.002759][T23578] RDX: 0000000000000000 RSI: 0000000008000000 RDI: 0000000000000000 [ 1366.002771][T23578] RBP: 0000000000000022 R08: 00000000ffffffff R09: 0000000000000000 [ 1366.002783][T23578] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000004000000 [ 1366.002795][T23578] R13: 0000000000001000 R14: 0000000000000022 R15: 00007f03f504e526 [ 1366.002828][T23578] [ 1366.004809][T23575] CPU: 0 UID: 0 PID: 23575 Comm: syz.1.4761 Tainted: G L syzkaller #0 PREEMPT(full) [ 1366.004835][T23575] Tainted: [L]=SOFTLOCKUP [ 1366.004847][T23575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1366.004856][T23575] Call Trace: [ 1366.004864][T23575] [ 1366.004871][T23575] dump_stack_lvl+0xe8/0x150 [ 1366.004897][T23575] should_fail_ex+0x412/0x560 [ 1366.004925][T23575] should_failslab+0xa8/0x100 [ 1366.004946][T23575] kmem_cache_alloc_noprof+0x87/0x6e0 [ 1366.004968][T23575] ? __netlink_lookup+0xc6/0x8b0 [ 1366.004990][T23575] ? skb_clone+0x212/0x3a0 [ 1366.005011][T23575] skb_clone+0x212/0x3a0 [ 1366.005031][T23575] __netlink_deliver_tap+0x404/0x850 [ 1366.005063][T23575] ? netlink_deliver_tap+0x2e/0x1b0 [ 1366.005086][T23575] netlink_deliver_tap+0x19c/0x1b0 [ 1366.005108][T23575] netlink_unicast+0x7e3/0x9b0 [ 1366.005136][T23575] ? __pfx_netlink_unicast+0x10/0x10 [ 1366.005153][T23575] ? __alloc_skb+0x193/0x390 [ 1366.005175][T23575] ? netlink_sendmsg+0x650/0xb40 [ 1366.005194][T23575] ? skb_put+0x11b/0x210 [ 1366.005220][T23575] netlink_sendmsg+0x813/0xb40 [ 1366.005249][T23575] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1366.005274][T23575] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1366.005300][T23575] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1366.005328][T23575] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1366.005348][T23575] ____sys_sendmsg+0xa68/0xad0 [ 1366.005374][T23575] ? __might_fault+0xaf/0x130 [ 1366.005403][T23575] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1366.005437][T23575] ? import_iovec+0x73/0xa0 [ 1366.005459][T23575] ___sys_sendmsg+0x2a5/0x360 [ 1366.005482][T23575] ? __lock_acquire+0x6b5/0x2cf0 [ 1366.005510][T23575] ? __pfx____sys_sendmsg+0x10/0x10 [ 1366.005569][T23575] ? __fget_files+0x2a/0x420 [ 1366.005586][T23575] ? __fget_files+0x3a0/0x420 [ 1366.005615][T23575] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1366.005642][T23575] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1366.005677][T23575] ? __pfx_ksys_write+0x10/0x10 [ 1366.005711][T23575] do_syscall_64+0xe2/0xf80 [ 1366.005733][T23575] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1366.005749][T23575] ? trace_irq_disable+0x37/0x100 [ 1366.005764][T23575] ? clear_bhb_loop+0x60/0xb0 [ 1366.005786][T23575] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1366.005803][T23575] RIP: 0033:0x7f822e99af79 [ 1366.005819][T23575] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1366.005833][T23575] RSP: 002b:00007f822f936028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1366.005852][T23575] RAX: ffffffffffffffda RBX: 00007f822ec15fa0 RCX: 00007f822e99af79 [ 1366.005865][T23575] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 1366.005876][T23575] RBP: 00007f822f936090 R08: 0000000000000000 R09: 0000000000000000 [ 1366.005887][T23575] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1366.005897][T23575] R13: 00007f822ec16038 R14: 00007f822ec15fa0 R15: 00007f822ed3fa48 [ 1366.005927][T23575] [ 1366.558094][ T1168] usb 4-1: Using ep0 maxpacket: 16 [ 1366.644762][ T1168] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1366.656128][ T1168] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1366.679490][ T1168] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1366.881923][ T1168] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1366.922126][ T1168] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1366.943917][T23583] netlink: 124 bytes leftover after parsing attributes in process `syz.1.4765'. [ 1366.956290][ T1168] usb 4-1: Product: syz [ 1366.968468][ T1168] usb 4-1: Manufacturer: syz [ 1366.982131][ T1168] usb 4-1: SerialNumber: syz [ 1367.031098][T23587] netlink: 148 bytes leftover after parsing attributes in process `syz.0.4763'. [ 1367.479171][ T1168] usb 4-1: 0:2 : does not exist [ 1368.609506][ T29] audit: type=1326 audit(1770700737.517:6984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23601 comm="syz.0.4770" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d4019af79 code=0x7ffc0000 [ 1368.652370][ T29] audit: type=1326 audit(1770700737.547:6985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23601 comm="syz.0.4770" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d4019af79 code=0x7ffc0000 [ 1368.676336][ T29] audit: type=1326 audit(1770700737.547:6986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23601 comm="syz.0.4770" exe="/root/syz-executor" sig=0 arch=c000003e syscall=111 compat=0 ip=0x7f5d4019af79 code=0x7ffc0000 [ 1368.772261][ T5897] usbhid 3-1:0.0: can't add hid device: -71 [ 1368.804903][ T47] usb 4-1: USB disconnect, device number 51 [ 1368.822688][ T5897] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1368.890294][ T5897] usb 3-1: USB disconnect, device number 48 [ 1368.931707][ T29] audit: type=1326 audit(1770700737.547:6987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23601 comm="syz.0.4770" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d4019af79 code=0x7ffc0000 [ 1369.069887][ T29] audit: type=1326 audit(1770700737.547:6988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23601 comm="syz.0.4770" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f5d4019af79 code=0x7ffc0000 [ 1369.116388][ T29] audit: type=1326 audit(1770700737.547:6989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23601 comm="syz.0.4770" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d4019af79 code=0x7ffc0000 [ 1369.161746][ T29] audit: type=1326 audit(1770700737.547:6990): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23601 comm="syz.0.4770" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d4019af79 code=0x7ffc0000 [ 1369.251054][ T29] audit: type=1326 audit(1770700737.557:6991): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23601 comm="syz.0.4770" exe="/root/syz-executor" sig=0 arch=c000003e syscall=72 compat=0 ip=0x7f5d4019af79 code=0x7ffc0000 [ 1369.258182][T23618] netlink: 'syz.2.4773': attribute type 29 has an invalid length. [ 1369.283295][ T29] audit: type=1326 audit(1770700737.557:6992): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23601 comm="syz.0.4770" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d4019af79 code=0x7ffc0000 [ 1369.315455][ T29] audit: type=1326 audit(1770700737.557:6993): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23601 comm="syz.0.4770" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5d4019af79 code=0x7ffc0000 [ 1369.316489][T13789] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 1369.392099][T23620] netlink: 'syz.2.4773': attribute type 29 has an invalid length. [ 1369.498250][T23622] netlink: 124 bytes leftover after parsing attributes in process `syz.2.4776'. [ 1369.620907][T13789] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 1369.654413][T13789] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1369.705179][T13789] usb 5-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 1369.716667][T13789] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1369.731717][T13789] usb 5-1: Product: syz [ 1369.736027][T13789] usb 5-1: Manufacturer: syz [ 1369.740875][T13789] usb 5-1: SerialNumber: syz [ 1369.765135][T13789] usb 5-1: config 0 descriptor?? [ 1369.771847][T23609] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1369.780135][T23609] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1369.993919][T23609] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1370.003712][T23609] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1370.280021][T23641] netlink: 148 bytes leftover after parsing attributes in process `syz.3.4780'. [ 1370.437444][T13789] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 1370.873704][T13789] dm9601 5-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 1370.915984][T13789] usb 5-1: USB disconnect, device number 69 [ 1370.925595][T23648] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1370.934719][T23648] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1371.531852][ T47] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 1371.771564][ T47] usb 1-1: Using ep0 maxpacket: 16 [ 1371.785920][ T47] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1371.826062][ T47] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1371.833159][T23661] FAULT_INJECTION: forcing a failure. [ 1371.833159][T23661] name failslab, interval 1, probability 0, space 0, times 0 [ 1371.833197][T23661] CPU: 0 UID: 0 PID: 23661 Comm: syz.4.4784 Tainted: G L syzkaller #0 PREEMPT(full) [ 1371.833223][T23661] Tainted: [L]=SOFTLOCKUP [ 1371.833231][T23661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1371.833243][T23661] Call Trace: [ 1371.833262][T23661] [ 1371.833270][T23661] dump_stack_lvl+0xe8/0x150 [ 1371.833301][T23661] should_fail_ex+0x412/0x560 [ 1371.833333][T23661] should_failslab+0xa8/0x100 [ 1371.833357][T23661] kmem_cache_alloc_noprof+0x87/0x6e0 [ 1371.833383][T23661] ? __netlink_lookup+0xc6/0x8b0 [ 1371.833407][T23661] ? skb_clone+0x212/0x3a0 [ 1371.833430][T23661] skb_clone+0x212/0x3a0 [ 1371.833453][T23661] __netlink_deliver_tap+0x404/0x850 [ 1371.833489][T23661] ? netlink_deliver_tap+0x2e/0x1b0 [ 1371.833514][T23661] netlink_deliver_tap+0x19c/0x1b0 [ 1371.833539][T23661] netlink_unicast+0x7e3/0x9b0 [ 1371.833569][T23661] ? __pfx_netlink_unicast+0x10/0x10 [ 1371.833588][T23661] ? __alloc_skb+0x193/0x390 [ 1371.833615][T23661] ? netlink_sendmsg+0x650/0xb40 [ 1371.833636][T23661] ? skb_put+0x11b/0x210 [ 1371.833667][T23661] netlink_sendmsg+0x813/0xb40 [ 1371.833700][T23661] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1371.833727][T23661] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1371.833757][T23661] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1371.833780][T23661] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1371.833799][T23661] ____sys_sendmsg+0xa68/0xad0 [ 1371.833824][T23661] ? __might_fault+0xaf/0x130 [ 1371.833853][T23661] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1371.833887][T23661] ? import_iovec+0x73/0xa0 [ 1371.833909][T23661] ___sys_sendmsg+0x2a5/0x360 [ 1371.833932][T23661] ? __lock_acquire+0x6b5/0x2cf0 [ 1371.833960][T23661] ? __pfx____sys_sendmsg+0x10/0x10 [ 1371.834019][T23661] ? __fget_files+0x2a/0x420 [ 1371.834037][T23661] ? __fget_files+0x3a0/0x420 [ 1371.834065][T23661] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1371.834092][T23661] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1371.834126][T23661] ? __pfx_ksys_write+0x10/0x10 [ 1371.834161][T23661] do_syscall_64+0xe2/0xf80 [ 1371.834181][T23661] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1371.834198][T23661] ? trace_irq_disable+0x37/0x100 [ 1371.834213][T23661] ? clear_bhb_loop+0x60/0xb0 [ 1371.834235][T23661] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1371.834261][T23661] RIP: 0033:0x7f03f4f9af79 [ 1371.834278][T23661] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1371.834293][T23661] RSP: 002b:00007f03f5da3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1371.834314][T23661] RAX: ffffffffffffffda RBX: 00007f03f5215fa0 RCX: 00007f03f4f9af79 [ 1371.834327][T23661] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 000000000000000b [ 1371.834339][T23661] RBP: 00007f03f5da3090 R08: 0000000000000000 R09: 0000000000000000 [ 1371.834349][T23661] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1371.834360][T23661] R13: 00007f03f5216038 R14: 00007f03f5215fa0 R15: 00007f03f533fa48 [ 1371.834390][T23661] [ 1371.834423][T23661] netlink: 'syz.4.4784': attribute type 10 has an invalid length. [ 1371.863090][ T47] usb 1-1: New USB device found, idVendor=0458, idProduct=0138, bcdDevice= 0.00 [ 1372.010034][T23663] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4787'. [ 1372.165744][ T47] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1372.213599][T23661] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1372.231682][ T47] usb 1-1: config 0 descriptor?? [ 1372.454562][T23650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1372.472198][T23650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1372.681862][ T126] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 1372.782449][T13789] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 1372.870841][ T126] usb 5-1: config 24 has 1 interface, different from the descriptor's value: 2 [ 1372.900858][ T126] usb 5-1: config 24 interface 0 has no altsetting 0 [ 1372.922283][ T126] usb 5-1: config 24 interface 0 has no altsetting 1 [ 1372.961525][T13789] usb 4-1: Using ep0 maxpacket: 16 [ 1372.967292][ T126] usb 5-1: New USB device found, idVendor=2a39, idProduct=3fa0, bcdDevice=70.25 [ 1372.995910][ T126] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1373.013574][ T126] usb 5-1: Product: syz [ 1373.018508][ T126] usb 5-1: Manufacturer: syz [ 1373.027705][ T126] usb 5-1: SerialNumber: syz [ 1373.036311][T13789] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1373.109332][T13789] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1373.310691][T13789] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1373.324342][T13789] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1373.343591][T13789] usb 4-1: config 0 descriptor?? [ 1373.875974][ T126] snd-usb-audio 5-1:24.0: probe with driver snd-usb-audio failed with error -22 [ 1373.930056][ T126] usb 5-1: USB disconnect, device number 70 [ 1374.033943][T12399] udevd[12399]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:24.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1375.196913][ T47] usbhid 1-1:0.0: can't add hid device: -71 [ 1375.206120][ T47] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1375.439694][ T47] usb 1-1: USB disconnect, device number 54 [ 1375.822321][T23692] FAULT_INJECTION: forcing a failure. [ 1375.822321][T23692] name failslab, interval 1, probability 0, space 0, times 0 [ 1375.881261][T23692] CPU: 0 UID: 0 PID: 23692 Comm: syz.2.4794 Tainted: G L syzkaller #0 PREEMPT(full) [ 1375.881299][T23692] Tainted: [L]=SOFTLOCKUP [ 1375.881306][T23692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1375.881316][T23692] Call Trace: [ 1375.881324][T23692] [ 1375.881332][T23692] dump_stack_lvl+0xe8/0x150 [ 1375.881362][T23692] should_fail_ex+0x412/0x560 [ 1375.881393][T23692] should_failslab+0xa8/0x100 [ 1375.881415][T23692] __kmalloc_noprof+0xde/0x7e0 [ 1375.881443][T23692] ? tomoyo_encode+0x28b/0x550 [ 1375.881466][T23692] tomoyo_encode+0x28b/0x550 [ 1375.881488][T23692] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1375.881518][T23692] ? tomoyo_path_number_perm+0x219/0x630 [ 1375.881543][T23692] tomoyo_path_number_perm+0x246/0x630 [ 1375.881568][T23692] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1375.881591][T23692] ? __lock_acquire+0x6b5/0x2cf0 [ 1375.881632][T23692] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1375.881672][T23692] ? __fget_files+0x2a/0x420 [ 1375.881695][T23692] ? __fget_files+0x2a/0x420 [ 1375.881712][T23692] ? __fget_files+0x3a0/0x420 [ 1375.881731][T23692] ? __fget_files+0x2a/0x420 [ 1375.881772][T23692] security_file_ioctl+0xc3/0x2a0 [ 1375.881799][T23692] __se_sys_ioctl+0x47/0x170 [ 1375.881826][T23692] do_syscall_64+0xe2/0xf80 [ 1375.881849][T23692] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1375.881869][T23692] ? clear_bhb_loop+0x60/0xb0 [ 1375.881891][T23692] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1375.881908][T23692] RIP: 0033:0x7f6753b9af79 [ 1375.881926][T23692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1375.881942][T23692] RSP: 002b:00007f6754ae9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1375.881964][T23692] RAX: ffffffffffffffda RBX: 00007f6753e15fa0 RCX: 00007f6753b9af79 [ 1375.881977][T23692] RDX: 00002000000001c0 RSI: 00000000c0306201 RDI: 0000000000000003 [ 1375.881989][T23692] RBP: 00007f6754ae9090 R08: 0000000000000000 R09: 0000000000000000 [ 1375.882000][T23692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1375.882012][T23692] R13: 00007f6753e16038 R14: 00007f6753e15fa0 R15: 00007f6753f3fa48 [ 1375.882044][T23692] [ 1376.113427][T23692] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1376.310110][T23701] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4796'. [ 1376.361305][ T982] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 1376.417024][T23699] FAULT_INJECTION: forcing a failure. [ 1376.417024][T23699] name failslab, interval 1, probability 0, space 0, times 0 [ 1376.431287][T23699] CPU: 0 UID: 0 PID: 23699 Comm: syz.1.4797 Tainted: G L syzkaller #0 PREEMPT(full) [ 1376.431321][T23699] Tainted: [L]=SOFTLOCKUP [ 1376.431329][T23699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1376.431341][T23699] Call Trace: [ 1376.431355][T23699] [ 1376.431364][T23699] dump_stack_lvl+0xe8/0x150 [ 1376.431395][T23699] should_fail_ex+0x412/0x560 [ 1376.431424][T23699] should_failslab+0xa8/0x100 [ 1376.431446][T23699] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 1376.431473][T23699] ? __alloc_skb+0x193/0x390 [ 1376.431498][T23699] ? __alloc_skb+0x1d7/0x390 [ 1376.431520][T23699] ? __local_bh_enable_ip+0xd0/0x130 [ 1376.431541][T23699] ? __alloc_skb+0x193/0x390 [ 1376.431566][T23699] __alloc_skb+0x1d7/0x390 [ 1376.431596][T23699] alloc_skb_with_frags+0xca/0x890 [ 1376.431627][T23699] ? __lock_acquire+0x6b5/0x2cf0 [ 1376.431664][T23699] sock_alloc_send_pskb+0x878/0x990 [ 1376.431691][T23699] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1376.431726][T23699] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1376.431750][T23699] ? dev_get_by_index+0x22/0x2e0 [ 1376.431771][T23699] ? dev_get_by_index+0x22/0x2e0 [ 1376.431798][T23699] isotp_sendmsg+0x7e2/0x14c0 [ 1376.431844][T23699] ? __pfx_isotp_sendmsg+0x10/0x10 [ 1376.431879][T23699] ? __pfx_aa_sk_perm+0x10/0x10 [ 1376.431905][T23699] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1376.431940][T23699] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1376.431970][T23699] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1376.431993][T23699] __sys_sendto+0x709/0x7a0 [ 1376.432023][T23699] ? __pfx___sys_sendto+0x10/0x10 [ 1376.432069][T23699] ? exc_page_fault+0x6a/0xc0 [ 1376.432095][T23699] ? do_user_addr_fault+0xc7c/0x1360 [ 1376.432117][T23699] __x64_sys_sendto+0xde/0x100 [ 1376.432142][T23699] do_syscall_64+0xe2/0xf80 [ 1376.432155][T23699] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1376.432166][T23699] ? trace_irq_disable+0x37/0x100 [ 1376.432185][T23699] ? clear_bhb_loop+0x60/0xb0 [ 1376.432198][T23699] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1376.432210][T23699] RIP: 0033:0x7f822e95b84e [ 1376.432222][T23699] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1376.432232][T23699] RSP: 002b:00007f822f934e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1376.432247][T23699] RAX: ffffffffffffffda RBX: 00007f822f9366c0 RCX: 00007f822e95b84e [ 1376.432256][T23699] RDX: 0000000000000020 RSI: 00007f822f935000 RDI: 0000000000000003 [ 1376.432264][T23699] RBP: 0000000000000000 R08: 00007f822f934f04 R09: 000000000000000c [ 1376.432271][T23699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 1376.432278][T23699] R13: 00007f822f934f58 R14: 00007f822f935000 R15: 0000000000000000 [ 1376.432296][T23699] [ 1376.571475][ T982] usb 1-1: Using ep0 maxpacket: 16 [ 1376.957030][ T982] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1377.011504][ T982] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1377.041514][ T982] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1377.094902][ T982] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1377.127404][ T982] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1377.157960][ T982] usb 1-1: Product: syz [ 1377.191442][ T982] usb 1-1: Manufacturer: syz [ 1377.196111][ T982] usb 1-1: SerialNumber: syz [ 1377.635251][ T982] usb 1-1: 0:2 : does not exist [ 1378.261476][ T1168] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 1378.301883][ T5897] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 1378.411624][ T1168] usb 3-1: Using ep0 maxpacket: 8 [ 1378.420671][ T1168] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 1378.434100][ T1168] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 1378.446571][ T1168] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1378.457898][ T1168] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 1378.472208][ T5897] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1378.483802][ T5897] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1378.495816][ T1168] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1378.507185][ T5897] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1378.522699][ T1168] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1378.536648][ T5897] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 1378.546834][ T1168] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1378.556996][ T5897] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1378.565733][ T1168] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1378.577095][ T5897] usb 5-1: config 0 descriptor?? [ 1378.828716][T23714] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1378.837591][T23714] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1378.856726][ T5897] ath6kl: Failed to submit usb control message: -71 [ 1378.863703][ T5897] ath6kl: unable to send the bmi data to the device: -71 [ 1378.874058][ T1168] usb 3-1: usb_control_msg returned -32 [ 1378.879787][ T5897] ath6kl: Unable to send get target info: -71 [ 1378.897225][ T1168] usbtmc 3-1:16.0: can't read capabilities [ 1378.908499][T13789] usbhid 4-1:0.0: can't add hid device: -32 [ 1378.920132][ T5904] usb 1-1: USB disconnect, device number 55 [ 1378.946958][ T5897] ath6kl: Failed to init ath6kl core: -71 [ 1378.979832][T13789] usbhid 4-1:0.0: probe with driver usbhid failed with error -32 [ 1379.001140][ T5897] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 1379.098376][ T5897] usb 5-1: USB disconnect, device number 71 [ 1379.233295][ C1] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1379.243485][T23726] usbtmc 3-1:16.0: Unable to send data, error -71 [ 1379.250690][T23726] usbtmc 3-1:16.0: usb_control_msg returned -32 [ 1379.442250][ T126] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 1379.601505][ T126] usb 1-1: Using ep0 maxpacket: 16 [ 1379.609248][ T126] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1379.623649][ T126] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1379.630476][ T126] usb 1-1: New USB device found, idVendor=0458, idProduct=0138, bcdDevice= 0.00 [ 1379.650874][ T126] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1379.680519][ T126] usb 1-1: config 0 descriptor?? [ 1379.900605][T23725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1379.922876][T23725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1380.089123][T23745] input: syz1 as /devices/virtual/input/input79 [ 1381.183853][ T5904] usb 3-1: USB disconnect, device number 49 [ 1382.867956][T23772] program syz.2.4819 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1382.932481][ T126] usbhid 1-1:0.0: can't add hid device: -71 [ 1382.960152][ T126] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1383.066502][ T126] usb 1-1: USB disconnect, device number 56 [ 1383.479069][T23778] Scaler: ================= START STATUS ================= [ 1383.504389][T23778] Scaler: ================== END STATUS ================== [ 1383.611653][T23780] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.4821'. [ 1384.071470][ T47] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 1384.141650][ T5904] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 1384.251585][ T47] usb 1-1: Using ep0 maxpacket: 8 [ 1384.306438][ T47] usb 1-1: config index 0 descriptor too short (expected 74, got 45) [ 1384.314790][ T47] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 1384.339900][ T47] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1384.343128][ T5904] usb 5-1: Using ep0 maxpacket: 16 [ 1384.368130][ T5904] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1384.371566][ T47] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 1384.382080][ T5904] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1384.401009][ T5904] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1384.419953][ T5904] usb 5-1: Product: syz [ 1384.429229][ T47] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1384.430080][ T5904] usb 5-1: Manufacturer: syz [ 1384.443467][T23790] FAULT_INJECTION: forcing a failure. [ 1384.443467][T23790] name failslab, interval 1, probability 0, space 0, times 0 [ 1384.461673][ T5904] usb 5-1: SerialNumber: syz [ 1384.472188][ T47] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1384.475032][ T5904] usb 5-1: config 0 descriptor?? [ 1384.490482][T23790] CPU: 1 UID: 0 PID: 23790 Comm: syz.2.4825 Tainted: G L syzkaller #0 PREEMPT(full) [ 1384.490514][T23790] Tainted: [L]=SOFTLOCKUP [ 1384.490521][T23790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1384.490532][T23790] Call Trace: [ 1384.490539][T23790] [ 1384.490548][T23790] dump_stack_lvl+0xe8/0x150 [ 1384.490577][T23790] should_fail_ex+0x412/0x560 [ 1384.490605][T23790] should_failslab+0xa8/0x100 [ 1384.490628][T23790] kmem_cache_alloc_noprof+0x87/0x6e0 [ 1384.490651][T23790] ? __netlink_lookup+0xc6/0x8b0 [ 1384.490674][T23790] ? skb_clone+0x212/0x3a0 [ 1384.490695][T23790] skb_clone+0x212/0x3a0 [ 1384.490718][T23790] __netlink_deliver_tap+0x404/0x850 [ 1384.490751][T23790] ? netlink_deliver_tap+0x2e/0x1b0 [ 1384.490775][T23790] netlink_deliver_tap+0x19c/0x1b0 [ 1384.490799][T23790] netlink_unicast+0x7e3/0x9b0 [ 1384.490826][T23790] ? __pfx_netlink_unicast+0x10/0x10 [ 1384.490844][T23790] ? __alloc_skb+0x193/0x390 [ 1384.490868][T23790] ? netlink_sendmsg+0x650/0xb40 [ 1384.490888][T23790] ? skb_put+0x11b/0x210 [ 1384.490919][T23790] netlink_sendmsg+0x813/0xb40 [ 1384.490949][T23790] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1384.490975][T23790] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1384.491002][T23790] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1384.491024][T23790] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1384.491044][T23790] ____sys_sendmsg+0xa68/0xad0 [ 1384.491071][T23790] ? __might_fault+0xaf/0x130 [ 1384.491102][T23790] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1384.491141][T23790] ? import_iovec+0x73/0xa0 [ 1384.491165][T23790] ___sys_sendmsg+0x2a5/0x360 [ 1384.491200][T23790] ? __lock_acquire+0x6b5/0x2cf0 [ 1384.491229][T23790] ? __pfx____sys_sendmsg+0x10/0x10 [ 1384.491292][T23790] ? __fget_files+0x2a/0x420 [ 1384.491310][T23790] ? __fget_files+0x3a0/0x420 [ 1384.491338][T23790] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1384.491373][T23790] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1384.491408][T23790] ? __pfx_ksys_write+0x10/0x10 [ 1384.491447][T23790] do_syscall_64+0xe2/0xf80 [ 1384.491470][T23790] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1384.491488][T23790] ? trace_irq_disable+0x37/0x100 [ 1384.491504][T23790] ? clear_bhb_loop+0x60/0xb0 [ 1384.491528][T23790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1384.491546][T23790] RIP: 0033:0x7f6753b9af79 [ 1384.491565][T23790] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1384.491582][T23790] RSP: 002b:00007f6754ae9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1384.491603][T23790] RAX: ffffffffffffffda RBX: 00007f6753e15fa0 RCX: 00007f6753b9af79 [ 1384.491618][T23790] RDX: 0000000000004040 RSI: 0000200000000000 RDI: 0000000000000003 [ 1384.491630][T23790] RBP: 00007f6754ae9090 R08: 0000000000000000 R09: 0000000000000000 [ 1384.491642][T23790] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1384.491653][T23790] R13: 00007f6753e16038 R14: 00007f6753e15fa0 R15: 00007f6753f3fa48 [ 1384.491685][T23790] [ 1384.786647][ T47] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1384.795773][ T47] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1384.807161][ T5904] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1384.817151][ T5904] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 1384.863287][T23790] openvswitch: : Dropping previously announced user features [ 1385.307044][ T47] usb 1-1: usb_control_msg returned -32 [ 1385.351903][ T47] usbtmc 1-1:16.0: can't read capabilities [ 1385.403078][ T5904] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 1385.695157][ C0] usbtmc 1-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1385.704787][T23801] usbtmc 1-1:16.0: Unable to send data, error -71 [ 1385.712698][T23801] usbtmc 1-1:16.0: usb_control_msg returned -32 [ 1385.817682][ T5904] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1385.826586][ T5904] em28xx 5-1:0.0: board has no eeprom [ 1386.181737][ T5904] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1386.197105][ T5904] em28xx 5-1:0.0: dvb set to bulk mode. [ 1386.205648][ T5897] em28xx 5-1:0.0: Binding DVB extension [ 1387.037700][ T982] usb 1-1: USB disconnect, device number 57 [ 1387.462293][T23786] em28xx 5-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 1387.521785][ T5904] usb 5-1: USB disconnect, device number 72 [ 1387.529564][ T5904] em28xx 5-1:0.0: Disconnecting em28xx [ 1387.653988][ T5897] em28xx 5-1:0.0: Registering input extension [ 1387.682967][ T5904] em28xx 5-1:0.0: Closing input extension [ 1387.835539][ T5904] em28xx 5-1:0.0: Freeing device [ 1387.866294][T21093] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1387.877052][T21093] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1387.888287][T21093] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1387.958813][T21093] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1387.971120][T21093] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1388.491555][ T5904] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 1388.658740][ T5904] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD6, changing to 0x86 [ 1388.691819][ T5904] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1388.752348][T23827] chnl_net:caif_netlink_parms(): no params data found [ 1388.883601][ T5904] usb 1-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 1388.936288][ T5904] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1388.945035][ T5904] usb 1-1: Product: syz [ 1388.949242][ T5904] usb 1-1: Manufacturer: syz [ 1388.957131][ T5904] usb 1-1: SerialNumber: syz [ 1388.972204][ T5904] usb 1-1: config 0 descriptor?? [ 1389.282137][T23847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1389.329048][T23847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1389.507666][T23827] bridge0: port 1(bridge_slave_0) entered blocking state [ 1389.596119][T23827] bridge0: port 1(bridge_slave_0) entered disabled state [ 1389.619694][T23827] bridge_slave_0: entered allmulticast mode [ 1389.649879][T23827] bridge_slave_0: entered promiscuous mode [ 1389.704583][T23827] bridge0: port 2(bridge_slave_1) entered blocking state [ 1389.784618][T23827] bridge0: port 2(bridge_slave_1) entered disabled state [ 1389.803326][T23827] bridge_slave_1: entered allmulticast mode [ 1389.826344][T23827] bridge_slave_1: entered promiscuous mode [ 1389.848275][T23842] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4841'. [ 1390.019751][T23827] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1390.030396][T21093] Bluetooth: hci2: command tx timeout [ 1390.123197][T23827] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1390.137632][T23856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1390.184664][T23856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1390.430842][T23827] team0: Port device team_slave_0 added [ 1390.484950][T23827] team0: Port device team_slave_1 added [ 1390.623874][T23827] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1390.640787][T23827] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1390.706469][T23827] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1390.740300][T23827] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1390.760067][T23827] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1390.821101][T23827] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1391.093644][T23827] hsr_slave_0: entered promiscuous mode [ 1391.111117][T23827] hsr_slave_1: entered promiscuous mode [ 1391.133314][T23827] debugfs: 'hsr0' already exists in 'hsr' [ 1391.154295][T23827] Cannot create hsr debugfs directory [ 1391.897206][ T5904] powermate: unknown product id 0240 [ 1391.934631][ T5904] input: Griffin SoundKnob as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input81 [ 1391.974422][ C0] powermate: config urb returned -71 [ 1391.979885][ C0] powermate: config urb returned -71 [ 1391.985343][ C0] powermate: config urb returned -71 [ 1391.990873][ C0] powermate: config urb returned -71 [ 1392.028660][ T5904] usb 1-1: USB disconnect, device number 58 [ 1392.034859][ C0] powermate 1-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 1392.101912][T21093] Bluetooth: hci2: command tx timeout [ 1392.452550][T23827] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1392.479221][T23827] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1392.502177][T23827] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1392.556443][T23827] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1392.884925][T23827] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1392.928759][T23827] 8021q: adding VLAN 0 to HW filter on device team0 [ 1392.956766][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 1392.964028][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1393.073410][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 1393.080582][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1393.541721][ T982] usb 3-1: new full-speed USB device number 50 using dummy_hcd [ 1393.836999][T23827] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1394.026746][ T982] usb 3-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1394.068963][ T982] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1394.105481][ T982] usb 3-1: Product: syz [ 1394.118013][ T982] usb 3-1: Manufacturer: syz [ 1394.132803][T23827] veth0_vlan: entered promiscuous mode [ 1394.149340][ T982] usb 3-1: SerialNumber: syz [ 1394.177614][ T982] usb 3-1: config 0 descriptor?? [ 1394.191413][T21093] Bluetooth: hci2: command tx timeout [ 1394.225888][ T982] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1394.273989][T23827] veth1_vlan: entered promiscuous mode [ 1394.751549][ T982] gspca_stk1135: reg_w 0x2 err -110 [ 1394.757884][ T982] gspca_stk1135: serial bus timeout: status=0x00 [ 1394.811634][ T982] gspca_stk1135: Sensor write failed [ 1394.852025][ T982] gspca_stk1135: serial bus timeout: status=0x00 [ 1394.867282][ T982] gspca_stk1135: Sensor write failed [ 1394.883176][ T982] gspca_stk1135: serial bus timeout: status=0x00 [ 1394.923037][ T982] gspca_stk1135: Sensor read failed [ 1394.948097][ T982] gspca_stk1135: serial bus timeout: status=0x00 [ 1394.995146][ T982] gspca_stk1135: Sensor read failed [ 1394.997717][T23827] veth0_macvtap: entered promiscuous mode [ 1395.048606][ T982] gspca_stk1135: Detected sensor type unknown (0x0) [ 1395.055292][T23827] veth1_macvtap: entered promiscuous mode [ 1395.112892][ T982] gspca_stk1135: serial bus timeout: status=0x00 [ 1395.151247][ T982] gspca_stk1135: Sensor read failed [ 1395.260286][ T982] gspca_stk1135: serial bus timeout: status=0x00 [ 1395.306474][ T982] gspca_stk1135: Sensor read failed [ 1395.342289][ T982] gspca_stk1135: serial bus timeout: status=0x00 [ 1395.348682][ T982] gspca_stk1135: Sensor write failed [ 1395.353293][T23827] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1395.394340][T23827] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1395.430100][ T982] gspca_stk1135: serial bus timeout: status=0x00 [ 1395.466619][ T3526] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1395.478717][T23912] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1395.511672][ T982] gspca_stk1135: Sensor write failed [ 1395.548423][ T982] stk1135 3-1:0.0: probe with driver stk1135 failed with error -110 [ 1395.557016][ T3526] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1395.597187][ T3526] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1395.636478][ T3526] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1395.731488][ T5897] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 1395.902019][ T5897] usb 5-1: Using ep0 maxpacket: 8 [ 1395.936780][ T5897] usb 5-1: config index 0 descriptor too short (expected 1307, got 27) [ 1395.951472][ T5897] usb 5-1: config 0 has an invalid interface number: 0 but max is -1 [ 1396.001754][ T5897] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1396.071528][ T5897] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 1396.091726][ T5897] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1396.135493][ T5897] usb 5-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=c3.de [ 1396.149392][ T5897] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1396.264651][ T5897] usb 5-1: Product: syz [ 1396.268897][ T5897] usb 5-1: Manufacturer: syz [ 1396.275254][ T5897] usb 5-1: SerialNumber: syz [ 1396.286137][ T5897] usb 5-1: config 0 descriptor?? [ 1396.291459][T21093] Bluetooth: hci2: command tx timeout [ 1396.298784][ T5897] hub 5-1:0.0: bad descriptor, ignoring hub [ 1396.305110][ T5897] hub 5-1:0.0: probe with driver hub failed with error -5 [ 1396.406078][ T5897] input: syz syz as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input82 [ 1396.430679][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1396.481506][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1396.559624][ T5897] usb 5-1: USB disconnect, device number 73 [ 1396.727814][ T3526] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1396.740293][ T3526] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1396.786690][ T47] usb 3-1: USB disconnect, device number 50 [ 1396.972610][T23921] FAULT_INJECTION: forcing a failure. [ 1396.972610][T23921] name failslab, interval 1, probability 0, space 0, times 0 [ 1397.011291][T23921] CPU: 1 UID: 0 PID: 23921 Comm: syz.2.4859 Tainted: G L syzkaller #0 PREEMPT(full) [ 1397.011315][T23921] Tainted: [L]=SOFTLOCKUP [ 1397.011320][T23921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1397.011328][T23921] Call Trace: [ 1397.011334][T23921] [ 1397.011347][T23921] dump_stack_lvl+0xe8/0x150 [ 1397.011377][T23921] should_fail_ex+0x412/0x560 [ 1397.011409][T23921] should_failslab+0xa8/0x100 [ 1397.011432][T23921] __kmalloc_node_track_caller_noprof+0xe1/0x7f0 [ 1397.011463][T23921] ? dh_data_from_key+0x15e/0x280 [ 1397.011487][T23921] kmemdup_noprof+0x2b/0x70 [ 1397.011510][T23921] dh_data_from_key+0x15e/0x280 [ 1397.011532][T23921] __keyctl_dh_compute+0x3a7/0xd10 [ 1397.011557][T23921] ? __lock_acquire+0x6b5/0x2cf0 [ 1397.011588][T23921] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 1397.011640][T23921] ? get_pid_task+0x20/0x1f0 [ 1397.011661][T23921] ? get_pid_task+0x20/0x1f0 [ 1397.011683][T23921] keyctl_dh_compute+0x124/0x180 [ 1397.011706][T23921] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 1397.011739][T23921] __se_sys_keyctl+0x44c/0x9e0 [ 1397.011767][T23921] ? __pfx___se_sys_keyctl+0x10/0x10 [ 1397.011802][T23921] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1397.011832][T23921] ? __fget_files+0x3a0/0x420 [ 1397.011860][T23921] ? fput+0xa0/0xd0 [ 1397.011883][T23921] ? ksys_write+0x242/0x270 [ 1397.011912][T23921] ? __pfx_ksys_write+0x10/0x10 [ 1397.011945][T23921] ? __x64_sys_keyctl+0x20/0xc0 [ 1397.011973][T23921] do_syscall_64+0xe2/0xf80 [ 1397.011996][T23921] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.012014][T23921] ? trace_irq_disable+0x37/0x100 [ 1397.012031][T23921] ? clear_bhb_loop+0x60/0xb0 [ 1397.012063][T23921] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.012082][T23921] RIP: 0033:0x7f6753b9af79 [ 1397.012100][T23921] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1397.012116][T23921] RSP: 002b:00007f6754ae9028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1397.012139][T23921] RAX: ffffffffffffffda RBX: 00007f6753e15fa0 RCX: 00007f6753b9af79 [ 1397.012154][T23921] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000017 [ 1397.012167][T23921] RBP: 00007f6754ae9090 R08: 0000000000000000 R09: 0000000000000000 [ 1397.012179][T23921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1397.012190][T23921] R13: 00007f6753e16038 R14: 00007f6753e15fa0 R15: 00007f6753f3fa48 [ 1397.012223][T23921] [ 1397.907729][T23932] blktrace: Concurrent blktraces are not allowed on sg0 [ 1398.370459][T23940] FAULT_INJECTION: forcing a failure. [ 1398.370459][T23940] name failslab, interval 1, probability 0, space 0, times 0 [ 1398.425456][T23940] CPU: 1 UID: 0 PID: 23940 Comm: syz.2.4863 Tainted: G L syzkaller #0 PREEMPT(full) [ 1398.425492][T23940] Tainted: [L]=SOFTLOCKUP [ 1398.425500][T23940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1398.425510][T23940] Call Trace: [ 1398.425519][T23940] [ 1398.425528][T23940] dump_stack_lvl+0xe8/0x150 [ 1398.425562][T23940] should_fail_ex+0x412/0x560 [ 1398.425596][T23940] should_failslab+0xa8/0x100 [ 1398.425620][T23940] __kmalloc_noprof+0xde/0x7e0 [ 1398.425649][T23940] ? tomoyo_encode+0x28b/0x550 [ 1398.425674][T23940] tomoyo_encode+0x28b/0x550 [ 1398.425699][T23940] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1398.425732][T23940] ? tomoyo_path_number_perm+0x219/0x630 [ 1398.425758][T23940] tomoyo_path_number_perm+0x246/0x630 [ 1398.425788][T23940] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1398.425813][T23940] ? __lock_acquire+0x6b5/0x2cf0 [ 1398.425867][T23940] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1398.425915][T23940] ? __fget_files+0x2a/0x420 [ 1398.425940][T23940] ? __fget_files+0x2a/0x420 [ 1398.425958][T23940] ? __fget_files+0x3a0/0x420 [ 1398.425977][T23940] ? __fget_files+0x2a/0x420 [ 1398.426002][T23940] security_file_ioctl+0xc3/0x2a0 [ 1398.426029][T23940] __se_sys_ioctl+0x47/0x170 [ 1398.426059][T23940] do_syscall_64+0xe2/0xf80 [ 1398.426082][T23940] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.426100][T23940] ? trace_irq_disable+0x37/0x100 [ 1398.426118][T23940] ? clear_bhb_loop+0x60/0xb0 [ 1398.426142][T23940] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.426162][T23940] RIP: 0033:0x7f6753b9af79 [ 1398.426181][T23940] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1398.426198][T23940] RSP: 002b:00007f6754ac8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1398.426221][T23940] RAX: ffffffffffffffda RBX: 00007f6753e16090 RCX: 00007f6753b9af79 [ 1398.426237][T23940] RDX: 0000200000000080 RSI: 00000000c004500a RDI: 0000000000000003 [ 1398.426251][T23940] RBP: 00007f6754ac8090 R08: 0000000000000000 R09: 0000000000000000 [ 1398.426264][T23940] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1398.426276][T23940] R13: 00007f6753e16128 R14: 00007f6753e16090 R15: 00007f6753f3fa48 [ 1398.426310][T23940] [ 1398.428104][T23940] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1398.561475][ T5897] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 1398.672381][ T1168] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 1398.851576][ T1168] usb 1-1: Using ep0 maxpacket: 8 [ 1398.863607][ T1168] usb 1-1: config index 0 descriptor too short (expected 74, got 45) [ 1398.873027][ T1168] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 1398.942520][ T5897] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1398.974792][ T1168] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1398.985690][ T5897] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1399.018765][ T1168] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 1399.043174][ T5897] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1399.074133][ T1168] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1399.086812][ T5897] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1399.129797][ T1168] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1399.144576][ T5897] usb 5-1: config 0 descriptor?? [ 1399.181955][ T5897] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 1399.199453][ T1168] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1399.240013][ T1168] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1399.488641][ T47] usb 5-1: USB disconnect, device number 74 [ 1399.495918][ T1168] usb 1-1: usb_control_msg returned -32 [ 1399.563556][ T1168] usbtmc 1-1:16.0: can't read capabilities [ 1399.854622][ C1] usbtmc 1-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1399.864377][T23950] usbtmc 1-1:16.0: Unable to send data, error -71 [ 1399.877414][T23950] usbtmc 1-1:16.0: usb_control_msg returned -32 [ 1400.921526][ T5897] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 1401.105664][ T5897] usb 6-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1401.138844][ T5897] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1401.165594][ T5897] usb 6-1: Product: syz [ 1401.180259][ T5897] usb 6-1: Manufacturer: syz [ 1401.206950][ T5897] usb 6-1: SerialNumber: syz [ 1401.256805][ T5897] usb 6-1: config 0 descriptor?? [ 1401.513916][ T126] usb 1-1: USB disconnect, device number 59 [ 1401.647940][ T5897] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1401.745432][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1401.768827][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1401.832088][ T126] ------------[ cut here ]------------ [ 1401.838272][ T126] no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0x0 with flags 0x0 [ 1401.848330][ T126] WARNING: net/mac80211/rate.c:406 at __rate_control_send_low+0x524/0x800, CPU#1: kworker/1:2/126 [ 1401.859007][ T126] Modules linked in: [ 1401.863422][ T126] CPU: 1 UID: 0 PID: 126 Comm: kworker/1:2 Tainted: G L syzkaller #0 PREEMPT(full) [ 1401.874428][ T126] Tainted: [L]=SOFTLOCKUP SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1401.878808][ T126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1401.888993][ T126] Workqueue: mld mld_ifc_work [ 1401.893950][ T126] RIP: 0010:__rate_control_send_low+0x5bb/0x800 [ 1401.900244][ T126] Code: ff 4c 8b 7c 24 08 48 8b 44 24 38 0f b6 04 28 84 c0 0f 85 d3 01 00 00 41 8b 0f 4c 89 f7 48 8b 74 24 18 44 8b 44 24 2c 45 89 e9 <67> 48 0f b9 3a 4c 8b 74 24 30 e9 81 fe ff ff 44 89 f9 80 e1 07 80 [ 1401.920208][ T126] RSP: 0018:ffffc90002e065f8 EFLAGS: 00010246 [ 1401.926430][ T126] RAX: 0000000000000000 RBX: 000000000000000c RCX: 0000000000000000 [ 1401.934454][ T126] RDX: 00000000ffffffff RSI: 0000000000000000 RDI: ffffffff9000bfe0 [ 1401.942587][ T126] RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1401.950842][ T126] R10: 0000000000000004 R11: 0000000000000000 R12: ffff888063e90168 [ 1401.958905][ T126] R13: 0000000000000000 R14: ffffffff9000bfe0 R15: ffff88807734b138 [ 1401.967137][ T126] FS: 0000000000000000(0000) GS:ffff8881257df000(0000) knlGS:0000000000000000 [ 1401.976135][ T126] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1401.982768][ T126] CR2: 000000110c3c9ed9 CR3: 000000004075e000 CR4: 00000000003526f0 [ 1401.990783][ T126] Call Trace: [ 1401.994158][ T126] [ 1401.997232][ T126] rate_control_send_low+0x1a7/0x7b0 [ 1402.002684][ T126] rate_control_get_rate+0x20b/0x5d0 [ 1402.008000][ T126] ieee80211_tx_h_rate_ctrl+0xaf6/0x1760 [ 1402.013797][ T126] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 1402.020155][ T126] ? __skb_flow_dissect+0x423/0x6d20 [ 1402.025522][ T126] ? lock_acquire+0x106/0x330 [ 1402.030335][ T126] invoke_tx_handlers_late+0xba/0x18a0 [ 1402.035903][ T126] ? ieee80211_tx_h_select_key+0xd1b/0x19f0 [ 1402.041866][ T126] ieee80211_tx_dequeue+0x3252/0x46e0 [ 1402.047301][ T126] ? __pfx_ieee80211_tx_dequeue+0x10/0x10 [ 1402.053097][ T126] ieee80211_handle_wake_tx_queue+0x132/0x2c0 [ 1402.059214][ T126] ? __pfx_ieee80211_handle_wake_tx_queue+0x10/0x10 [ 1402.065854][ T126] ? __local_bh_enable_ip+0xd0/0x130 [ 1402.071153][ T126] ieee80211_queue_skb+0x1a3f/0x2210 [ 1402.076499][ T126] ieee80211_tx+0x2c2/0x4b0 [ 1402.081026][ T126] ? __pfx_ieee80211_tx+0x10/0x10 [ 1402.086113][ T126] ? ieee80211_xmit+0x315/0x400 [ 1402.091065][ T126] __ieee80211_subif_start_xmit+0xd12/0x1660 [ 1402.097106][ T126] ? __ieee80211_subif_start_xmit+0x2cf/0x1660 [ 1402.103308][ T126] ? __pfx___ieee80211_subif_start_xmit+0x10/0x10 [ 1402.109751][ T126] ? ieee80211_multicast_to_unicast+0x19c/0x320 [ 1402.116062][ T126] ieee80211_subif_start_xmit+0xf3/0x570 [ 1402.121834][ T126] ? __pfx_ieee80211_subif_start_xmit+0x10/0x10 [ 1402.128274][ T126] ? __pfx_netif_skb_features+0x10/0x10 [ 1402.133957][ T126] dev_hard_start_xmit+0x2cd/0x7f0 [ 1402.139108][ T126] __dev_queue_xmit+0x168f/0x3850 [ 1402.144181][ T126] ? __dev_queue_xmit+0x274/0x3850 [ 1402.149337][ T126] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1402.154849][ T126] ? neigh_resolve_output+0x438/0x750 [ 1402.160274][ T126] ? eth_header+0x11b/0x200 [ 1402.164872][ T126] ? __asan_memcpy+0x40/0x70 [ 1402.169566][ T126] ? eth_header+0x11b/0x200 [ 1402.174162][ T126] ? __pfx_eth_header+0x10/0x10 [ 1402.179051][ T126] ? neigh_resolve_output+0x624/0x750 [ 1402.184500][ T126] ? ip6_output+0x126/0x550 [ 1402.189100][ T126] ip6_output+0x340/0x550 [ 1402.193667][ T126] NF_HOOK+0xa2/0x3a0 [ 1402.197660][ T126] ? NF_HOOK+0xf9/0x3a0 [ 1402.201871][ T126] ? __pfx_NF_HOOK+0x10/0x10 [ 1402.206514][ T126] ? __pfx_dst_output+0x10/0x10 [ 1402.211415][ T126] ? lockdep_hardirqs_on+0x7a/0x110 [ 1402.216740][ T126] ? __local_bh_enable_ip+0xd0/0x130 [ 1402.222164][ T126] ? icmp6_dst_alloc+0x3a6/0x440 [ 1402.227119][ T126] mld_sendpack+0x8b4/0xe40 [ 1402.231689][ T126] ? mld_sendpack+0x213/0xe40 [ 1402.236379][ T126] ? __pfx_mld_sendpack+0x10/0x10 [ 1402.241494][ T126] mld_ifc_work+0x835/0xe70 [ 1402.246017][ T126] ? process_scheduled_works+0xa0f/0x17a0 [ 1402.251776][ T126] process_scheduled_works+0xaec/0x17a0 [ 1402.257541][ T126] ? __pfx_process_scheduled_works+0x10/0x10 [ 1402.263736][ T126] ? do_raw_spin_lock+0x12b/0x2f0 [ 1402.268780][ T126] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1402.274201][ T126] ? schedule+0x90/0x360 [ 1402.278557][ T126] worker_thread+0xda6/0x1360 [ 1402.283385][ T126] kthread+0x726/0x8b0 [ 1402.287472][ T126] ? __pfx_worker_thread+0x10/0x10 [ 1402.292617][ T126] ? __pfx_kthread+0x10/0x10 [ 1402.297304][ T126] ? _raw_spin_unlock_irq+0x23/0x50 [ 1402.302538][ T126] ? __pfx_kthread+0x10/0x10 [ 1402.307155][ T126] ret_from_fork+0x51b/0xa40 [ 1402.311810][ T126] ? __pfx_ret_from_fork+0x10/0x10 [ 1402.317009][ T126] ? __switch_to+0xc82/0x1410 [ 1402.321834][ T126] ? __pfx_kthread+0x10/0x10 [ 1402.326814][ T126] ret_from_fork_asm+0x1a/0x30 [ 1402.331650][ T126] [ 1402.334792][ T126] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1402.342096][ T126] CPU: 1 UID: 0 PID: 126 Comm: kworker/1:2 Tainted: G L syzkaller #0 PREEMPT(full) [ 1402.352950][ T126] Tainted: [L]=SOFTLOCKUP [ 1402.357300][ T126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1402.367572][ T126] Workqueue: mld mld_ifc_work [ 1402.372324][ T126] Call Trace: [ 1402.375626][ T126] [ 1402.378564][ T126] vpanic+0x1e0/0x670 [ 1402.382569][ T126] panic+0xc5/0xd0 [ 1402.386310][ T126] ? __pfx_panic+0x10/0x10 [ 1402.390757][ T126] ? ret_from_fork_asm+0x1a/0x30 [ 1402.395730][ T126] __warn+0x315/0x4a0 [ 1402.399727][ T126] ? __rate_control_send_low+0x524/0x800 [ 1402.405580][ T126] ? __rate_control_send_low+0x524/0x800 [ 1402.411244][ T126] __report_bug+0x29a/0x540 [ 1402.415844][ T126] ? __rate_control_send_low+0x524/0x800 [ 1402.421558][ T126] ? __pfx___report_bug+0x10/0x10 [ 1402.426744][ T126] ? __lock_acquire+0x6b5/0x2cf0 [ 1402.431719][ T126] report_bug_entry+0x19a/0x290 [ 1402.436611][ T126] ? __rate_control_send_low+0x5bb/0x800 [ 1402.442353][ T126] ? __rate_control_send_low+0x5c0/0x800 [ 1402.448060][ T126] handle_bug+0xca/0x200 [ 1402.452391][ T126] exc_invalid_op+0x1a/0x50 [ 1402.456947][ T126] asm_exc_invalid_op+0x1a/0x20 [ 1402.461845][ T126] RIP: 0010:__rate_control_send_low+0x5bb/0x800 [ 1402.468115][ T126] Code: ff 4c 8b 7c 24 08 48 8b 44 24 38 0f b6 04 28 84 c0 0f 85 d3 01 00 00 41 8b 0f 4c 89 f7 48 8b 74 24 18 44 8b 44 24 2c 45 89 e9 <67> 48 0f b9 3a 4c 8b 74 24 30 e9 81 fe ff ff 44 89 f9 80 e1 07 80 [ 1402.487837][ T126] RSP: 0018:ffffc90002e065f8 EFLAGS: 00010246 [ 1402.494024][ T126] RAX: 0000000000000000 RBX: 000000000000000c RCX: 0000000000000000 [ 1402.502040][ T126] RDX: 00000000ffffffff RSI: 0000000000000000 RDI: ffffffff9000bfe0 [ 1402.510515][ T126] RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1402.518529][ T126] R10: 0000000000000004 R11: 0000000000000000 R12: ffff888063e90168 [ 1402.526516][ T126] R13: 0000000000000000 R14: ffffffff9000bfe0 R15: ffff88807734b138 [ 1402.534638][ T126] ? __rate_control_send_low+0x58d/0x800 [ 1402.540417][ T126] rate_control_send_low+0x1a7/0x7b0 [ 1402.545723][ T126] rate_control_get_rate+0x20b/0x5d0 [ 1402.551063][ T126] ieee80211_tx_h_rate_ctrl+0xaf6/0x1760 [ 1402.556737][ T126] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 1402.562814][ T126] ? __skb_flow_dissect+0x423/0x6d20 [ 1402.568101][ T126] ? lock_acquire+0x106/0x330 [ 1402.572844][ T126] invoke_tx_handlers_late+0xba/0x18a0 [ 1402.578343][ T126] ? ieee80211_tx_h_select_key+0xd1b/0x19f0 [ 1402.584271][ T126] ieee80211_tx_dequeue+0x3252/0x46e0 [ 1402.589749][ T126] ? __pfx_ieee80211_tx_dequeue+0x10/0x10 [ 1402.595522][ T126] ieee80211_handle_wake_tx_queue+0x132/0x2c0 [ 1402.601628][ T126] ? __pfx_ieee80211_handle_wake_tx_queue+0x10/0x10 [ 1402.608254][ T126] ? __local_bh_enable_ip+0xd0/0x130 [ 1402.613571][ T126] ieee80211_queue_skb+0x1a3f/0x2210 [ 1402.619152][ T126] ieee80211_tx+0x2c2/0x4b0 [ 1402.623848][ T126] ? __pfx_ieee80211_tx+0x10/0x10 [ 1402.628991][ T126] ? ieee80211_xmit+0x315/0x400 [ 1402.633872][ T126] __ieee80211_subif_start_xmit+0xd12/0x1660 [ 1402.640040][ T126] ? __ieee80211_subif_start_xmit+0x2cf/0x1660 [ 1402.646441][ T126] ? __pfx___ieee80211_subif_start_xmit+0x10/0x10 [ 1402.652875][ T126] ? ieee80211_multicast_to_unicast+0x19c/0x320 [ 1402.659123][ T126] ieee80211_subif_start_xmit+0xf3/0x570 [ 1402.664779][ T126] ? __pfx_ieee80211_subif_start_xmit+0x10/0x10 [ 1402.671027][ T126] ? __pfx_netif_skb_features+0x10/0x10 [ 1402.676641][ T126] dev_hard_start_xmit+0x2cd/0x7f0 [ 1402.681870][ T126] __dev_queue_xmit+0x168f/0x3850 [ 1402.686972][ T126] ? __dev_queue_xmit+0x274/0x3850 [ 1402.692148][ T126] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1402.697566][ T126] ? neigh_resolve_output+0x438/0x750 [ 1402.702989][ T126] ? eth_header+0x11b/0x200 [ 1402.707522][ T126] ? __asan_memcpy+0x40/0x70 [ 1402.712163][ T126] ? eth_header+0x11b/0x200 [ 1402.716805][ T126] ? __pfx_eth_header+0x10/0x10 [ 1402.721681][ T126] ? neigh_resolve_output+0x624/0x750 [ 1402.727102][ T126] ? ip6_output+0x126/0x550 [ 1402.732080][ T126] ip6_output+0x340/0x550 [ 1402.736459][ T126] NF_HOOK+0xa2/0x3a0 [ 1402.740475][ T126] ? NF_HOOK+0xf9/0x3a0 [ 1402.744774][ T126] ? __pfx_NF_HOOK+0x10/0x10 [ 1402.749436][ T126] ? __pfx_dst_output+0x10/0x10 [ 1402.754527][ T126] ? lockdep_hardirqs_on+0x7a/0x110 [ 1402.759749][ T126] ? __local_bh_enable_ip+0xd0/0x130 [ 1402.765061][ T126] ? icmp6_dst_alloc+0x3a6/0x440 [ 1402.770035][ T126] mld_sendpack+0x8b4/0xe40 [ 1402.774585][ T126] ? mld_sendpack+0x213/0xe40 [ 1402.779303][ T126] ? __pfx_mld_sendpack+0x10/0x10 [ 1402.784392][ T126] mld_ifc_work+0x835/0xe70 [ 1402.789000][ T126] ? process_scheduled_works+0xa0f/0x17a0 [ 1402.794815][ T126] process_scheduled_works+0xaec/0x17a0 [ 1402.800520][ T126] ? __pfx_process_scheduled_works+0x10/0x10 [ 1402.806544][ T126] ? do_raw_spin_lock+0x12b/0x2f0 [ 1402.811591][ T126] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1402.816964][ T126] ? schedule+0x90/0x360 [ 1402.821337][ T126] worker_thread+0xda6/0x1360 [ 1402.826133][ T126] kthread+0x726/0x8b0 [ 1402.830232][ T126] ? __pfx_worker_thread+0x10/0x10 [ 1402.835338][ T126] ? __pfx_kthread+0x10/0x10 [ 1402.839953][ T126] ? _raw_spin_unlock_irq+0x23/0x50 [ 1402.845185][ T126] ? __pfx_kthread+0x10/0x10 [ 1402.849890][ T126] ret_from_fork+0x51b/0xa40 [ 1402.854677][ T126] ? __pfx_ret_from_fork+0x10/0x10 [ 1402.859890][ T126] ? __switch_to+0xc82/0x1410 [ 1402.864587][ T126] ? __pfx_kthread+0x10/0x10 [ 1402.869298][ T126] ret_from_fork_asm+0x1a/0x30 [ 1402.874193][ T126] [ 1402.877387][ T126] Kernel Offset: disabled [ 1402.881790][ T126] Rebooting in 86400 seconds..