last executing test programs: 12.155803805s ago: executing program 2 (id=3126): r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000030020f003040040000000000109022472510000000009040000120701030009050102cb0a00000009058202", @ANYRESDEC, @ANYRES32=r0, @ANYRES64=r0, @ANYRES16=r0, @ANYRESHEX=r0], 0x0) 11.626409577s ago: executing program 3 (id=3127): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_MCE_KILL(0x35, 0x1, 0x8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) ptrace(0x10, 0x1) socket$kcm(0xa, 0x2, 0x3a) r3 = syz_open_dev$video4linux(0x0, 0x5, 0x20980) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r3, 0xc040564a, 0x0) add_key(&(0x7f0000000000)='dns_resolver\x00', 0x0, &(0x7f0000000040)='\x00\x00', 0x2, 0xfffffffffffffffd) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, 0x0) close(0xffffffffffffffff) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') read$FUSE(r5, &(0x7f0000002580)={0x2020}, 0x2020) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002382, 0x0) pwritev2(r6, &(0x7f0000001980)=[{&(0x7f0000000140)="b4e846942b6861f09388691daa7b703019683d230d203d54b8659b613a681196429f74b32d358168004810703d9160a2dd71ea96a6060db27dbfa4dce6459f3dbb8ce5d701b53fac1479ccc2f48cd9c80d3be9d0b2e3dee9b2f168a07f5e48fae9af3036aa50afbf0ea0dcc683515a55342917b3071b1bc2cffe971916dbc265730e0700d6f97b338cbd9f05f1ae6faf5e7ce9f92865e25938e7795ac78841f4e2589e23576547d00801b96b1ba3e0e56f7d309e8903cf", 0x34}], 0x100000000000034b, 0xc0b6, 0x102, 0xd) recvmmsg(r0, &(0x7f0000000b80)=[{{0x0, 0xffffffffffffff6c, 0x0, 0x0, 0x0, 0x52}, 0xa}], 0x360, 0x120, 0x0) 10.071215739s ago: executing program 2 (id=3129): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17", 0x2b}], 0x1) 9.684046082s ago: executing program 2 (id=3131): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000001980)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) execve(0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201010200400010f3044d0740000102030109022400010103300509040008010301010075faa528ea22a52b886b0921ff00010122b0"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x194, 0x10, 0x1, 0x0, 0x0, {{@in6=@private0, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, {@in, 0x0, 0x32}, @in6=@remote, {}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @algo_auth_trunc={0x5c, 0x14, {{'cmac(aes)\x00'}, 0x80, 0x0, "e3630dde215f3da533f861c33b10bf7d"}}]}, 0x194}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="200000001e843c0d000000000000000007000000", @ANYRES32=0x0, @ANYBLOB="01a0000001500400"], 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1, 0x0, 0x0, 0x2000000}, 0x20) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r4, 0x0, 0x19, 0x0, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000001640)=ANY=[@ANYBLOB="0002020100000008ff"], 0x18) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0xff}, 0x7}, 0x1c) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000100)="88", 0xfdef}], 0x1) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue0\x00', 0x200000}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r5, 0x54a2) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r6, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f00000000c0)={0x2, 0x2, 0x44, 0x0, 0xd}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000070000040900010073797a300000000040000000030a01080000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d65746100000000140002800800014000000012080002400000001514000000110001"], 0xd8}}, 0x0) 8.228168592s ago: executing program 3 (id=3132): r0 = semget(0x1, 0x4, 0x39c) semop(r0, &(0x7f0000000080)=[{0x1, 0x8001, 0x1000}, {0x1, 0x5b7a, 0x800}], 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="30000000070603000000000000004a00030000050900020073790400000000000800c651f082f8050500010007"], 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) semctl$GETNCNT(r0, 0x1, 0xe, 0x0) 7.635169678s ago: executing program 0 (id=3133): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000000, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x8) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 7.511130828s ago: executing program 0 (id=3134): r0 = socket$nl_route(0x10, 0x3, 0x0) symlink(0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x32) socket$nl_generic(0x10, 0x3, 0x10) getsockopt(0xffffffffffffffff, 0x200000000114, 0x5, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x20400, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) r5 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(r5, &(0x7f0000000600)={&(0x7f00000001c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000640)="80", 0x26892}], 0x1}, 0xfc) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x334ecc4b, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) sendmsg$tipc(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000e40)=[{0x0, 0xf5}, {&(0x7f0000000dc0)="8a", 0x1}], 0x2, 0x0, 0x0, 0x24040804}, 0x8800) sendmsg$inet(r5, &(0x7f0000000680)={&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000240)="f9", 0x1}], 0x1}, 0x4000080) sendmsg$inet(r5, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000200)="cd", 0x1}], 0x1}, 0x240448c4) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000980), 0x6e, &(0x7f0000000bc0)=[{&(0x7f0000000a00)=""/211, 0xd3}, {&(0x7f0000000b00)=""/65, 0x41}, {&(0x7f0000000e80)=""/4096, 0x1000}, {&(0x7f0000000b80)=""/5, 0x5}], 0x4}, 0x40000020) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/58, 0x328000, 0xc00, 0xb, 0x1}, 0x20) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000300)={&(0x7f0000000800)=@gettaction={0x148, 0x32, 0x4, 0x70bd2a, 0x25dfdbfb, {}, [@action_gd=@TCA_ACT_TAB={0x58, 0x1, [{0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}, @action_gd=@TCA_ACT_TAB={0x5c, 0x1, [{0xc, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xfffffffb}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x38, 0x1, [{0xc, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}]}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x10006}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}]}, 0x148}}, 0xc000) write(r1, &(0x7f0000000080)="163210f9ff02d49e303bc990eedeb12d2b171e9e600ea4065ca7bc6fc1d7beffd0750331075fb5bca2ea6fa48e3cb1a379e7c41eafa6c41b0cbb86ba50", 0x3d) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="400000001000010029bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="4402f461b771e06efc31cbbf39e0fa5c050000000000140003006d6163767461703000000000000000000400168005d5fe7275b7addb423cfb447800110009000000e35e4a2e571b79256fc500f6867abe9e6d9b34b410d7fd2003e14688bf872d2db31a328963cf9c312c2b7b13195378918a9a19ce3ca658933bee96d7b0ba1e12a5b8b4ecc0c583dac8b6bfffad3f8d8664b25ce8c9b9b1f48a8d0a98b89552de39211cd463357a8e5be4560a7d53aeb830ae0e517d807e195f3d1679757f2fd1551a51391e4054b6367bb6c7435261a5399c36ec44da1dcab6d71ced43fc098e9f1126f953af610c6c66d0e1658d69"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x40) 7.172294552s ago: executing program 1 (id=3135): bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000202070250000bfa100000000000007010000f8ffffffb703000008000000b7030000000000208500000072"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a0b040000000000000000f7ff00002c0004802800018007000100637400001c0002800800024000000012080004400000000405000300000000000900010073797a30001000000900020073"], 0x80}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000480)={{0x7000, 0xdddd1000, 0x0, 0x0, 0x8, 0x8, 0x0, 0x2, 0x0, 0x6, 0x9, 0x10}, {0x8080000, 0x0, 0x3, 0x8, 0x3, 0x0, 0x0, 0x0, 0x7, 0x7, 0x0, 0xff}, {0x3000, 0x5000, 0xc, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x10, 0xfc}, {0x1000, 0xd000, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x4, 0x3}, {0xeeee8000, 0x3000, 0x9, 0x0, 0xff, 0x4, 0x0, 0xe, 0x0, 0x3c}, {0x0, 0x4000, 0xd, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x80}, {0x4000, 0xdddd1000, 0xa, 0x6, 0x5, 0x0, 0x3}, {0x80a0000, 0xdddd0000, 0xb, 0x0, 0x0, 0x1, 0x0, 0xa, 0x26, 0x0, 0x0, 0x1}, {0x80a0000, 0x4}, {0xeeef0000}, 0xfdfcffc9, 0x0, 0x10000, 0x28, 0xb, 0xf801, 0xdddd0000, [0x0, 0x0, 0x1]}) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xd13a}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000009c0)={0x6, 0x0, 0x0, &(0x7f00000002c0)='GPL\x00', 0xdf64, 0x0, 0x0, 0x41100, 0x1, '\x00', r1, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000600)={0x8, 0x3}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000100)={0x0, &(0x7f00000001c0)}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r9 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/tty/drivers\x00', 0x0, 0x0) r10 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r11, r12, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd=r9, 0xffffffffffffffff, &(0x7f0000000580)=""/207, 0xcf, 0x2, 0x1}) io_uring_enter(r10, 0x627, 0x4c1, 0x43, 0x0, 0x30) 6.942939006s ago: executing program 3 (id=3136): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x7, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000280)={0xffffffffffffffff, 0x7, {0x0, 0x0, 0x0, 0xf, 0x8, 0x0, 0x6, 0x6, 0x10, "b36185e150be2f5c30f09a2b1d0ea95b0e60ab08821b698eb04f8a8a35f3b74213df355397706a1109b1c8d1204ba7b3e2a37fafdcaa8dbc4840aa9fd4536177", "c121670615642b7584c2bcdab3ec2d5f913abe8ec149c3fe3a45a6b18db94169c12869bf72e15e1565d176bb81baa450e53cf50107a5173893b09213d4af50f6", "21801b4d3df0f18e04712546c3ba05cb2770cb63c097366f775e7afd523d3db5", [0x0, 0x528a]}}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) memfd_secret(0x80000) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) socket$inet6(0xa, 0x3, 0x6) socket$inet6_sctp(0xa, 0x5, 0x84) pipe(&(0x7f0000000240)) socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz1\x00', {0x1b10, 0x0, 0x1, 0x2}, 0x2f, [0x2, 0x1, 0x704d, 0x1, 0x3, 0x1, 0x2, 0x7db, 0x4, 0xfffffc01, 0xfffffffb, 0x8, 0x200001, 0x100, 0xfe, 0x4a, 0x7, 0x5, 0x2ca, 0x8, 0x76, 0x8, 0x0, 0x200, 0x40, 0x19b2, 0x8000, 0x7, 0xc1, 0x4000000, 0x7, 0x3, 0xe, 0x7, 0x1, 0x1, 0x5, 0xf, 0x7, 0x10001, 0x7, 0x7f, 0x8, 0x6, 0xb, 0x4, 0x6, 0x40, 0x7f, 0x9, 0x1, 0x6, 0x4, 0x2284919, 0x4, 0x5643fa73, 0xfffeffff, 0x7, 0x800, 0x2, 0x8a, 0x6, 0x1, 0x6], [0xfffffed2, 0x7fffffff, 0xffff, 0x7, 0xe62, 0x3, 0x0, 0x9, 0xc33, 0xf, 0x7, 0x800, 0x6c368000, 0x4, 0x1000007, 0x0, 0x10, 0x5, 0x8, 0x8001, 0x3, 0x7fff, 0x9, 0x40, 0x5, 0x4, 0x4, 0xb, 0x40, 0xc14, 0x80000001, 0x3, 0x3, 0x7, 0x7, 0x8, 0x8, 0x5, 0x4, 0x9, 0x5, 0x3, 0x2, 0x4, 0x0, 0xfff, 0xa4, 0x4, 0x5, 0xd69, 0x9, 0xf404, 0xf1, 0x3, 0x3, 0x1, 0x6, 0x0, 0x0, 0x106, 0x8, 0x9, 0x4, 0x1000068], [0x1, 0x1, 0x4, 0xfffffffc, 0x0, 0x7fff, 0x405, 0x9, 0x2, 0xffc, 0x7, 0x4, 0xc, 0x7, 0xa, 0xa, 0x6, 0x4, 0x5, 0x5, 0x2, 0x30000000, 0x3, 0x2, 0xfffffffd, 0x7, 0x10000, 0x7f, 0x7ff, 0xd, 0x400, 0x0, 0x41, 0x81, 0xc99, 0x25a, 0x2, 0xfffffffc, 0x2, 0x5d9fff6, 0x3ff, 0xff, 0x4, 0x8, 0x10000, 0xe7, 0x200, 0x7af5, 0x0, 0x9, 0x0, 0xffff, 0x7, 0x6, 0x0, 0x81, 0x9, 0x2000002, 0x3, 0x100, 0x8, 0x0, 0x6, 0x10], [0xffefff80, 0xd5800000, 0x0, 0x4, 0x2, 0x62a, 0x6, 0x407, 0xb343, 0x4, 0x80001, 0x8, 0x7, 0x8, 0xffffff7e, 0x80000000, 0x5, 0x3, 0x201, 0xfff, 0x3, 0x0, 0x3c65, 0xa, 0x5, 0x80, 0xffffffff, 0x3, 0x2, 0x7, 0x1, 0x7, 0x7, 0x8, 0x1, 0x0, 0x9, 0x17ce, 0x0, 0x3, 0x6fe, 0x20e, 0x7, 0x13b, 0x7, 0x8, 0xb757, 0x2, 0x117, 0x896, 0x54, 0x8c1, 0x0, 0x5, 0x5, 0xf, 0x100, 0x10000400, 0x9, 0x5, 0x661b, 0xfffffffb, 0xc, 0x2]}, 0x45c) syz_io_uring_setup(0xd2, &(0x7f0000000500)={0x0, 0x2000000, 0x800, 0x0, 0xc0}, &(0x7f00000002c0)=0x0, &(0x7f0000000640)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) ioprio_set$pid(0x1, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) mprotect(&(0x7f0000155000/0x1000)=nil, 0x1000, 0x6) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x7b, 0x0, 0x0, 0x0, &(0x7f0000011000/0x4000)=nil, 0x4000, 0xc}) io_uring_enter(r2, 0x46bc, 0xc6de, 0x4a, 0x0, 0x0) r5 = io_uring_setup(0x6e1a, &(0x7f0000000200)={0x0, 0x5bdb, 0x481, 0xfffffffc, 0x83}) io_uring_register$IORING_REGISTER_BUFFERS2(r5, 0xf, &(0x7f0000001580)={0x1, 0x0, 0x0, &(0x7f00000014c0)=[{0x0}], &(0x7f0000001440)=[0x1]}, 0x20) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 6.70432023s ago: executing program 3 (id=3137): r0 = socket$kcm(0xa, 0x3, 0x87) sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @empty}, 0x80, &(0x7f00000004c0), 0x3e}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000e1310a10f0031d58b776010203010902240001000000000904310002ff0107ff09058a02100000fa000905", @ANYBLOB="29f6"], 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5", 0x4f}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000f00)=""/260, 0x104}, {&(0x7f0000000240)=""/227, 0xe3}, {&(0x7f00000030c0)=""/4075, 0xfeb}, {&(0x7f0000000540)=""/195, 0xc3}, {&(0x7f00000008c0)=""/213, 0xd5}, {&(0x7f00000010c0)=""/4081, 0xff1}, {&(0x7f0000000b00)=""/195, 0xc3}, {&(0x7f00000007c0)=""/167, 0xa7}, {0x0}, {0x0}, {&(0x7f0000000440)=""/218, 0xda}], 0xb}, 0x40012100) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) fcntl$setpipe(r2, 0x8, 0x80000000) recvmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1e}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r5, 0x4048aecb, &(0x7f0000000180)={0x4, 0x0, [{0x0, 0x0, 0x300, 0x6}, {0x0, 0x6}, {0x5e2796afef1a2f31, 0xffffffff, 0x0, 0x9, 0x1, 0x80000001, 0x8}, {0x80000001, 0xffffffff, 0x7, 0x8, 0x5, 0x110, 0x3}]}) 6.347675354s ago: executing program 0 (id=3138): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0xfac0d, &(0x7f0000000680)={&(0x7f0000000000)={0x38, r0, 0x801, 0xfffffffc, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY={0x1c, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "5f570ac77a"}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x880}, 0x0) 5.850966953s ago: executing program 0 (id=3139): timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3", 0x8}], 0x1, 0x0, 0x0, 0x8804}], 0x1, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x700, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/57, 0x3}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) 5.829629683s ago: executing program 2 (id=3140): r0 = socket$nl_route(0x10, 0x3, 0x0) symlink(0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x32) socket$nl_generic(0x10, 0x3, 0x10) getsockopt(0xffffffffffffffff, 0x200000000114, 0x5, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x20400, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) r5 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(r5, &(0x7f0000000600)={&(0x7f00000001c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000640)="80", 0x26892}], 0x1}, 0xfc) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x334ecc4b, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) sendmsg$tipc(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000e40)=[{0x0, 0xf5}, {&(0x7f0000000dc0)="8a", 0x1}], 0x2, 0x0, 0x0, 0x24040804}, 0x8800) sendmsg$inet(r5, &(0x7f0000000680)={&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000240)="f9", 0x1}], 0x1}, 0x4000080) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000c00)={&(0x7f0000000980), 0x6e, &(0x7f0000000bc0)=[{&(0x7f0000000a00)=""/211, 0xd3}, {&(0x7f0000000b00)=""/65, 0x41}, {&(0x7f0000000e80)=""/4096, 0x1000}, {&(0x7f0000000b80)=""/5, 0x5}], 0x4}, 0x40000020) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/58, 0x328000, 0xc00, 0xb, 0x1}, 0x20) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000300)={&(0x7f0000000800)=@gettaction={0x148, 0x32, 0x4, 0x70bd2a, 0x25dfdbfb, {}, [@action_gd=@TCA_ACT_TAB={0x58, 0x1, [{0xc, 0x1e, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}, @action_gd=@TCA_ACT_TAB={0x5c, 0x1, [{0xc, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x0, 0x1}}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xfffffffb}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x38, 0x1, [{0xc, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}]}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x10006}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}]}, 0x148}}, 0xc000) write(r1, &(0x7f0000000080)="163210f9ff02d49e303bc990eedeb12d2b171e9e600ea4065ca7bc6fc1d7beffd0750331075fb5bca2ea6fa48e3cb1a379e7c41eafa6c41b0cbb86ba50", 0x3d) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="400000001000010029bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="4402f461b771e06efc31cbbf39e0fa5c050000000000140003006d6163767461703000000000000000000400168005d5fe7275b7addb423cfb447800110009000000e35e4a2e571b79256fc500f6867abe9e6d9b34b410d7fd2003e14688bf872d2db31a328963cf9c312c2b7b13195378918a9a19ce3ca658933bee96d7b0ba1e12a5b8b4ecc0c583dac8b6bfffad3f8d8664b25ce8c9b9b1f48a8d0a98b89552de39211cd463357a8e5be4560a7d53aeb830ae0e517d807e195f3d1679757f2fd1551a51391e4054b6367bb6c7435261a5399c36ec44da1dcab6d71ced43fc098e9f1126f953af610c6c66d0e1658d69"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x40) 5.705713865s ago: executing program 1 (id=3141): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) sendto$inet6(r0, &(0x7f0000000000)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000580)={0x41, 0x80}, 0xe) recvmmsg(r0, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f00000000c0), 0x1f, &(0x7f00000003c0)=""/21, 0x21}, 0x1ff}], 0x73d, 0x40000040, 0x0) 4.577576423s ago: executing program 1 (id=3143): socket$kcm(0x11, 0x200000000000002, 0x300) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_TABLE(r0, 0x0, 0xcf, &(0x7f0000000080)=0xff, 0x4) r1 = socket$kcm(0xa, 0x1, 0x106) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000001340)=""/4096, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r3, 0x6, 0x1e, 0xffffffffffffffff, &(0x7f0000000040)) connect$inet(r2, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) ioctl$int_in(r2, 0x5452, &(0x7f0000000000)=0x2) fadvise64(r2, 0x8000, 0x7ffffffc, 0x4) sendmsg$kcm(r1, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0x6, @loopback={0x0, 0x7ffffffe}, 0x2}, 0x80, 0x0}, 0xe07e872420dfefca) 4.279077105s ago: executing program 2 (id=3144): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/3, 0x1e000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_RMFB(r1, 0xc00464af, &(0x7f00000000c0)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1038, 0x1410, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x7, {[@main=@item_4={0x3, 0x0, 0xa, "0cf80d00"}, @global=@item_012={0x1, 0x1, 0x3, "ad"}]}}, 0x0}, 0x0) ioctl$VIDIOC_S_OUTPUT(0xffffffffffffffff, 0xc004562f, &(0x7f00000000c0)=0x1) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x1fd, 0x1, 0x0, 0x2000, &(0x7f0000bd3000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_GET_VCPU_EVENTS(r5, 0x4048aecb, &(0x7f00000000c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r7, 0x402, 0x8000003d) fcntl$setsig(r7, 0xa, 0x21) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x0, 0x1000000d) r8 = open(&(0x7f0000000000)='./bus\x00', 0x1, 0xc32a4cddd557707a) fallocate(r8, 0x0, 0x0, 0x9000f3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeed, 0x80010, r8, 0x5000) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f00000000c0)=0x100, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) bind$xdp(r0, &(0x7f00000001c0)={0x2c, 0x0, r9}, 0x10) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000000010301000000000000000a000000"], 0x14}}, 0x0) 3.969225s ago: executing program 4 (id=3145): syz_open_dev$sg(&(0x7f00000002c0), 0x6f5e, 0x0) r0 = socket(0x1e, 0x80000, 0x3) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x3, 0x20001, 0x1, 0x8}, 0x10) write(r0, &(0x7f0000000000)="1b0000001a005f0214f9f4070009040081000000002c0000000000", 0x1b) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, 0x0, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$UHID_CREATE2(r3, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) read$char_usb(r4, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 3.432694122s ago: executing program 3 (id=3146): r0 = syz_usb_connect(0x0, 0x35, &(0x7f0000000040)=ANY=[@ANYRESDEC, @ANYRES32=0x0], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000010c0)={0x24, 0x0, &(0x7f0000000f80)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) 2.642328168s ago: executing program 0 (id=3147): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_MCE_KILL(0x35, 0x1, 0x8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) ptrace(0x10, 0x1) socket$kcm(0xa, 0x2, 0x3a) r3 = syz_open_dev$video4linux(0x0, 0x5, 0x20980) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r3, 0xc040564a, 0x0) add_key(&(0x7f0000000000)='dns_resolver\x00', 0x0, &(0x7f0000000040)='\x00\x00\x00', 0x3, 0xfffffffffffffffd) r4 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, 0x0) close(0xffffffffffffffff) r5 = syz_open_procfs(0xffffffffffffffff, 0x0) read$FUSE(r5, &(0x7f0000002580)={0x2020}, 0x2020) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002382, 0x0) pwritev2(r6, &(0x7f0000001980)=[{&(0x7f0000000140)="b4e846942b6861f09388691daa7b703019683d230d203d54b8659b613a681196429f74b32d358168004810703d9160a2dd71ea96a6060db27dbfa4dce6459f3dbb8ce5d701b53fac1479ccc2f48cd9c80d3be9d0b2e3dee9b2f168a07f5e48fae9af3036aa50afbf0ea0dcc683515a55342917b3071b1bc2cffe971916dbc265730e0700d6f97b338cbd9f05f1ae6faf5e7ce9f92865e25938e7795ac78841f4e2589e23576547d00801b96b1ba3e0e56f7d309e8903cf", 0x34}], 0x100000000000034b, 0xc0b6, 0x102, 0xd) recvmmsg(r0, &(0x7f0000000b80)=[{{0x0, 0xffffffffffffff6c, 0x0, 0x0, 0x0, 0x52}, 0xa}], 0x360, 0x120, 0x0) 1.847044896s ago: executing program 4 (id=3148): r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x5, &(0x7f00000000c0)=0x80, 0x4) syz_emit_ethernet(0x4e, &(0x7f00000020c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3986dd6c370c8900182b01fe800000000000000000000000000025fe8000000000000000000000000000aaff"], 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x278, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x2d8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x103000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) sendto$inet(0xffffffffffffffff, &(0x7f00000000c0)="8689d4622d4b72e204000000a5ce7839edaf02afe39ead95913e9c4f8cf31440006769ebdf12cfacae8e8c03f5db079da7d9", 0x32, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000200)={0x0, 0x0, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) r5 = dup(r4) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f0000000000)=@arm64={0x9, 0xfc, 0x2, '\x00', 0x8001}) r6 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) writev(r6, &(0x7f0000000540)=[{&(0x7f00000002c0)="4202", 0x2}], 0x1) ioctl$KVM_SET_VAPIC_ADDR(r5, 0x4008ae93, &(0x7f00000002c0)=0x10000) ioctl$KVM_RUN(r4, 0xae80, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002240)=""/17, 0x15}, 0x8e0f}], 0x400029c, 0x40010142, 0x0) 1.695702516s ago: executing program 1 (id=3149): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x1000003, 0x0, 0x4, 0x722}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000fe0000000000000008000f00fd000000", 0x24) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_netprio_ifpriomap(r1, &(0x7f0000000040), 0x2, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r4 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r4, 0xc0205648, &(0x7f0000000500)={0x0, 0x1, 0x10000, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90d, 0x7, '\x00', @p_u32=&(0x7f0000000580)=0xfffffffe}}) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f0000000140)={0x13, 0x10, 0xfa00, {0x0, r5}}, 0x18) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4004}, 0x20000000) write$cgroup_netprio_ifpriomap(r2, &(0x7f0000000240)=ANY=[], 0x12) 1.469228185s ago: executing program 1 (id=3150): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x0, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000005c0)={{0x3000, 0x4, 0x9, 0x7, 0xe, 0x40, 0x14, 0x80, 0x0, 0x4, 0xb8, 0x9}, {0x8080000, 0x4, 0x4, 0xeb, 0xed, 0x2, 0x1, 0x8, 0x2c, 0x5, 0x4, 0x8}, {0x1, 0x2, 0x4, 0xb, 0x7, 0x40, 0x1, 0x0, 0x9, 0x4, 0xc, 0xc1}, {0x100000, 0x2000, 0x1, 0x9, 0xb5, 0x8, 0x4, 0x6, 0xa6, 0x8, 0x8, 0xb}, {0x10000, 0xffff1000, 0xb, 0xc, 0xd0, 0xc, 0x3, 0xc, 0x4, 0x6, 0x10, 0x2b}, {0x0, 0x8000000, 0xd, 0x81, 0x5, 0xfb, 0x7, 0x5, 0x2, 0x67}, {0x8000000, 0x1000, 0x3, 0x8, 0x5, 0x3, 0x23, 0x0, 0xd, 0x8, 0x38}, {0xeeee8000, 0xeeee8000, 0x4, 0xc, 0x4, 0xb2, 0xbc, 0x80, 0x4, 0x9, 0x6, 0xb}, {0x102001, 0xa1b}, {0x6000, 0xf07}, 0x0, 0x0, 0xeeee8000, 0x80, 0x400000000000001, 0x4000, 0x6000, [0x9, 0x81, 0x8, 0x8]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000080000024d564b000000"]) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x5b) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.322144755s ago: executing program 4 (id=3151): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000040)={0x6, 0x3, 0x9, 0x1003, 0x31, '\v\x00\x00]\x00'}) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000000)=0x8001) ioctl$TIOCSERGETLSR(r0, 0x5459, &(0x7f0000000000)) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='net\x00') getdents(r2, 0xfffffffffffffffd, 0x3b) recvmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f00000007c0)=""/195, 0xc3}, {&(0x7f0000001c80)=""/4079, 0xfef}, {&(0x7f00000006c0)=""/248, 0xf8}, {&(0x7f0000000580)=""/193, 0xc1}, {&(0x7f0000000240)=""/45, 0x2d}, {&(0x7f00000003c0)=""/185, 0xb9}, {&(0x7f0000000340)=""/110, 0x6e}, {&(0x7f0000000a80)=""/78, 0x4e}, {&(0x7f0000004200)=""/4112, 0x1010}, {&(0x7f0000000a00)=""/94, 0x5e}], 0xa}, 0x0) 1.104662428s ago: executing program 4 (id=3152): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x4102, 0x20000845, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @rand_addr, 0x5}, 0x1c) 970.723511ms ago: executing program 4 (id=3153): syz_open_procfs(0x0, &(0x7f0000000400)='net/llc/socket\x00') r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) socket$l2tp(0x2, 0x2, 0x73) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000040)={0xf0f024}) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000100)={0x2, @vbi={0x9, 0x7, 0x80000000, 0x34524742, [0x1000, 0x7], [0x9, 0xfff], 0x108}}) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000280)=ANY=[@ANYBLOB="ffffffffff0000aaaaaaaa00000d010000a0160600ad1100000000000037e4da9707f653e812f340ace5733a33dc5af03aa1939e28153eb8282b1da382161fd80f7757e423f45751fd1dd4586f5d99cbaaf8b332233f"], 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xd21, 0x4000) r4 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) r6 = dup3(r4, r5, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050000e22dcbc80b47befa0000000900010073797a30000000002c000000030a01020000000000000000010000030900030073797a30000000000900010073797a3000000000540000001a0a010400000000000000000100000008000b40000000000900010073797a30000000002c0004"], 0xc8}}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x19}, [@IFLA_NET_NS_FD={0x8}, @IFLA_TARGET_NETNSID={0x8}]}, 0x30}}, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000080), 0xfecc) symlinkat(&(0x7f0000000040)='./file0\x00', r6, &(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x12, r10, 0x0) 690.710726ms ago: executing program 2 (id=3154): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = dup(0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000000000108117980800000000000109022400010000000009040000020308000009210000010122290a09058103"], 0x0) syz_open_dev$evdev(&(0x7f0000000080), 0xe, 0x0) 672.662296ms ago: executing program 0 (id=3155): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x21, &(0x7f0000000000)=0x8, 0x4) socket$netlink(0x10, 0x3, 0x0) socket(0x11, 0x800000003, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x4082c1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x8904, 0x0, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000001900)={0x0, 0x0, &(0x7f0000001880)=[{&(0x7f0000001840)="e8e44433b3b318bcf93258d2df3f04c46535e7f967275d62bb0620f7c60c91a924228c946fbb0463ca3f86ad00c2f67aeda2eb219ed6ee5e62209bb11e646c61", 0x40}], 0x1}, 0x4010) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000001940), 0x1000, 0x0) close_range(r3, r4, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=@newchain={0x43c, 0x64, 0x100, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x7}, {0xfff1}, {0xc, 0xe}}, [@f_rsvp6={{0xa}, {0x40c, 0x2, [@TCA_RSVP_POLICE={0x408, 0x5, [@TCA_POLICE_RATE={0x404, 0x2, [0x85, 0x8, 0x4, 0x9, 0x4, 0x1, 0xcf, 0x775, 0xfffffffa, 0x3, 0xa2, 0x4, 0x4, 0x7fff, 0x3, 0xf, 0x4, 0x3, 0x6, 0x2, 0x8, 0x7, 0x6, 0xfffffffb, 0x9, 0x78, 0x1, 0x2, 0x4, 0x1, 0xfffffee8, 0x5, 0x5, 0xa, 0x5, 0x8000, 0xd9, 0x0, 0x16, 0x0, 0x8, 0xfffffffa, 0x1ff, 0x5, 0x3ff, 0x7, 0x0, 0x5, 0xfffffff7, 0x8, 0x40050ea, 0x6, 0x8001, 0x9, 0xb0e0, 0xf, 0x5, 0x8, 0x3, 0x0, 0x4, 0x5b23, 0x5, 0x8, 0x2, 0xee, 0x7fffffff, 0xffff8001, 0x3, 0x172, 0x5ae27a20, 0x5, 0x6, 0x4, 0x200, 0x1ff, 0x3, 0x400, 0xe6b3, 0xd171, 0x6, 0x1ff, 0x7, 0x699213b0, 0x9, 0x8, 0x12, 0x3, 0x4, 0x0, 0x100, 0x5, 0x6793, 0xff4f, 0x1, 0xfffffffa, 0x9, 0x80000000, 0x7, 0x5, 0x0, 0x80000000, 0x400, 0x7, 0x7, 0x5, 0x9, 0x6, 0x9, 0x0, 0x1, 0x5, 0x2, 0x2, 0x2, 0x7ff, 0x40, 0x7f, 0x5fece1ea, 0xbf7, 0x8, 0x78, 0xe, 0x80000000, 0x6, 0x8, 0x5, 0xe, 0x5, 0x200, 0x4, 0x4, 0x0, 0x0, 0x1, 0x3, 0xb, 0x70, 0x2, 0x4, 0x9, 0x1800000, 0x9, 0xbff, 0x4, 0x6, 0x800, 0x7, 0x5, 0x3, 0x9, 0x6, 0x0, 0x2, 0x6, 0x800, 0x3ff, 0x9, 0x3, 0xcc, 0xc60, 0x3, 0x8, 0x4, 0x1, 0x0, 0x7, 0x2, 0x6, 0xc, 0x4, 0x32, 0x3, 0x8, 0x1000, 0x2, 0x2, 0x4, 0x2, 0xffff, 0xb37, 0x8000, 0xbec, 0x8, 0x5, 0x1, 0x5, 0x0, 0x1, 0xffff, 0x7f, 0x3, 0x94f, 0xc91, 0x9, 0x3, 0x2, 0xd46, 0xf, 0x200, 0x0, 0x8, 0x7ffeffff, 0x0, 0x8, 0x2, 0xe6, 0xb, 0x18000000, 0x4, 0x5, 0xd756, 0x6, 0x3, 0x800, 0x2000d3, 0x2, 0x6, 0x9, 0x4, 0x7, 0x5, 0xaec, 0x100, 0x0, 0xfffffffb, 0x40, 0xfffffffe, 0x3, 0xa, 0x7f, 0x1, 0x9c, 0x400, 0x5, 0x8000, 0x8, 0x8, 0xd, 0x6, 0xffffff7f, 0xee2b, 0x7, 0xeaf, 0x3, 0x401, 0x7, 0x7f, 0x5f, 0x1000, 0x7, 0x9, 0x4, 0x8001, 0x9, 0xf]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x1}, 0x40881) recvmmsg(r6, &(0x7f0000006fc0)=[{{0x0, 0x0, &(0x7f0000001f80)=[{0x0}, {0x0}], 0x2}, 0x3}], 0x1, 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000030c0)=[{&(0x7f0000000340)="1400000016001963d25a80648c56915a19aa2bfe", 0x14}], 0x1}, 0x0) r7 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r7, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x40001}, 0x8) sendto$inet6(r7, &(0x7f0000000140)="f4", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00'}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r7, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x0, 0x2ce9}, 0x8) 482.744805ms ago: executing program 1 (id=3156): r0 = socket$kcm(0xa, 0x3, 0x87) sendmsg$kcm(r0, &(0x7f0000000580)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @empty}, 0x80, &(0x7f00000004c0), 0x3e}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000e1310a10f0031d58b776010203010902240001000000000904310002ff0107ff09058a02100000fa000905", @ANYBLOB="29f6"], 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5", 0x4f}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000f00)=""/260, 0x104}, {&(0x7f0000000240)=""/227, 0xe3}, {&(0x7f00000030c0)=""/4075, 0xfeb}, {&(0x7f0000000540)=""/195, 0xc3}, {&(0x7f00000008c0)=""/213, 0xd5}, {&(0x7f00000010c0)=""/4081, 0xff1}, {&(0x7f0000000b00)=""/195, 0xc3}, {&(0x7f00000007c0)=""/167, 0xa7}, {0x0}, {0x0}, {&(0x7f0000000440)=""/218, 0xda}], 0xb}, 0x40012100) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) fcntl$setpipe(r2, 0x8, 0x80000000) recvmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1e}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r5, 0x4048aecb, &(0x7f0000000180)={0x4, 0x0, [{0x0, 0x0, 0x300, 0x6}, {0x0, 0x6}, {0x5e2796afef1a2f31, 0xffffffff, 0x0, 0x9, 0x1, 0x80000001, 0x8}, {0x80000001, 0xffffffff, 0x7, 0x8, 0x5, 0x110, 0x3}]}) 257.76599ms ago: executing program 3 (id=3157): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x161141) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$PPPIOCATTACH(r1, 0x4004743d, &(0x7f0000000180)=0x2) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000040)={0x7ff, 0x2064, 0x1}) mmap(&(0x7f0000fec000/0x3000)=nil, 0x3000, 0x0, 0x8021852, r3, 0x1000f0000) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB, @ANYRES32], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r4 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) write$binfmt_misc(r5, &(0x7f0000000780)="109b709610a7baaadf99a0a104d3f3cb1cfa31f1f2cbdb22db332a51222d13618dc5ec4eb264fad2eb99e3fe91b22b4d3e95b24f9cc30ab8afbd3712c27334003099a30edcd513ebc95d7eb26f5b01db0f39332beb8eb0cbcca9afa908fcecfead76fb7f9865fdca0a05b34ade5cb25b716d2850faf660d50eb87b201f013d5a0f2f8f252ce1ed1ab8a742ed2bb1249df74275ab04300f349f8187be014756b617dd961b0c2ccaf81b94f71841b5fb23962ed91f075de89bd6f15ac13dfeca65b94bcc4c6b", 0xffffffffffffff22) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000002c0)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900000000000000000000000000001800", [0x0, 0x2000000000001]}}) r6 = eventfd(0xc) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r6) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r6}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000001c40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_INNER_TYPE={0xffffffffffffff2a, 0x2, 0x1, 0x0, 0xb5}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_INNER_NUM={0x8}, @NFTA_INNER_NUM={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x8c}}, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000e40)={0x3, 0x0, [{0x0, 0xf3, &(0x7f00000008c0)=""/243}, {0xdddd0000, 0x8e, &(0x7f0000000580)=""/142}, {0xffff1000, 0x1000, &(0x7f0000004200)=""/4096}]}) ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f00000002c0)={0x1, r6}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) 0s ago: executing program 4 (id=3158): syz_open_dev$sg(&(0x7f00000002c0), 0x6f5e, 0x0) r0 = socket(0x1e, 0x80000, 0x3) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x3, 0x20001, 0x1, 0x8}, 0x10) write(r0, &(0x7f0000000000)="1b0000001a005f0214f9f4070009040081000000002c0000000000", 0x1b) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, 0x0, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$UHID_CREATE2(r3, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) read$char_usb(r4, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): 9] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 997.517329][T11667] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 997.528015][T11667] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 997.547014][T11667] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 997.585308][T11667] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 997.613008][T11667] usb 5-1: config 0 descriptor?? [ 997.658355][T11667] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 997.690777][T16069] team0: Port device team_slave_0 added [ 997.701839][T11667] dvb-usb: bulk message failed: -22 (3/0) [ 997.709619][T16183] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 997.720585][T16183] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 997.733156][T16069] team0: Port device team_slave_1 added [ 997.765168][T11667] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 997.793688][T11667] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 997.814427][T11667] usb 5-1: media controller created [ 997.845045][T16191] dibusb: i2c wr: len=61 is too big! [ 997.845045][T16191] [ 997.857209][T16191] netlink: 'syz.4.2839': attribute type 7 has an invalid length. [ 997.865292][T16191] netlink: 'syz.4.2839': attribute type 8 has an invalid length. [ 998.014805][T11667] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 998.049713][T16069] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 998.068703][T16069] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 998.133173][T11667] dvb-usb: bulk message failed: -22 (6/0) [ 998.168747][T11667] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 998.179415][T16069] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 998.210245][T11667] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input78 [ 998.275842][T11667] dvb-usb: schedule remote query interval to 150 msecs. [ 998.285150][T11667] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 998.325319][T16069] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 998.351244][T16069] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 998.377369][ C1] vkms_vblank_simulate: vblank timer overrun [ 998.400965][T16069] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 998.421685][T16205] netlink: 'syz.0.2841': attribute type 4 has an invalid length. [ 998.458627][ T5923] dvb-usb: bulk message failed: -22 (1/0) [ 998.464676][ T5923] dvb-usb: error while querying for an remote control event. [ 998.484399][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 998.486426][T16206] netlink: 'syz.0.2841': attribute type 4 has an invalid length. [ 998.491459][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 998.609600][T16205] FAULT_INJECTION: forcing a failure. [ 998.609600][T16205] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 998.636950][ T5923] dvb-usb: bulk message failed: -22 (1/0) [ 998.643619][ T5923] dvb-usb: error while querying for an remote control event. [ 998.705261][T16205] CPU: 0 UID: 0 PID: 16205 Comm: syz.0.2841 Not tainted 6.16.0-rc7-syzkaller-00105-g2942242dde89 #0 PREEMPT(full) [ 998.705294][T16205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 998.705308][T16205] Call Trace: [ 998.705318][T16205] [ 998.705328][T16205] dump_stack_lvl+0x189/0x250 [ 998.705358][T16205] ? __pfx____ratelimit+0x10/0x10 [ 998.705383][T16205] ? __pfx_dump_stack_lvl+0x10/0x10 [ 998.705408][T16205] ? __pfx__printk+0x10/0x10 [ 998.705438][T16205] ? __might_fault+0xb0/0x130 [ 998.705501][T16205] should_fail_ex+0x414/0x560 [ 998.705530][T16205] _copy_from_user+0x2d/0xb0 [ 998.705563][T16205] kstrtouint_from_user+0xc4/0x170 [ 998.705592][T16205] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 998.705643][T16205] proc_fail_nth_write+0x88/0x240 [ 998.705665][T16205] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 998.705695][T16205] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 998.705719][T16205] vfs_write+0x27b/0xa90 [ 998.705758][T16205] ? __pfx_vfs_write+0x10/0x10 [ 998.705788][T16205] ? __fget_files+0x2a/0x420 [ 998.705812][T16205] ? __fget_files+0x3a0/0x420 [ 998.705831][T16205] ? __fget_files+0x2a/0x420 [ 998.705860][T16205] ksys_write+0x145/0x250 [ 998.705892][T16205] ? __pfx_ksys_write+0x10/0x10 [ 998.705932][T16205] ? do_syscall_64+0xbe/0x3b0 [ 998.705962][T16205] do_syscall_64+0xfa/0x3b0 [ 998.705984][T16205] ? lockdep_hardirqs_on+0x9c/0x150 [ 998.706007][T16205] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 998.706028][T16205] ? clear_bhb_loop+0x60/0xb0 [ 998.706054][T16205] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 998.706075][T16205] RIP: 0033:0x7f430b98d45f [ 998.706094][T16205] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 998.706113][T16205] RSP: 002b:00007f430c744030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 998.706136][T16205] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f430b98d45f [ 998.706151][T16205] RDX: 0000000000000001 RSI: 00007f430c7440a0 RDI: 0000000000000005 [ 998.706165][T16205] RBP: 00007f430c744090 R08: 0000000000000000 R09: 0000000000000000 [ 998.706177][T16205] R10: 0000200000000440 R11: 0000000000000293 R12: 0000000000000001 [ 998.706191][T16205] R13: 0000000000000000 R14: 00007f430bbb5fa0 R15: 00007f430bcdfa28 [ 998.706224][T16205] [ 998.846983][ T5923] dvb-usb: bulk message failed: -22 (1/0) [ 999.202183][T16069] hsr_slave_0: entered promiscuous mode [ 999.238052][T16069] hsr_slave_1: entered promiscuous mode [ 999.280916][T16069] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 999.318475][T16069] Cannot create hsr debugfs directory [ 999.503369][ T5935] gspca_stk1135: reg_w 0x2ff err -71 [ 999.535815][ T5935] gspca_stk1135: serial bus timeout: status=0x00 [ 999.586845][ T5935] gspca_stk1135: Sensor write failed [ 999.592257][ T5935] gspca_stk1135: serial bus timeout: status=0x00 [ 999.683578][ T5935] gspca_stk1135: Sensor write failed [ 999.724392][ T5935] gspca_stk1135: serial bus timeout: status=0x00 [ 999.754977][ T5935] gspca_stk1135: Sensor read failed [ 999.765172][ T5935] gspca_stk1135: serial bus timeout: status=0x00 [ 999.805147][ T5923] dvb-usb: error while querying for an remote control event. [ 999.827007][ T5935] gspca_stk1135: Sensor read failed [ 999.837031][ T5935] gspca_stk1135: Detected sensor type unknown (0x0) [ 999.843712][ T5935] gspca_stk1135: serial bus timeout: status=0x00 [ 999.890783][ T5935] gspca_stk1135: Sensor read failed [ 999.896127][ T5935] gspca_stk1135: serial bus timeout: status=0x00 [ 999.977565][ T5935] gspca_stk1135: Sensor read failed [ 999.982880][ T5935] gspca_stk1135: serial bus timeout: status=0x00 [ 1000.017011][ T5923] dvb-usb: bulk message failed: -22 (1/0) [ 1000.022873][ T5923] dvb-usb: error while querying for an remote control event. [ 1000.106883][ T5935] gspca_stk1135: Sensor write failed [ 1000.112286][ T5935] gspca_stk1135: serial bus timeout: status=0x00 [ 1000.165295][ T5935] gspca_stk1135: Sensor write failed [ 1000.187050][ T5935] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71 [ 1000.225131][ T5935] usb 4-1: USB disconnect, device number 27 [ 1000.272901][ T31] audit: type=1326 audit(1753434978.892:770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16220 comm="syz.0.2844" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f430b98e9a9 code=0x0 [ 1000.297193][T11667] dvb-usb: bulk message failed: -22 (1/0) [ 1000.303039][T11667] dvb-usb: error while querying for an remote control event. [ 1000.390956][ T10] usb 5-1: USB disconnect, device number 16 [ 1000.503536][ T10] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1000.767703][ T5935] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 1000.967008][ T5935] usb 4-1: Using ep0 maxpacket: 16 [ 1001.082658][T16241] net_ratelimit: 7 callbacks suppressed [ 1001.082704][T16241] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1001.817120][T11667] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 1002.006738][T11667] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1002.041234][T11667] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1002.099150][T11667] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1002.122866][T11667] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1002.161052][T11667] usb 5-1: Product: syz [ 1002.185703][T11667] usb 5-1: Manufacturer: syz [ 1002.197528][T11667] usb 5-1: SerialNumber: syz [ 1002.201966][T16069] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1002.230278][T11667] cdc_mbim 5-1:1.0: MBIM functional descriptor missing [ 1002.251098][T11667] cdc_mbim 5-1:1.0: bind() failure [ 1002.437291][ T5923] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 1002.450155][T16069] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1002.524356][T16069] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1002.546504][T16069] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1002.600929][ T5923] usb 3-1: config 0 has an invalid interface number: 72 but max is 0 [ 1002.622087][ T5923] usb 3-1: config 0 has no interface number 0 [ 1002.670758][ T5923] usb 3-1: config 0 interface 72 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1002.734728][ T5923] usb 3-1: config 0 interface 72 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1002.849536][ T5923] usb 3-1: New USB device found, idVendor=04fc, idProduct=0204, bcdDevice=49.bf [ 1002.859184][ T5923] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1002.909986][ T5923] usb 3-1: Product: syz [ 1002.927287][ T5923] usb 3-1: Manufacturer: syz [ 1002.944541][ T5923] usb 3-1: SerialNumber: syz [ 1002.975472][ T5923] usb 3-1: config 0 descriptor?? [ 1003.005098][ T5923] spcp8x5 3-1:0.72: required endpoints missing [ 1003.090971][T16069] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1003.163800][T16069] 8021q: adding VLAN 0 to HW filter on device team0 [ 1003.187828][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1003.195096][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1003.224105][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1003.231396][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1003.267254][ T5923] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 1003.459773][ T5923] usb 1-1: Using ep0 maxpacket: 32 [ 1003.471498][ T5923] usb 1-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1003.500746][T16260] netlink: 180 bytes leftover after parsing attributes in process `syz.2.2853'. [ 1003.535767][ T5923] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1003.545710][T16260] netlink: 180 bytes leftover after parsing attributes in process `syz.2.2853'. [ 1003.565781][T16069] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1003.611095][ T5923] usb 1-1: Product: syz [ 1003.643406][ T5923] usb 1-1: Manufacturer: syz [ 1003.694721][ T5923] usb 1-1: SerialNumber: syz [ 1003.767624][ T5923] usb 1-1: config 0 descriptor?? [ 1003.808649][ T5923] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1003.817984][T16069] veth0_vlan: entered promiscuous mode [ 1003.892074][T16069] veth1_vlan: entered promiscuous mode [ 1004.040279][T16069] veth0_macvtap: entered promiscuous mode [ 1004.066651][T16069] veth1_macvtap: entered promiscuous mode [ 1004.142245][T16069] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1004.203245][T16069] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1004.245896][T16069] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1004.263694][T16069] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1004.274470][T16069] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1004.292665][T16069] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1004.345127][ T5935] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1004.387349][ T5935] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1004.421516][T16273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1004.433450][ T5935] usb 4-1: can't read configurations, error -71 [ 1004.459654][T16273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1004.463854][ T5961] usb 5-1: USB disconnect, device number 17 [ 1004.704532][T11791] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1004.755110][T11791] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1004.925991][ T6510] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1004.964708][ T6510] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1005.147600][ T5913] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 1005.314880][ T5913] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1005.325344][ T5913] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1005.370260][ T5913] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1005.390630][T16301] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2813'. [ 1005.461201][ T5913] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1005.481534][ T5913] usb 5-1: config 0 descriptor?? [ 1005.514003][ T5913] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1005.532248][ T5913] dvb-usb: bulk message failed: -22 (3/0) [ 1005.541318][ T5935] usb 3-1: USB disconnect, device number 16 [ 1005.590321][ T5913] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1005.634477][ T5913] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1005.642401][ T5913] usb 5-1: media controller created [ 1005.685276][ T5913] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1005.715563][T16304] netlink: 'syz.2.2858': attribute type 4 has an invalid length. [ 1005.735047][T16294] dibusb: i2c wr: len=61 is too big! [ 1005.735047][T16294] [ 1005.745916][T16294] netlink: 'syz.4.2856': attribute type 7 has an invalid length. [ 1005.760100][T16294] netlink: 'syz.4.2856': attribute type 8 has an invalid length. [ 1005.879739][ T5913] dvb-usb: bulk message failed: -22 (6/0) [ 1005.889014][T16310] netlink: 'syz.2.2858': attribute type 4 has an invalid length. [ 1005.995848][ T5913] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1006.079589][ T5913] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input79 [ 1006.129706][ T5913] dvb-usb: schedule remote query interval to 150 msecs. [ 1006.154929][ T5913] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1006.180529][ T5923] gspca_stk1135: reg_w 0x2ff err -71 [ 1006.187056][ T5923] gspca_stk1135: serial bus timeout: status=0x00 [ 1006.193495][ T5923] gspca_stk1135: Sensor write failed [ 1006.210504][ T5923] gspca_stk1135: serial bus timeout: status=0x00 [ 1006.307976][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1006.314007][ T10] dvb-usb: error while querying for an remote control event. [ 1006.322291][ T5923] gspca_stk1135: Sensor write failed [ 1006.344230][ T5923] gspca_stk1135: serial bus timeout: status=0x00 [ 1006.382871][ T5923] gspca_stk1135: Sensor read failed [ 1006.413369][ T5923] gspca_stk1135: serial bus timeout: status=0x00 [ 1006.455399][ T5923] gspca_stk1135: Sensor read failed [ 1006.495554][ T5923] gspca_stk1135: Detected sensor type unknown (0x0) [ 1006.517559][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1006.523536][ T10] dvb-usb: error while querying for an remote control event. [ 1006.541297][ T5923] gspca_stk1135: serial bus timeout: status=0x00 [ 1006.587558][ T5923] gspca_stk1135: Sensor read failed [ 1006.613894][ T5923] gspca_stk1135: serial bus timeout: status=0x00 [ 1006.668742][ T5923] gspca_stk1135: Sensor read failed [ 1006.734528][ T5923] gspca_stk1135: serial bus timeout: status=0x00 [ 1006.757178][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1006.764369][ T10] dvb-usb: error while querying for an remote control event. [ 1006.773689][ T5923] gspca_stk1135: Sensor write failed [ 1006.821330][ T5923] gspca_stk1135: serial bus timeout: status=0x00 [ 1006.845855][ T5923] gspca_stk1135: Sensor write failed [ 1006.875435][ T5923] stk1135 1-1:0.0: probe with driver stk1135 failed with error -71 [ 1006.918118][ T5923] usb 1-1: USB disconnect, device number 6 [ 1006.928111][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1006.937625][ T10] dvb-usb: error while querying for an remote control event. [ 1007.147908][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1007.154585][ T10] dvb-usb: error while querying for an remote control event. [ 1007.357510][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1007.363426][ T10] dvb-usb: error while querying for an remote control event. [ 1007.674350][ T5913] dvb-usb: bulk message failed: -22 (1/0) [ 1007.698968][ T5913] dvb-usb: error while querying for an remote control event. [ 1007.707139][ T5935] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 1007.888878][ T5935] usb 3-1: Using ep0 maxpacket: 16 [ 1007.898140][ T5913] dvb-usb: bulk message failed: -22 (1/0) [ 1007.904030][ T5913] dvb-usb: error while querying for an remote control event. [ 1008.137851][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1008.143920][ T10] dvb-usb: error while querying for an remote control event. [ 1008.239641][T16340] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1008.307525][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1008.313376][ T10] dvb-usb: error while querying for an remote control event. [ 1009.037861][ T5913] dvb-usb: bulk message failed: -22 (1/0) [ 1009.061720][ T5913] dvb-usb: error while querying for an remote control event. [ 1009.271322][ T846] dvb-usb: bulk message failed: -22 (1/0) [ 1009.298648][ T846] dvb-usb: error while querying for an remote control event. [ 1009.691084][ T846] dvb-usb: bulk message failed: -22 (1/0) [ 1009.697685][ T846] dvb-usb: error while querying for an remote control event. [ 1009.880009][ T846] dvb-usb: bulk message failed: -22 (1/0) [ 1009.885979][ T846] dvb-usb: error while querying for an remote control event. [ 1010.014390][T16362] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2865'. [ 1010.068528][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1010.074452][ T10] dvb-usb: error while querying for an remote control event. [ 1010.277523][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1010.332756][T11667] usb 5-1: USB disconnect, device number 18 [ 1010.335616][ T10] dvb-usb: error while querying for an remote control event. [ 1010.481299][T11667] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1011.168537][T16377] fuse: Unknown parameter 'user_i00000000000000000000' [ 1011.189072][T16378] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1011.622697][T11667] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 1011.787033][T11667] usb 1-1: Using ep0 maxpacket: 16 [ 1011.794175][T11667] usb 1-1: config 0 has an invalid interface number: 214 but max is 0 [ 1011.807510][T11667] usb 1-1: config 0 has no interface number 0 [ 1011.813766][T11667] usb 1-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 1011.825784][T11667] usb 1-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 1011.837224][T11667] usb 1-1: New USB device strings: Mfr=1, Product=0, SerialNumber=3 [ 1011.845528][T11667] usb 1-1: Manufacturer: syz [ 1011.851090][ T5935] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1011.862454][T11667] usb 1-1: SerialNumber: syz [ 1011.872825][ T5935] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1011.893831][ T5935] usb 3-1: can't read configurations, error -71 [ 1012.126001][T11667] usb 1-1: config 0 descriptor?? [ 1012.712365][T11667] usbtouchscreen 1-1:0.214: probe with driver usbtouchscreen failed with error -71 [ 1012.858103][T11667] usb 1-1: USB disconnect, device number 7 [ 1013.802611][T16417] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2876'. [ 1014.457532][ T10] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 1015.131614][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1015.146966][ T5935] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 1015.214793][ T10] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1015.347141][ T5935] usb 4-1: Using ep0 maxpacket: 32 [ 1015.361463][ T5935] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1015.402745][ T5935] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1015.453591][ T10] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1015.492936][ T5935] usb 4-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 1015.532905][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1015.567984][ T5935] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1015.595144][ T10] usb 2-1: config 0 descriptor?? [ 1015.664534][ T5935] usb 4-1: config 0 descriptor?? [ 1015.805507][ T10] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1015.864857][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 1015.914584][ T5935] usbhid 4-1:0.0: can't add hid device: -71 [ 1015.932845][ T5935] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1015.982205][ T5935] usb 4-1: USB disconnect, device number 30 [ 1015.998054][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1016.057777][ T10] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1016.073755][T16425] dibusb: i2c wr: len=61 is too big! [ 1016.073755][T16425] [ 1016.084567][T16425] netlink: 'syz.1.2878': attribute type 7 has an invalid length. [ 1016.094150][T16425] netlink: 'syz.1.2878': attribute type 8 has an invalid length. [ 1016.154403][ T10] usb 2-1: media controller created [ 1016.265910][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1016.403682][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 1016.421583][ T10] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1016.455525][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input81 [ 1016.516097][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 1016.569217][ T10] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1016.734745][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1016.772163][ T10] dvb-usb: error while querying for an remote control event. [ 1017.001499][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1017.181427][ T5907] dvb-usb: error while querying for an remote control event. [ 1017.307127][ T5935] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 1017.377602][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1017.393948][ T5907] dvb-usb: error while querying for an remote control event. [ 1017.570765][ T5935] usb 5-1: config 0 has an invalid interface number: 147 but max is 0 [ 1017.601622][ T5935] usb 5-1: config 0 has no interface number 0 [ 1017.607565][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1017.614422][ T5907] dvb-usb: error while querying for an remote control event. [ 1017.659853][ T5935] usb 5-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1017.714160][ T5935] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 1017.732227][ T5935] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1017.866032][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1017.877637][ T5935] usb 5-1: Product: syz [ 1017.892183][ T5907] dvb-usb: error while querying for an remote control event. [ 1017.900044][ T5935] usb 5-1: Manufacturer: syz [ 1017.900068][ T5935] usb 5-1: SerialNumber: syz [ 1017.915141][ T5935] usb 5-1: config 0 descriptor?? [ 1018.085445][T16445] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1018.247703][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1018.253642][ T10] dvb-usb: error while querying for an remote control event. [ 1018.260200][ T5935] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1018.337972][ T10] usb 5-1: USB disconnect, device number 19 [ 1018.356484][ T6510] usb 5-1: Failed to submit usb control message: -19 [ 1018.463845][ T846] dvb-usb: bulk message failed: -22 (1/0) [ 1018.475992][ T846] dvb-usb: error while querying for an remote control event. [ 1018.495347][ T6510] usb 5-1: unable to send the bmi data to the device: -19 [ 1018.507158][T16283] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 1018.552348][ T6510] usb 5-1: unable to get target info from device [ 1018.572874][ T6510] usb 5-1: could not get target info (-19) [ 1018.633059][ T6510] usb 5-1: could not probe fw (-19) [ 1018.686932][T16283] usb 1-1: Using ep0 maxpacket: 16 [ 1018.730505][ T846] dvb-usb: bulk message failed: -22 (1/0) [ 1018.736378][ T846] dvb-usb: error while querying for an remote control event. [ 1018.948576][ T846] dvb-usb: bulk message failed: -22 (1/0) [ 1018.954433][ T846] dvb-usb: error while querying for an remote control event. [ 1019.827219][ T846] dvb-usb: bulk message failed: -22 (1/0) [ 1019.859258][T16481] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1019.977509][T11667] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 1020.051471][ T846] dvb-usb: error while querying for an remote control event. [ 1020.189341][T11667] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1020.257020][T11667] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1020.258046][ T846] dvb-usb: bulk message failed: -22 (1/0) [ 1020.309403][ T846] dvb-usb: error while querying for an remote control event. [ 1020.323910][T11667] usb 4-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 1020.360266][T16490] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2891'. [ 1020.421976][T11667] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1020.454627][T11667] usb 4-1: config 0 descriptor?? [ 1020.537518][ T5935] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 1020.673852][ T846] usb 2-1: USB disconnect, device number 10 [ 1020.746957][ T5935] usb 5-1: Using ep0 maxpacket: 32 [ 1020.760208][ T5935] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1020.771741][ T5935] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1020.796323][ T5935] usb 5-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 1020.831046][ T5935] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1020.898940][T11667] arvo 0003:1E7D:30D4.002A: item fetching failed at offset 5/7 [ 1020.922010][T11667] arvo 0003:1E7D:30D4.002A: parse failed [ 1020.928020][T11667] arvo 0003:1E7D:30D4.002A: probe with driver arvo failed with error -22 [ 1020.945551][ T5935] usb 5-1: config 0 descriptor?? [ 1021.061546][ T846] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1021.130482][T11612] usb 4-1: USB disconnect, device number 31 [ 1021.208127][ T5935] usbhid 5-1:0.0: can't add hid device: -71 [ 1021.246538][ T5935] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1021.282253][ T5935] usb 5-1: USB disconnect, device number 20 [ 1021.467549][T16500] netlink: 'syz.1.2893': attribute type 4 has an invalid length. [ 1022.273990][T16283] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1022.355038][T16513] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2895'. [ 1022.392266][T16283] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 1022.457425][T16516] netlink: 'syz.3.2894': attribute type 4 has an invalid length. [ 1022.497507][T16283] usb 1-1: can't read configurations, error -71 [ 1023.636993][T16531] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2898'. [ 1024.041963][T16536] netlink: 'syz.1.2900': attribute type 4 has an invalid length. [ 1025.713873][T16548] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2902'. [ 1025.777574][ T846] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 1025.949648][ T846] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1025.960688][ T846] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1025.974300][ T846] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1026.001809][ T846] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1026.070065][ T846] usb 4-1: config 0 descriptor?? [ 1026.103074][ T846] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1026.111224][ T846] dvb-usb: bulk message failed: -22 (3/0) [ 1026.124309][ T846] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1026.178107][ T846] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1026.185337][ T846] usb 4-1: media controller created [ 1026.209485][ T846] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1026.334535][T16556] dibusb: i2c wr: len=61 is too big! [ 1026.334535][T16556] [ 1026.347975][T16556] netlink: 'syz.3.2903': attribute type 7 has an invalid length. [ 1026.355912][T16556] netlink: 'syz.3.2903': attribute type 8 has an invalid length. [ 1026.412093][ T846] dvb-usb: bulk message failed: -22 (6/0) [ 1026.441781][ T846] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1026.458621][ T846] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input82 [ 1026.491894][ T846] dvb-usb: schedule remote query interval to 150 msecs. [ 1026.513895][ T846] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1026.678859][T16283] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 1026.687561][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1026.693743][ T10] dvb-usb: error while querying for an remote control event. [ 1026.750092][T16571] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2906'. [ 1026.938166][ T846] dvb-usb: bulk message failed: -22 (1/0) [ 1027.005841][T16283] usb 1-1: Using ep0 maxpacket: 32 [ 1027.015387][ T846] dvb-usb: error while querying for an remote control event. [ 1027.024285][T16283] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1027.056629][T16283] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1027.071099][T16283] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 1027.086409][T16283] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1027.116700][T16283] usb 1-1: config 0 descriptor?? [ 1027.217631][ T846] dvb-usb: bulk message failed: -22 (1/0) [ 1027.223810][ T846] dvb-usb: error while querying for an remote control event. [ 1027.407724][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1027.510657][ T5907] dvb-usb: error while querying for an remote control event. [ 1027.543708][T16283] usbhid 1-1:0.0: can't add hid device: -71 [ 1027.550281][T16283] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1027.579473][T16283] usb 1-1: USB disconnect, device number 10 [ 1027.698667][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1027.704618][ T5907] dvb-usb: error while querying for an remote control event. [ 1027.867763][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1027.873626][ T5907] dvb-usb: error while querying for an remote control event. [ 1028.045327][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1028.051940][ T5907] dvb-usb: error while querying for an remote control event. [ 1028.217456][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1028.223632][ T5907] dvb-usb: error while querying for an remote control event. [ 1028.387417][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1028.393304][ T5907] dvb-usb: error while querying for an remote control event. [ 1028.567448][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1028.597565][ T5907] dvb-usb: error while querying for an remote control event. [ 1028.799051][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1028.820215][ T5907] dvb-usb: error while querying for an remote control event. [ 1029.022691][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1029.041357][ T5907] dvb-usb: error while querying for an remote control event. [ 1029.067051][ T5935] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 1029.173688][T16591] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1029.277478][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1029.283338][ T10] dvb-usb: error while querying for an remote control event. [ 1029.309764][ T5935] usb 1-1: config 0 has no interfaces? [ 1029.387722][ T5935] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1029.462066][ T5935] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1029.470428][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1029.476220][ T10] dvb-usb: error while querying for an remote control event. [ 1029.528582][ T5935] usb 1-1: Product: syz [ 1029.546876][ T5935] usb 1-1: Manufacturer: syz [ 1029.554300][ T5935] usb 1-1: SerialNumber: syz [ 1029.587180][ T5935] usb 1-1: config 0 descriptor?? [ 1029.612687][T16599] netlink: 'syz.4.2913': attribute type 4 has an invalid length. [ 1029.717421][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 1029.723217][ T10] dvb-usb: error while querying for an remote control event. [ 1029.842574][ T5935] usb 4-1: USB disconnect, device number 32 [ 1029.915872][ T5935] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1029.945977][T16602] veth0: entered promiscuous mode [ 1030.040912][T16605] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2915'. [ 1031.239084][T16623] FAULT_INJECTION: forcing a failure. [ 1031.239084][T16623] name failslab, interval 1, probability 0, space 0, times 0 [ 1031.252066][ T10] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 1031.295972][T16623] CPU: 1 UID: 0 PID: 16623 Comm: syz.3.2920 Not tainted 6.16.0-rc7-syzkaller-00105-g2942242dde89 #0 PREEMPT(full) [ 1031.296005][T16623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1031.296018][T16623] Call Trace: [ 1031.296029][T16623] [ 1031.296039][T16623] dump_stack_lvl+0x189/0x250 [ 1031.296070][T16623] ? __pfx____ratelimit+0x10/0x10 [ 1031.296094][T16623] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1031.296120][T16623] ? __pfx__printk+0x10/0x10 [ 1031.296155][T16623] ? __pfx___might_resched+0x10/0x10 [ 1031.296179][T16623] ? fs_reclaim_acquire+0x7d/0x100 [ 1031.296205][T16623] should_fail_ex+0x414/0x560 [ 1031.296240][T16623] should_failslab+0xa8/0x100 [ 1031.296274][T16623] __kmalloc_noprof+0xcb/0x4f0 [ 1031.296301][T16623] ? kfree+0x4d/0x440 [ 1031.296324][T16623] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1031.296357][T16623] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1031.296385][T16623] ? tomoyo_domain+0xd9/0x130 [ 1031.296418][T16623] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1031.296439][T16623] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1031.296463][T16623] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1031.296503][T16623] ? __lock_acquire+0xab9/0xd20 [ 1031.296547][T16623] ? __fget_files+0x2a/0x420 [ 1031.296570][T16623] ? __fget_files+0x2a/0x420 [ 1031.296588][T16623] ? __fget_files+0x3a0/0x420 [ 1031.296605][T16623] ? __fget_files+0x2a/0x420 [ 1031.296626][T16623] security_file_ioctl+0xcb/0x2d0 [ 1031.296659][T16623] __se_sys_ioctl+0x47/0x170 [ 1031.296687][T16623] do_syscall_64+0xfa/0x3b0 [ 1031.296710][T16623] ? lockdep_hardirqs_on+0x9c/0x150 [ 1031.296732][T16623] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1031.296753][T16623] ? clear_bhb_loop+0x60/0xb0 [ 1031.296781][T16623] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1031.296801][T16623] RIP: 0033:0x7f50dff8e9a9 [ 1031.296821][T16623] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1031.296839][T16623] RSP: 002b:00007f50e0ed8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1031.296862][T16623] RAX: ffffffffffffffda RBX: 00007f50e01b5fa0 RCX: 00007f50dff8e9a9 [ 1031.296877][T16623] RDX: 0000000000000000 RSI: 0000000000005101 RDI: 0000000000000003 [ 1031.296890][T16623] RBP: 00007f50e0ed8090 R08: 0000000000000000 R09: 0000000000000000 [ 1031.296903][T16623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1031.296916][T16623] R13: 0000000000000000 R14: 00007f50e01b5fa0 R15: 00007f50e02dfa28 [ 1031.296948][T16623] [ 1031.562761][T16623] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1031.766212][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 1032.033725][T11612] usb 1-1: USB disconnect, device number 11 [ 1032.677247][ T5907] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 1032.851887][ T5907] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1032.865374][ T5907] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1032.901596][ T5907] usb 4-1: New USB device found, idVendor=09da, idProduct=0006, bcdDevice= 0.00 [ 1032.941182][ T5907] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1032.969397][ T5907] usb 4-1: config 0 descriptor?? [ 1032.991332][T11612] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 1033.049347][T16635] netlink: 'syz.1.2924': attribute type 4 has an invalid length. [ 1033.167718][T11612] usb 1-1: Using ep0 maxpacket: 16 [ 1033.230518][T11612] usb 1-1: config 0 has an invalid interface number: 145 but max is 0 [ 1033.267093][T11612] usb 1-1: config 0 has no interface number 0 [ 1033.314053][T11612] usb 1-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 1033.363833][T11612] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1033.413414][ T5907] a4tech 0003:09DA:0006.002B: unknown main item tag 0x0 [ 1033.445002][T11612] usb 1-1: Product: syz [ 1033.607681][T11612] usb 1-1: Manufacturer: syz [ 1033.615273][ T5907] a4tech 0003:09DA:0006.002B: item fetching failed at offset 4/7 [ 1033.635026][T11612] usb 1-1: SerialNumber: syz [ 1033.663995][T11612] usb 1-1: config 0 descriptor?? [ 1033.684014][ T5907] a4tech 0003:09DA:0006.002B: parse failed [ 1033.765762][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1033.774996][ T10] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1033.788258][T11612] hub 1-1:0.145: bad descriptor, ignoring hub [ 1033.828994][ T10] usb 3-1: can't read configurations, error -71 [ 1033.838846][ T5907] a4tech 0003:09DA:0006.002B: probe with driver a4tech failed with error -22 [ 1033.897739][ T5907] usb 4-1: USB disconnect, device number 33 [ 1033.908034][T11612] hub 1-1:0.145: probe with driver hub failed with error -5 [ 1033.982521][T11612] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.145/input/input83 [ 1034.108861][T11612] input: failed to attach handler mousedev to device input83, error: -2 [ 1034.196028][T16652] netlink: 'syz.2.2933': attribute type 1 has an invalid length. [ 1034.469967][T16658] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2932'. [ 1034.563644][T16652] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1035.200142][T16673] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2938'. [ 1035.319689][T16673] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2938'. [ 1035.597384][T16283] usb 1-1: USB disconnect, device number 12 [ 1035.783839][ T51] Bluetooth: hci0: unexpected event 0x3e length: 901 > 260 [ 1035.783880][ T51] Bluetooth: hci0: unexpected subevent 0x0d length: 900 > 260 [ 1035.807583][ T51] Bluetooth: hci0: Unknown advertising packet type: 0x16 [ 1035.807616][ T51] Bluetooth: hci0: adv larger than maximum supported [ 1035.815113][ T51] Bluetooth: hci0: adv larger than maximum supported [ 1035.823117][ T51] Bluetooth: hci0: adv larger than maximum supported [ 1035.830039][ T51] Bluetooth: hci0: adv larger than maximum supported [ 1037.257715][ T5913] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 1037.466712][ T5913] usb 1-1: config 0 has no interfaces? [ 1037.486609][T16713] netlink: 'syz.4.2950': attribute type 1 has an invalid length. [ 1037.524081][ T5913] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1037.608821][ T5913] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.694874][ T5913] usb 1-1: Product: syz [ 1037.743077][T16713] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1037.794807][ T5913] usb 1-1: Manufacturer: syz [ 1037.816547][ T5913] usb 1-1: SerialNumber: syz [ 1037.836152][ T5913] usb 1-1: config 0 descriptor?? [ 1038.227403][T16725] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1038.627073][T16283] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 1038.824749][T16283] usb 2-1: Using ep0 maxpacket: 32 [ 1038.854403][T16283] usb 2-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1038.878346][T16741] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2958'. [ 1038.942864][T16283] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1038.989264][T16283] usb 2-1: Product: syz [ 1039.105609][ T5935] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1039.177618][T16283] usb 2-1: Manufacturer: syz [ 1039.274612][T16283] usb 2-1: SerialNumber: syz [ 1039.315843][T16283] usb 2-1: config 0 descriptor?? [ 1039.357051][ T5935] usb 3-1: Using ep0 maxpacket: 16 [ 1039.385286][T16283] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1039.462962][ T5935] usb 3-1: config 0 has an invalid interface number: 145 but max is 0 [ 1039.496031][ T5935] usb 3-1: config 0 has no interface number 0 [ 1040.001190][ T5935] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 1040.002585][T16734] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1040.052468][T16734] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1040.074707][ T5935] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1040.146874][ T5935] usb 3-1: Product: syz [ 1040.157098][ T5935] usb 3-1: Manufacturer: syz [ 1040.182212][ T5935] usb 3-1: SerialNumber: syz [ 1040.246166][ T5935] usb 3-1: config 0 descriptor?? [ 1040.288338][ T5935] hub 3-1:0.145: bad descriptor, ignoring hub [ 1040.305785][ T5935] hub 3-1:0.145: probe with driver hub failed with error -5 [ 1040.322366][ T5935] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.145/input/input84 [ 1040.602872][ T5913] usb 1-1: USB disconnect, device number 13 [ 1041.067342][ T5923] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 1041.257178][ T5923] usb 5-1: Using ep0 maxpacket: 16 [ 1041.264862][ T5923] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xC has an invalid bInterval 0, changing to 7 [ 1041.278075][ T5923] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 1041.308677][ T5923] usb 5-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=19.82 [ 1041.321155][ T5923] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.352063][ T5923] usb 5-1: Product: syz [ 1041.376612][ T5923] usb 5-1: Manufacturer: syz [ 1041.382158][ T31] audit: type=1326 audit(1753435020.022:771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16753 comm="syz.3.2965" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f50dff8e9a9 code=0x0 [ 1041.394022][ T5923] usb 5-1: SerialNumber: syz [ 1041.441130][T16755] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1041.465241][ T5923] usb 5-1: config 0 descriptor?? [ 1041.489417][ T5923] kobil_sct 5-1:0.0: KOBIL USB smart card terminal converter detected [ 1041.546743][ T5923] usb 5-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 1041.728603][T16283] gspca_stk1135: reg_w 0x2ff err -71 [ 1041.731728][ T10] usb 5-1: USB disconnect, device number 21 [ 1041.743779][T16283] gspca_stk1135: serial bus timeout: status=0x00 [ 1041.750038][ T10] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 1041.783999][T16283] gspca_stk1135: Sensor write failed [ 1041.796521][T16283] gspca_stk1135: serial bus timeout: status=0x00 [ 1041.812534][T16283] gspca_stk1135: Sensor write failed [ 1041.825294][T16283] gspca_stk1135: serial bus timeout: status=0x00 [ 1041.828910][ T10] kobil_sct 5-1:0.0: device disconnected [ 1041.840996][T16283] gspca_stk1135: Sensor read failed [ 1041.852012][T16283] gspca_stk1135: serial bus timeout: status=0x00 [ 1041.873800][T16283] gspca_stk1135: Sensor read failed [ 1041.902984][T16283] gspca_stk1135: Detected sensor type unknown (0x0) [ 1041.919250][T16283] gspca_stk1135: serial bus timeout: status=0x00 [ 1041.937431][T16283] gspca_stk1135: Sensor read failed [ 1041.956847][T16283] gspca_stk1135: serial bus timeout: status=0x00 [ 1041.993006][T16283] gspca_stk1135: Sensor read failed [ 1042.025685][T16283] gspca_stk1135: serial bus timeout: status=0x00 [ 1042.035186][T16283] gspca_stk1135: Sensor write failed [ 1042.048598][T16283] gspca_stk1135: serial bus timeout: status=0x00 [ 1042.095487][T16283] gspca_stk1135: Sensor write failed [ 1042.220114][T16283] stk1135 2-1:0.0: probe with driver stk1135 failed with error -71 [ 1042.296872][T16283] usb 2-1: USB disconnect, device number 11 [ 1042.347379][ T5039] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.450018][ T5923] usb 3-1: USB disconnect, device number 21 [ 1042.519958][T10555] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1042.543774][T10555] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1042.561080][T10555] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1042.590023][T10555] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1042.603036][T10555] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1042.649368][ T5039] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.655560][T16769] fuse: Unknown parameter 'user_id00000000000000000000' [ 1042.956281][ T5039] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.263781][ T5039] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1043.778565][T16784] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2970'. [ 1043.927462][ T5039] bridge_slave_1: left allmulticast mode [ 1043.967540][ T5039] bridge_slave_1: left promiscuous mode [ 1043.973415][ T5039] bridge0: port 2(bridge_slave_1) entered disabled state [ 1044.076477][ T5039] bridge0: port 1(bridge_slave_0) entered disabled state [ 1044.711646][T10555] Bluetooth: hci0: command tx timeout [ 1045.186535][ T5039] bond0 (unregistering): left promiscuous mode [ 1045.193566][ T5039] bond_slave_0: left promiscuous mode [ 1045.202230][ T5039] bond_slave_1: left promiscuous mode [ 1045.211606][ T5039] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1045.223084][ T5039] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1045.236011][ T5039] bond0 (unregistering): Released all slaves [ 1045.285442][T16770] chnl_net:caif_netlink_parms(): no params data found [ 1045.419616][ T5039] tipc: Disabling bearer [ 1045.468442][ T5039] tipc: Left network mode [ 1045.508073][ T5039] IPVS: stopping master sync thread 12321 ... [ 1045.759907][ T5923] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 1045.887431][ T5913] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 1045.936926][ T5923] usb 5-1: Using ep0 maxpacket: 16 [ 1045.944389][ T5923] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xC has an invalid bInterval 0, changing to 7 [ 1045.955714][ T5923] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 1045.968884][ T5923] usb 5-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=19.82 [ 1045.978350][ T5923] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1045.986411][ T5923] usb 5-1: Product: syz [ 1045.991149][ T5923] usb 5-1: Manufacturer: syz [ 1045.995800][ T5923] usb 5-1: SerialNumber: syz [ 1046.004512][ T5923] usb 5-1: config 0 descriptor?? [ 1046.012894][ T5923] kobil_sct 5-1:0.0: KOBIL USB smart card terminal converter detected [ 1046.029853][ T5923] usb 5-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 1046.073999][T16770] bridge0: port 1(bridge_slave_0) entered blocking state [ 1046.087001][ T5913] usb 4-1: Using ep0 maxpacket: 32 [ 1046.109422][T16770] bridge0: port 1(bridge_slave_0) entered disabled state [ 1046.131294][ T5913] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 1046.149861][T16770] bridge_slave_0: entered allmulticast mode [ 1046.155962][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1046.178796][T16770] bridge_slave_0: entered promiscuous mode [ 1046.188928][ T5913] usb 4-1: Product: syz [ 1046.193183][ T5913] usb 4-1: Manufacturer: syz [ 1046.203564][T16770] bridge0: port 2(bridge_slave_1) entered blocking state [ 1046.211211][ T5913] usb 4-1: SerialNumber: syz [ 1046.218329][T16770] bridge0: port 2(bridge_slave_1) entered disabled state [ 1046.226274][T16770] bridge_slave_1: entered allmulticast mode [ 1046.233438][ T5913] usb 4-1: config 0 descriptor?? [ 1046.268117][T16770] bridge_slave_1: entered promiscuous mode [ 1046.285159][ T5913] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 1046.341787][ T10] usb 5-1: USB disconnect, device number 22 [ 1046.365978][ T10] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 1046.391428][ T10] kobil_sct 5-1:0.0: device disconnected [ 1046.525268][T16770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1046.560236][T16770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1046.755862][T16770] team0: Port device team_slave_0 added [ 1046.787791][T10555] Bluetooth: hci0: command tx timeout [ 1046.795706][T16824] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2978'. [ 1046.809139][T16770] team0: Port device team_slave_1 added [ 1046.850907][T16815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1046.860219][T16815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1047.035871][T16770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1047.069327][T16770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1047.125914][T16770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1047.150158][T16770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1047.175841][T16770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1047.220667][T16770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1047.251528][ T5039] batadv_slave_1: left promiscuous mode [ 1047.311563][ T5039] hsr_slave_0: left promiscuous mode [ 1047.328819][ T5039] hsr_slave_1: left promiscuous mode [ 1047.349460][ T5039] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1047.377234][ T5039] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1047.401809][ T5039] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1047.423035][ T5039] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1047.491238][ T5039] veth1_vlan: left promiscuous mode [ 1047.519445][ T5039] veth0_vlan: left promiscuous mode [ 1048.102642][T16863] netlink: 'syz.4.2984': attribute type 4 has an invalid length. [ 1048.573784][ T5913] gspca_stk1135: reg_w 0x2ff err -71 [ 1048.584558][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 1048.629651][ T5913] gspca_stk1135: Sensor write failed [ 1048.635134][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 1048.815976][ T5913] gspca_stk1135: Sensor write failed [ 1048.822678][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 1048.829426][ T5913] gspca_stk1135: Sensor read failed [ 1048.841749][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 1048.854146][ T5913] gspca_stk1135: Sensor read failed [ 1048.864047][ T5913] gspca_stk1135: Detected sensor type unknown (0x0) [ 1048.867337][T10555] Bluetooth: hci0: command tx timeout [ 1048.871525][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 1048.896581][ T5913] gspca_stk1135: Sensor read failed [ 1048.906655][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 1048.914196][ T5913] gspca_stk1135: Sensor read failed [ 1048.928981][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 1048.949235][ T5913] gspca_stk1135: Sensor write failed [ 1048.954637][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 1048.992047][ T5913] gspca_stk1135: Sensor write failed [ 1049.021686][ T5913] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71 [ 1049.052547][ T5913] usb 4-1: USB disconnect, device number 34 [ 1049.167482][ T5039] team0 (unregistering): Port device team_slave_1 removed [ 1049.259598][ T5039] team0 (unregistering): Port device team_slave_0 removed [ 1049.506937][ T5923] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 1049.668916][ T5923] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1049.684260][ T5923] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1049.703103][ T5923] usb 4-1: New USB device found, idVendor=09da, idProduct=0006, bcdDevice= 0.00 [ 1049.722435][ T5923] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1049.763236][ T5923] usb 4-1: config 0 descriptor?? [ 1049.983387][T16770] hsr_slave_0: entered promiscuous mode [ 1050.004836][T16770] hsr_slave_1: entered promiscuous mode [ 1050.227385][ T5923] a4tech 0003:09DA:0006.002C: unknown main item tag 0x0 [ 1050.257818][ T5923] a4tech 0003:09DA:0006.002C: item fetching failed at offset 4/7 [ 1050.295794][ T5923] a4tech 0003:09DA:0006.002C: parse failed [ 1050.314267][ T5923] a4tech 0003:09DA:0006.002C: probe with driver a4tech failed with error -22 [ 1050.337031][ T5935] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 1050.431684][ T5923] usb 4-1: USB disconnect, device number 35 [ 1050.517262][ T5935] usb 5-1: Using ep0 maxpacket: 16 [ 1050.529166][ T5935] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xC has an invalid bInterval 0, changing to 7 [ 1050.573628][ T5935] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 1050.593070][ T5935] usb 5-1: New USB device found, idVendor=0d46, idProduct=0081, bcdDevice=19.82 [ 1050.613611][ T5935] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1050.629132][ T5935] usb 5-1: Product: syz [ 1050.640172][ T5935] usb 5-1: Manufacturer: syz [ 1050.652688][ T5935] usb 5-1: SerialNumber: syz [ 1050.686242][ T5935] usb 5-1: config 0 descriptor?? [ 1050.710890][ T5935] kobil_sct 5-1:0.0: KOBIL USB smart card terminal converter detected [ 1050.745653][ T5935] usb 5-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 1050.957706][T10555] Bluetooth: hci0: command tx timeout [ 1051.191430][ T5907] usb 5-1: USB disconnect, device number 23 [ 1051.241501][ T5907] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 1051.281768][ T5907] kobil_sct 5-1:0.0: device disconnected [ 1051.477350][ T5935] usb 4-1: new full-speed USB device number 36 using dummy_hcd [ 1051.691363][ T5935] usb 4-1: config 0 has an invalid interface number: 147 but max is 0 [ 1051.721612][ T5935] usb 4-1: config 0 has no interface number 0 [ 1051.765816][ T5935] usb 4-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1051.804660][ T5935] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 1051.823224][ T5935] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1051.862269][ T5935] usb 4-1: Product: syz [ 1051.886345][ T5935] usb 4-1: Manufacturer: syz [ 1051.903725][ T5935] usb 4-1: SerialNumber: syz [ 1051.952873][ T5935] usb 4-1: config 0 descriptor?? [ 1051.974783][T16899] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1051.998717][T16770] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1052.043266][ T5935] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1052.058591][T16770] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1052.157071][T16770] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1052.305179][ T5935] usb 4-1: USB disconnect, device number 36 [ 1052.314093][ T12] usb 4-1: Failed to submit usb control message: -71 [ 1052.353440][T16770] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1052.356540][ T12] usb 4-1: unable to send the bmi data to the device: -71 [ 1052.577770][ T12] usb 4-1: unable to get target info from device [ 1052.594579][ T12] usb 4-1: could not get target info (-71) [ 1052.601433][ T12] usb 4-1: could not probe fw (-71) [ 1053.018616][T16770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1053.174996][T16770] 8021q: adding VLAN 0 to HW filter on device team0 [ 1053.241872][T11791] bridge0: port 1(bridge_slave_0) entered blocking state [ 1053.249115][T11791] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1053.308272][T16937] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1053.360360][T11791] bridge0: port 2(bridge_slave_1) entered blocking state [ 1053.367588][T11791] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1053.802401][T16770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1054.129571][T16770] veth0_vlan: entered promiscuous mode [ 1054.223323][T16770] veth1_vlan: entered promiscuous mode [ 1054.476314][T16770] veth0_macvtap: entered promiscuous mode [ 1054.524256][T16770] veth1_macvtap: entered promiscuous mode [ 1054.542676][T16959] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1340 [ 1054.602166][T16959] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1054.617952][T16770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1054.681664][T16770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1054.734430][T16770] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1054.797856][T16770] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1054.853947][T16970] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3000'. [ 1055.001049][T16770] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1055.060554][T16770] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1055.216918][ T5935] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1055.777470][ T5935] usb 2-1: config 0 has no interfaces? [ 1055.797428][ T5913] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 1055.805831][ T5935] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1055.816975][ T5935] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1055.832716][ T5935] usb 2-1: Product: syz [ 1055.852654][ T5935] usb 2-1: Manufacturer: syz [ 1055.871569][T11791] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1055.885942][ T5935] usb 2-1: SerialNumber: syz [ 1055.899749][ T5935] usb 2-1: config 0 descriptor?? [ 1055.940712][T11791] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1055.987005][ T5913] usb 3-1: Using ep0 maxpacket: 16 [ 1055.998941][ T6510] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1056.007631][ T6510] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1056.062275][ T5913] usb 3-1: config 0 has an invalid interface number: 214 but max is 0 [ 1056.177284][ T5913] usb 3-1: config 0 has no interface number 0 [ 1056.186161][ T5913] usb 3-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 1056.292876][ T5913] usb 3-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 1056.306185][ T5913] usb 3-1: New USB device strings: Mfr=1, Product=0, SerialNumber=3 [ 1056.319672][ T5913] usb 3-1: Manufacturer: syz [ 1056.324374][ T5913] usb 3-1: SerialNumber: syz [ 1056.404241][ T5913] usb 3-1: config 0 descriptor?? [ 1056.506014][T10555] Bluetooth: hci0: unexpected event 0x3e length: 901 > 260 [ 1056.506056][T10555] Bluetooth: hci0: unexpected subevent 0x0d length: 900 > 260 [ 1056.536859][T10555] Bluetooth: hci0: Unknown advertising packet type: 0x16 [ 1056.536917][T10555] Bluetooth: hci0: adv larger than maximum supported [ 1056.544565][T10555] Bluetooth: hci0: adv larger than maximum supported [ 1056.552649][T10555] Bluetooth: hci0: adv larger than maximum supported [ 1056.560604][T10555] Bluetooth: hci0: adv larger than maximum supported [ 1056.628327][ T5913] usbtouchscreen 3-1:0.214: Failed to read FW rev: 13 [ 1056.728871][ T5913] usbtouchscreen 3-1:0.214: probe with driver usbtouchscreen failed with error -5 [ 1056.857404][ T5913] usb 3-1: USB disconnect, device number 22 [ 1057.077570][ T5935] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 1057.259565][ T5935] usb 1-1: config 0 has an invalid interface number: 147 but max is 0 [ 1057.277093][ T5935] usb 1-1: config 0 has no interface number 0 [ 1057.291915][ T5935] usb 1-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1057.325034][ T5935] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 1057.334489][ T5935] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1057.352974][ T5935] usb 1-1: Product: syz [ 1057.389916][ T5935] usb 1-1: Manufacturer: syz [ 1057.410702][ T5935] usb 1-1: SerialNumber: syz [ 1057.438599][ T5935] usb 1-1: config 0 descriptor?? [ 1057.453469][T16994] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1057.568239][ T5935] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1057.703481][ T49] usb 1-1: Failed to submit usb control message: -71 [ 1057.711314][ T5913] usb 1-1: USB disconnect, device number 14 [ 1057.796528][ T49] usb 1-1: unable to send the bmi data to the device: -71 [ 1057.820159][ T49] usb 1-1: unable to get target info from device [ 1057.848587][ T49] usb 1-1: could not get target info (-71) [ 1057.860928][ T49] usb 1-1: could not probe fw (-71) [ 1058.012502][T17007] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3005'. [ 1058.432832][T17015] ptrace attach of "./syz-executor exec"[5861] was attempted by "./syz-executor exec"[17015] [ 1058.814477][T17018] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1058.866241][ T5935] usb 2-1: USB disconnect, device number 12 [ 1059.920747][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1059.927557][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1060.516458][T17045] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3013'. [ 1060.587744][ T5913] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 1060.757243][ T5913] usb 1-1: Using ep0 maxpacket: 16 [ 1060.774826][ T5913] usb 1-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4 [ 1060.817661][ T5913] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1060.979691][ T5913] usb 1-1: Product: syz [ 1060.989556][ T5913] usb 1-1: Manufacturer: syz [ 1061.000818][ T5913] usb 1-1: SerialNumber: syz [ 1061.029225][ T5913] usb 1-1: config 0 descriptor?? [ 1061.045349][ T5913] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver' in warm state. [ 1061.277764][ T5913] gp8psk: usb in 128 operation failed. [ 1061.918318][ T5913] gp8psk: usb in 137 operation failed. [ 1061.963443][ T5913] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1062.036922][ T5913] dvbdev: DVB: registering new adapter (Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver) [ 1062.080352][ T5913] usb 1-1: media controller created [ 1062.159873][ T5907] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 1062.222374][ T5913] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1062.297564][ T5913] gp8psk_fe: Frontend revision 1 attached [ 1062.317293][ T5913] usb 1-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 1062.338044][ T5913] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 1062.367358][ T5907] usb 3-1: Using ep0 maxpacket: 8 [ 1062.387921][ T5907] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 17 [ 1062.419870][ T5907] usb 3-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=c8.07 [ 1062.466184][ T5907] usb 3-1: New USB device strings: Mfr=209, Product=185, SerialNumber=60 [ 1062.508317][ T5907] usb 3-1: Product: syz [ 1062.543129][ T5907] usb 3-1: Manufacturer: syz [ 1062.557236][ T5907] usb 3-1: SerialNumber: syz [ 1062.583198][T17078] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1062.608521][ T5907] usb 3-1: config 0 descriptor?? [ 1062.620604][ T5913] gp8psk: usb in 138 operation failed. [ 1062.635483][ T5913] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver successfully initialized and connected. [ 1062.652528][ T5913] gp8psk: found Genpix USB device pID = 201 (hex) [ 1062.673903][ T5913] usb 1-1: USB disconnect, device number 15 [ 1062.858945][ T5907] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 1063.065690][ T5913] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receive successfully deinitialized and disconnected. [ 1063.808187][ T5907] gspca_sunplus: reg_w_riv err -110 [ 1063.819536][ T5907] sunplus 3-1:0.0: probe with driver sunplus failed with error -110 [ 1063.937935][T17096] netlink: 'syz.3.3024': attribute type 4 has an invalid length. [ 1064.100970][ T5913] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 1064.377118][ T5907] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 1064.422030][ T5913] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1064.463033][ T5913] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1064.521150][ T5913] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1064.548352][ T5913] usb 1-1: config 0 descriptor?? [ 1064.596890][ T5907] usb 2-1: Using ep0 maxpacket: 16 [ 1064.625989][ T5913] pwc: Askey VC010 type 2 USB webcam detected. [ 1065.020642][ T5913] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1065.045909][ T5913] pwc: recv_control_msg error -32 req 02 val 2700 [ 1065.077641][ T5913] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1065.524368][T17089] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3023'. [ 1065.561211][ T846] usb 3-1: USB disconnect, device number 23 [ 1065.591981][ T5913] pwc: recv_control_msg error -32 req 04 val 1400 [ 1065.618885][ T5913] pwc: recv_control_msg error -32 req 02 val 2000 [ 1065.649170][ T5913] pwc: recv_control_msg error -32 req 02 val 2100 [ 1065.686087][ T5913] pwc: recv_control_msg error -32 req 04 val 1500 [ 1065.722214][ T5913] pwc: recv_control_msg error -32 req 02 val 2500 [ 1065.757418][ T5913] pwc: recv_control_msg error -32 req 02 val 2400 [ 1065.983420][ T5913] pwc: recv_control_msg error -71 req 02 val 2900 [ 1066.021599][ T5913] pwc: recv_control_msg error -71 req 02 val 2800 [ 1066.042494][ T5913] pwc: recv_control_msg error -71 req 04 val 1100 [ 1066.058330][ T5913] pwc: recv_control_msg error -71 req 04 val 1200 [ 1066.108423][ T5913] pwc: Registered as video103. [ 1066.158493][ T5913] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input86 [ 1066.340022][ T5913] usb 1-1: USB disconnect, device number 16 [ 1066.379063][ T5907] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1066.482824][ T5907] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1066.526972][ T5907] usb 2-1: can't read configurations, error -71 [ 1066.648173][T17133] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3030'. [ 1066.985171][T17138] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3032'. [ 1067.089139][T17141] dummy0: entered promiscuous mode [ 1067.223337][T17141] dummy0: entered allmulticast mode [ 1067.466868][ T5923] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 1068.237622][ T5923] usb 5-1: Using ep0 maxpacket: 16 [ 1068.247892][ T5923] usb 5-1: config 0 has an invalid interface number: 49 but max is 0 [ 1068.282020][ T5923] usb 5-1: config 0 has no interface number 0 [ 1068.299715][ T5923] usb 5-1: config 0 interface 49 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 16 [ 1068.322384][ T5923] usb 5-1: config 0 interface 49 altsetting 0 has an endpoint descriptor with address 0x29, changing to 0x9 [ 1068.334201][ T5935] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 1068.372542][ T5923] usb 5-1: config 0 interface 49 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1068.404815][ T5923] usb 5-1: config 0 interface 49 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 1068.437558][ T5923] usb 5-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 1068.447079][ T5923] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.476690][ T5923] usb 5-1: Product: syz [ 1068.485798][ T5923] usb 5-1: Manufacturer: syz [ 1068.497073][ T5935] usb 1-1: Using ep0 maxpacket: 16 [ 1068.520232][ T5923] usb 5-1: SerialNumber: syz [ 1068.572683][ T5923] usb 5-1: config 0 descriptor?? [ 1068.610299][T17144] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1069.207021][ T5913] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 1069.437111][ T5913] usb 4-1: Using ep0 maxpacket: 16 [ 1069.484742][ T31] audit: type=1326 audit(1753435048.122:772): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17160 comm="syz.2.3038" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd932b8e9a9 code=0x7ffc0000 [ 1069.525335][ T31] audit: type=1326 audit(1753435048.122:773): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17160 comm="syz.2.3038" exe="/root/syz-executor" sig=0 arch=c000003e syscall=114 compat=0 ip=0x7fd932b8e9a9 code=0x7ffc0000 [ 1069.557169][ T31] audit: type=1326 audit(1753435048.122:774): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17160 comm="syz.2.3038" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd932b8e9a9 code=0x7ffc0000 [ 1069.596345][ T31] audit: type=1326 audit(1753435048.122:775): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17160 comm="syz.2.3038" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fd932b8e9a9 code=0x7ffc0000 [ 1069.630125][ T31] audit: type=1326 audit(1753435048.162:776): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17160 comm="syz.2.3038" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd932b8e9a9 code=0x7ffc0000 [ 1069.662340][ T31] audit: type=1326 audit(1753435048.162:777): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17160 comm="syz.2.3038" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd932b8e9a9 code=0x7ffc0000 [ 1069.695380][ T31] audit: type=1326 audit(1753435048.162:778): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17160 comm="syz.2.3038" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fd932b8e9a9 code=0x7ffc0000 [ 1069.725366][ T31] audit: type=1326 audit(1753435048.162:779): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17160 comm="syz.2.3038" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd932b8e9a9 code=0x7ffc0000 [ 1069.883832][ T31] audit: type=1326 audit(1753435048.162:780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17160 comm="syz.2.3038" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fd932b8e9a9 code=0x7ffc0000 [ 1069.978868][ T31] audit: type=1326 audit(1753435048.162:781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17160 comm="syz.2.3038" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd932b8e9a9 code=0x7ffc0000 [ 1070.415269][ T5935] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1070.482931][ T5935] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 1070.545239][ T5935] usb 1-1: can't read configurations, error -71 [ 1070.620361][ T5923] qcserial 5-1:0.49: Qualcomm USB modem converter detected [ 1070.728184][ T5923] usb 5-1: USB disconnect, device number 24 [ 1070.775860][ T5923] qcserial 5-1:0.49: device disconnected [ 1071.529745][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1071.546742][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1071.573495][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1071.627138][ T5935] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 1071.635396][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1071.682552][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1071.738429][ T5855] syz_tun (unregistering): left promiscuous mode [ 1071.880609][ T5935] usb 1-1: device descriptor read/64, error -71 [ 1072.020730][ T5935] usb usb1-port1: attempt power cycle [ 1072.185051][ T5913] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1072.207609][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1072.208588][ T5913] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1072.266871][ T5913] usb 4-1: can't read configurations, error -71 [ 1072.335495][T17189] tipc: Failed to remove unknown binding: 66,1,1/0:317040625/317040627 [ 1072.344409][T17189] tipc: Failed to remove unknown binding: 66,1,1/0:317040625/317040627 [ 1072.384348][ T5935] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 1072.417787][ T5935] usb 1-1: device descriptor read/8, error -71 [ 1072.542509][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1072.583258][T17189] xt_CT: No such helper "snmp" [ 1072.608949][T17194] input: syz0 as /devices/virtual/input/input87 [ 1072.709490][ T5935] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 1072.738111][ T5935] usb 1-1: device descriptor read/8, error -71 [ 1072.778630][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1072.850669][ T5935] usb usb1-port1: unable to enumerate USB device [ 1072.857307][ T5923] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 1073.006950][ T5923] usb 5-1: device descriptor read/64, error -71 [ 1073.035573][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1073.267084][ T5923] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 1073.382210][T17203] FAULT_INJECTION: forcing a failure. [ 1073.382210][T17203] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1073.406945][T17203] CPU: 0 UID: 0 PID: 17203 Comm: syz.1.3048 Not tainted 6.16.0-rc7-syzkaller-00105-g2942242dde89 #0 PREEMPT(full) [ 1073.406975][T17203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1073.406987][T17203] Call Trace: [ 1073.406995][T17203] [ 1073.407004][T17203] dump_stack_lvl+0x189/0x250 [ 1073.407032][T17203] ? __pfx____ratelimit+0x10/0x10 [ 1073.407052][T17203] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1073.407075][T17203] ? __pfx__printk+0x10/0x10 [ 1073.407113][T17203] should_fail_ex+0x414/0x560 [ 1073.407141][T17203] _copy_to_user+0x31/0xb0 [ 1073.407172][T17203] simple_read_from_buffer+0xe1/0x170 [ 1073.407208][T17203] proc_fail_nth_read+0x1df/0x250 [ 1073.407232][T17203] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1073.407254][T17203] ? rw_verify_area+0x258/0x650 [ 1073.407274][T17203] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1073.407292][T17203] vfs_read+0x1fd/0x980 [ 1073.407319][T17203] ? __pfx___mutex_lock+0x10/0x10 [ 1073.407341][T17203] ? __pfx_vfs_read+0x10/0x10 [ 1073.407366][T17203] ? __fget_files+0x2a/0x420 [ 1073.407385][T17203] ? __fget_files+0x3a0/0x420 [ 1073.407399][T17203] ? __fget_files+0x2a/0x420 [ 1073.407424][T17203] ksys_read+0x145/0x250 [ 1073.407451][T17203] ? __pfx_ksys_read+0x10/0x10 [ 1073.407482][T17203] ? rcu_is_watching+0x15/0xb0 [ 1073.407510][T17203] ? do_syscall_64+0xbe/0x3b0 [ 1073.407535][T17203] do_syscall_64+0xfa/0x3b0 [ 1073.407554][T17203] ? lockdep_hardirqs_on+0x9c/0x150 [ 1073.407573][T17203] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1073.407591][T17203] ? clear_bhb_loop+0x60/0xb0 [ 1073.407614][T17203] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1073.407634][T17203] RIP: 0033:0x7f3bccd8d3bc [ 1073.407653][T17203] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1073.407670][T17203] RSP: 002b:00007f3bcdba7030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1073.407692][T17203] RAX: ffffffffffffffda RBX: 00007f3bccfb5fa0 RCX: 00007f3bccd8d3bc [ 1073.407703][T17203] RDX: 000000000000000f RSI: 00007f3bcdba70a0 RDI: 0000000000000005 [ 1073.407712][T17203] RBP: 00007f3bcdba7090 R08: 0000000000000000 R09: 0000000000000000 [ 1073.407721][T17203] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1073.407730][T17203] R13: 0000000000000000 R14: 00007f3bccfb5fa0 R15: 00007f3bcd0dfa28 [ 1073.407753][T17203] [ 1073.417555][ T5923] usb 5-1: device descriptor read/64, error -71 [ 1073.752820][T10555] Bluetooth: hci1: command tx timeout [ 1073.868701][ T5923] usb usb5-port1: attempt power cycle [ 1073.904420][T17185] chnl_net:caif_netlink_parms(): no params data found [ 1073.909075][T17207] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1073.946190][ T12] bridge_slave_1: left allmulticast mode [ 1073.953005][ T12] bridge_slave_1: left promiscuous mode [ 1073.963679][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 1074.003657][ T12] bridge_slave_0: left allmulticast mode [ 1074.011774][ T12] bridge_slave_0: left promiscuous mode [ 1074.033721][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 1074.219085][ T5923] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 1074.249506][ T5923] usb 5-1: device descriptor read/8, error -71 [ 1074.259302][ T12] ip6gretap0 (unregistering): left promiscuous mode [ 1074.413366][T16283] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 1074.489991][ T5923] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 1074.528325][ T5923] usb 5-1: device descriptor read/8, error -71 [ 1074.578925][T16283] usb 1-1: config 0 has an invalid interface number: 147 but max is 0 [ 1074.624370][T16283] usb 1-1: config 0 has no interface number 0 [ 1074.632732][T16283] usb 1-1: config 0 interface 147 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1074.644746][ T5923] usb usb5-port1: unable to enumerate USB device [ 1074.669408][T16283] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.03 [ 1074.685256][T16283] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1074.695264][T16283] usb 1-1: Product: syz [ 1074.700123][T16283] usb 1-1: Manufacturer: syz [ 1074.704960][T16283] usb 1-1: SerialNumber: syz [ 1074.731343][T16283] usb 1-1: config 0 descriptor?? [ 1074.737556][T17210] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1074.773930][T16283] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1074.987915][ T5039] usb 1-1: Failed to submit usb control message: -71 [ 1074.989734][ T5913] usb 1-1: USB disconnect, device number 21 [ 1074.995125][ T5039] usb 1-1: unable to send the bmi data to the device: -71 [ 1075.033669][ T5039] usb 1-1: unable to get target info from device [ 1075.043128][ T5039] usb 1-1: could not get target info (-71) [ 1075.051369][ T5039] usb 1-1: could not probe fw (-71) [ 1075.498486][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1075.531352][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1075.607813][ T12] bond0 (unregistering): (slave team0): Releasing backup interface [ 1075.625593][ T12] bond0 (unregistering): Released all slaves [ 1075.744216][ T5913] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 1075.827320][T10555] Bluetooth: hci1: command tx timeout [ 1075.922140][ T5913] usb 2-1: Using ep0 maxpacket: 16 [ 1075.940965][ T5913] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1075.952959][ T12] bond1 (unregistering): Released all slaves [ 1075.959158][ T5913] usb 2-1: New USB device found, idVendor=1ea7, idProduct=0907, bcdDevice= 0.00 [ 1075.977356][ T5913] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1076.003787][ T5913] usb 2-1: config 0 descriptor?? [ 1076.241259][ T12] bond2 (unregistering): Released all slaves [ 1076.252547][ T5913] usbhid 2-1:0.0: can't add hid device: -71 [ 1076.270181][ T5913] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1076.294978][ T5913] usb 2-1: USB disconnect, device number 15 [ 1076.411504][ T5923] usb 4-1: new full-speed USB device number 39 using dummy_hcd [ 1076.452471][ T12] bond3 (unregistering): Released all slaves [ 1076.574554][ T5923] usb 4-1: config 0 has an invalid interface number: 212 but max is 0 [ 1076.585228][ T12] bond4 (unregistering): Released all slaves [ 1076.586219][ T5923] usb 4-1: config 0 has no interface number 0 [ 1076.605002][ T5923] usb 4-1: config 0 interface 212 has no altsetting 0 [ 1076.614744][ T5923] usb 4-1: New USB device found, idVendor=1ae7, idProduct=0525, bcdDevice=ca.e6 [ 1076.636541][ T5923] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1076.644844][ T5923] usb 4-1: Product: syz [ 1076.657903][ T5923] usb 4-1: Manufacturer: syz [ 1076.662652][ T5923] usb 4-1: SerialNumber: syz [ 1076.684908][ T5923] usb 4-1: config 0 descriptor?? [ 1076.809865][ T5923] HFC-S_USB 4-1:0.212: probe with driver HFC-S_USB failed with error -5 [ 1076.996232][T17185] bridge0: port 1(bridge_slave_0) entered blocking state [ 1077.026728][T17185] bridge0: port 1(bridge_slave_0) entered disabled state [ 1077.043331][T17185] bridge_slave_0: entered allmulticast mode [ 1077.056622][T17185] bridge_slave_0: entered promiscuous mode [ 1077.217067][T17185] bridge0: port 2(bridge_slave_1) entered blocking state [ 1077.230882][ T846] usb 4-1: USB disconnect, device number 39 [ 1077.247141][T17185] bridge0: port 2(bridge_slave_1) entered disabled state [ 1077.284366][T17185] bridge_slave_1: entered allmulticast mode [ 1077.328983][T17185] bridge_slave_1: entered promiscuous mode [ 1077.622863][T17185] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1077.662314][T17185] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1077.854548][ T5923] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 1077.908070][T10555] Bluetooth: hci1: command tx timeout [ 1078.043398][ T5923] usb 1-1: Using ep0 maxpacket: 32 [ 1078.053982][ T5923] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1078.077609][ T5923] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1078.110635][T17185] team0: Port device team_slave_0 added [ 1078.118628][ T5923] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 1078.161497][ T5923] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1078.219664][T17185] team0: Port device team_slave_1 added [ 1078.247352][ T5923] usb 1-1: config 0 descriptor?? [ 1078.490649][ T5923] usbhid 1-1:0.0: can't add hid device: -71 [ 1078.515827][ T5923] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1078.536689][ T5923] usb 1-1: USB disconnect, device number 22 [ 1078.616340][T17185] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1078.665604][T17185] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1078.796413][T17185] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1078.817991][ T12] batadv_slave_0: left promiscuous mode [ 1078.838471][ T12] hsr_slave_0: left promiscuous mode [ 1078.844787][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1078.874693][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1078.887016][ T846] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 1078.897948][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1078.905463][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1078.957664][ T12] veth1_macvtap: left promiscuous mode [ 1078.963574][ T12] veth1_vlan: left promiscuous mode [ 1079.097061][ T846] usb 5-1: config 0 has an invalid interface number: 72 but max is 0 [ 1079.105241][ T846] usb 5-1: config 0 has no interface number 0 [ 1079.134749][ T846] usb 5-1: config 0 interface 72 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1079.169786][ T846] usb 5-1: config 0 interface 72 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1079.212939][ T846] usb 5-1: config 0 interface 72 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1079.236242][ T846] usb 5-1: config 0 interface 72 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1079.251105][ T846] usb 5-1: New USB device found, idVendor=04fc, idProduct=0204, bcdDevice=49.bf [ 1079.274295][ T846] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1079.293285][ T846] usb 5-1: Product: syz [ 1079.303431][ T846] usb 5-1: Manufacturer: syz [ 1079.317886][ T846] usb 5-1: SerialNumber: syz [ 1079.331373][ T846] usb 5-1: config 0 descriptor?? [ 1079.351232][ T846] spcp8x5 5-1:0.72: SPCP8x5 converter detected [ 1079.385448][ T846] usb 5-1: SPCP8x5 converter now attached to ttyUSB0 [ 1079.997426][T10555] Bluetooth: hci1: command tx timeout [ 1080.317348][ T12] team0 (unregistering): Port device team_slave_1 removed [ 1080.385605][ T12] team0 (unregistering): Port device team_slave_0 removed [ 1081.763918][T17185] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1081.786507][T17185] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1081.813528][T17185] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1081.834079][T17286] netlink: 180 bytes leftover after parsing attributes in process `syz.4.3063'. [ 1082.120244][ T5907] usb 5-1: USB disconnect, device number 29 [ 1082.157607][ T5907] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 1082.166338][ T5907] spcp8x5 5-1:0.72: device disconnected [ 1082.269484][T17185] hsr_slave_0: entered promiscuous mode [ 1082.303424][T17185] hsr_slave_1: entered promiscuous mode [ 1082.357811][T17185] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1082.400598][T17185] Cannot create hsr debugfs directory [ 1082.486492][T17312] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3069'. [ 1082.717035][ T5907] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 1082.958058][ T5907] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1082.979863][ T5907] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1083.006249][ T5907] usb 1-1: New USB device found, idVendor=09da, idProduct=0006, bcdDevice= 0.00 [ 1083.092355][ T5907] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1083.234287][ T5907] usb 1-1: config 0 descriptor?? [ 1083.700346][ T5907] a4tech 0003:09DA:0006.002D: unknown main item tag 0x0 [ 1083.728223][ T5907] a4tech 0003:09DA:0006.002D: item fetching failed at offset 4/7 [ 1083.773887][ T5907] a4tech 0003:09DA:0006.002D: parse failed [ 1083.806985][ T5907] a4tech 0003:09DA:0006.002D: probe with driver a4tech failed with error -22 [ 1083.900190][T11612] usb 1-1: USB disconnect, device number 23 [ 1084.676878][T16283] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 1084.857277][T16283] usb 4-1: Using ep0 maxpacket: 32 [ 1084.893019][T16283] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1084.914684][T16283] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1084.939370][T16283] usb 4-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 1084.950602][T16283] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1084.973602][T17185] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1084.987544][T16283] usb 4-1: config 0 descriptor?? [ 1085.020240][T17185] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1085.042782][T17185] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1085.067844][T17185] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1085.180285][ T5923] usb 1-1: new low-speed USB device number 24 using dummy_hcd [ 1085.241815][T16283] usbhid 4-1:0.0: can't add hid device: -71 [ 1085.253365][T16283] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1085.294301][T16283] usb 4-1: USB disconnect, device number 40 [ 1085.359876][ T5923] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 1085.386710][T17185] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1085.398116][ T5923] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1085.420194][ T5923] usb 1-1: config 0 descriptor?? [ 1085.472260][T17185] 8021q: adding VLAN 0 to HW filter on device team0 [ 1085.499054][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 1085.506318][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1085.549220][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 1085.556458][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1085.752283][T17185] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1085.916645][T17185] veth0_vlan: entered promiscuous mode [ 1085.978442][T17185] veth1_vlan: entered promiscuous mode [ 1086.116176][T17185] veth0_macvtap: entered promiscuous mode [ 1086.142105][T17185] veth1_macvtap: entered promiscuous mode [ 1086.268490][T17185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1086.313432][T17185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1086.350621][T17185] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.375183][T17185] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.402979][T17185] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.432499][T17185] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.486889][ T5913] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 1086.546135][T17379] loop5: detected capacity change from 0 to 1759 [ 1086.595596][T17380] netlink: 'syz.0.3076': attribute type 5 has an invalid length. [ 1086.674142][ T5913] usb 2-1: config 0 has an invalid interface number: 72 but max is 0 [ 1086.704920][ T5913] usb 2-1: config 0 has no interface number 0 [ 1086.727378][ T5913] usb 2-1: config 0 interface 72 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1086.758997][ T5913] usb 2-1: config 0 interface 72 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1086.782996][ T5913] usb 2-1: config 0 interface 72 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1086.833867][ T5913] usb 2-1: config 0 interface 72 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1086.856300][ T5913] usb 2-1: New USB device found, idVendor=04fc, idProduct=0204, bcdDevice=49.bf [ 1086.886017][ T5913] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1086.943738][ T5913] usb 2-1: Product: syz [ 1086.963173][ T5913] usb 2-1: Manufacturer: syz [ 1086.977821][ T5913] usb 2-1: SerialNumber: syz [ 1086.986548][ T6510] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1087.010706][ T5913] usb 2-1: config 0 descriptor?? [ 1087.051773][ T5913] spcp8x5 2-1:0.72: SPCP8x5 converter detected [ 1087.059265][ T6510] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1087.092152][ T5913] usb 2-1: SPCP8x5 converter now attached to ttyUSB0 [ 1087.223076][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1087.265122][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1087.359010][T17397] netlink: 180 bytes leftover after parsing attributes in process `syz.1.3079'. [ 1087.388331][T17397] netlink: 180 bytes leftover after parsing attributes in process `syz.1.3079'. [ 1088.288736][ T5923] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x8001: -71 [ 1088.325544][ T5923] asix 1-1:0.0: probe with driver asix failed with error -71 [ 1088.361040][ T5923] usb 1-1: USB disconnect, device number 24 [ 1088.821620][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1088.835394][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1088.854305][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1088.881104][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1088.896328][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1089.394890][T17423] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1089.416459][T17423] batadv_slave_0: entered promiscuous mode [ 1089.444994][ T846] usb 2-1: USB disconnect, device number 16 [ 1089.448315][T11612] usb 5-1: new full-speed USB device number 30 using dummy_hcd [ 1089.468101][ T846] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 1089.523161][ T846] spcp8x5 2-1:0.72: device disconnected [ 1089.616918][T11612] usb 5-1: device descriptor read/64, error -71 [ 1089.842159][T17430] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3088'. [ 1089.883715][T17436] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1089.907270][T11612] usb 5-1: new full-speed USB device number 31 using dummy_hcd [ 1090.178891][T11612] usb 5-1: device descriptor read/64, error -71 [ 1090.337431][T11612] usb usb5-port1: attempt power cycle [ 1090.362215][T17418] chnl_net:caif_netlink_parms(): no params data found [ 1090.460535][ T5961] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 1090.648575][T17455] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3093'. [ 1090.666129][ T5961] usb 1-1: config index 0 descriptor too short (expected 786, got 18) [ 1090.696967][ T5961] usb 1-1: config 0 has an invalid interface number: 0 but max is -1 [ 1090.716953][T11612] usb 5-1: new full-speed USB device number 32 using dummy_hcd [ 1090.791823][ T5961] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1090.817600][T11612] usb 5-1: device descriptor read/8, error -71 [ 1090.848807][ T5961] usb 1-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 1090.883300][ T5913] hid-generic 0000:0000:0000.002E: unknown main item tag 0x0 [ 1090.894682][ T5961] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1090.913420][ T5961] usb 1-1: Product: syz [ 1090.918114][ T5961] usb 1-1: Manufacturer: syz [ 1090.922777][ T5961] usb 1-1: SerialNumber: syz [ 1090.940899][ T5913] hid-generic 0000:0000:0000.002E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1090.949065][ T5961] usb 1-1: config 0 descriptor?? [ 1090.968012][ T5961] ch341 1-1:0.0: ch341-uart converter detected [ 1091.027253][ T51] Bluetooth: hci2: command tx timeout [ 1091.060922][T11612] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 1091.121401][T17418] bridge0: port 1(bridge_slave_0) entered blocking state [ 1091.128911][T17418] bridge0: port 1(bridge_slave_0) entered disabled state [ 1091.136208][T17418] bridge_slave_0: entered allmulticast mode [ 1091.145010][T17418] bridge_slave_0: entered promiscuous mode [ 1091.154317][T17418] bridge0: port 2(bridge_slave_1) entered blocking state [ 1091.165288][T17418] bridge0: port 2(bridge_slave_1) entered disabled state [ 1091.167182][ T5961] usb 1-1: failed to receive control message: -121 [ 1091.173293][T17418] bridge_slave_1: entered allmulticast mode [ 1091.198832][T11612] usb 5-1: device descriptor read/8, error -71 [ 1091.218011][T17418] bridge_slave_1: entered promiscuous mode [ 1091.245939][ T5961] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -121 [ 1091.316428][T11612] usb usb5-port1: unable to enumerate USB device [ 1091.435848][T17418] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1091.465373][T17418] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1091.573121][T17418] team0: Port device team_slave_0 added [ 1091.589240][T17418] team0: Port device team_slave_1 added [ 1091.655101][T17418] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1091.670873][T17418] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1091.697618][T11612] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 1091.713669][T17418] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1091.728120][T17418] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1091.740947][T17418] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1091.770044][T17418] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1091.857330][T11612] usb 2-1: Using ep0 maxpacket: 16 [ 1091.873825][T11612] usb 2-1: config 0 has an invalid interface number: 49 but max is 0 [ 1091.889647][T11612] usb 2-1: config 0 has no interface number 0 [ 1091.906589][T11612] usb 2-1: config 0 interface 49 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 16 [ 1091.924079][T11612] usb 2-1: config 0 interface 49 altsetting 0 has an endpoint descriptor with address 0x29, changing to 0x9 [ 1091.937483][T11612] usb 2-1: config 0 interface 49 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1091.959284][T11612] usb 2-1: config 0 interface 49 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 1091.970243][T17418] hsr_slave_0: entered promiscuous mode [ 1091.977977][T17418] hsr_slave_1: entered promiscuous mode [ 1091.986704][T11612] usb 2-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 1091.997657][T11612] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.006981][T17418] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1092.016150][T11612] usb 2-1: Product: syz [ 1092.020905][T17418] Cannot create hsr debugfs directory [ 1092.026584][T11612] usb 2-1: Manufacturer: syz [ 1092.032560][T11612] usb 2-1: SerialNumber: syz [ 1092.053202][T11612] usb 2-1: config 0 descriptor?? [ 1092.076184][T17467] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1092.515465][T17418] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1092.608826][ T5961] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 1092.640005][T17418] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1092.723086][T17418] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1092.772002][T16283] usb 1-1: USB disconnect, device number 25 [ 1092.779884][ T5961] usb 5-1: config 0 has an invalid interface number: 72 but max is 0 [ 1092.789852][T16283] ch341 1-1:0.0: device disconnected [ 1092.803361][ T5961] usb 5-1: config 0 has no interface number 0 [ 1092.810878][ T5961] usb 5-1: config 0 interface 72 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1092.824223][ T5961] usb 5-1: config 0 interface 72 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1092.841575][ T5961] usb 5-1: config 0 interface 72 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1092.857110][ T5961] usb 5-1: config 0 interface 72 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1092.879472][T17418] bond0: (slave netdevsim0): Releasing backup interface [ 1092.883513][ T5961] usb 5-1: New USB device found, idVendor=04fc, idProduct=0204, bcdDevice=49.bf [ 1092.899651][T17418] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1092.900381][ T5961] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.932070][ T5961] usb 5-1: Product: syz [ 1092.940738][ T5961] usb 5-1: Manufacturer: syz [ 1092.945511][ T5961] usb 5-1: SerialNumber: syz [ 1092.960843][ T5961] usb 5-1: config 0 descriptor?? [ 1092.978185][ T5961] spcp8x5 5-1:0.72: SPCP8x5 converter detected [ 1093.001460][ T5961] usb 5-1: SPCP8x5 converter now attached to ttyUSB0 [ 1093.117494][ T51] Bluetooth: hci2: command tx timeout [ 1093.298913][T17418] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1093.329954][T17479] netlink: 180 bytes leftover after parsing attributes in process `syz.4.3097'. [ 1093.344384][T17418] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1093.361631][T17418] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1093.388893][T17496] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3099'. [ 1093.412481][T17479] netlink: 180 bytes leftover after parsing attributes in process `syz.4.3097'. [ 1093.455208][T17418] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1093.706901][ T5961] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 1093.847660][ T5961] usb 1-1: device descriptor read/64, error -71 [ 1094.016806][T17418] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1094.079128][T17418] 8021q: adding VLAN 0 to HW filter on device team0 [ 1094.100571][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 1094.107839][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1094.127427][ T5961] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 1094.192341][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 1094.199630][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1094.277500][ T5961] usb 1-1: device descriptor read/64, error -71 [ 1094.401969][ T5961] usb usb1-port1: attempt power cycle [ 1094.493607][T17418] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1094.577553][T11612] qcserial 2-1:0.49: Qualcomm USB modem converter detected [ 1094.614016][T11612] usb 2-1: USB disconnect, device number 17 [ 1094.687869][T11612] qcserial 2-1:0.49: device disconnected [ 1094.702196][T17418] veth0_vlan: entered promiscuous mode [ 1094.753562][T17418] veth1_vlan: entered promiscuous mode [ 1094.768074][ T5961] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 1094.808631][ T5961] usb 1-1: device descriptor read/8, error -71 [ 1094.842362][T17418] veth0_macvtap: entered promiscuous mode [ 1094.856139][T17418] veth1_macvtap: entered promiscuous mode [ 1094.908298][T17418] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1094.965948][T17418] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1094.991578][T17418] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1095.002138][T17418] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1095.016733][T17418] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1095.051501][T17418] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1095.060592][ T5961] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 1095.091128][ T5961] usb 1-1: device descriptor read/8, error -71 [ 1095.187279][ T51] Bluetooth: hci2: command tx timeout [ 1095.207340][ T5961] usb usb1-port1: unable to enumerate USB device [ 1095.237022][ T5913] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 1095.262129][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1095.285784][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1095.297443][T17514] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3103'. [ 1095.351738][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1095.376409][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1095.417881][ T5913] usb 2-1: Using ep0 maxpacket: 32 [ 1095.444476][ T5913] usb 2-1: no configurations [ 1095.456068][ T5913] usb 2-1: can't read configurations, error -22 [ 1095.567167][ T5961] usb 5-1: USB disconnect, device number 34 [ 1095.605730][ T5961] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 1095.637621][ T5961] spcp8x5 5-1:0.72: device disconnected [ 1095.737113][ T5913] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 1095.946936][ T5913] usb 2-1: Using ep0 maxpacket: 32 [ 1095.960511][ T5913] usb 2-1: no configurations [ 1095.968840][ T5913] usb 2-1: can't read configurations, error -22 [ 1095.989113][ T5913] usb usb2-port1: attempt power cycle [ 1096.431024][ T5913] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 1096.499617][ T5913] usb 2-1: Using ep0 maxpacket: 32 [ 1096.507045][ T5913] usb 2-1: no configurations [ 1096.515859][ T5913] usb 2-1: can't read configurations, error -22 [ 1096.544329][T17529] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1096.693083][T10555] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1096.702973][T10555] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1096.715048][T10555] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1096.724378][T10555] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1096.726994][ T5913] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 1096.734117][T10555] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1096.877568][ T5913] usb 2-1: Using ep0 maxpacket: 32 [ 1096.897889][ T5913] usb 2-1: no configurations [ 1096.902575][ T5913] usb 2-1: can't read configurations, error -22 [ 1096.941764][ T5913] usb usb2-port1: unable to enumerate USB device [ 1097.267481][T10555] Bluetooth: hci2: command tx timeout [ 1097.411942][T17539] netlink: 'syz.0.3109': attribute type 29 has an invalid length. [ 1098.105627][T17534] chnl_net:caif_netlink_parms(): no params data found [ 1098.316886][ T5898] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 1098.476314][T17534] bridge0: port 1(bridge_slave_0) entered blocking state [ 1098.486961][ T5898] usb 3-1: Using ep0 maxpacket: 16 [ 1098.535879][ T5898] usb 3-1: config 0 has an invalid interface number: 49 but max is 0 [ 1098.547006][ T5898] usb 3-1: config 0 has no interface number 0 [ 1098.555298][ T5898] usb 3-1: config 0 interface 49 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 16 [ 1098.577215][T17534] bridge0: port 1(bridge_slave_0) entered disabled state [ 1098.584606][T17534] bridge_slave_0: entered allmulticast mode [ 1098.605290][ T5898] usb 3-1: config 0 interface 49 altsetting 0 has an endpoint descriptor with address 0x29, changing to 0x9 [ 1098.616953][T11667] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 1098.648928][T17534] bridge_slave_0: entered promiscuous mode [ 1098.729474][ T5898] usb 3-1: config 0 interface 49 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1098.759842][T17534] bridge0: port 2(bridge_slave_1) entered blocking state [ 1098.787383][ T5898] usb 3-1: config 0 interface 49 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 1098.794118][T10555] Bluetooth: hci4: command tx timeout [ 1098.806697][T11667] usb 4-1: Using ep0 maxpacket: 16 [ 1098.868105][T17534] bridge0: port 2(bridge_slave_1) entered disabled state [ 1098.880528][ T5898] usb 3-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 1098.897978][ T5898] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1098.932167][T17534] bridge_slave_1: entered allmulticast mode [ 1098.940444][ T5898] usb 3-1: Product: syz [ 1098.956437][ T5898] usb 3-1: Manufacturer: syz [ 1098.976564][T17534] bridge_slave_1: entered promiscuous mode [ 1099.006138][ T5898] usb 3-1: SerialNumber: syz [ 1099.017295][ T5898] usb 3-1: config 0 descriptor?? [ 1099.054392][T17546] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1099.172754][T17534] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1099.221924][T17534] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1099.635172][T17534] team0: Port device team_slave_0 added [ 1099.660011][T17534] team0: Port device team_slave_1 added [ 1099.857014][T17534] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1099.910100][T17534] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1099.936138][ C1] vkms_vblank_simulate: vblank timer overrun [ 1100.174837][T17534] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1100.189478][T17534] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1100.198402][T17534] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1100.224413][ C1] vkms_vblank_simulate: vblank timer overrun [ 1100.320967][T17534] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1100.634208][T17534] hsr_slave_0: entered promiscuous mode [ 1100.657058][T17534] hsr_slave_1: entered promiscuous mode [ 1100.685245][T17534] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1100.715762][T17534] Cannot create hsr debugfs directory [ 1100.875342][T10555] Bluetooth: hci4: command tx timeout [ 1101.072160][ T5898] qcserial 3-1:0.49: Qualcomm USB modem converter detected [ 1101.131056][ T5898] usb 3-1: USB disconnect, device number 24 [ 1101.199202][ T5898] qcserial 3-1:0.49: device disconnected [ 1101.259195][T17569] fuse: Bad value for 'user_id' [ 1101.303825][T17569] fuse: Bad value for 'user_id' [ 1101.425751][T17534] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1101.648832][T11667] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1101.671139][T11667] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1101.692771][T11667] usb 4-1: can't read configurations, error -71 [ 1101.898886][T17572] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1102.136660][T17534] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.636617][T17534] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.777479][T11667] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 1102.898493][T17534] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1102.947161][T10555] Bluetooth: hci4: command tx timeout [ 1103.037107][T11667] usb 4-1: Using ep0 maxpacket: 16 [ 1103.594792][ T5898] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 1103.873059][ T5898] usb 1-1: Using ep0 maxpacket: 16 [ 1103.899652][ T5898] usb 1-1: config 0 has an invalid interface number: 49 but max is 0 [ 1103.927162][ T5898] usb 1-1: config 0 has no interface number 0 [ 1103.955836][ T5898] usb 1-1: config 0 interface 49 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 16 [ 1104.023210][ T5898] usb 1-1: config 0 interface 49 altsetting 0 has an endpoint descriptor with address 0x29, changing to 0x9 [ 1104.087428][ T5898] usb 1-1: config 0 interface 49 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1104.136901][ T5898] usb 1-1: config 0 interface 49 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 1104.155404][T17534] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1104.167413][ T5961] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 1104.224695][ T5898] usb 1-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 1104.238643][T17534] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1104.280829][ T5898] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1104.286155][T17534] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1104.378103][ T5961] usb 2-1: Using ep0 maxpacket: 16 [ 1104.427433][ T5898] usb 1-1: Product: syz [ 1104.442250][ T5898] usb 1-1: Manufacturer: syz [ 1104.455299][ T5898] usb 1-1: SerialNumber: syz [ 1104.517328][ T5898] usb 1-1: config 0 descriptor?? [ 1104.557369][T17597] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1104.663541][T17534] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1105.027031][T10555] Bluetooth: hci4: command tx timeout [ 1105.435206][T17534] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1105.646033][T11667] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1105.657513][T17534] 8021q: adding VLAN 0 to HW filter on device team0 [ 1105.687177][ T5913] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1105.764861][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 1105.768135][T11667] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1105.772132][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1105.787132][T11667] usb 4-1: can't read configurations, error -71 [ 1105.844441][T11667] usb usb4-port1: attempt power cycle [ 1105.852745][ T6510] bridge0: port 2(bridge_slave_1) entered blocking state [ 1105.860026][ T6510] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1105.886969][ T5913] usb 3-1: Using ep0 maxpacket: 32 [ 1105.898102][ T5913] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 1105.906579][ T5913] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1105.933857][ T5913] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1105.952735][ T5913] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 2763, setting to 1024 [ 1105.967380][ T5913] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1106.001990][ T5913] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 14385, setting to 1024 [ 1106.014567][ T5913] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1106.026487][ T5913] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1106.093994][T17615] ptrace attach of "./syz-executor exec"[17418] was attempted by "./syz-executor exec"[17615] [ 1106.152293][ T5913] usb 3-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 1106.240041][ T5913] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1106.278143][ T5913] usb 3-1: config 0 descriptor?? [ 1106.311004][T17611] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 1106.319291][T17611] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 1106.341911][ T5913] usblp0: Disabling reads from problematic bidirectional printer [ 1106.375701][T17534] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1106.548289][ T5913] usblp 3-1:0.0: usblp0: USB Unidirectional printer dev 25 if 0 alt 0 proto 3 vid 0x03F0 pid 0x0004 [ 1106.568503][ T5898] qcserial 1-1:0.49: Qualcomm USB modem converter detected [ 1106.626498][ T5913] usb 3-1: USB disconnect, device number 25 [ 1106.654754][ T5898] usb 1-1: USB disconnect, device number 30 [ 1106.705110][ T5913] usblp0: removed [ 1106.720847][ T5898] qcserial 1-1:0.49: device disconnected [ 1106.954864][T17534] veth0_vlan: entered promiscuous mode [ 1107.029094][T17534] veth1_vlan: entered promiscuous mode [ 1107.408984][T17534] veth0_macvtap: entered promiscuous mode [ 1107.571216][ T5961] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1107.585414][ T5961] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1107.656150][ T5961] usb 2-1: can't read configurations, error -71 [ 1107.701098][T17534] veth1_macvtap: entered promiscuous mode [ 1107.862249][T17534] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1107.921357][T17534] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1108.070859][ T51] Bluetooth: hci5: command 0x0406 tx timeout [ 1108.148548][ T5913] hid-generic 0000:0000:0000.002F: unknown main item tag 0x0 [ 1108.204820][T17534] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1108.216071][ T5913] hid-generic 0000:0000:0000.002F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1108.216957][T16283] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 1108.284626][T17534] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1108.364793][T17534] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1108.407020][T16283] usb 3-1: Using ep0 maxpacket: 16 [ 1108.424539][T17534] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1108.795915][ T1317] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1108.835269][ T1317] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1109.060639][T11787] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1109.096039][T11787] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1109.518263][T17636] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 1109.518263][T17636] The task syz.3.3132 (17636) triggered the difference, watch for misbehavior. [ 1109.633288][ T5923] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 1109.893754][ T5923] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1109.955906][ T5923] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1110.002367][ T5923] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1110.056142][ T5923] usb 5-1: config 0 descriptor?? [ 1110.093522][ T5923] pwc: Askey VC010 type 2 USB webcam detected. [ 1110.500430][ T5923] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1110.518961][ T5923] pwc: recv_control_msg error -32 req 02 val 2700 [ 1110.536292][ T5923] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1110.952760][T17633] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3105'. [ 1110.991718][ T5923] pwc: recv_control_msg error -32 req 04 val 1400 [ 1111.001203][ T5923] pwc: recv_control_msg error -32 req 02 val 2000 [ 1111.033077][ T5923] pwc: recv_control_msg error -32 req 02 val 2100 [ 1111.045828][ T5923] pwc: recv_control_msg error -32 req 04 val 1500 [ 1111.068099][T11612] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 1111.078272][ T5923] pwc: recv_control_msg error -32 req 02 val 2500 [ 1111.141053][ T5923] pwc: recv_control_msg error -32 req 02 val 2400 [ 1111.155520][ T5923] pwc: recv_control_msg error -71 req 02 val 2600 [ 1111.176659][ T5923] pwc: recv_control_msg error -71 req 02 val 2900 [ 1111.201321][ T5923] pwc: recv_control_msg error -71 req 02 val 2800 [ 1111.228300][ T5923] pwc: recv_control_msg error -71 req 04 val 1100 [ 1111.247831][ T5923] pwc: recv_control_msg error -71 req 04 val 1200 [ 1111.257575][T11612] usb 4-1: Using ep0 maxpacket: 16 [ 1111.286208][ T5923] pwc: Registered as video103. [ 1111.299337][T11612] usb 4-1: config 0 has an invalid interface number: 49 but max is 0 [ 1111.310523][ T5923] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input88 [ 1111.335109][T11612] usb 4-1: config 0 has no interface number 0 [ 1111.365664][T11612] usb 4-1: config 0 interface 49 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 16 [ 1111.401441][ T5923] usb 5-1: USB disconnect, device number 35 [ 1111.417684][T11612] usb 4-1: config 0 interface 49 altsetting 0 has an endpoint descriptor with address 0x29, changing to 0x9 [ 1111.504975][T11612] usb 4-1: config 0 interface 49 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1111.519922][T16283] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1111.541119][T11612] usb 4-1: config 0 interface 49 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 1111.562449][T16283] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1111.588918][T16283] usb 3-1: can't read configurations, error -71 [ 1111.606381][T11612] usb 4-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 1111.626658][T11612] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1111.644316][T11612] usb 4-1: Product: syz [ 1111.674919][T11612] usb 4-1: Manufacturer: syz [ 1111.718754][T11612] usb 4-1: SerialNumber: syz [ 1111.760903][T11612] usb 4-1: config 0 descriptor?? [ 1111.782068][T17650] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1112.654608][T17673] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3142'. [ 1113.633479][ T5913] hid-generic 0000:0000:0000.0030: unknown main item tag 0x0 [ 1113.668865][ T5913] hid-generic 0000:0000:0000.0030: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1113.678954][T16283] usb 3-1: new low-speed USB device number 28 using dummy_hcd [ 1113.840487][T16283] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1113.871435][T16283] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1113.918930][T11612] qcserial 4-1:0.49: Qualcomm USB modem converter detected [ 1113.947718][T16283] usb 3-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 1113.994679][T16283] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1114.014039][T11612] usb 4-1: USB disconnect, device number 44 [ 1114.064786][T11612] qcserial 4-1:0.49: device disconnected [ 1114.075059][T16283] usb 3-1: config 0 descriptor?? [ 1114.446072][T11612] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 1114.521469][T16283] steelseries 0003:1038:1410.0031: unbalanced collection at end of report description [ 1114.573971][T16283] steelseries 0003:1038:1410.0031: parse failed [ 1114.590193][T16283] steelseries 0003:1038:1410.0031: probe with driver steelseries failed with error -22 [ 1114.697677][T11612] usb 4-1: device descriptor read/64, error -71 [ 1114.937322][T11612] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 1115.007734][T17694] ptrace attach of "./syz-executor exec"[16770] was attempted by "./syz-executor exec"[17694] [ 1115.087297][T11612] usb 4-1: device descriptor read/64, error -71 [ 1115.197855][T11612] usb usb4-port1: attempt power cycle [ 1115.537763][T11612] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 1115.574291][T11612] usb 4-1: device descriptor read/8, error -71 [ 1115.847470][T11612] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 1115.870299][T11612] usb 4-1: device descriptor read/8, error -71 [ 1115.991862][T11612] usb usb4-port1: unable to enumerate USB device [ 1116.009696][ T31] kauditd_printk_skb: 5 callbacks suppressed [ 1116.009716][ T31] audit: type=1326 audit(1753435094.652:787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17701 comm="syz.1.3150" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3bccd8e9a9 code=0x0 [ 1116.061900][T17703] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1116.121625][ T5961] usb 3-1: USB disconnect, device number 28 [ 1116.174005][T17706] netlink: 'syz.4.3151': attribute type 29 has an invalid length. [ 1116.194877][T17706] netlink: 'syz.4.3151': attribute type 29 has an invalid length. [ 1116.698919][T17712] netlink: 'syz.4.3153': attribute type 4 has an invalid length. [ 1117.157369][ T5961] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 1117.275137][T17724] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3157'. [ 1117.309743][ T5913] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1117.346982][ T5961] usb 3-1: Using ep0 maxpacket: 16 [ 1117.369635][ T5961] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1117.397950][ T5961] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1117.448798][ T5961] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1117.467036][ T5913] usb 2-1: Using ep0 maxpacket: 16 [ 1117.480409][ T5913] usb 2-1: config 0 has an invalid interface number: 49 but max is 0 [ 1117.493410][ T5913] usb 2-1: config 0 has no interface number 0 [ 1117.504439][ T5961] usb 3-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 1117.658107][ T5913] usb 2-1: config 0 interface 49 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 16 [ 1117.662880][ T5961] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1117.678144][ T5913] usb 2-1: config 0 interface 49 altsetting 0 has an endpoint descriptor with address 0x29, changing to 0x9 [ 1117.692935][ T5923] hid-generic 0000:0000:0000.0032: unknown main item tag 0x0 [ 1117.709795][ T5913] usb 2-1: config 0 interface 49 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1117.733218][ T5913] usb 2-1: config 0 interface 49 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 1117.746036][ T5913] usb 2-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 1117.757485][ T5913] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1117.765647][ T5913] usb 2-1: Product: syz [ 1117.770494][ T5913] usb 2-1: Manufacturer: syz [ 1117.775154][ T5913] usb 2-1: SerialNumber: syz [ 1117.784488][ T5923] hid-generic 0000:0000:0000.0032: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1117.795874][ T5913] usb 2-1: config 0 descriptor?? [ 1117.812256][ T5961] usb 3-1: config 0 descriptor?? [ 1117.854417][ T5961] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input89 [ 1117.897285][T17721] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1118.022665][ T5201] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 1118.105831][T17722] ------------[ cut here ]------------ [ 1118.112077][T17722] WARNING: CPU: 0 PID: 17722 at drivers/gpu/drm/vkms/vkms_crtc.c:97 vkms_get_vblank_timestamp+0x137/0x160 [ 1118.123593][T17722] Modules linked in: [ 1118.129010][T17722] CPU: 0 UID: 0 PID: 17722 Comm: syz.3.3157 Not tainted 6.16.0-rc7-syzkaller-00105-g2942242dde89 #0 PREEMPT(full) [ 1118.141978][T17722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1118.154568][T17722] RIP: 0010:vkms_get_vblank_timestamp+0x137/0x160 [ 1118.161998][T17722] Code: 42 80 3c 28 00 74 08 48 89 df e8 b4 eb 33 fc 4c 89 33 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 aa d8 d1 fb 90 <0f> 0b 90 eb e3 44 89 e1 80 e1 07 38 c1 0f 8c ff fe ff ff 4c 89 e7 [ 1118.181914][T17722] RSP: 0018:ffffc900044ef6c8 EFLAGS: 00010293 [ 1118.188076][T17722] RAX: ffffffff85ee4e36 RBX: ffffc900044ef840 RCX: ffff88801c3f5a00 [ 1118.196109][T17722] RDX: 0000000000000000 RSI: 000001044ff345cf RDI: 000001044ff345cf [ 1118.204176][T17722] RBP: 1ffff9200089df08 R08: ffffc900036a9000 R09: 0000000000000000 [ 1118.212634][T17722] R10: ffffc900036a9000 R11: ffffffff85ee4d00 R12: 000001044ff345cf [ 1118.220871][T17722] R13: dffffc0000000000 R14: ffff888024fa8028 R15: 000001044ff345cf [ 1118.230197][T17722] FS: 0000555572be9500(0000) GS:ffff888125c23000(0000) knlGS:0000000000000000 [ 1118.240027][T17722] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1118.246886][T17722] CR2: 0000200000675000 CR3: 000000005e372000 CR4: 00000000003526f0 [ 1118.255001][T17722] DR0: 0000000000000000 DR1: 000000000000000b DR2: 0000000000000000 [ 1118.263159][T17722] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1118.271286][T17722] Call Trace: [ 1118.274635][T17722] [ 1118.277718][T17722] ? __pfx_vkms_get_vblank_timestamp+0x10/0x10 [ 1118.283970][T17722] drm_crtc_next_vblank_start+0x223/0x470 [ 1118.289894][T17722] ? __pfx_drm_crtc_next_vblank_start+0x10/0x10 [ 1118.296252][T17722] ? drm_gem_fb_vmap+0x230/0x8d0 [ 1118.301360][T17722] drm_atomic_helper_wait_for_fences+0x265/0x8c0 [ 1118.308249][T17722] ? __pfx_drm_atomic_helper_wait_for_fences+0x10/0x10 [ 1118.315200][T17722] ? drm_atomic_helper_prepare_planes+0x670/0xb60 [ 1118.321782][T17722] drm_atomic_helper_commit+0x5c7/0xb10 [ 1118.327475][T17722] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 1118.334291][T17722] drm_atomic_commit+0x25f/0x2c0 [ 1118.339886][T17722] ? __pfx_drm_atomic_commit+0x10/0x10 [ 1118.345402][T17722] ? __pfx___drm_printfn_info+0x10/0x10 [ 1118.351059][T17722] ? drm_client_rotation+0x47c/0x5b0 [ 1118.356496][T17722] drm_client_modeset_commit_atomic+0x620/0x760 [ 1118.362855][T17722] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 1118.369734][T17722] ? trace_contention_end+0x39/0x120 [ 1118.375127][T17722] drm_client_modeset_commit_locked+0xcb/0x4d0 [ 1118.381384][T17722] drm_client_modeset_commit+0x4a/0x70 [ 1118.387069][T17722] drm_fb_helper_lastclose+0xa4/0x1c0 [ 1118.392513][T17722] drm_fbdev_client_restore+0x34/0x40 [ 1118.397999][T17722] drm_client_dev_restore+0x13c/0x270 [ 1118.403428][T17722] drm_release+0x318/0x3f0 [ 1118.407928][T17722] ? __pfx_drm_release+0x10/0x10 [ 1118.412916][T17722] __fput+0x449/0xa70 [ 1118.417033][T17722] task_work_run+0x1d4/0x260 [ 1118.421684][T17722] ? __pfx_task_work_run+0x10/0x10 [ 1118.426866][T17722] ? exit_to_user_mode_loop+0x40/0x110 [ 1118.432396][T17722] exit_to_user_mode_loop+0xec/0x110 [ 1118.438372][T17722] do_syscall_64+0x2bd/0x3b0 [ 1118.442990][T17722] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.449686][T17722] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1118.455885][T17722] ? clear_bhb_loop+0x60/0xb0 [ 1118.460660][T17722] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.466586][T17722] RIP: 0033:0x7f4253d8e9a9 [ 1118.471136][T17722] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1118.490820][T17722] RSP: 002b:00007f42540dfb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 1118.499299][T17722] RAX: 0000000000000000 RBX: 00007f4253fb7ba0 RCX: 00007f4253d8e9a9 [ 1118.507344][T17722] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 1118.515394][T17722] RBP: 00007f4253fb7ba0 R08: 0000000000001d0c R09: 0000001e540dfe7f [ 1118.523560][T17722] R10: 00007f4253fb7ac0 R11: 0000000000000246 R12: 0000000000110eb6 [ 1118.531611][T17722] R13: 00007f4253fb6080 R14: ffffffffffffffff R15: 00007f42540dfca0 [ 1118.540470][T17722] [ 1118.543536][T17722] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1118.550838][T17722] CPU: 0 UID: 0 PID: 17722 Comm: syz.3.3157 Not tainted 6.16.0-rc7-syzkaller-00105-g2942242dde89 #0 PREEMPT(full) [ 1118.562911][T17722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1118.573010][T17722] Call Trace: [ 1118.576309][T17722] [ 1118.579256][T17722] dump_stack_lvl+0x99/0x250 [ 1118.583873][T17722] ? __asan_memcpy+0x40/0x70 [ 1118.588482][T17722] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1118.593708][T17722] ? __pfx__printk+0x10/0x10 [ 1118.598354][T17722] panic+0x2db/0x790 [ 1118.602306][T17722] ? __pfx_panic+0x10/0x10 [ 1118.606762][T17722] ? show_trace_log_lvl+0x4fb/0x550 [ 1118.612006][T17722] __warn+0x31b/0x4b0 [ 1118.616000][T17722] ? vkms_get_vblank_timestamp+0x137/0x160 [ 1118.621833][T17722] ? vkms_get_vblank_timestamp+0x137/0x160 [ 1118.627654][T17722] report_bug+0x2be/0x4f0 [ 1118.632025][T17722] ? vkms_get_vblank_timestamp+0x137/0x160 [ 1118.637871][T17722] ? vkms_get_vblank_timestamp+0x137/0x160 [ 1118.645882][T17722] ? vkms_get_vblank_timestamp+0x139/0x160 [ 1118.651724][T17722] handle_bug+0x84/0x160 [ 1118.655988][T17722] exc_invalid_op+0x1a/0x50 [ 1118.660516][T17722] asm_exc_invalid_op+0x1a/0x20 [ 1118.665381][T17722] RIP: 0010:vkms_get_vblank_timestamp+0x137/0x160 [ 1118.671814][T17722] Code: 42 80 3c 28 00 74 08 48 89 df e8 b4 eb 33 fc 4c 89 33 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 aa d8 d1 fb 90 <0f> 0b 90 eb e3 44 89 e1 80 e1 07 38 c1 0f 8c ff fe ff ff 4c 89 e7 [ 1118.691430][T17722] RSP: 0018:ffffc900044ef6c8 EFLAGS: 00010293 [ 1118.697521][T17722] RAX: ffffffff85ee4e36 RBX: ffffc900044ef840 RCX: ffff88801c3f5a00 [ 1118.705523][T17722] RDX: 0000000000000000 RSI: 000001044ff345cf RDI: 000001044ff345cf [ 1118.713506][T17722] RBP: 1ffff9200089df08 R08: ffffc900036a9000 R09: 0000000000000000 [ 1118.721494][T17722] R10: ffffc900036a9000 R11: ffffffff85ee4d00 R12: 000001044ff345cf [ 1118.729485][T17722] R13: dffffc0000000000 R14: ffff888024fa8028 R15: 000001044ff345cf [ 1118.737471][T17722] ? __pfx_vkms_get_vblank_timestamp+0x10/0x10 [ 1118.743679][T17722] ? vkms_get_vblank_timestamp+0x136/0x160 [ 1118.749517][T17722] ? vkms_get_vblank_timestamp+0x136/0x160 [ 1118.755358][T17722] ? __pfx_vkms_get_vblank_timestamp+0x10/0x10 [ 1118.761528][T17722] drm_crtc_next_vblank_start+0x223/0x470 [ 1118.767275][T17722] ? __pfx_drm_crtc_next_vblank_start+0x10/0x10 [ 1118.773534][T17722] ? drm_gem_fb_vmap+0x230/0x8d0 [ 1118.778581][T17722] drm_atomic_helper_wait_for_fences+0x265/0x8c0 [ 1118.784924][T17722] ? __pfx_drm_atomic_helper_wait_for_fences+0x10/0x10 [ 1118.791783][T17722] ? drm_atomic_helper_prepare_planes+0x670/0xb60 [ 1118.798234][T17722] drm_atomic_helper_commit+0x5c7/0xb10 [ 1118.803858][T17722] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 1118.809943][T17722] drm_atomic_commit+0x25f/0x2c0 [ 1118.814902][T17722] ? __pfx_drm_atomic_commit+0x10/0x10 [ 1118.820382][T17722] ? __pfx___drm_printfn_info+0x10/0x10 [ 1118.826032][T17722] ? drm_client_rotation+0x47c/0x5b0 [ 1118.831340][T17722] drm_client_modeset_commit_atomic+0x620/0x760 [ 1118.837615][T17722] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 1118.844399][T17722] ? trace_contention_end+0x39/0x120 [ 1118.849763][T17722] drm_client_modeset_commit_locked+0xcb/0x4d0 [ 1118.855966][T17722] drm_client_modeset_commit+0x4a/0x70 [ 1118.861698][T17722] drm_fb_helper_lastclose+0xa4/0x1c0 [ 1118.867088][T17722] drm_fbdev_client_restore+0x34/0x40 [ 1118.872475][T17722] drm_client_dev_restore+0x13c/0x270 [ 1118.877864][T17722] drm_release+0x318/0x3f0 [ 1118.882294][T17722] ? __pfx_drm_release+0x10/0x10 [ 1118.887242][T17722] __fput+0x449/0xa70 [ 1118.891246][T17722] task_work_run+0x1d4/0x260 [ 1118.895855][T17722] ? __pfx_task_work_run+0x10/0x10 [ 1118.900993][T17722] ? exit_to_user_mode_loop+0x40/0x110 [ 1118.906463][T17722] exit_to_user_mode_loop+0xec/0x110 [ 1118.911790][T17722] do_syscall_64+0x2bd/0x3b0 [ 1118.916395][T17722] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.922471][T17722] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1118.928655][T17722] ? clear_bhb_loop+0x60/0xb0 [ 1118.933348][T17722] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.939249][T17722] RIP: 0033:0x7f4253d8e9a9 [ 1118.943676][T17722] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1118.963301][T17722] RSP: 002b:00007f42540dfb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 1118.971729][T17722] RAX: 0000000000000000 RBX: 00007f4253fb7ba0 RCX: 00007f4253d8e9a9 [ 1118.979707][T17722] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 1118.987703][T17722] RBP: 00007f4253fb7ba0 R08: 0000000000001d0c R09: 0000001e540dfe7f [ 1118.995681][T17722] R10: 00007f4253fb7ac0 R11: 0000000000000246 R12: 0000000000110eb6 [ 1119.003670][T17722] R13: 00007f4253fb6080 R14: ffffffffffffffff R15: 00007f42540dfca0 [ 1119.011669][T17722] [ 1119.015080][T17722] Kernel Offset: disabled [ 1119.019443][T17722] Rebooting in 86400 seconds..