last executing test programs: 38m49.684304161s ago: executing program 1 (id=987): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01012abd7000feffffff2b000000", @ANYRES32=r2, @ANYBLOB="0400460005003400c4000000080026006c09000024005180200000800900010000000000001800000500020002"], 0x54}, 0x1, 0x0, 0x0, 0x4044014}, 0x48000) 38m49.623205279s ago: executing program 1 (id=988): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) (async, rerun: 64) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) (async) r3 = syz_open_dev$video4linux(&(0x7f0000000400), 0x800000000401, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc040564a, &(0x7f0000002580)={0x0, 0x1, 0x1014, 0xffffffffffffffff, 0x0, 0x0}) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000940)=0xffffffffffffffff) (async) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f00000020c0), 0x2, 0x0) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r5, 0x7ab, &(0x7f0000002080)={0x0}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r4, 0x7c81, 0x0) unshare(0x2a020400) (async) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) io_setup(0x3, &(0x7f0000000180)=0x0) (async) r7 = syz_open_procfs(0x0, &(0x7f0000002240)='net/mcfilter6\x00') io_submit(r6, 0x1, &(0x7f0000000800)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x5, 0x0, r7, 0x0}]) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYRES64=r0], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xb9, &(0x7f0000002100)=""/185, 0x0, 0x68, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x76, 0x10, &(0x7f00000021c0), 0x10}, 0xfffffffffffffde9) (rerun: 64) r8 = openat(r4, 0x0, 0x545742, 0x99) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/net\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async, rerun: 32) write(0xffffffffffffffff, &(0x7f0000000000)="3c00000058001f000307f4f9002304000a04d65f0800010002010002170003800500000099db973b91aa057972513500b0406700912deb5b85932234", 0x3c) (async, rerun: 32) r9 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_MSFILTER(r9, 0x29, 0x30, 0x0, 0x310) read$FUSE(r8, &(0x7f0000000040)={0x2020}, 0x2020) close(r8) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20048050}, 0x4008811) (async) ioctl$SOUND_PCM_READ_RATE(r0, 0x80045002, 0x0) 38m49.484225298s ago: executing program 1 (id=989): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc73}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r3, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2], 0xeeee8000, 0x8340}) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, 0x0}], 0x1, 0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0xb, &(0x7f0000000200)=ANY=[@ANYBLOB="d7000000200007007911b800000000001801000020646c2500000000002020207b18f8ff00000000bfa1000000ffffffbf010000f8ffffffb702000008000000b70300000700000085000000d40000009500740000000000ef5f6082e4a0a52b72bde925efe35e0c28542f1716572a77c3939e085958131eb5d6ab7a69e1a83a4c8354fce7a66fe529cf5d06f6010e13c72fe2174e984706fbb446efe6271a62fc1c495beb391ce3ca6f852a3a36ecf9c5"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0x18, &(0x7f000000cf3d)=""/195, 0x0, 0xc, '\x00', 0x0, @fallback=0xd}, 0x59) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0x3a00, 0x0, 0x0, 0xb907}, 0x3f) sendto$inet6(r0, &(0x7f0000000100)="8c53935071e9041cc1e78066587a1d8d10bae9484e4e1cf3fa2e6e46c5484b22e121f140d3ab347197621859cb39a10aaa77775f7b91bbd8042155f92340a18d2eb601ca8ff581ebc5bfd3f4c7a261be60b0d17c18fff8d978de4f6256f4fc856af877497ca01793e4d68d2bd59d377574cff889a7fecab64c040f36eceb13765b449b", 0x83, 0xc045, &(0x7f0000000280)={0xa, 0x2000, 0xffff7fff, @mcast2, 0x401}, 0x1c) r4 = syz_open_dev$vivid(&(0x7f0000000040), 0x1, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000080)=0x4) setsockopt$inet6_int(r0, 0x29, 0x1, 0x0, 0x0) r5 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)="1400000023003517d25a806f8b6394f90324fc60", 0x14}]}, 0x40011) 38m49.242879865s ago: executing program 1 (id=991): mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109300) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000400)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0x2}}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) chroot(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00') r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r2) sendmsg$TIPC_CMD_GET_NODES(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)={0x1c, r5, 0x1, 0x4, 0x0, {{}, {0x0, 0x6}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x0) r6 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x2100) r7 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r7, 0x4010640d, &(0x7f0000000040)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r7, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r7, 0xc02064b9, &(0x7f0000000280)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f00000000c0), 0x3, r8}) timer_create(0x0, &(0x7f0000000340)={0x0, 0x5, 0x7}, &(0x7f0000000380)) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000300)={&(0x7f00000006c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r6, 0xc02064b6, &(0x7f00000003c0)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETPLANE(r6, 0xc03064b7, &(0x7f0000000200)={r9, 0x0, r10, 0x5, 0x80400000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x800f, 0x222}) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f00000000c0)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) ftruncate(0xffffffffffffffff, 0x51a9497) clock_gettime(0x0, &(0x7f0000000040)) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r11, 0x84, 0x6b, &(0x7f0000000580)=[@in6={0xa, 0x4e24, 0x80, @local, 0x1000}], 0x18) 38m49.164209402s ago: executing program 1 (id=992): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f0000000240)={'tunl0\x00', 0x0}) writev(0xffffffffffffffff, &(0x7f0000000340)=[{0x0}], 0x1) sendto$inet(r1, 0x0, 0x0, 0x24000840, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x76, &(0x7f0000000100)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x3c, 0x68, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x15, 0x10, 0x0, 0x0, 0x1, {[@md5sig={0x13, 0x12, "a6a8709d251e6a4c70438886819ca8bf"}, @mptcp=@synack={0x1e, 0x10, 0x1, 0x2, 0xe5, 0x1000, 0x6}, @md5sig={0x13, 0x12, "d1ebface2434c6552c453f3279859585"}, @sack={0x5, 0xa, [0x9, 0x1]}]}}}}}}}, 0x0) 38m49.00504316s ago: executing program 1 (id=993): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x7, &(0x7f00000001c0), 0x4) r2 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2f, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @remote, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0xfffffff9}}}, 0x104) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=@allocspi={0x128, 0x16, 0x401, 0x0, 0x0, {{{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x1a}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@mcast2, 0x20000000, 0x33}, @in=@remote}, 0x8, 0xffffffff}, [@migrate={0x4, 0x1b}, @mark={0xc}, @lifetime_val={0x24}]}, 0x128}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), 0x0, 0x0, 0x1) removexattr(&(0x7f0000000200)='./cgroup\x00', &(0x7f0000000240)=@known='user.incfs.metadata\x00') setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000001280)=ANY=[@ANYBLOB="030000000a004e000000000cff010000000000000000000000000001ffffff7f0000000000000000000000000000000010000000000000000000000000000000000000000000006f1334b0dd7b708b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000010000000a004e2500000007fe8000000000000000000000000000aa0900"/268], 0x110) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000040)={@mcast2, @local, @mcast1, 0x1, 0x8, 0x0, 0x180, 0xfffffffffffffffd, 0x2430102, r4}) 38m48.760745611s ago: executing program 32 (id=993): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x7, &(0x7f00000001c0), 0x4) r2 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2f, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @remote, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0xfffffff9}}}, 0x104) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=@allocspi={0x128, 0x16, 0x401, 0x0, 0x0, {{{@in6=@private0, @in=@dev={0xac, 0x14, 0x14, 0x1a}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@mcast2, 0x20000000, 0x33}, @in=@remote}, 0x8, 0xffffffff}, [@migrate={0x4, 0x1b}, @mark={0xc}, @lifetime_val={0x24}]}, 0x128}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), 0x0, 0x0, 0x1) removexattr(&(0x7f0000000200)='./cgroup\x00', &(0x7f0000000240)=@known='user.incfs.metadata\x00') setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000001280)=ANY=[@ANYBLOB="030000000a004e000000000cff010000000000000000000000000001ffffff7f0000000000000000000000000000000010000000000000000000000000000000000000000000006f1334b0dd7b708b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000010000000a004e2500000007fe8000000000000000000000000000aa0900"/268], 0x110) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000040)={@mcast2, @local, @mcast1, 0x1, 0x8, 0x0, 0x180, 0xfffffffffffffffd, 0x2430102, r4}) 25m14.339858866s ago: executing program 3 (id=3907): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000010000000a00000008"], 0x48) r2 = openat$6lowpan_enable(0xffffff9c, &(0x7f0000000380), 0x2, 0x0) write$6lowpan_enable(r2, &(0x7f00000003c0)='0', 0x1) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000002000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) r4 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace00000000000000002100000002ff02000000000000000000000000000104004e200023b0"], 0x0) recvmmsg(r4, &(0x7f00000038c0)=[{{0x0, 0x0, 0x0}, 0x32685768}], 0x1, 0x42, 0x0) modify_ldt$read(0x0, &(0x7f0000000840)=""/4096, 0x1000) move_mount(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f0000002080)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0/file0\x00', 0x44) unshare(0x20040600) unshare(0x24060400) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000000)="4dc07f947163300c", 0x8) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmmsg$inet(r6, &(0x7f00000035c0)=[{{0x0, 0x0, &(0x7f0000002ec0)=[{&(0x7f0000002c80)="7b39d00000", 0x5}], 0x1}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000002f40)="92f0ac0d687fc396c6e3fcb435c1ab468bfbcb101f67fb0a6eaf21f2fc72ec5a03074a7357c6308114ad5b64ecac13598f51c6ae646ab3f0d7b8", 0x3a}], 0x1}}], 0x2, 0x24000884) unshare(0x4020400) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000005b80)={{{@in6=@remote, @in6=@rand_addr=' \x01\x00', 0x4000, 0x0, 0x0, 0x0, 0x2, 0x0, 0xa0, 0x0, 0x0, 0xee00}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x5}}, {{@in, 0x0, 0x2b}, 0x0, @in6=@private2, 0xfffffffd, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffffffff}}, 0xe4) 25m13.749389141s ago: executing program 3 (id=3908): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x109301) ioctl$USBDEVFS_BULK(r0, 0xc0185502, &(0x7f0000000680)={{{0x1, 0x1}}, 0x0, 0x20000000, 0x0}) 25m13.504220614s ago: executing program 3 (id=3909): r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r0, 0x0, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000001f00)) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11894000, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)='\b') madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0x15, @remote, 'bond0\x00'}}, 0x1e) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f0000000040)=0x2) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e21, @local}], 0x10) setsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000), 0x4) sendmsg$inet_sctp(r4, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f00000000c0)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x0) ioctl$PPPIOCBRIDGECHAN(r3, 0x40047435, &(0x7f0000000200)=0x1) sendmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x6) 25m13.033251303s ago: executing program 3 (id=3914): r0 = socket$unix(0x1, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x4c, &(0x7f0000000000), 0x4) bind$unix(r0, &(0x7f0000000040)=@abs={0x1}, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0x10, 0x80000, 0x3) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x8, 0x3}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newqdisc={0x98, 0x24, 0x1, 0x70bd2d, 0x0, {0x0, 0x0, 0x12, 0x0, {0x0, 0x5}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x68, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME_EXTENSION={0xc, 0x9, 0x8}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0xfd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x1, 0x0, 0xfe], 0xff, [0x8, 0x4, 0x0, 0x2, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x1, 0x800, 0x0, 0x8]}}]}}]}, 0x98}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) syz_80211_join_ibss(&(0x7f00000002c0)='wlan0\x00', &(0x7f0000000340)=@default_ap_ssid, 0x6, 0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, 0x0) syz_open_dev$mouse(&(0x7f0000000680), 0x0, 0x14b200) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000400)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r3, &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24004084}, 0x40000) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) 25m11.403162368s ago: executing program 3 (id=3917): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x17ffc, @mcast2, 0x2}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x34000}], 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xc817}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x5c}]}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}}, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x8, 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000000), 0x5, 0x105040) ioctl$USBDEVFS_CLEAR_HALT(r3, 0x80045515, &(0x7f0000000140)={0x0, 0x1}) 25m10.900009892s ago: executing program 3 (id=3918): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='\x00', &(0x7f0000000000), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYRESOCT=r2, @ANYRESDEC=0x0, @ANYRES32=r0, @ANYRESDEC=0x0]) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000009e602206d0414c340000000000109022400010400a000090480000103010100093700086ce82201000905815f"], 0x0) syz_usb_control_io(r5, &(0x7f0000000a80)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2, 0xc, 0x0, 0x8, "b6537c38", "16550349"}}, &(0x7f0000000200)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2e, 0x8, 0x36, 0xe4, 0x9, 0x4, 0x3ff}}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000540)={'syztnl1\x00', 0x0}) read$FUSE(r2, &(0x7f0000006380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000100)={0x50, 0x0, r6, {0x7, 0x1f, 0xffffc000, 0x8000}}, 0x50) syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000e40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r7, 0x3516, 0x0, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r10 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r10, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r10, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r10, 0x6, 0x16, &(0x7f0000000000), 0x20000328) 24m55.663567284s ago: executing program 33 (id=3918): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='\x00', &(0x7f0000000000), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYRESOCT=r2, @ANYRESDEC=0x0, @ANYRES32=r0, @ANYRESDEC=0x0]) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000009e602206d0414c340000000000109022400010400a000090480000103010100093700086ce82201000905815f"], 0x0) syz_usb_control_io(r5, &(0x7f0000000a80)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2, 0xc, 0x0, 0x8, "b6537c38", "16550349"}}, &(0x7f0000000200)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2e, 0x8, 0x36, 0xe4, 0x9, 0x4, 0x3ff}}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000540)={'syztnl1\x00', 0x0}) read$FUSE(r2, &(0x7f0000006380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000100)={0x50, 0x0, r6, {0x7, 0x1f, 0xffffc000, 0x8000}}, 0x50) syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000000e40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r7, 0x3516, 0x0, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r10 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r10, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r10, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r10, 0x6, 0x16, &(0x7f0000000000), 0x20000328) 9.049712018s ago: executing program 5 (id=9416): syz_usb_connect$uac1(0x7, 0x71, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001000000406b1d010140000102030109025f0009000c00f40904000000010100000a24010f000102010209040100000102000009"], 0x0) r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) syz_usb_connect$uac1(0x0, 0xb1, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d010140010102030109029f0003010000000904000000010100000a24010000000201020d24060000030800000031ce21c798329740594c137d0000000c24020201010608000010000c2402000000030000000000092406000601000000092403000000000500092406"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000001000)=ANY=[], 0x0) syz_usb_control_io(r0, &(0x7f0000001380)={0x2c, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0003020000000203"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000007c0)={0x14, 0x0, &(0x7f0000000780)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000600)={0x24, &(0x7f0000000540)=ANY=[@ANYBLOB="200801000000d79afa504d4de7299eb8faae7b20064fb90110fcc4694a365d2c9980e6348cb1a69934062de7669bf2d47d161c1895d664fd8bea387bc1f42e8f0216"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="1e1501"], 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000500)={0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="60080400000000000051fbde"], 0x0, 0x0, 0x0, 0x0, 0x0}) 8.728320881s ago: executing program 6 (id=9420): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001400)=ANY=[@ANYBLOB="180000002c000100000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="634566715b22002a64d675c0d5c0e0bac431c7cc3185e52bdfb610a3db3bfd1e0ad6ee57aa3600269c44a6f0e8beff96f6108700ac87707966b6da521de673d8c1297f42223bf05cf6f94a095be777d3da7ded4fd1ea523227e9b36ff9629fd4dbc044feb081baece3350bbaa77d5bcffc9f4114dbc36ad3918c2de3acfd8fa7be2c857076c8f13f1e36a0ba865b4cd3"], 0x18}], 0x1}, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/seq/clients\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_window_scaling\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f00000000c0)=0x48, 0x5) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f0000000040)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f00000008c0)={0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "d20bddda7d1db9342de76eec7967fe97751f13a23aeaacb0565c1c2251560ed1"}}) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) syz_emit_ethernet(0x57, &(0x7f0000000180)={@broadcast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x49, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x1, 0x1b59, 0x35, 0x0, @opaque="216cfbd55f39bb28e0d10355bbc1396e8b1c4d656fd1dcbb9fc58272985145a936351fddfb533b5024d2b50286"}}}}}, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r5, 0xc05064a7, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000540), 0x0, 0x5, 0x0, 0x0, r6}) writev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23ffbf510040041", 0x2b}], 0x1) readv(r1, &(0x7f0000000180)=[{&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f0000001240)=""/249, 0xf9}, {&(0x7f0000001340)=""/175, 0xaf}], 0x3) r7 = socket$inet6(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000014c0)=@newlink={0xe8, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x1ba00}, [@IFLA_PROP_LIST={0xb8, 0x34, 0x0, 0x1, [{0x14, 0x35, 'veth1_to_team\x00'}, {0xfffffe5f, 0x35, 'macsec0\x00'}, {0x14, 0x35, 'batadv_slave_0\x00'}, {0x14, 0x35, 'pimreg\x00'}, {0x14, 0x35, 'team0\x00'}, {0x14, 0x35, 'veth1_to_hsr\x00'}, {0x14, 0x35, 'veth0_vlan\x00'}, {0x14, 0x35, 'pimreg\x00'}, {0x14}]}, @IFLA_LINK={0x8, 0x5, r9}, @IFLA_LINKMODE={0x5, 0x11, 0x1}]}, 0xe8}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac14140034000800"], 0x2c}}, 0x0) sendto$inet6(r7, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 8.63903657s ago: executing program 6 (id=9422): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'macvtap0\x00'}) sendmsg$nl_route(r0, 0x0, 0x8000002) 8.537832156s ago: executing program 6 (id=9424): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs\x00') pread64(r2, &(0x7f0000000280)=""/86, 0x56, 0x4000000000000f3) preadv(r2, 0x0, 0x0, 0xc9, 0x1) madvise(&(0x7f00005ce000/0x3000)=nil, 0x3000, 0xb) pread64(0xffffffffffffffff, &(0x7f0000000400)=""/154, 0x9a, 0x51) pipe2$watch_queue(0x0, 0x80) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00'}) set_mempolicy(0x3, &(0x7f0000000000)=0x7, 0x7) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NG_TYPE={0x8}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x15}]}}}, {0x14, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}}, 0x0) 7.726878432s ago: executing program 2 (id=9427): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) syz_open_dev$vbi(0x0, 0x0, 0x2) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xea100, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000300)={[0x8000000000000000, 0x100000000, 0x0, 0x20, 0x0, 0x0, 0x2004cc, 0x8000002, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x4000000000000004, 0x767], 0xeeef0000, 0x80}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ee4268873c1c000800a61a00010000000080fbdbdf250a80800900f6", @ANYRESDEC=r0], 0x1c}}, 0x20008884) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$uac1(r6, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="40000600000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) (async) syz_open_dev$vbi(0x0, 0x0, 0x2) (async) socket$packet(0x11, 0x3, 0x300) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xea100, 0x0) (async) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000300)={[0x8000000000000000, 0x100000000, 0x0, 0x20, 0x0, 0x0, 0x2004cc, 0x8000002, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x4000000000000004, 0x767], 0xeeef0000, 0x80}) (async) ioctl$KVM_RUN(r5, 0xae80, 0x0) (async) ioctl$KVM_RUN(r5, 0xae80, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ee4268873c1c000800a61a00010000000080fbdbdf250a80800900f6", @ANYRESDEC=r0], 0x1c}}, 0x20008884) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[], 0x0) (async) syz_usb_control_io$uac1(r6, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="40000600000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) 7.522419351s ago: executing program 6 (id=9428): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000040), 0xa, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000140)={0x0, 0x3131354f, 0x2, @discrete={0x1, 0x401}}) r3 = socket(0x10, 0x803, 0x0) bind$netlink(r3, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbff, 0x8001000}, 0xc) getsockname$packet(r3, 0x0, &(0x7f0000000080)) r4 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r4, 0x0) lseek(r4, 0x0, 0x4) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') pread64(r5, &(0x7f0000000080)=""/196, 0xc4, 0x3) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000001580), 0x0, 0x0) pread64(r6, 0x0, 0x0, 0x5f) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000000010000000000070000009500000000000000f76e5f97ef1abdfc48aa60d2a5df0bca1b89eac5a3e84fd499a92b570cb20385a19c800000000000000054b18d518f"], &(0x7f0000000340)='GPL\x00', 0x7fffffff}, 0x94) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="020e0000180000000000000000000000030005000000000002000000ac1e0001000000000000000003000600000700000200000000000000000000000000000004000400000000000000000000000000000000000000000000000000000000000800120000000200000000000000000006000000000000000000000000000000ff02000000000000000000000000000100000000000000000000000000000000040003"], 0xc0}}, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/bus/input/devices\x00', 0x0, 0x0) read$FUSE(r8, &(0x7f0000004100)={0x2020}, 0x2020) socket$packet(0x11, 0x2, 0x300) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r9, &(0x7f0000003500)=[{{&(0x7f00000006c0)={0xa, 0x0, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4}, 0x1c, &(0x7f00000005c0)=[{&(0x7f0000000600)="81", 0x1}], 0x1}}, {{&(0x7f0000000080)={0xa, 0x4e22, 0x4, @loopback, 0x5}, 0x1c, &(0x7f0000000780), 0x0, 0x0, 0xffffffffffffff62}}], 0x2b, 0x4004851) 6.496504183s ago: executing program 2 (id=9432): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001280)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4, 0x0, 0x10400}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_NUM_TX_QUEUES={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2400c000}, 0xc000) (fail_nth: 3) 6.409563535s ago: executing program 2 (id=9434): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'macvtap0\x00'}) sendmsg$nl_route(r0, 0x0, 0x8000002) 6.266899357s ago: executing program 6 (id=9436): r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x10bf, 0x0, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) r4 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffffffffffff5]}, 0x8, 0x0) ppoll(&(0x7f0000000000)=[{r4, 0x4180}, {r4, 0x100}], 0x2, 0x0, 0x0, 0x0) signalfd4(r4, &(0x7f0000000040)={[0x2]}, 0x8, 0x800) r5 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0) r6 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCSREPORT(r6, 0x400c4808, &(0x7f0000000000)={0x10000003, 0x100, 0x2}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r7 = io_uring_setup(0x2237, &(0x7f0000000880)={0x0, 0xfffffffc, 0x3018, 0x2}) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r7, 0xd, &(0x7f0000000140)={0x7, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r7, 0xe, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000040)=[{0x0}], &(0x7f0000000080)=[0x400000000000], 0x1}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r7, 0xe, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x0, 0x1}, 0x20) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x24, 0x3c, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r1, 0x75fa, 0xe475, 0x0, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000002fc0)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x3, @empty, 0x7}, 0x1c, 0x0}}], 0x1, 0x24000000) 6.232786878s ago: executing program 2 (id=9437): creat(0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0xe000) writev(0xffffffffffffffff, &(0x7f00000022c0)=[{0x0}, {&(0x7f0000002300)="08b5b2c0ca", 0x5}], 0x2) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) recvmmsg(r0, &(0x7f00000002c0), 0x220, 0x100, 0x0) (fail_nth: 7) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(0xffffffffffffffff, 0xc0485510, 0x0) execve(0x0, 0x0, 0x0) socket(0xa, 0x1, 0x0) 5.832171685s ago: executing program 2 (id=9440): mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r1, 0x0, 0x48010) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000003c0)={0x14, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0x4}]}}, 0x0}, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) socket$kcm(0x11, 0x2, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000800}, 0x8d0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x3, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) ioctl$EVIOCSCLOCKID(r2, 0x400445a0, &(0x7f0000000100)=0xb7) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r3, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 5.632850053s ago: executing program 5 (id=9441): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000000)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) set_mempolicy_home_node(&(0x7f0000634000/0x4000)=nil, 0x4000, 0x3, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200), 0x111}}, 0x20) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000100), 0x0, 0x80405, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000b64000/0x1000)=nil, 0x1000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000003, 0x50032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x2, 0x3, 0x1, 0x0, 0x35}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) r7 = accept4(r6, 0x0, 0x0, 0x0) sendto$packet(r7, &(0x7f00000002c0)="48357e0287af48ffa745b497a54e0eec1bf2c69011f35b48339d15afaef1bd7efe075ff441b16e244b8b05fe09e29583ad142567826dfa5cbc6f979b050015bde8c4441cd0fa6be03213181bfe84743015ec12ced8b1aa8f44e5c30afac6f9fd2ab1303be0d1b2c02533bcc97cce7da9b507b053b11821323590d379e9e350a3291fbedb6382de878b7a56e4e38c7f746d0424029f5d49b04697a4", 0xfffffffffffffcf6, 0xf0ff, 0x0, 0x0) 5.511867571s ago: executing program 4 (id=9442): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{0x0}, {&(0x7f0000000340)=""/97, 0x61}], 0x2}, 0x7f}], 0x1, 0x10002, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES16], 0x48}, 0x1, 0x0, 0x0, 0x8000010}, 0x20004801) 5.276190395s ago: executing program 4 (id=9443): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{0x6, 0x0, 0x600}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options]}, 0x24}}, 0x4004080) 5.078602652s ago: executing program 4 (id=9444): r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) sendmmsg$sock(r0, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=[@mark={{0x10, 0x1, 0x4f, 0x3}}], 0x10}}, {{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="9839d2725e89707ab86df400b1a63164b358b1fb800f9c1de38a67e2c23ea09b29c0cc9fc925d113518a16010fb565561ee4d6d290e3ff9ab706f14074d0908c54526d79fd94a63f3b2f0c451b379fb60edbdc1b995ce6ee352ed2ac60d8cd0e57c94b46a17335488485f893a45a7c2d3235c8880b9bf0919ac7ebaaa7f65d61fa380b9a1a0fa22608e9cad607b6a5b135160ca29706e767729b0b165792372822f9a736710ccfd5bc6ac249776159d336eb", 0xb2}, {&(0x7f00000000c0)="2586b32d76e61c096ae3bc84428aa5fe4a5169831dbd029db8a44b46db380f7923b2707371b4a55b4e7b349958cb", 0x2e}, {&(0x7f0000000180)="07ced8b00f941a0b2e12812e756289cb459e94567411ad39196d883e3fd26277e01f58319d3523a06c317311fc0785ea0bbede49b2666bb5f0fee4af1293775548b7d366850b360e6377437421861ac62507eae2183103e5e5c0a4abba10317740921199df403da62b28d37390", 0x6d}, {&(0x7f0000000200)="483d7c17c40cecef42f16bfb3b639bc0449f3ceb989f1d9ed77a53cbee8566207c13270ed291da27a33cf02dc0f4ce874585c11f35a8702be71de87dcce720f5f14450fbb1891a9728cddaed7bd9e735a1cea47606abef3a0a7bca408937983dcfc281a2a5164df62f5862bd32c8a1c5a3ac5f293bc35ad8c2c3949a33b06501847081", 0x83}], 0x4, &(0x7f0000000380)=[@timestamping={{0x10, 0x1, 0x25, 0x1ff}}, @timestamping={{0x10, 0x1, 0x25, 0x4}}, @timestamping={{0x10, 0x1, 0x25, 0x2}}, @timestamping={{0x10, 0x1, 0x25, 0xa}}, @txtime={{0x14, 0x1, 0x3d, 0x4}}, @txtime={{0x14}}, @txtime={{0x14}}, @mark={{0x10, 0x1, 0x24, 0xd}}], 0x8c}}], 0x2, 0x20000000) 4.846412745s ago: executing program 4 (id=9445): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000000)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) set_mempolicy_home_node(&(0x7f0000634000/0x4000)=nil, 0x4000, 0x3, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200), 0x111}}, 0x20) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000100), 0x0, 0x80405, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000b64000/0x1000)=nil, 0x1000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000003, 0x50032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x2, 0x3, 0x1, 0x0, 0x35}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000740)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64-generic\x00'}, 0x58) r6 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendto$packet(r6, &(0x7f00000002c0)="48357e0287af48ffa745b497a54e0eec1bf2c69011f35b48339d15afaef1bd7efe075ff441b16e244b8b05fe09e29583ad142567826dfa5cbc6f979b050015bde8c4441cd0fa6be03213181bfe84743015ec12ced8b1aa8f44e5c30afac6f9fd2ab1303be0d1b2c02533bcc97cce7da9b507b053b11821323590d379e9e350a3291fbedb6382de878b7a56e4e38c7f746d0424029f5d49b04697a4", 0xfffffffffffffcf6, 0xf0ff, 0x0, 0x0) 3.376159831s ago: executing program 0 (id=9447): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'macvtap0\x00'}) sendmsg$nl_route(r0, 0x0, 0x8000002) 3.283699141s ago: executing program 5 (id=9448): openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{0x0}, {&(0x7f0000000340)=""/97, 0x61}], 0x2}, 0x7f}], 0x1, 0x10002, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x6) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000004c0)={0x79, 0x0, 0x35}) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES16], 0x48}, 0x1, 0x0, 0x0, 0x8000010}, 0x20004801) r2 = openat$hwrng(0xffffff9c, &(0x7f0000000540), 0x270100, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000580)=0x1, 0x4) openat$binfmt(0xffffff9c, 0x0, 0x41, 0x1ff) r3 = openat$binfmt(0xffffff9c, 0x0, 0x41, 0x1ff) close$binfmt(r3) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) 3.206851973s ago: executing program 0 (id=9449): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000002d00)=[{{0x0, 0x0, 0x0, 0x2000}, 0x8103}, {{0x0, 0x0, 0x0}, 0x10000}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000001300)=""/193, 0xc1}, {&(0x7f0000000000)=""/261, 0x105}, {&(0x7f0000003d40)=""/4097, 0x1001}], 0x3}, 0x80000000}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, &(0x7f0000001280)=[{&(0x7f0000000440)=""/244, 0xf4}, {&(0x7f0000006080)=""/4111, 0x100f}, {&(0x7f0000001ac0)=""/4112, 0x1010}, {&(0x7f00000011c0)=""/158, 0x9e}], 0x4}, 0x20000f}, {{0x0, 0x0, 0x0}, 0x9}], 0x8, 0x20, 0x0) 3.011185211s ago: executing program 0 (id=9450): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000bc0)=@bridge_getlink={0x28, 0x12, 0x201, 0x70bd25, 0x25dfdbfd, {0x7, 0x0, 0x0, 0x0, 0x8900, 0x1000}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x80}]}, 0x28}, 0x1, 0xffffffff, 0x0, 0x8080}, 0x80) 2.978273467s ago: executing program 6 (id=9451): pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002, 0x2000}, 0x1c) r2 = syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x200000, 0x0, 0x0, 0x0, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x1010, r2, 0xbf416000) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='\x00', 0x81101) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) open_tree(r3, &(0x7f0000000640)='\x00', 0x89901) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000810087406d040e0a759400000001090212000100000000090400200003"], 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000080)={'syz0\x00', {}, 0x0, [0x80000000, 0x3, 0x3ff, 0x8, 0xfffffffd, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5248, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xffffffff, 0x10000000, 0x99, 0x20000000, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x1], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x0, 0x5ee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0xa0000000, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffff8, 0x2, 0x0, 0x2000079, 0x400, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4771], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4], [0x2, 0x0, 0x6, 0x0, 0x0, 0x3, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x4, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x10c, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) connect$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r6, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000000180)={0x50, 0x0, r7, {0x7, 0x29, 0x0, 0xffffffff85000014, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x50) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x4b) syz_fuse_handle_req(r6, &(0x7f00000042c0), 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r6, &(0x7f00000067c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b00", 0x2000, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="780000000000000002000000000000040000000000000000000000000000000004"], 0x0, 0x0, 0x0, 0x0}) getdents(r8, &(0x7f0000000700)=""/90, 0x5a) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090000006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd7, 0x1, 0x0, 0x0) 2.7876882s ago: executing program 0 (id=9452): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000000)={@link_local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x30, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @dev, @dev, [{0x2, 0x1, "1d6ace8f8ca9"}]}}}}}}, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'veth0_to_hsr\x00', 0x400}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') fchdir(r2) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) lseek(r3, 0x1, 0x0) getdents(r3, 0x0, 0x58) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_80211_inject_frame(&(0x7f0000000000), 0x0, 0x3bb) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) close(0x3) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0xc008ae09, &(0x7f0000000240)=ANY=[@ANYBLOB="0100000000000000010000000400000006000000010000"]) mlock(&(0x7f0000a38000/0x1000)=nil, 0x1000) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f000043b000/0x1000)=nil, 0xfffffffffffffdb5, &(0x7f0000000080)='\x00\xc9\xf5\x00\x00\x00\x00\x00\x00\x00+\x1ct\xc6\fr\xbaU\xc1\xb2\xd2\xde\xbfk\xc0\x18\x94\xc5&\xec\x03\xa0w\"E\xc9\xf2,K4\x10\xc8\x8cuj\xd3\xf0\xb3\xa9f\xf7\xb7\x17\xdf\xca\xac\x8b\x81K\t\x14^\xc3\xb7<\xa1\x15\v4\xd0\xbe\xa8\x01\x00<:-Y\n<\x1d\xb2\xe0kU\xc0\xc1\x14') openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0xe4ffffff00000000, &(0x7f0000004440)=@base={0x4, 0x4, 0x4, 0x40007, 0x4, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) 2.455243268s ago: executing program 5 (id=9453): openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{0x0}, {&(0x7f0000000340)=""/97, 0x61}], 0x2}, 0x7f}], 0x1, 0x10002, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x6) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000004c0)={0x79, 0x0, 0x35}) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES16], 0x48}, 0x1, 0x0, 0x0, 0x8000010}, 0x20004801) r2 = openat$hwrng(0xffffff9c, &(0x7f0000000540), 0x270100, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000580)=0x1, 0x4) openat$binfmt(0xffffff9c, 0x0, 0x41, 0x1ff) r3 = openat$binfmt(0xffffff9c, 0x0, 0x41, 0x1ff) close$binfmt(r3) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) unshare(0x22020600) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r5 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000080)="bc5dfc", 0x3, 0xfffffffffffffffe) r6 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r5, r6, r5}, 0x0, 0x0, 0x0) add_key$user(&(0x7f0000000000), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000600)="7f8c167ba9c3ccb94805e9f6c5a32b8f897c90552a2dc4ff47109246812577fa33882671bb6374249276bc7a7b8f816bfef61aabb61f57016356e1b089ece2f160a8926e206cd7aa5dd2c309bace065bdf442ec17a3f7695db9cf822b68667203be55d9ca6dbaab9fdb5cabbc746ef7ea087c1a441652d665e18dc3e66a3ca4187b3eab1878fb1aba5627f", 0x8b, 0xfffffffffffffff8) 1.9164718s ago: executing program 5 (id=9454): r0 = creat(0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000001c0)={0x0, 0x81}, &(0x7f0000000200)=0x8) sendmsg$NL80211_CMD_GET_KEY(r3, &(0x7f0000003180)={0x0, 0x0, &(0x7f0000003140)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010025bd7000fbdbdf250900000008000300", @ANYRES32=r5, @ANYBLOB], 0x24}}, 0x84) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, r4, 0x2e62c9b07f3b276d, 0x70bd29, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x1, 0x7b}}}}, ["", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4000805}, 0x4000) unshare(0x22020400) r6 = fsopen(&(0x7f0000000000)='9p\x00', 0x1) fsconfig$FSCONFIG_SET_BINARY(r6, 0x2, &(0x7f0000000140)='/&\x00', &(0x7f0000000180)="5b3b9b67", 0x4) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000880)={0x28, 0x3e, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@nested={0x4, 0x12}, @nested={0xd, 0x1, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @uid=0xee00}, @generic="b4"]}]}, 0x28}}, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0xe000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x24, 0x68, 0x309, 0x0, 0x9f, {}, [@NHA_BLACKHOLE={0x4}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x24}}, 0x0) writev(0xffffffffffffffff, &(0x7f00000022c0)=[{0x0}, {&(0x7f0000002300)="08b5b2c0ca", 0x5}], 0x2) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=ANY=[@ANYBLOB="6c00000000010104000000000000000002000000240001801400018008000100ffffffff08000200ac1414000c00028005000100000000002400028014000180080001"], 0x6c}}, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0x101a02, 0x0) userfaultfd(0x801) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) connect$inet6(r8, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) recvmmsg(r8, &(0x7f00000002c0), 0x220, 0x100, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(0xffffffffffffffff, 0xc0485510, 0x0) execve(0x0, 0x0, 0x0) socket(0xa, 0x1, 0x0) 1.583801275s ago: executing program 4 (id=9455): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f0000000240)={'tunl0\x00', 0x0}) writev(0xffffffffffffffff, &(0x7f0000000340)=[{0x0}, {0x0}], 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) syz_clone3(&(0x7f00000000c0)={0x200000400, 0x0, 0x0, 0x0, {0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, {r3}}, 0x58) sendto$inet(r1, 0x0, 0x0, 0x24000840, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) syz_emit_ethernet(0x76, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb080045f00068000000000006907884c6243ffab3814d00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5c100000907800011312a6a8709d251e6a4c70438886819ca8bf1e1021e50010000000000000060000001312d1ebface2434c6552c453f3279859585050a00000009000000010000"], 0x0) 1.473688713s ago: executing program 5 (id=9456): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x8) r1 = dup(r0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000380)=0x1, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) gettid() prctl$PR_MCE_KILL_GET(0x22) mkdir(0x0, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x2000000000001}}, 0x30) r5 = socket(0x10, 0x80002, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010e7010000000000000000000000000a20000000000a03000000000000000000070000000c00044000000000000000021c000000090a010400000000000000000700000008000a"], 0x64}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0xfffffffffffffe47, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x40d, 0x70bd25, 0x25ffdbfc, {0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_HELLO_TIME={0x8, 0x2, 0x6}, @IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x84}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg$alg(r5, &(0x7f00000000c0), 0x492492492492627, 0x0) 1.371528438s ago: executing program 2 (id=9457): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x1c, &(0x7f00000002c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x14}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') preadv(r1, &(0x7f0000000340)=[{&(0x7f0000000440)=""/123, 0x7b}], 0x1, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'team0\x00'}) r4 = open(&(0x7f0000000280)='.\x00', 0x141080, 0x0) fcntl$notify(r4, 0x402, 0x8000003d) syz_usb_connect(0x3, 0x1a, &(0x7f00000002c0)={{0x12, 0x1, 0x201, 0x2a, 0xcd, 0x75, 0x10, 0x4e8, 0x6601, 0x3ef0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4b, 0x1, 0x80, 0x5, [{{0x9, 0x4, 0xd5, 0x3, 0x0, 0xcb, 0x7f, 0x44, 0xf}}]}}]}}, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0}) syz_open_dev$loop(&(0x7f000000d940), 0x4, 0x40) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f00000003c0)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r5, @ANYBLOB="05", @ANYRES16=r5, @ANYRES64=r5], 0x0) syz_usb_connect(0x4, 0x0, 0x0, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0xf0ff}}]}) r6 = syz_open_dev$evdev(&(0x7f0000001540), 0x0, 0x0) ioctl$EVIOCGLED(r6, 0x5452, &(0x7f0000000240)=""/77) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x57, 0x0, 0x0, {0xfffe, 0x1}, {0x74, 0x2}, @const={0x6, {0x7f, 0x0, 0x8000, 0xfffd}}}) r7 = syz_open_dev$evdev(&(0x7f00000000c0), 0x78, 0x822b01) write$char_usb(r7, &(0x7f0000000040)="e2", 0x1068) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r8, r8, 0x0) r9 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r10 = fanotify_init(0x200, 0x0) fanotify_mark(r10, 0x1, 0x40000001, r9, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r4) 1.045293561s ago: executing program 4 (id=9458): sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) socket$igmp6(0xa, 0x3, 0x2) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x40400c5}, 0x80) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x40c}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) syz_open_dev$sndmidi(0x0, 0x2, 0x141581) r3 = dup(0xffffffffffffffff) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$DRM_IOCTL_GET_MAP(r3, 0xc0286404, &(0x7f0000000140)={&(0x7f0000329000/0x4000)=nil}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, 0x0, 0x0) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0xfffffb07, @local, 0x680}, 0x1c) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x2002, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r8, @ANYBLOB="0c00990000000000000000000800a000ea15000008009f0003000000080026000816"], 0x40}}, 0x0) write$rfkill(r5, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) socket$nl_generic(0x10, 0x3, 0x10) socket(0x6, 0x3, 0x0) 101.837648ms ago: executing program 0 (id=9459): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'macvtap0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) 0s ago: executing program 0 (id=9460): r0 = socket$inet_sctp(0x2, 0x1, 0x84) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dc58c", 0x14, 0x6, 0x0, @local, @local, {[], {{0xfffe, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0xfffd}}}}}}}, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x2b, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e21, 0x3, 'wrr\x00', 0x1, 0x81, 0x5}, {@rand_addr=0xac1414aa, 0x4e23, 0x10000, 0x1cb, 0x12d5b, 0x12d5c}}, 0x44) r1 = socket$nl_generic(0x10, 0x3, 0x10) openat$qrtrtun(0xffffff9c, &(0x7f00000002c0), 0x8000) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x108, r2, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond_slave_1\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@dev={0xac, 0x14, 0x14, 0x3f}}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfa9f}]}, 0x108}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) kernel console output (not intermixed with test programs): .535690][T26035] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 62, changing to 9 [ 2515.556212][ T7197] "syz.2.8949" (7197) uses obsolete ecb(arc4) skcipher [ 2515.603888][T26035] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2515.627266][T26035] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2515.667894][T26035] usb 7-1: Product: syz [ 2515.701124][T26035] usb 7-1: Manufacturer: syz [ 2515.705779][T26035] usb 7-1: SerialNumber: syz [ 2515.764746][T26035] usb 7-1: bad CDC descriptors [ 2515.974095][T24236] Bluetooth: hci5: SCO packet for unknown connection handle 200 [ 2516.061059][ T979] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 2516.237474][ T979] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2516.261136][ T979] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 62, changing to 9 [ 2516.278058][ T979] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2516.290346][ T979] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2516.304468][ T979] usb 3-1: Product: syz [ 2516.308740][ T979] usb 3-1: Manufacturer: syz [ 2516.315138][ T979] usb 3-1: SerialNumber: syz [ 2516.327128][ T979] usb 3-1: bad CDC descriptors [ 2516.481165][T26035] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 2516.493728][ T979] usb 7-1: USB disconnect, device number 44 [ 2516.643074][T26035] usb 6-1: Using ep0 maxpacket: 8 [ 2516.755981][ T7219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2516.809367][ T7219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2517.046272][T27737] usb 3-1: USB disconnect, device number 73 [ 2517.062902][ T7225] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8957'. [ 2517.713437][T26035] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2517.745086][T26035] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 2517.807708][T26035] usb 6-1: can't read configurations, error -71 [ 2517.820168][ T7237] "syz.5.8961" (7237) uses obsolete ecb(arc4) skcipher [ 2519.411447][ T7270] "syz.0.8973" (7270) uses obsolete ecb(arc4) skcipher [ 2519.491107][T26035] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 2519.664374][T26035] usb 6-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 2519.673860][T26035] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2519.721994][T26035] usb 6-1: Product: syz [ 2519.731047][T26035] usb 6-1: Manufacturer: syz [ 2519.735717][T26035] usb 6-1: SerialNumber: syz [ 2519.778010][ T30] kauditd_printk_skb: 692 callbacks suppressed [ 2519.778028][ T30] audit: type=1800 audit(1755087140.852:17630): pid=7276 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.8975" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 2519.811653][T26035] usb 6-1: config 0 descriptor?? [ 2519.836127][T26035] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 2520.246516][ T5984] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 2520.288692][ T30] audit: type=1400 audit(1755087141.362:17631): apparmor="DENIED" operation="setprocattr" info="exec" error=-22 profile="unconfined" pid=7281 comm="syz.2.8978" [ 2520.478743][ T5984] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 2520.488211][ T5984] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2520.524210][ T5984] usb 7-1: Product: syz [ 2520.529934][ T5984] usb 7-1: Manufacturer: syz [ 2520.538998][ T5984] usb 7-1: SerialNumber: syz [ 2520.551258][ T979] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 2520.600343][ T5984] usb 7-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 2520.664738][T26035] gspca_sunplus: reg_r err -71 [ 2520.669834][T26035] sunplus 6-1:0.0: probe with driver sunplus failed with error -71 [ 2520.693058][ T979] usb 3-1: device descriptor read/64, error -71 [ 2520.695614][T26035] usb 6-1: USB disconnect, device number 42 [ 2520.704390][T18030] usb 7-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 2520.971450][ T979] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 2521.225911][ T7280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2521.235716][ T7280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2521.251243][ T979] usb 3-1: device descriptor read/64, error -71 [ 2521.275635][ T7280] bridge0: entered promiscuous mode [ 2521.285484][ T7280] bond0: entered promiscuous mode [ 2521.290862][ T7280] bond_slave_0: entered promiscuous mode [ 2521.310569][ T7280] bond_slave_1: entered promiscuous mode [ 2521.331863][ T7280] debugfs: 'hsr1' already exists in 'hsr' [ 2521.348418][ T7280] Cannot create hsr debugfs directory [ 2521.356295][ T7280] hsr1: entered allmulticast mode [ 2521.365668][ T7280] bridge0: entered allmulticast mode [ 2521.371898][ T979] usb usb3-port1: attempt power cycle [ 2521.432067][ T7280] bond0: entered allmulticast mode [ 2521.448588][ T7280] bond_slave_0: entered allmulticast mode [ 2521.467876][ T7280] bond_slave_1: entered allmulticast mode [ 2521.542768][ T7280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2521.604681][ T7280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2521.711103][ T979] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 2521.731956][ T979] usb 3-1: device descriptor read/8, error -71 [ 2521.991032][ T7280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2522.011219][ T979] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 2522.021598][T26035] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 2522.074473][ T7280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2522.089128][ T979] usb 3-1: device descriptor read/8, error -71 [ 2522.172065][T18030] ath9k_htc 7-1:1.0: ath9k_htc: Target is unresponsive [ 2522.179659][T18030] ath9k_htc: Failed to initialize the device [ 2522.226799][ T979] usb usb3-port1: unable to enumerate USB device [ 2522.282717][ T7280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2522.298238][ T7280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2522.311858][T26035] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 2522.328645][T18030] usb 7-1: ath9k_htc: USB layer deinitialized [ 2522.352068][T26035] usb 5-1: can't read configurations, error -61 [ 2522.380229][T18030] usb 7-1: USB disconnect, device number 45 [ 2522.501279][T26035] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 2522.743723][T26035] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 2522.751533][T26035] usb 5-1: can't read configurations, error -61 [ 2522.758461][T26035] usb usb5-port1: attempt power cycle [ 2523.141321][T26035] usb 5-1: new full-speed USB device number 26 using dummy_hcd [ 2523.171224][T18030] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 2523.172738][T26035] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 2523.172776][T26035] usb 5-1: can't read configurations, error -61 [ 2523.301085][T26035] usb 5-1: new full-speed USB device number 27 using dummy_hcd [ 2523.321212][T18030] usb 6-1: Using ep0 maxpacket: 8 [ 2523.324230][T26035] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 2523.333211][T18030] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2523.334675][T26035] usb 5-1: can't read configurations, error -61 [ 2523.351246][T18030] usb 6-1: config 0 has no interfaces? [ 2523.358502][T18030] usb 6-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 2523.361117][T26035] usb usb5-port1: unable to enumerate USB device [ 2523.480877][T18030] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2523.510763][T18030] usb 6-1: config 0 descriptor?? [ 2523.895983][T26035] usb 6-1: USB disconnect, device number 43 [ 2524.383251][ T7338] tipc: Enabled bearer , priority 0 [ 2524.412360][ T7338] syzkaller0: entered promiscuous mode [ 2524.427108][ T7338] syzkaller0: entered allmulticast mode [ 2524.755265][ T7338] tipc: Resetting bearer [ 2525.276699][ T7348] syz_tun: entered allmulticast mode [ 2525.289977][ T7348] dvmrp1: entered allmulticast mode [ 2525.298820][ T7347] syz_tun: left allmulticast mode [ 2525.311089][T26035] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 2525.631233][ T5931] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 2525.663000][T26035] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2525.672028][T26035] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 2525.692171][T26035] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2525.701359][T26035] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 2525.721033][T26035] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 2525.750762][T26035] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2525.761549][T26035] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2525.771629][T26035] usb 3-1: Product: syz [ 2525.775925][T26035] usb 3-1: Manufacturer: syz [ 2525.797330][T26035] cdc_wdm 3-1:1.0: skipping garbage [ 2525.811136][ T5931] usb 7-1: Using ep0 maxpacket: 32 [ 2525.815225][T26035] cdc_wdm 3-1:1.0: skipping garbage [ 2525.828087][ T5931] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2525.905147][T26035] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 2525.921045][ T5931] usb 7-1: config 0 has no interfaces? [ 2525.925638][T26035] cdc_wdm 3-1:1.0: Unknown control protocol [ 2525.937982][ T5931] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2525.994210][ T5931] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2526.008662][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 2526.015280][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 2526.021849][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 2526.028549][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 2526.034815][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 2526.041410][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 2526.047778][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 2526.054371][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 2526.060886][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 2526.067512][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 2526.069255][ T5931] usb 7-1: config 0 descriptor?? [ 2526.074132][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 2526.085379][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 2526.101342][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 2526.108234][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 2526.114667][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 2526.121302][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 2526.127664][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 2526.134253][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 2526.140506][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 2526.147108][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 2526.154145][T26035] usb 3-1: USB disconnect, device number 78 [ 2526.160083][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 2526.201220][T18030] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 2526.322153][ T7337] tipc: Resetting bearer [ 2526.392357][ T7337] tipc: Disabling bearer [ 2526.392654][T18030] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2526.458596][T18030] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 62, changing to 9 [ 2526.558131][T18030] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2526.577621][T18030] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2526.616137][T18030] usb 6-1: Product: syz [ 2526.631066][T18030] usb 6-1: Manufacturer: syz [ 2526.644823][T18030] usb 6-1: SerialNumber: syz [ 2526.679072][T18030] usb 6-1: bad CDC descriptors [ 2526.706554][ T7367] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9001'. [ 2527.504504][T18030] usb 6-1: USB disconnect, device number 44 [ 2527.931612][T18030] usb 6-1: new full-speed USB device number 45 using dummy_hcd [ 2528.133372][T18030] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2528.147338][T18030] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2528.158556][ T7384] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9007'. [ 2528.167612][T18030] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2528.183989][T18030] usb 6-1: config 0 descriptor?? [ 2528.571906][ T979] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 2528.596980][ T7401] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9013'. [ 2528.619471][T18030] ath6kl: Failed to read usb control message: -71 [ 2528.631049][T18030] ath6kl: Unable to read the bmi data from the device: -71 [ 2528.638485][T18030] ath6kl: Unable to recv target info: -71 [ 2528.656845][T18030] ath6kl: Failed to init ath6kl core: -71 [ 2528.667868][T18030] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 2528.697432][T18030] usb 6-1: USB disconnect, device number 45 [ 2528.745693][ T979] usb 5-1: config 0 has no interfaces? [ 2528.752368][ T979] usb 5-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 2528.762021][ T979] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2528.773462][ T979] usb 5-1: config 0 descriptor?? [ 2528.929486][T18030] usb 7-1: USB disconnect, device number 46 [ 2529.057651][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 2529.064394][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 2529.109416][ T7409] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9008'. [ 2529.312621][T18030] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 2529.572990][T18030] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2529.597878][T18030] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 62, changing to 9 [ 2529.616188][T18030] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2529.626654][T18030] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2529.986872][T18030] usb 7-1: Product: syz [ 2529.996386][T18030] usb 7-1: Manufacturer: syz [ 2530.004209][T18030] usb 7-1: SerialNumber: syz [ 2530.071569][T18030] usb 7-1: bad CDC descriptors [ 2530.276508][T24236] Bluetooth: hci5: SCO packet for unknown connection handle 200 [ 2530.767292][T18030] usb 5-1: USB disconnect, device number 28 [ 2530.994656][T18030] usb 7-1: USB disconnect, device number 47 [ 2531.010724][ T5984] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 2531.183326][ T5984] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2531.193894][ T5984] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 2531.204610][ T5984] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 2531.222198][ T5984] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2531.227531][ T7431] random: crng reseeded on system resumption [ 2531.235851][ T5984] usb 3-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 2531.252076][ T5984] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2531.274208][ T5984] usb 3-1: config 0 descriptor?? [ 2531.568370][ T1212] usb 3-1: USB disconnect, device number 79 [ 2531.574426][T26035] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 2531.791119][T26035] usb 7-1: Using ep0 maxpacket: 32 [ 2531.798289][T26035] usb 7-1: config 0 has an invalid interface number: 146 but max is 0 [ 2531.807137][T26035] usb 7-1: config 0 has no interface number 0 [ 2531.815299][T26035] usb 7-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2531.837427][T26035] usb 7-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 2531.863142][T26035] usb 7-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 2531.973327][T26035] usb 7-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 2532.061307][T26035] usb 7-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 2532.171653][T26035] usb 7-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2532.182226][T26035] usb 7-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 2532.220064][T26035] usb 7-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 19968, setting to 1024 [ 2532.232593][T26035] usb 7-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 2532.246411][T26035] usb 7-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 2532.264598][T26035] usb 7-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 2532.274340][T26035] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2532.294435][T26035] usb 7-1: Product: syz [ 2532.298689][T26035] usb 7-1: Manufacturer: syz [ 2532.307053][T26035] usb 7-1: SerialNumber: syz [ 2532.321381][ T979] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 2532.322784][T26035] usb 7-1: config 0 descriptor?? [ 2532.354052][ T7431] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 2532.442583][ T7431] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 2532.506893][ T979] usb 5-1: Using ep0 maxpacket: 32 [ 2532.530683][ T979] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2532.544626][T26035] microtek usb (rev 0.4.3): will this work? Response EP is not usually 3 [ 2532.559291][ T979] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2532.575594][ T979] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2532.576017][T26035] microtek usb (rev 0.4.3): will this work? Image data EP is not usually 2 [ 2532.617561][ T979] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2532.621834][T26035] scsi host1: microtekX6 [ 2532.809358][ T979] usb 5-1: config 0 descriptor?? [ 2532.819453][ T979] hub 5-1:0.0: USB hub found [ 2533.038970][ T979] hub 5-1:0.0: 1 port detected [ 2533.249464][ T7441] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2533.272015][ T7441] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2533.340401][ T979] hub 5-1:0.0: hub_hub_status failed (err = -71) [ 2533.346997][ T979] hub 5-1:0.0: config failed, can't get hub status (err -71) [ 2533.388399][ T979] usbhid 5-1:0.0: can't add hid device: -71 [ 2533.447517][ T979] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2533.512210][ T979] usb 5-1: USB disconnect, device number 29 [ 2533.713298][ T5984] usb 7-1: USB disconnect, device number 48 [ 2534.321146][ T5984] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 2534.421195][T26035] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 2534.471084][ T5984] usb 6-1: Using ep0 maxpacket: 32 [ 2534.556316][ T5984] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2534.604209][ T5984] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 2534.632695][ T5984] usb 6-1: can't read configurations, error -71 [ 2534.783320][T26035] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2534.795434][T26035] usb 5-1: config 7 has an invalid interface number: 174 but max is 0 [ 2534.818113][T26035] usb 5-1: config 7 has no interface number 0 [ 2534.846281][T26035] usb 5-1: config 7 interface 174 has no altsetting 0 [ 2534.876360][T26035] usb 5-1: New USB device found, idVendor=04dd, idProduct=9031, bcdDevice=92.f8 [ 2534.900338][T26035] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2534.961986][T26035] usb 5-1: Product: syz [ 2534.977040][T26035] usb 5-1: Manufacturer: syz [ 2534.999812][T26035] usb 5-1: SerialNumber: syz [ 2535.249052][T26035] zaurus 5-1:7.174: More than one union descriptor, skipping ... [ 2535.257984][T26035] usb 5-1: bad CDC descriptors [ 2535.270672][T26035] usb 5-1: USB disconnect, device number 30 [ 2537.761549][ T5984] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 2537.911043][ T5984] usb 3-1: Using ep0 maxpacket: 32 [ 2537.927431][ T5984] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2537.947431][ T5984] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2537.951090][T26035] usb 7-1: new full-speed USB device number 49 using dummy_hcd [ 2537.961031][ T5984] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2537.984592][ T5984] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2538.015542][ T5984] usb 3-1: config 0 descriptor?? [ 2538.032605][ T5984] hub 3-1:0.0: USB hub found [ 2538.101104][T26035] usb 7-1: device descriptor read/64, error -71 [ 2538.278724][ T5984] hub 3-1:0.0: 1 port detected [ 2538.341254][T26035] usb 7-1: new full-speed USB device number 50 using dummy_hcd [ 2538.444768][ T7528] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2538.460931][ T7528] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2538.481196][ T5984] hub 3-1:0.0: hub_hub_status failed (err = -71) [ 2538.499568][ T5984] hub 3-1:0.0: config failed, can't get hub status (err -71) [ 2538.511446][T26035] usb 7-1: device descriptor read/64, error -71 [ 2538.534158][ T5984] usbhid 3-1:0.0: can't add hid device: -71 [ 2538.540531][ T5984] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 2538.582552][ T5984] usb 3-1: USB disconnect, device number 80 [ 2538.645616][T26035] usb usb7-port1: attempt power cycle [ 2538.701328][ T979] usb 5-1: new full-speed USB device number 31 using dummy_hcd [ 2538.865584][ T979] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2538.878740][ T979] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2538.910469][ T979] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 2538.923130][ T979] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2539.011553][T26035] usb 7-1: new full-speed USB device number 51 using dummy_hcd [ 2539.054710][T26035] usb 7-1: device descriptor read/8, error -71 [ 2539.153158][ T979] usb 5-1: GET_CAPABILITIES returned 0 [ 2539.158701][ T979] usbtmc 5-1:16.0: can't read capabilities [ 2539.321619][T26035] usb 7-1: new full-speed USB device number 52 using dummy_hcd [ 2539.345456][T26035] usb 7-1: device descriptor read/8, error -71 [ 2539.400570][ T7551] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2539.409697][ T7551] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2539.425993][ T7551] ptrace attach of "./syz-executor exec"[7563] was attempted by "./syz-executor exec"[7551] [ 2539.466655][T26035] usb usb7-port1: unable to enumerate USB device [ 2539.521123][ T1212] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 2539.531510][T27737] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 2539.678735][ T1212] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 2539.688081][ T1212] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2539.696600][T27737] usb 3-1: Using ep0 maxpacket: 16 [ 2539.701973][ T1212] usb 6-1: Product: syz [ 2539.706352][ T1212] usb 6-1: Manufacturer: syz [ 2539.711301][ T1212] usb 6-1: SerialNumber: syz [ 2539.717383][T27737] usb 3-1: config 0 has an invalid interface number: 123 but max is 0 [ 2539.733065][T27737] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2539.743628][T27737] usb 3-1: config 0 has no interface number 0 [ 2539.751890][ T1212] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 2539.761798][T27737] usb 3-1: config 0 interface 123 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1024 [ 2539.780890][T27737] usb 3-1: config 0 interface 123 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2539.806839][T26035] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 2539.817939][T27737] usb 3-1: config 0 interface 123 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 2539.839924][T27737] usb 3-1: New USB device found, idVendor=04b8, idProduct=0521, bcdDevice=68.25 [ 2539.851615][T27737] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2539.859848][T27737] usb 3-1: Product: syz [ 2539.865284][T27737] usb 3-1: Manufacturer: syz [ 2539.870054][T27737] usb 3-1: SerialNumber: syz [ 2539.897965][T27737] usb 3-1: config 0 descriptor?? [ 2539.906809][ T7561] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 2539.923592][T27737] pl2303 3-1:0.123: required interrupt-in endpoint missing [ 2540.079172][ T5984] usb 5-1: USB disconnect, device number 31 [ 2540.138425][ T30] audit: type=1326 audit(1755087161.212:17632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7560 comm="syz.2.9062" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ff00000 [ 2540.175727][ T30] audit: type=1326 audit(1755087161.222:17633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7560 comm="syz.2.9062" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ff00000 [ 2540.243506][ T30] audit: type=1326 audit(1755087161.222:17634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7560 comm="syz.2.9062" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ff00000 [ 2540.266842][ T30] audit: type=1326 audit(1755087161.222:17635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7560 comm="syz.2.9062" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ff00000 [ 2540.289108][ C1] vkms_vblank_simulate: vblank timer overrun [ 2540.305791][ T30] audit: type=1326 audit(1755087161.222:17636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7560 comm="syz.2.9062" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ff00000 [ 2540.331394][ T30] audit: type=1326 audit(1755087161.222:17637): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7560 comm="syz.2.9062" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ff00000 [ 2540.360296][ C1] vkms_vblank_simulate: vblank timer overrun [ 2540.375298][ T30] audit: type=1326 audit(1755087161.222:17638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7560 comm="syz.2.9062" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ff00000 [ 2540.404185][ T30] audit: type=1326 audit(1755087161.222:17639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7560 comm="syz.2.9062" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ff00000 [ 2540.426473][ C1] vkms_vblank_simulate: vblank timer overrun [ 2540.481753][ T7559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2540.650699][ T30] audit: type=1326 audit(1755087161.222:17640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7560 comm="syz.2.9062" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ff00000 [ 2540.661657][ T7559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2540.672859][ C1] vkms_vblank_simulate: vblank timer overrun [ 2540.719473][ T30] audit: type=1326 audit(1755087161.222:17641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7560 comm="syz.2.9062" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ff00000 [ 2540.892662][T26035] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 2540.899876][T26035] ath9k_htc: Failed to initialize the device [ 2540.951876][T26035] usb 6-1: ath9k_htc: USB layer deinitialized [ 2541.272587][ T7559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2541.281668][ T7559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2541.731820][ T7559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2541.792217][ T7559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2541.934599][ T7559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2541.975268][ T7559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2542.029674][ T1212] usb 6-1: USB disconnect, device number 48 [ 2542.319853][ T979] usb 3-1: USB disconnect, device number 81 [ 2542.771681][ T979] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 2543.005090][ T979] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2543.032143][ T979] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 62, changing to 9 [ 2543.205080][ T979] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2543.238306][ T979] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2543.253484][ T979] usb 3-1: Product: syz [ 2543.260812][ T979] usb 3-1: Manufacturer: syz [ 2543.265595][ T979] usb 3-1: SerialNumber: syz [ 2543.277301][ T979] usb 3-1: bad CDC descriptors [ 2543.841085][ T979] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 2543.903966][ T7618] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9076'. [ 2544.024286][ T5984] usb 3-1: USB disconnect, device number 82 [ 2544.061109][ T979] usb 7-1: Using ep0 maxpacket: 8 [ 2544.068059][ T979] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2544.163175][ T979] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2544.446169][ T979] usb 7-1: New USB device found, idVendor=0c70, idProduct=f00a, bcdDevice= 0.00 [ 2544.469623][ T979] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2544.749924][ T979] usb 7-1: config 0 descriptor?? [ 2545.227673][ T979] aquacomputer_d5next 0003:0C70:F00A.009F: unknown main item tag 0x0 [ 2545.254075][ T979] aquacomputer_d5next 0003:0C70:F00A.009F: unknown main item tag 0x0 [ 2545.343830][ T979] aquacomputer_d5next 0003:0C70:F00A.009F: unknown main item tag 0x0 [ 2545.359768][ T979] aquacomputer_d5next 0003:0C70:F00A.009F: unknown main item tag 0x0 [ 2545.369022][ T979] aquacomputer_d5next 0003:0C70:F00A.009F: unknown main item tag 0x0 [ 2545.561867][ T979] aquacomputer_d5next 0003:0C70:F00A.009F: hidraw0: USB HID v0.00 Device [HID 0c70:f00a] on usb-dummy_hcd.6-1/input0 [ 2546.353614][T27737] usb 7-1: USB disconnect, device number 53 [ 2546.530025][ T7658] tipc: Started in network mode [ 2546.536527][ T7658] tipc: Node identity ac14140f, cluster identity 4711 [ 2546.566699][ T7658] tipc: New replicast peer: 255.255.255.255 [ 2546.590592][ T7658] tipc: Enabled bearer , priority 20 [ 2546.641595][ T7661] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9087'. [ 2546.672073][ T7661] tipc: Disabling bearer [ 2548.291298][ T7687] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9094'. [ 2548.399907][T26952] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 2548.425093][T26952] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 2548.444255][T26952] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 2548.464879][T26952] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 2548.630244][ T7693] FAULT_INJECTION: forcing a failure. [ 2548.630244][ T7693] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2548.651079][ T979] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 2548.672648][ T7693] CPU: 1 UID: 0 PID: 7693 Comm: syz.2.9096 Not tainted 6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 PREEMPT(full) [ 2548.672678][ T7693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2548.672692][ T7693] Call Trace: [ 2548.672701][ T7693] [ 2548.672710][ T7693] dump_stack_lvl+0x189/0x250 [ 2548.672739][ T7693] ? __pfx____ratelimit+0x10/0x10 [ 2548.672765][ T7693] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2548.672787][ T7693] ? __pfx__printk+0x10/0x10 [ 2548.672813][ T7693] ? __might_fault+0xb0/0x130 [ 2548.672849][ T7693] should_fail_ex+0x414/0x560 [ 2548.672878][ T7693] _copy_from_user+0x2d/0xb0 [ 2548.672900][ T7693] get_compat_msghdr+0xad/0x4a0 [ 2548.672933][ T7693] ? __pfx_get_compat_msghdr+0x10/0x10 [ 2548.672970][ T7693] ___sys_sendmsg+0x193/0x2a0 [ 2548.672990][ T7693] ? __pfx____sys_sendmsg+0x10/0x10 [ 2548.673009][ T7693] ? rcu_is_watching+0x15/0xb0 [ 2548.673031][ T7693] ? rcu_read_unlock_special+0x475/0x5e0 [ 2548.673082][ T7693] ? __fget_files+0x2a/0x420 [ 2548.673098][ T7693] ? __fget_files+0x3a0/0x420 [ 2548.673125][ T7693] __sys_sendmsg+0x164/0x220 [ 2548.673146][ T7693] ? __pfx___sys_sendmsg+0x10/0x10 [ 2548.673180][ T7693] ? lockdep_hardirqs_on+0x9c/0x150 [ 2548.673207][ T7693] __do_fast_syscall_32+0xb6/0x2b0 [ 2548.673241][ T7693] do_fast_syscall_32+0x34/0x80 [ 2548.673266][ T7693] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2548.673289][ T7693] RIP: 0023:0xf710e539 [ 2548.673305][ T7693] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 2548.673321][ T7693] RSP: 002b:00000000f54fe55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2548.673341][ T7693] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001500 [ 2548.673355][ T7693] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2548.673366][ T7693] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2548.673378][ T7693] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2548.673389][ T7693] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2548.673423][ T7693] [ 2548.888441][ C1] vkms_vblank_simulate: vblank timer overrun [ 2549.011327][ T979] usb 6-1: Using ep0 maxpacket: 8 [ 2549.050889][ T979] usb 6-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 2549.127767][ T979] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2549.160321][ T7695] netlink: 'syz.2.9097': attribute type 1 has an invalid length. [ 2549.185753][ T979] usb 6-1: Product: syz [ 2549.217744][ T979] usb 6-1: Manufacturer: syz [ 2549.225453][ T979] usb 6-1: SerialNumber: syz [ 2549.274448][ T979] usb 6-1: config 0 descriptor?? [ 2549.327263][ T7695] 8021q: adding VLAN 0 to HW filter on device bond5 [ 2549.527771][ T7689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2549.537935][ T7689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2549.762798][ T30] kauditd_printk_skb: 1366 callbacks suppressed [ 2549.762816][ T30] audit: type=1326 audit(1755087170.842:19008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7709 comm="syz.4.9103" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70fe539 code=0x0 [ 2549.821115][ T5984] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 2549.981125][ T5984] usb 3-1: Using ep0 maxpacket: 32 [ 2549.989192][ T5984] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2550.005272][ T5984] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2550.017710][ T5984] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 2550.029743][ T5984] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2550.043065][ T5984] usb 3-1: config 0 descriptor?? [ 2550.469652][ T5984] ft260 0003:0403:6030.00A0: unknown main item tag 0x0 [ 2550.667565][ T5984] ft260 0003:0403:6030.00A0: chip code: 6424 8183 [ 2550.869463][ T5984] ft260 0003:0403:6030.00A0: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.2-1/input0 [ 2551.104113][ T979] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 2551.231115][ T1212] usb 7-1: new full-speed USB device number 54 using dummy_hcd [ 2551.291775][ T979] usb 5-1: Using ep0 maxpacket: 32 [ 2551.300681][ T979] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2551.314411][ T979] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2551.323995][ T979] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2551.348714][ T5931] usb 6-1: USB disconnect, device number 49 [ 2551.373819][ T979] usb 5-1: config 0 descriptor?? [ 2551.384681][ T1212] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2551.403164][ T979] hub 5-1:0.0: bad descriptor, ignoring hub [ 2551.409141][ T979] hub 5-1:0.0: probe with driver hub failed with error -5 [ 2551.428989][ T1212] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2551.453699][ T1212] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2551.461927][ T979] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 2551.481217][ T1212] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2551.495137][ T1212] usb 7-1: config 0 descriptor?? [ 2551.629671][ T7724] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9107'. [ 2551.679683][ T5984] ft260 0003:0403:6030.00A0: failed to retrieve status: -71, no wakeup [ 2551.696550][ T5984] ft260 0003:0403:6030.00A0: failed to retrieve status: -71 [ 2551.731808][ T5984] ft260 0003:0403:6030.00A0: failed to reset I2C controller: -71 [ 2551.773670][ T5984] usb 3-1: USB disconnect, device number 83 [ 2551.821272][ T5931] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 2551.981211][ T5931] usb 6-1: device descriptor read/64, error -71 [ 2552.221065][ T5931] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 2552.381082][ T5931] usb 6-1: device descriptor read/64, error -71 [ 2552.511710][ T5931] usb usb6-port1: attempt power cycle [ 2552.837769][ T7749] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9115'. [ 2552.846998][ T7749] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9115'. [ 2552.961086][ T5931] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 2552.981930][ T5931] usb 6-1: device descriptor read/8, error -71 [ 2553.231915][ T5931] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 2553.256457][ T5931] usb 6-1: device descriptor read/8, error -71 [ 2553.382432][ T5931] usb usb6-port1: unable to enumerate USB device [ 2554.035614][ T1212] usb 7-1: USB disconnect, device number 54 [ 2554.105834][T27737] usb 5-1: USB disconnect, device number 32 [ 2554.762998][T27737] usb 7-1: new high-speed USB device number 55 using dummy_hcd [ 2555.261603][T27737] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 2555.279992][T27737] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 2555.344518][T27737] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 2555.375170][T27737] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 2555.414362][T27737] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2555.441425][ T1212] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 2555.507667][T27737] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 2555.616289][ T1212] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2555.634014][ T1212] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2555.685176][ T1212] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 2555.818241][ T1212] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 2555.840436][T27737] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -12 [ 2555.866371][ T1212] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 2555.900866][ T1212] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2555.910107][ T1212] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 2555.918504][ T1212] usb 5-1: SerialNumber: syz [ 2556.072366][ T7783] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 2556.086949][ T1212] cdc_acm 5-1:1.0: Control and data interfaces are not separated! [ 2556.097828][ T1212] cdc_acm 5-1:1.0: probe with driver cdc_acm failed with error -12 [ 2557.441893][ T979] usb 7-1: USB disconnect, device number 55 [ 2558.231089][ T979] usb 7-1: new high-speed USB device number 56 using dummy_hcd [ 2558.492314][ T5984] usb 5-1: USB disconnect, device number 33 [ 2558.561092][ T979] usb 7-1: device descriptor read/64, error -71 [ 2558.732328][ T5931] usb 6-1: new full-speed USB device number 54 using dummy_hcd [ 2558.821087][ T979] usb 7-1: new high-speed USB device number 57 using dummy_hcd [ 2558.893089][ T5931] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2558.906069][ T5931] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2558.935607][ T5931] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2558.961274][ T979] usb 7-1: device descriptor read/64, error -71 [ 2558.988122][ T5931] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2559.036928][ T5931] usb 6-1: config 0 descriptor?? [ 2559.071581][ T979] usb usb7-port1: attempt power cycle [ 2559.451397][ T979] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 2559.506940][ T979] usb 7-1: device descriptor read/8, error -71 [ 2559.751076][ T979] usb 7-1: new high-speed USB device number 59 using dummy_hcd [ 2559.772885][ T979] usb 7-1: device descriptor read/8, error -71 [ 2560.171891][ T979] usb usb7-port1: unable to enumerate USB device [ 2560.571143][ T1212] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 2560.682118][ T7830] input input155: cannot allocate more than FF_MAX_EFFECTS effects [ 2560.746668][ T1212] usb 5-1: Using ep0 maxpacket: 16 [ 2560.765676][ T1212] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 2560.775769][ T1212] usb 5-1: config 0 has no interface number 0 [ 2560.775818][ T1212] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 2560.775845][ T1212] usb 5-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 49152, setting to 1024 [ 2560.777584][ T1212] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 2560.777612][ T1212] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 2560.777632][ T1212] usb 5-1: Product: syz [ 2560.777648][ T1212] usb 5-1: SerialNumber: syz [ 2560.779738][ T1212] usb 5-1: config 0 descriptor?? [ 2560.790618][ T1212] cm109 5-1:0.8: invalid payload size 1024, expected 4 [ 2560.795103][ T1212] input: CM109 USB driver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.8/input/input156 [ 2560.979400][ T7841] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9143'. [ 2561.098549][ C1] cm109 5-1:0.8: cm109_urb_irq_callback: urb status -71 [ 2561.259291][ T979] usb 6-1: USB disconnect, device number 54 [ 2561.961785][T27737] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 2562.021118][ T5975] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 2562.121124][T27737] usb 6-1: Using ep0 maxpacket: 32 [ 2562.132922][T27737] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 2562.144004][T27737] usb 6-1: config 0 has no interface number 0 [ 2562.150843][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2562.158109][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2562.165363][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2562.173258][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2562.180689][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2562.188172][T27737] usb 6-1: config 0 interface 184 has no altsetting 0 [ 2562.195363][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2562.202691][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2562.209734][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2562.217111][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2562.224202][ C1] cm109 5-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 2562.233045][ T1212] usb 5-1: USB disconnect, device number 34 [ 2562.239017][ C1] cm109 5-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 2562.252088][ T5975] usb 3-1: Using ep0 maxpacket: 16 [ 2562.261510][ T1212] cm109 5-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 2562.279322][ T5975] usb 3-1: config 8 has an invalid interface number: 57 but max is 0 [ 2562.288233][ T5975] usb 3-1: config 8 has an invalid descriptor of length 115, skipping remainder of the config [ 2562.323309][ T5975] usb 3-1: config 8 has no interface number 0 [ 2562.329514][ T5975] usb 3-1: config 8 interface 57 altsetting 5 has an endpoint descriptor with address 0xFA, changing to 0x8A [ 2562.343956][T27737] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 2562.365120][T27737] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2562.373570][T27737] usb 6-1: Product: syz [ 2562.377747][T27737] usb 6-1: Manufacturer: syz [ 2562.382506][ T5975] usb 3-1: config 8 interface 57 altsetting 5 endpoint 0x8A has an invalid bInterval 247, changing to 7 [ 2562.401520][T27737] usb 6-1: SerialNumber: syz [ 2562.408021][ T5975] usb 3-1: config 8 interface 57 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2562.422103][T27737] usb 6-1: config 0 descriptor?? [ 2562.433089][T27737] smsc75xx v1.0.0 [ 2562.438914][ T5975] usb 3-1: config 8 interface 57 has no altsetting 0 [ 2562.452836][ T5975] usb 3-1: New USB device found, idVendor=39c6, idProduct=8f68, bcdDevice=dd.44 [ 2562.463183][ T5975] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2562.463209][ T5975] usb 3-1: Product: syz [ 2562.463225][ T5975] usb 3-1: Manufacturer: syz [ 2562.463264][ T5975] usb 3-1: SerialNumber: syz [ 2562.693107][ T1212] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 2562.841165][ T1212] usb 5-1: Using ep0 maxpacket: 8 [ 2562.849851][ T1212] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 2562.859511][ T1212] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2562.867687][ T1212] usb 5-1: Product: syz [ 2562.873448][ T1212] usb 5-1: Manufacturer: syz [ 2562.878097][ T1212] usb 5-1: SerialNumber: syz [ 2562.887155][ T1212] usb 5-1: config 0 descriptor?? [ 2563.035415][T27737] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 2563.046613][T27737] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 2563.095779][ T1212] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 2564.673454][ T7849] fuse: Bad value for 'fd' [ 2564.791049][ T1212] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 2564.827546][ T5975] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 2564.843476][ T1212] usb 5-1: USB disconnect, device number 35 [ 2564.854313][ T5975] usb 3-1: MIDIStreaming interface descriptor not found [ 2564.984889][ T5975] usb 3-1: USB disconnect, device number 84 [ 2565.042353][ T7044] udevd[7044]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:8.57/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2565.441358][ T5975] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 2565.466210][ T7907] fuse: Unknown parameter 'd' [ 2565.641567][ T5975] usb 3-1: Using ep0 maxpacket: 32 [ 2565.657871][ T5975] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 2565.672424][ T5975] usb 3-1: config 0 has no interface number 0 [ 2565.714070][ T5975] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 2565.723469][ T7061] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 2565.781179][ T5975] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2565.798440][ T5975] usb 3-1: Product: syz [ 2565.808769][ T5975] usb 3-1: Manufacturer: syz [ 2565.823308][ T5975] usb 3-1: SerialNumber: syz [ 2565.845516][ T5975] usb 3-1: config 0 descriptor?? [ 2565.856284][T27737] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000011c: -71 [ 2565.901501][ T7061] usb 5-1: Using ep0 maxpacket: 8 [ 2565.906732][ T5975] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 2565.915673][T27737] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to write RX_ADDRL: -71 [ 2565.939604][ T5975] usb 3-1: selecting invalid altsetting 1 [ 2565.956408][ T7061] usb 5-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 2565.980267][T27737] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to set mac address [ 2565.990816][ T5975] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 2565.998410][ T7061] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2566.011044][T27737] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 2566.021443][ T5975] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 2566.033889][ T7061] usb 5-1: Product: syz [ 2566.038816][ T7061] usb 5-1: Manufacturer: syz [ 2566.049470][T27737] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -71 [ 2566.068500][ T7061] usb 5-1: SerialNumber: syz [ 2566.075876][ T5975] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 2566.100166][ T7061] usb 5-1: config 0 descriptor?? [ 2566.125221][ T5975] usb 3-1: media controller created [ 2566.139271][T27737] usb 6-1: USB disconnect, device number 55 [ 2566.157600][ T7061] gspca_main: se401-2.14.0 probing 047d:5003 [ 2566.280396][ T5975] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2566.351805][ T5975] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 2566.360189][ T7908] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2566.368839][ T5975] zl10353_read_register: readreg error (reg=127, ret==-71) [ 2566.369314][ T5975] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 2566.415819][ T7908] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2567.176043][ T5975] usb 3-1: USB disconnect, device number 85 [ 2568.043030][ T7061] gspca_se401: read req failed req 0x06 error -19 [ 2568.051682][ T7061] usb 5-1: USB disconnect, device number 36 [ 2568.342733][ T7061] usb 5-1: new low-speed USB device number 37 using dummy_hcd [ 2568.412635][ T7950] bridge0: port 2(bridge_slave_1) entered disabled state [ 2568.421983][ T7950] bridge0: port 1(bridge_slave_0) entered disabled state [ 2568.681301][ T7061] usb 5-1: Invalid ep0 maxpacket: 16 [ 2568.839939][ T7061] usb 5-1: new low-speed USB device number 38 using dummy_hcd [ 2569.007849][ T7061] usb 5-1: Invalid ep0 maxpacket: 16 [ 2569.013656][ T7061] usb usb5-port1: attempt power cycle [ 2569.266244][ T7963] fuse: Bad value for 'user_id' [ 2569.272837][ T7963] fuse: Bad value for 'user_id' [ 2569.361134][ T7061] usb 5-1: new low-speed USB device number 39 using dummy_hcd [ 2569.491185][ T7061] usb 5-1: Invalid ep0 maxpacket: 16 [ 2569.667824][ T7950] tipc: Resetting bearer [ 2569.673399][ T7061] usb 5-1: new low-speed USB device number 40 using dummy_hcd [ 2569.701888][ T7061] usb 5-1: Invalid ep0 maxpacket: 16 [ 2569.722430][ T7061] usb usb5-port1: unable to enumerate USB device [ 2570.132459][ T7950] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2570.376347][ T7977] netlink: 'syz.0.9181': attribute type 8 has an invalid length. [ 2570.499340][ T7950] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2570.776694][ T6835] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2570.802291][ T6835] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2570.812520][ T6835] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2570.826851][ T6835] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2570.857593][ T6835] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2571.173989][ T7987] FAULT_INJECTION: forcing a failure. [ 2571.173989][ T7987] name failslab, interval 1, probability 0, space 0, times 0 [ 2571.202275][ T7987] CPU: 0 UID: 0 PID: 7987 Comm: syz.4.9185 Not tainted 6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 PREEMPT(full) [ 2571.202306][ T7987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2571.202318][ T7987] Call Trace: [ 2571.202327][ T7987] [ 2571.202335][ T7987] dump_stack_lvl+0x189/0x250 [ 2571.202362][ T7987] ? __pfx____ratelimit+0x10/0x10 [ 2571.202384][ T7987] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2571.202403][ T7987] ? __pfx__printk+0x10/0x10 [ 2571.202429][ T7987] ? __pfx___might_resched+0x10/0x10 [ 2571.202443][ T7987] ? fs_reclaim_acquire+0x7d/0x100 [ 2571.202461][ T7987] should_fail_ex+0x414/0x560 [ 2571.202477][ T7987] should_failslab+0xa8/0x100 [ 2571.202493][ T7987] __kmalloc_noprof+0xcb/0x4f0 [ 2571.202512][ T7987] ? tomoyo_encode+0x28b/0x550 [ 2571.202524][ T7987] tomoyo_encode+0x28b/0x550 [ 2571.202542][ T7987] tomoyo_realpath_from_path+0x58d/0x5d0 [ 2571.202558][ T7987] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 2571.202572][ T7987] tomoyo_path_number_perm+0x1e8/0x5a0 [ 2571.202587][ T7987] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2571.202610][ T7987] ? __lock_acquire+0xab9/0xd20 [ 2571.202635][ T7987] ? __fget_files+0x2a/0x420 [ 2571.202647][ T7987] ? __fget_files+0x3a0/0x420 [ 2571.202655][ T7987] ? __fget_files+0x2a/0x420 [ 2571.202665][ T7987] security_file_ioctl_compat+0xcb/0x2d0 [ 2571.202680][ T7987] __ia32_compat_sys_ioctl+0x128/0x840 [ 2571.202696][ T7987] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 2571.202708][ T7987] ? __fget_files+0x3a0/0x420 [ 2571.202721][ T7987] ? fput+0xa0/0xd0 [ 2571.202731][ T7987] ? ksys_write+0x22a/0x250 [ 2571.202750][ T7987] ? lockdep_hardirqs_on+0x9c/0x150 [ 2571.202765][ T7987] __do_fast_syscall_32+0xb6/0x2b0 [ 2571.202780][ T7987] ? lockdep_hardirqs_on+0x9c/0x150 [ 2571.202795][ T7987] do_fast_syscall_32+0x34/0x80 [ 2571.202809][ T7987] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2571.202821][ T7987] RIP: 0023:0xf70fe539 [ 2571.202831][ T7987] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 2571.202840][ T7987] RSP: 002b:00000000f54ee55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 2571.202852][ T7987] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000005411 [ 2571.202859][ T7987] RDX: 0000000080000240 RSI: 0000000000000000 RDI: 0000000000000000 [ 2571.202900][ T7987] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2571.202905][ T7987] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2571.202911][ T7987] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2571.202926][ T7987] [ 2571.202947][ T7987] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2571.529026][ T7973] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2571.586210][ T7973] batadv_slave_0: entered promiscuous mode [ 2571.637183][ T7973] batadv_slave_0: entered allmulticast mode [ 2571.665786][ T7973] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 2571.790547][ T7977] bridge3: entered allmulticast mode [ 2571.868233][ T8865] netdevsim netdevsim5 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2571.916432][ T8865] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2571.983733][ T8865] netdevsim netdevsim5 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2571.993397][ T8865] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2572.040199][ T8865] netdevsim netdevsim5 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2572.049743][ T8865] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2572.058949][ T5975] usb 6-1: new full-speed USB device number 56 using dummy_hcd [ 2572.108317][ T8865] netdevsim netdevsim5 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2572.122084][ T8865] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2572.197359][T26952] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2572.209659][T26952] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2572.227508][ T5975] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2572.238031][ T5975] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2572.258710][ T5975] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2572.270375][ T5975] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2572.290235][ T5975] usb 6-1: config 0 descriptor?? [ 2572.460251][T26952] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2572.481212][T26952] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2572.647232][T26952] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2572.669777][T26952] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2572.990474][T26952] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2573.060351][T24236] Bluetooth: hci2: command tx timeout [ 2573.081483][T26952] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2573.248892][ T7985] chnl_net:caif_netlink_parms(): no params data found [ 2574.705837][ T7985] bridge0: port 1(bridge_slave_0) entered blocking state [ 2574.713357][ T7985] bridge0: port 1(bridge_slave_0) entered disabled state [ 2574.739309][ T7985] bridge_slave_0: entered allmulticast mode [ 2574.824763][ T5975] usb 6-1: USB disconnect, device number 56 [ 2574.882095][ T7985] bridge_slave_0: entered promiscuous mode [ 2574.919542][ T7985] bridge0: port 2(bridge_slave_1) entered blocking state [ 2574.933990][ T7985] bridge0: port 2(bridge_slave_1) entered disabled state [ 2574.944842][ T7985] bridge_slave_1: entered allmulticast mode [ 2574.962428][ T7985] bridge_slave_1: entered promiscuous mode [ 2575.133702][T24236] Bluetooth: hci2: command tx timeout [ 2576.181211][T26952] bond2 (unregistering): (slave geneve2): Releasing active interface [ 2576.455560][T26952] bond0 (unregistering): Released all slaves [ 2576.514919][T26952] bond1 (unregistering): Released all slaves [ 2577.077691][T26952] bond2 (unregistering): Released all slaves [ 2577.171289][ T7914] usb 7-1: new high-speed USB device number 60 using dummy_hcd [ 2577.212639][T24236] Bluetooth: hci2: command tx timeout [ 2577.342124][ T7914] usb 7-1: Using ep0 maxpacket: 32 [ 2577.384541][ T7914] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2577.397688][ T7914] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2577.407683][ T7914] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2577.419370][T26952] bond3 (unregistering): (slave vlan0): Releasing backup interface [ 2577.440818][T26952] bond3 (unregistering): Released all slaves [ 2577.447723][ T7914] usb 7-1: config 0 descriptor?? [ 2577.461583][T21748] usb 5-1: new full-speed USB device number 41 using dummy_hcd [ 2577.493205][ T7914] hub 7-1:0.0: bad descriptor, ignoring hub [ 2577.606001][ T7914] hub 7-1:0.0: probe with driver hub failed with error -5 [ 2577.668507][ T7914] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 2577.706928][ T8051] netlink: 16 bytes leftover after parsing attributes in process `syz.6.9202'. [ 2577.722747][T21748] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2577.733561][T21748] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2577.762803][T21748] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2577.775547][T21748] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2577.841649][T21748] usb 5-1: config 0 descriptor?? [ 2578.062600][T26952] bond4 (unregistering): Released all slaves [ 2578.403738][ T8066] fuse: Bad value for 'group_id' [ 2578.408731][ T8066] fuse: Bad value for 'group_id' [ 2578.543537][T26952] bond5 (unregistering): Released all slaves [ 2578.587347][ T7985] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2578.622600][ T7985] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2578.912450][ T7985] team0: Port device team_slave_0 added [ 2578.937421][ T7985] team0: Port device team_slave_1 added [ 2579.122332][T26952] tipc: Left network mode [ 2579.164915][ T8075] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9217'. [ 2579.207399][ T8075] netlink: 32 bytes leftover after parsing attributes in process `syz.0.9217'. [ 2579.301393][T24236] Bluetooth: hci2: command tx timeout [ 2579.538277][ T7985] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2579.572057][ T7985] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2579.678362][ T7985] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2579.694693][ T7985] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2579.706724][ T7985] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2579.888170][ T7985] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2580.263391][ T7914] usb 5-1: USB disconnect, device number 41 [ 2581.272615][ T7061] usb 7-1: USB disconnect, device number 60 [ 2581.417454][ T7985] hsr_slave_0: entered promiscuous mode [ 2581.478918][ T7985] hsr_slave_1: entered promiscuous mode [ 2581.499163][ T7985] debugfs: 'hsr0' already exists in 'hsr' [ 2581.518319][ T7985] Cannot create hsr debugfs directory [ 2582.134057][T26952] hsr_slave_0: left promiscuous mode [ 2582.167791][T26952] hsr_slave_1: left promiscuous mode [ 2582.187245][T26952] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2582.291040][T26952] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2582.310796][T26952] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2582.331058][T26952] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2582.392956][T26952] veth1_macvtap: left allmulticast mode [ 2582.398673][T26952] veth1_macvtap: left promiscuous mode [ 2582.427908][T26952] veth0_macvtap: left allmulticast mode [ 2582.453548][T26952] veth0_macvtap: left promiscuous mode [ 2583.011652][T26952] macsec0 (unregistering): left allmulticast mode [ 2584.312810][T26952] team_slave_1 (unregistering): left promiscuous mode [ 2584.328301][T26952] team0 (unregistering): Port device team_slave_1 removed [ 2584.406722][T26952] team_slave_0 (unregistering): left promiscuous mode [ 2584.415969][T26952] team0 (unregistering): Port device team_slave_0 removed [ 2586.311055][ T5975] usb 6-1: new full-speed USB device number 57 using dummy_hcd [ 2586.492439][ T5975] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2586.546613][ T5975] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2586.592328][ T5975] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2586.696969][ T5975] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2586.749775][T26952] IPVS: stop unused estimator thread 0... [ 2586.791232][ T7061] usb 7-1: new full-speed USB device number 61 using dummy_hcd [ 2586.815703][ T5975] usb 6-1: config 0 descriptor?? [ 2587.222967][ T7061] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2587.314917][ T7061] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2587.325043][ T7061] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 2587.481656][ T7061] usb 7-1: New USB device found, idVendor=045e, idProduct=008e, bcdDevice= 0.00 [ 2587.502489][ T7061] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2587.526388][ T7061] usb 7-1: config 0 descriptor?? [ 2588.033803][ T8168] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2588.042974][ T8168] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2588.560223][ T7985] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 2588.587583][ T7985] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 2588.607138][ T7985] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 2588.635512][ T7985] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 2588.930352][ T7985] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2589.013224][ T7914] usb 6-1: USB disconnect, device number 57 [ 2589.063607][ T7985] 8021q: adding VLAN 0 to HW filter on device team0 [ 2589.093121][ T8858] bridge0: port 1(bridge_slave_0) entered blocking state [ 2589.100349][ T8858] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2589.134912][ T8851] bridge0: port 2(bridge_slave_1) entered blocking state [ 2589.142150][ T8851] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2589.592784][ T7985] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 2589.754449][ T7061] usbhid 7-1:0.0: can't add hid device: -71 [ 2589.871605][ T7061] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 2589.891935][ T7061] usb 7-1: USB disconnect, device number 61 [ 2590.255372][ T7985] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2590.442929][ T7985] veth0_vlan: entered promiscuous mode [ 2590.463931][ T7985] veth1_vlan: entered promiscuous mode [ 2590.497237][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 2590.497771][ T5975] usb 7-1: new high-speed USB device number 62 using dummy_hcd [ 2590.503785][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 2590.542858][ T7985] veth0_macvtap: entered promiscuous mode [ 2590.567840][ T7985] veth1_macvtap: entered promiscuous mode [ 2590.607867][ T7985] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2590.641472][ T7985] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2590.651535][ T5931] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 2590.668207][ T8865] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2590.714180][ T5975] usb 7-1: too many configurations: 151, using maximum allowed: 8 [ 2590.723528][ T8865] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2590.763325][ T8865] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2590.803128][ T5975] usb 7-1: New USB device found, idVendor=04d8, idProduct=0082, bcdDevice=ce.b7 [ 2590.806448][ T8865] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2590.828044][ T5931] usb 6-1: config 0 has no interfaces? [ 2590.834380][ T5931] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2590.834529][ T5975] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=130 [ 2590.859362][ T5931] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2590.910004][ T8211] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9232'. [ 2590.933805][ T5975] usb 7-1: Product: syz [ 2590.935585][ T5931] usb 6-1: config 0 descriptor?? [ 2590.938018][ T5975] usb 7-1: Manufacturer: syz [ 2591.001649][ T5975] usb 7-1: SerialNumber: syz [ 2591.041074][ T5975] usb 7-1: config 0 descriptor?? [ 2591.056238][ T5975] ims_pcu 7-1:0.0: Zero length descriptor [ 2591.089498][ T5975] ims_pcu 7-1:0.0: probe with driver ims_pcu failed with error -22 [ 2591.186963][ T8216] bridge0: port 2(bridge_slave_1) entered disabled state [ 2591.194863][ T8216] bridge0: port 1(bridge_slave_0) entered disabled state [ 2591.210394][ T8202] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2591.228093][ T8202] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2591.238259][ T8209] usb 6-1: USB disconnect, device number 58 [ 2591.366102][ T8216] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2591.382989][ T8216] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2591.511325][ T8209] usb 7-1: USB disconnect, device number 62 [ 2591.660326][ T8861] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2591.681452][T18030] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 2591.690585][ T8224] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.9233'. [ 2591.708116][ T8851] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2591.718153][ T8861] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2591.730643][ T8851] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2591.749678][ T8851] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2591.765297][ T8851] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2591.806587][ T8851] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2591.835359][ T8851] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2591.871104][T18030] usb 6-1: Using ep0 maxpacket: 16 [ 2591.872215][ T8851] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2591.886998][T18030] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2591.907861][T18030] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2591.912439][ T8851] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2591.951063][T18030] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 1.40 [ 2591.980513][T18030] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2591.995930][T18030] usb 6-1: Product: syz [ 2592.000225][T18030] usb 6-1: Manufacturer: syz [ 2592.007555][ T8851] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2592.008415][T18030] usb 6-1: SerialNumber: syz [ 2592.041666][ T8851] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2592.458297][T18030] usb 6-1: 0:2 : does not exist [ 2592.821155][ T8209] usb 5-1: new full-speed USB device number 42 using dummy_hcd [ 2593.033278][ T8209] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2593.044989][ T8209] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2593.117758][ T8209] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2593.191126][T27737] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 2593.239404][ T8209] usb 5-1: config 0 descriptor?? [ 2593.373379][T27737] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 2593.387775][T27737] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2593.431165][T27737] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2593.442367][T27737] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 2593.459777][T27737] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 2593.479808][T27737] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 2593.505469][T27737] usb 3-1: Manufacturer: syz [ 2593.531599][T27737] usb 3-1: config 0 descriptor?? [ 2593.684375][ T8209] ath6kl: Failed to read usb control message: -71 [ 2593.719588][ T8209] ath6kl: Unable to read the bmi data from the device: -71 [ 2593.748892][ T5975] usb 6-1: USB disconnect, device number 59 [ 2593.831162][ T8209] ath6kl: Unable to recv target info: -71 [ 2593.868977][ T8209] ath6kl: Failed to init ath6kl core: -71 [ 2593.902141][ T8209] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 2593.952654][ T8209] usb 5-1: USB disconnect, device number 42 [ 2594.005168][T27737] appleir 0003:05AC:8243.00A1: unknown main item tag 0x0 [ 2594.053414][T27737] appleir 0003:05AC:8243.00A1: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 2594.107815][ T8270] tipc: Enabled bearer , priority 20 [ 2594.368652][ T8281] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9239'. [ 2595.732069][ T8305] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9245'. [ 2595.881346][ T8308] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9247'. [ 2595.948596][ T8308] vlan2: entered promiscuous mode [ 2595.963066][ T8308] macvtap0: entered promiscuous mode [ 2596.192756][ T5975] usb 3-1: USB disconnect, device number 86 [ 2596.494482][ T8314] fuse: Bad value for 'user_id' [ 2596.499412][ T8314] fuse: Bad value for 'user_id' [ 2596.897917][ T8319] netdevsim netdevsim5: Direct firmware load for . [ 2596.897917][ T8319] failed with error -2 [ 2596.917353][ T8319] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 2596.917353][ T8319] [ 2597.222888][ T5975] usb 5-1: new full-speed USB device number 43 using dummy_hcd [ 2597.501569][ T5975] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2597.551391][ T5975] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 2597.589662][ T5975] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2597.628719][ T5975] usb 5-1: config 0 descriptor?? [ 2597.961257][ T8349] netlink: 'syz.6.9257': attribute type 3 has an invalid length. [ 2598.161093][ T5975] ath6kl: Failed to read usb control message: -71 [ 2598.301093][ T8209] usb 7-1: new high-speed USB device number 63 using dummy_hcd [ 2598.386591][ T5975] ath6kl: Unable to read the bmi data from the device: -71 [ 2598.405253][ T5975] ath6kl: Unable to recv target info: -71 [ 2598.449065][ T5975] ath6kl: Failed to init ath6kl core: -71 [ 2598.461564][ T5975] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 2598.506776][ T5975] usb 5-1: USB disconnect, device number 43 [ 2598.516124][ T8209] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2598.545068][ T8209] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2598.709663][ T8209] usb 7-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2598.749253][ T8209] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2598.916316][ T8209] usb 7-1: config 0 descriptor?? [ 2598.978611][ T8357] usb usb1: check_ctrlrecip: process 8357 (syz.5.9259) requesting ep 01 but needs 81 [ 2599.581836][ T8209] usb 7-1: string descriptor 0 read error: -22 [ 2599.805823][ T8209] input: HID 256c:006d as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:256C:006D.00A2/input/input157 [ 2599.884847][ T8209] input: HID 256c:006d as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:256C:006D.00A2/input/input158 [ 2600.002157][ T8209] input: HID 256c:006d Touch Strip as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:256C:006D.00A2/input/input159 [ 2600.112771][ T8209] input: HID 256c:006d Dial as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:256C:006D.00A2/input/input160 [ 2600.204703][ T8209] uclogic 0003:256C:006D.00A2: input,hidraw0: USB HID v0.00 Keypad [HID 256c:006d] on usb-dummy_hcd.6-1/input0 [ 2600.277201][ T8209] usb 7-1: USB disconnect, device number 63 [ 2600.427914][ T8374] fido_id[8374]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/7-1/report_descriptor': No such file or directory [ 2600.503502][T27737] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 2600.663430][T27737] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2600.687333][T27737] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 2600.699577][T27737] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2600.719064][T27737] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 2600.786658][T27737] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 2600.805906][T27737] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2600.831008][T27737] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2600.857177][T27737] usb 5-1: Product: syz [ 2600.863038][T27737] usb 5-1: Manufacturer: syz [ 2600.909266][T27737] cdc_wdm 5-1:1.0: skipping garbage [ 2600.925106][T27737] cdc_wdm 5-1:1.0: skipping garbage [ 2600.950184][T27737] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 2600.975408][T27737] cdc_wdm 5-1:1.0: Unknown control protocol [ 2601.700486][ C0] cdc_wdm 5-1:1.0: Unexpected error -71 [ 2601.706156][ C0] wdm_int_callback: 6 callbacks suppressed [ 2601.706179][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 2601.718588][ C0] wdm_int_callback: 6 callbacks suppressed [ 2601.718609][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 2601.731416][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 2601.738054][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 2601.744373][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 2601.751080][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 2601.757358][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 2601.763976][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 2601.770398][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 2601.777076][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 2601.783431][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 2601.790036][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 2601.796357][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 2601.803051][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 2601.809409][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 2601.816130][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 2601.822479][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 2601.829127][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 2601.835398][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 2601.841984][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 2601.871076][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1 [ 2601.892134][ T8209] usb 5-1: USB disconnect, device number 44 [ 2603.995815][ T8431] FAULT_INJECTION: forcing a failure. [ 2603.995815][ T8431] name failslab, interval 1, probability 0, space 0, times 0 [ 2604.095966][ T8431] CPU: 1 UID: 0 PID: 8431 Comm: syz.2.9281 Not tainted 6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 PREEMPT(full) [ 2604.095993][ T8431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2604.096004][ T8431] Call Trace: [ 2604.096011][ T8431] [ 2604.096019][ T8431] dump_stack_lvl+0x189/0x250 [ 2604.096051][ T8431] ? __pfx____ratelimit+0x10/0x10 [ 2604.096073][ T8431] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2604.096093][ T8431] ? __pfx__printk+0x10/0x10 [ 2604.096121][ T8431] ? __pfx___might_resched+0x10/0x10 [ 2604.096142][ T8431] should_fail_ex+0x414/0x560 [ 2604.096167][ T8431] ? seq_read_iter+0x1fd/0xe10 [ 2604.096186][ T8431] should_failslab+0xa8/0x100 [ 2604.096211][ T8431] __kvmalloc_node_noprof+0x161/0x5f0 [ 2604.096235][ T8431] ? seq_read_iter+0x1fd/0xe10 [ 2604.096259][ T8431] seq_read_iter+0x1fd/0xe10 [ 2604.096279][ T8431] ? _parse_integer_limit+0x1ae/0x1f0 [ 2604.096307][ T8431] ? look_up_lock_class+0x74/0x170 [ 2604.096331][ T8431] ? __asan_memset+0x22/0x50 [ 2604.096356][ T8431] seq_read+0x369/0x480 [ 2604.096386][ T8431] ? __pfx_seq_read+0x10/0x10 [ 2604.096407][ T8431] ? __pfx___mutex_trylock_common+0x10/0x10 [ 2604.096441][ T8431] ? __pfx_seq_read+0x10/0x10 [ 2604.096458][ T8431] proc_reg_read+0x1e9/0x2e0 [ 2604.096479][ T8431] ? __pfx_proc_reg_read+0x10/0x10 [ 2604.096501][ T8431] vfs_read+0x200/0xa30 [ 2604.096520][ T8431] ? fdget_pos+0x247/0x320 [ 2604.096539][ T8431] ? __pfx___mutex_lock+0x10/0x10 [ 2604.096562][ T8431] ? __pfx_vfs_read+0x10/0x10 [ 2604.096595][ T8431] ? __fget_files+0x2a/0x420 [ 2604.096612][ T8431] ? __fget_files+0x3a0/0x420 [ 2604.096624][ T8431] ? __fget_files+0x2a/0x420 [ 2604.096646][ T8431] ksys_read+0x145/0x250 [ 2604.096670][ T8431] ? __pfx_ksys_read+0x10/0x10 [ 2604.096694][ T8431] ? lockdep_hardirqs_on+0x9c/0x150 [ 2604.096719][ T8431] __do_fast_syscall_32+0xb6/0x2b0 [ 2604.096742][ T8431] ? lockdep_hardirqs_on+0x9c/0x150 [ 2604.096765][ T8431] do_fast_syscall_32+0x34/0x80 [ 2604.096789][ T8431] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2604.096810][ T8431] RIP: 0023:0xf70ee539 [ 2604.096833][ T8431] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 2604.096849][ T8431] RSP: 002b:00000000f54de55c EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 2604.096871][ T8431] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080004200 [ 2604.096883][ T8431] RDX: 0000000000002020 RSI: 0000000000000000 RDI: 0000000000000000 [ 2604.096894][ T8431] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2604.096905][ T8431] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2604.096916][ T8431] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2604.096942][ T8431] [ 2604.351262][ T8209] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 2604.359124][ C1] vkms_vblank_simulate: vblank timer overrun [ 2604.533785][ T8209] usb 3-1: device descriptor read/64, error -71 [ 2604.691382][ T8439] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9284'. [ 2604.700379][ T8439] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9284'. [ 2604.789995][ T8438] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9284'. [ 2604.881465][ T8209] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 2604.928886][ T8445] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9285'. [ 2604.938738][ T8438] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9284'. [ 2605.022538][ T8209] usb 3-1: device descriptor read/64, error -71 [ 2605.154969][ T8209] usb usb3-port1: attempt power cycle [ 2605.175185][ T8453] FAULT_INJECTION: forcing a failure. [ 2605.175185][ T8453] name failslab, interval 1, probability 0, space 0, times 0 [ 2605.201104][ T8453] CPU: 0 UID: 0 PID: 8453 Comm: syz.0.9290 Not tainted 6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 PREEMPT(full) [ 2605.201135][ T8453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2605.201146][ T8453] Call Trace: [ 2605.201153][ T8453] [ 2605.201162][ T8453] dump_stack_lvl+0x189/0x250 [ 2605.201188][ T8453] ? __pfx____ratelimit+0x10/0x10 [ 2605.201316][ T8453] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2605.201339][ T8453] ? __pfx__printk+0x10/0x10 [ 2605.201370][ T8453] ? __pfx___might_resched+0x10/0x10 [ 2605.201387][ T8453] ? fs_reclaim_acquire+0x7d/0x100 [ 2605.201419][ T8453] should_fail_ex+0x414/0x560 [ 2605.201447][ T8453] should_failslab+0xa8/0x100 [ 2605.201475][ T8453] __kmalloc_cache_noprof+0x70/0x3d0 [ 2605.201498][ T8453] ? __kthread_create_on_node+0xef/0x3e0 [ 2605.201518][ T8453] ? __pfx_rescuer_thread+0x10/0x10 [ 2605.201540][ T8453] __kthread_create_on_node+0xef/0x3e0 [ 2605.201564][ T8453] ? __pfx___kthread_create_on_node+0x10/0x10 [ 2605.201583][ T8453] ? string+0x279/0x2b0 [ 2605.201613][ T8453] ? __pfx_rescuer_thread+0x10/0x10 [ 2605.201634][ T8453] ? __pfx_rescuer_thread+0x10/0x10 [ 2605.201655][ T8453] kthread_create_on_node+0xdd/0x130 [ 2605.201682][ T8453] ? __pfx_kthread_create_on_node+0x10/0x10 [ 2605.201708][ T8453] ? __kmalloc_cache_node_noprof+0x234/0x3d0 [ 2605.201739][ T8453] init_rescuer+0x305/0x570 [ 2605.201768][ T8453] ? __pfx_init_rescuer+0x10/0x10 [ 2605.201803][ T8453] ? wq_adjust_max_active+0x195/0x4b0 [ 2605.201831][ T8453] __alloc_workqueue+0x176b/0x1b70 [ 2605.201871][ T8453] alloc_workqueue_noprof+0xd4/0x210 [ 2605.201895][ T8453] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 2605.201922][ T8453] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 2605.201943][ T8453] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 2605.201979][ T8453] nci_register_device+0x220/0x9d0 [ 2605.202007][ T8453] ? __pfx_nci_register_device+0x10/0x10 [ 2605.202030][ T8453] ? __raw_spin_lock_init+0x45/0x100 [ 2605.202055][ T8453] ? __init_waitqueue_head+0xa9/0x150 [ 2605.202081][ T8453] virtual_ncidev_open+0x129/0x1a0 [ 2605.202104][ T8453] ? __pfx_virtual_ncidev_open+0x10/0x10 [ 2605.202123][ T8453] misc_open+0x2b9/0x330 [ 2605.202149][ T8453] chrdev_open+0x4cc/0x5e0 [ 2605.202176][ T8453] ? __pfx_chrdev_open+0x10/0x10 [ 2605.202211][ T8453] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 2605.202243][ T8453] ? __pfx_chrdev_open+0x10/0x10 [ 2605.202266][ T8453] do_dentry_open+0x953/0x13f0 [ 2605.202301][ T8453] vfs_open+0x3b/0x340 [ 2605.202316][ T8453] ? path_openat+0x2ecd/0x3830 [ 2605.202340][ T8453] path_openat+0x2ee5/0x3830 [ 2605.202360][ T8453] ? arch_stack_walk+0xfc/0x150 [ 2605.202401][ T8453] ? stack_depot_save_flags+0x40/0x860 [ 2605.202439][ T8453] ? __pfx_path_openat+0x10/0x10 [ 2605.202457][ T8453] ? do_fast_syscall_32+0x34/0x80 [ 2605.202479][ T8453] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2605.202522][ T8453] do_filp_open+0x1fa/0x410 [ 2605.202541][ T8453] ? __lock_acquire+0xab9/0xd20 [ 2605.202567][ T8453] ? __pfx_do_filp_open+0x10/0x10 [ 2605.202612][ T8453] ? _raw_spin_unlock+0x28/0x50 [ 2605.202632][ T8453] ? alloc_fd+0x64c/0x6c0 [ 2605.202670][ T8453] do_sys_openat2+0x121/0x1c0 [ 2605.202692][ T8453] ? __pfx_do_sys_openat2+0x10/0x10 [ 2605.202716][ T8453] ? ksys_write+0x22a/0x250 [ 2605.202747][ T8453] __ia32_compat_sys_openat+0x131/0x160 [ 2605.202775][ T8453] __do_fast_syscall_32+0xb6/0x2b0 [ 2605.202800][ T8453] ? lockdep_hardirqs_on+0x9c/0x150 [ 2605.202827][ T8453] do_fast_syscall_32+0x34/0x80 [ 2605.202851][ T8453] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2605.202872][ T8453] RIP: 0023:0xf7fe3539 [ 2605.202889][ T8453] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 2605.202904][ T8453] RSP: 002b:00000000f550655c EFLAGS: 00000206 ORIG_RAX: 0000000000000127 [ 2605.202923][ T8453] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000080 [ 2605.202937][ T8453] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 2605.202948][ T8453] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2605.202959][ T8453] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2605.202969][ T8453] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2605.202999][ T8453] [ 2605.203060][ T8453] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -ENOMEM [ 2605.767973][ T8459] netlink: 'syz.5.9293': attribute type 32 has an invalid length. [ 2605.789172][ T8459] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9293'. [ 2605.801654][ T8459] (unnamed net_device) (uninitialized): option coupled_control: invalid value (32) [ 2605.891074][ T8209] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 2605.911797][ T8209] usb 3-1: device descriptor read/8, error -71 [ 2606.127238][ T8473] binder: 8472:8473 unknown command 0 [ 2606.154118][ T8473] binder: 8472:8473 ioctl c0306201 80000080 returned -22 [ 2606.161545][ T8209] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 2606.313468][ T8479] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9300'. [ 2606.401669][ T8209] usb 3-1: device descriptor read/8, error -71 [ 2606.467031][ T8479] vlan3: entered promiscuous mode [ 2606.507094][ T8479] macvtap0: entered promiscuous mode [ 2606.541368][ T8209] usb usb3-port1: unable to enumerate USB device [ 2607.187723][ T5975] usb 6-1: new low-speed USB device number 60 using dummy_hcd [ 2607.355060][ T5975] usb 6-1: config 1 interface 0 altsetting 7 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2607.385396][ T5975] usb 6-1: config 1 interface 0 has no altsetting 0 [ 2608.547870][ T8502] "syz.0.9307" (8502) uses obsolete ecb(arc4) skcipher [ 2608.711067][ T30] audit: type=1326 audit(1755087229.782:19009): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8499 comm="syz.0.9307" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7fc00000 [ 2608.796476][ T8509] FAULT_INJECTION: forcing a failure. [ 2608.796476][ T8509] name failslab, interval 1, probability 0, space 0, times 0 [ 2608.819520][ T8509] CPU: 1 UID: 0 PID: 8509 Comm: syz.2.9310 Not tainted 6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 PREEMPT(full) [ 2608.819548][ T8509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2608.819560][ T8509] Call Trace: [ 2608.819568][ T8509] [ 2608.819576][ T8509] dump_stack_lvl+0x189/0x250 [ 2608.819603][ T8509] ? __pfx____ratelimit+0x10/0x10 [ 2608.819629][ T8509] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2608.819650][ T8509] ? __pfx__printk+0x10/0x10 [ 2608.819679][ T8509] ? __pfx___might_resched+0x10/0x10 [ 2608.819702][ T8509] should_fail_ex+0x414/0x560 [ 2608.819729][ T8509] should_failslab+0xa8/0x100 [ 2608.819756][ T8509] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 2608.819780][ T8509] ? __alloc_skb+0x112/0x2d0 [ 2608.819809][ T8509] __alloc_skb+0x112/0x2d0 [ 2608.819846][ T8509] netlink_sendmsg+0x5c6/0xb30 [ 2608.819881][ T8509] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2608.819908][ T8509] ? __import_iovec+0x5d4/0x7f0 [ 2608.819925][ T8509] ? aa_sock_msg_perm+0xf1/0x1d0 [ 2608.819952][ T8509] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2608.819971][ T8509] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2608.819996][ T8509] __sock_sendmsg+0x21c/0x270 [ 2608.820021][ T8509] ____sys_sendmsg+0x505/0x830 [ 2608.820046][ T8509] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2608.820079][ T8509] ___sys_sendmsg+0x21f/0x2a0 [ 2608.820100][ T8509] ? __pfx____sys_sendmsg+0x10/0x10 [ 2608.820153][ T8509] ? __fget_files+0x2a/0x420 [ 2608.820169][ T8509] ? __fget_files+0x3a0/0x420 [ 2608.820196][ T8509] __sys_sendmsg+0x164/0x220 [ 2608.820217][ T8509] ? __pfx___sys_sendmsg+0x10/0x10 [ 2608.820252][ T8509] ? lockdep_hardirqs_on+0x9c/0x150 [ 2608.820276][ T8509] __do_fast_syscall_32+0xb6/0x2b0 [ 2608.820302][ T8509] ? lockdep_hardirqs_on+0x9c/0x150 [ 2608.820328][ T8509] do_fast_syscall_32+0x34/0x80 [ 2608.820352][ T8509] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2608.820373][ T8509] RIP: 0023:0xf70ee539 [ 2608.820389][ T8509] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 2608.820405][ T8509] RSP: 002b:00000000f54de55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2608.820425][ T8509] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000180 [ 2608.820438][ T8509] RDX: 00000000000000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 2608.820449][ T8509] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2608.820461][ T8509] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2608.820471][ T8509] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2608.820498][ T8509] [ 2609.308733][ T8521] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9314'. [ 2609.361845][ T5984] usb 7-1: new high-speed USB device number 64 using dummy_hcd [ 2609.553805][ T5984] usb 7-1: config 0 has no interfaces? [ 2609.561101][ T5984] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2609.564402][ T5975] usb 6-1: New USB device found, idVendor=056a, idProduct=006a, bcdDevice= 0.40 [ 2609.598154][ T5984] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2609.634684][ T5984] usb 7-1: config 0 descriptor?? [ 2609.651720][ T8209] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 2609.688827][ T5975] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2609.738864][ T5975] usb 6-1: can't set config #1, error -71 [ 2609.761781][ T5975] usb 6-1: USB disconnect, device number 60 [ 2609.816549][ T8209] usb 3-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 2609.834908][ T8209] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2609.864026][ T8513] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2609.975752][ T8513] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2610.153022][ T8209] usb 3-1: Product: syz [ 2610.169234][ T8209] usb 3-1: Manufacturer: syz [ 2610.171472][ T5975] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 2610.176099][T21748] usb 7-1: USB disconnect, device number 64 [ 2610.193573][ T8209] usb 3-1: SerialNumber: syz [ 2610.320023][ T8209] usb 3-1: config 0 descriptor?? [ 2610.336732][ T5975] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2610.347688][ T5975] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 62, changing to 9 [ 2610.390174][ T5975] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2610.405243][ T5975] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2610.414100][ T5975] usb 6-1: Product: syz [ 2610.418838][ T5975] usb 6-1: Manufacturer: syz [ 2610.429236][ T5975] usb 6-1: SerialNumber: syz [ 2610.692546][ T5975] usb 6-1: bad CDC descriptors [ 2610.721091][T21748] usb 7-1: new high-speed USB device number 65 using dummy_hcd [ 2610.873308][T21748] usb 7-1: Using ep0 maxpacket: 16 [ 2611.006414][T21748] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2611.017592][T21748] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2611.054313][T21748] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 1.40 [ 2611.098546][T21748] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2611.149376][T21748] usb 7-1: Product: syz [ 2611.157766][T21748] usb 7-1: Manufacturer: syz [ 2611.169785][T21748] usb 7-1: SerialNumber: syz [ 2611.304650][ T5975] usb 6-1: USB disconnect, device number 61 [ 2611.600171][T21748] usb 7-1: 0:2 : does not exist [ 2611.654772][ T8209] usb 3-1: f81604_read: reg: 100e failed: -EPROTO [ 2611.727248][ T8209] usb 3-1: f81604_read: reg: 200f failed: -EPROTO [ 2611.741266][ T8209] usb 3-1: USB disconnect, device number 91 [ 2611.757591][ T8209] usb 3-1: f81604_read: reg: 100f failed: -ENODEV [ 2611.771269][ T5975] usb 6-1: new full-speed USB device number 62 using dummy_hcd [ 2611.855650][ T8209] usb 3-1: f81604_read: reg: 200f failed: -ENODEV [ 2612.009471][ T5975] usb 6-1: config 0 has an invalid interface number: 138 but max is 0 [ 2612.039665][ T5975] usb 6-1: config 0 has no interface number 0 [ 2612.115317][ T5975] usb 6-1: config 0 interface 138 altsetting 0 has an endpoint descriptor with address 0xE4, changing to 0x84 [ 2612.131650][ T5975] usb 6-1: config 0 interface 138 altsetting 0 endpoint 0x84 has an invalid bInterval 87, changing to 4 [ 2612.169272][ T5975] usb 6-1: config 0 interface 138 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 4 [ 2612.188905][ T5975] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=c8.66 [ 2612.200235][ T5975] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2612.219671][ T5975] usb 6-1: config 0 descriptor?? [ 2612.449058][ T5975] usb 6-1: string descriptor 0 read error: -71 [ 2612.489698][ T5975] usbtest 6-1:0.138: Linux gadget zero [ 2612.496207][ T5975] usbtest 6-1:0.138: full-speed {control in/out iso-in iso-out} tests (+alt) [ 2612.513168][ T5975] usb 6-1: USB disconnect, device number 62 [ 2612.731186][ T8209] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 2612.878004][ T5975] usb 7-1: USB disconnect, device number 65 [ 2612.904641][ T8209] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2612.927544][ T8209] usb 3-1: config 1 has an invalid descriptor of length 46, skipping remainder of the config [ 2612.981242][ T8209] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2613.059953][T24236] Bluetooth: hci4: command 0x0406 tx timeout [ 2613.077869][ T8209] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 27753, setting to 1024 [ 2613.093899][ T8209] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1024 [ 2613.107495][ T8209] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2613.125653][ T8209] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2613.139827][ T8209] usb 3-1: Product: syz [ 2613.148713][ T8209] usb 3-1: Manufacturer: syz [ 2613.177855][ T8551] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 2613.189134][ T8209] cdc_wdm 3-1:1.0: skipping garbage [ 2613.230298][ T8209] cdc_wdm 3-1:1.0: skipping garbage [ 2613.235966][ T8209] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 2613.474980][ T8209] usb 3-1: USB disconnect, device number 92 [ 2614.711447][T21748] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 2614.954165][T21748] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2614.970367][T21748] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 62, changing to 9 [ 2615.013779][T21748] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2615.050269][T21748] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2615.092971][T21748] usb 3-1: Product: syz [ 2615.097270][T21748] usb 3-1: Manufacturer: syz [ 2615.111081][T21748] usb 3-1: SerialNumber: syz [ 2615.230581][T21748] usb 3-1: bad CDC descriptors [ 2615.451017][ T8601] fuse: Bad value for 'fd' [ 2615.520890][ T8605] loop4: detected capacity change from 0 to 7 [ 2615.598211][ T8212] Dev loop4: unable to read RDB block 7 [ 2615.605131][ T8212] loop4: unable to read partition table [ 2615.611163][ T8212] loop4: partition table beyond EOD, truncated [ 2615.619989][ T8605] Dev loop4: unable to read RDB block 7 [ 2615.626085][ T8605] loop4: unable to read partition table [ 2615.632269][ T8605] loop4: partition table beyond EOD, truncated [ 2615.646615][ T8605] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 2615.887177][ T8610] FAULT_INJECTION: forcing a failure. [ 2615.887177][ T8610] name failslab, interval 1, probability 0, space 0, times 0 [ 2615.904974][ T8610] CPU: 0 UID: 0 PID: 8610 Comm: syz.6.9339 Not tainted 6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 PREEMPT(full) [ 2615.905001][ T8610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2615.905013][ T8610] Call Trace: [ 2615.905022][ T8610] [ 2615.905031][ T8610] dump_stack_lvl+0x189/0x250 [ 2615.905058][ T8610] ? __pfx____ratelimit+0x10/0x10 [ 2615.905081][ T8610] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2615.905103][ T8610] ? __pfx__printk+0x10/0x10 [ 2615.905140][ T8610] ? __pfx___might_resched+0x10/0x10 [ 2615.905157][ T8610] ? fs_reclaim_acquire+0x7d/0x100 [ 2615.905190][ T8610] should_fail_ex+0x414/0x560 [ 2615.905218][ T8610] should_failslab+0xa8/0x100 [ 2615.905245][ T8610] __kmalloc_noprof+0xcb/0x4f0 [ 2615.905268][ T8610] ? security_inode_init_security+0x107/0x3f0 [ 2615.905293][ T8610] security_inode_init_security+0x107/0x3f0 [ 2615.905313][ T8610] ? __pfx_shmem_initxattrs+0x10/0x10 [ 2615.905336][ T8610] ? __pfx_security_inode_init_security+0x10/0x10 [ 2615.905355][ T8610] ? set_cached_acl+0xd2/0x180 [ 2615.905377][ T8610] ? simple_acl_create+0x184/0x1b0 [ 2615.905404][ T8610] shmem_mknod+0x1f6/0x3e0 [ 2615.905429][ T8610] shmem_mkdir+0x33/0x70 [ 2615.905449][ T8610] vfs_mkdir+0x306/0x510 [ 2615.905489][ T8610] do_mkdirat+0x247/0x590 [ 2615.905515][ T8610] ? __pfx_do_mkdirat+0x10/0x10 [ 2615.905540][ T8610] ? getname_flags+0x1e5/0x540 [ 2615.905562][ T8610] __ia32_sys_mkdirat+0x87/0xa0 [ 2615.905587][ T8610] __do_fast_syscall_32+0xb6/0x2b0 [ 2615.905612][ T8610] ? lockdep_hardirqs_on+0x9c/0x150 [ 2615.905640][ T8610] do_fast_syscall_32+0x34/0x80 [ 2615.905664][ T8610] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2615.905686][ T8610] RIP: 0023:0xf706e539 [ 2615.905704][ T8610] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 2615.905719][ T8610] RSP: 002b:00000000f545e3c8 EFLAGS: 00000206 ORIG_RAX: 0000000000000128 [ 2615.905739][ T8610] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000800000c0 [ 2615.905753][ T8610] RDX: 00000000000001ff RSI: 0000000080002880 RDI: 0000000000000000 [ 2615.905765][ T8610] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2615.905776][ T8610] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2615.905787][ T8610] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2615.905816][ T8610] [ 2616.217031][ T8612] binder: 8611:8612 unknown command 0 [ 2616.226908][ T8612] binder: 8611:8612 ioctl c0306201 80000080 returned -22 [ 2616.235458][ T8612] binder: BINDER_SET_CONTEXT_MGR already set [ 2616.241735][ T8612] binder: 8611:8612 ioctl 4018620d 80000040 returned -16 [ 2616.300087][ T5975] usb 3-1: USB disconnect, device number 93 [ 2616.350540][ T5231] Dev loop4: unable to read RDB block 7 [ 2616.377461][ T5231] loop4: unable to read partition table [ 2616.383912][ T5231] loop4: partition table beyond EOD, truncated [ 2616.482458][ T8623] netlink: 8 bytes leftover after parsing attributes in process `syz.6.9344'. [ 2616.581110][ T5984] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 2616.758775][ T5984] usb 5-1: Using ep0 maxpacket: 16 [ 2616.842573][ T5984] usb 5-1: config 0 has an invalid interface number: 165 but max is 0 [ 2616.850794][ T5984] usb 5-1: config 0 has no interface number 0 [ 2616.924059][ T5984] usb 5-1: New USB device found, idVendor=0781, idProduct=0100, bcdDevice= 1.00 [ 2617.046664][ T5984] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2617.066401][ T5984] usb 5-1: Product: syz [ 2617.090360][ T5984] usb 5-1: Manufacturer: syz [ 2617.173035][ T5984] usb 5-1: SerialNumber: syz [ 2617.306467][ T5984] usb 5-1: config 0 descriptor?? [ 2617.723548][ T8619] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2617.741556][ T8619] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2617.871250][ T5931] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 2618.103821][ T5931] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2618.128390][ T5931] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2618.168746][ T5931] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2618.245339][ T5931] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2618.307267][ T5931] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2618.373513][ T5984] usb-storage 5-1:0.165: USB Mass Storage device detected [ 2618.395389][ T5931] usb 6-1: config 0 descriptor?? [ 2618.419406][ T5984] usb-storage 5-1:0.165: Quirks match for vid 0781 pid 0100: 1 [ 2618.499421][ T5984] usb 5-1: USB disconnect, device number 45 [ 2618.855116][ T5931] plantronics 0003:047F:FFFF.00A3: reserved main item tag 0xd [ 2618.879724][ T5931] plantronics 0003:047F:FFFF.00A3: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 2619.497645][ T8657] binder: 8636:8657 ioctl c0306201 80000540 returned -14 [ 2620.024179][ T5984] usb 3-1: new full-speed USB device number 94 using dummy_hcd [ 2620.161655][ T5984] usb 3-1: device descriptor read/64, error -71 [ 2620.361043][T21748] usb 6-1: reset high-speed USB device number 63 using dummy_hcd [ 2620.411103][ T5984] usb 3-1: new full-speed USB device number 95 using dummy_hcd [ 2620.491630][T21748] usb 6-1: device descriptor read/64, error -32 [ 2620.541055][ T5984] usb 3-1: device descriptor read/64, error -71 [ 2620.652539][ T5984] usb usb3-port1: attempt power cycle [ 2620.731884][T21748] usb 6-1: reset high-speed USB device number 63 using dummy_hcd [ 2620.871191][T18030] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 2620.879444][T21748] usb 6-1: device descriptor read/64, error -32 [ 2621.001636][ T5984] usb 3-1: new full-speed USB device number 96 using dummy_hcd [ 2621.042822][ T5984] usb 3-1: device descriptor read/8, error -71 [ 2621.060850][T18030] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2621.072869][T18030] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 62, changing to 9 [ 2621.091696][T18030] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2621.101289][T18030] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2621.109433][T18030] usb 5-1: Product: syz [ 2621.116208][T18030] usb 5-1: Manufacturer: syz [ 2621.120811][T18030] usb 5-1: SerialNumber: syz [ 2621.131148][T21748] usb 6-1: reset high-speed USB device number 63 using dummy_hcd [ 2621.147400][T18030] usb 5-1: bad CDC descriptors [ 2621.342026][T21748] usb 6-1: device descriptor read/8, error -32 [ 2621.401093][ T5984] usb 3-1: new full-speed USB device number 97 using dummy_hcd [ 2621.440047][ T5984] usb 3-1: device descriptor read/8, error -71 [ 2621.601812][ T5984] usb usb3-port1: unable to enumerate USB device [ 2621.811284][T21748] usb 6-1: reset high-speed USB device number 63 using dummy_hcd [ 2621.917522][T21748] usb 6-1: device reset changed ep0 maxpacket size! [ 2622.003294][ T5975] usb 5-1: USB disconnect, device number 46 [ 2622.003487][ T5931] usb 6-1: USB disconnect, device number 63 [ 2622.297455][ T8673] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2622.334243][ T8690] pim6reg1: entered promiscuous mode [ 2622.339638][ T8690] pim6reg1: entered allmulticast mode [ 2622.401239][ T5931] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 2622.561078][ T5931] usb 6-1: Using ep0 maxpacket: 8 [ 2622.567906][ T5931] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2622.579173][ T5931] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2622.588334][ T5931] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2622.599438][ T5931] usb 6-1: config 0 descriptor?? [ 2622.651413][T21748] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 2622.805341][T21748] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2622.833538][T21748] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 2622.844187][T21748] usb 5-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 2622.858834][ T5931] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 2622.870388][T21748] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2622.917108][T21748] usb 5-1: config 0 descriptor?? [ 2623.815018][ T7914] usb 6-1: USB disconnect, device number 64 [ 2623.838394][T21748] Bluetooth: Can't get state to change to load ram patch err [ 2623.870836][T21748] Bluetooth: Loading patch file failed [ 2623.886679][T21748] ath3k 5-1:0.0: probe with driver ath3k failed with error -71 [ 2623.947608][T21748] usb 5-1: USB disconnect, device number 47 [ 2625.600012][ T8730] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 2626.439423][ T8740] tipc: Started in network mode [ 2626.444524][ T8740] tipc: Node identity 4edc7abda099, cluster identity 4711 [ 2626.461256][ T8740] tipc: Enabled bearer , priority 0 [ 2626.474756][ T8740] syzkaller0: entered promiscuous mode [ 2626.480320][ T8740] syzkaller0: entered allmulticast mode [ 2626.896420][ T8747] tipc: Resetting bearer [ 2626.999283][ T8738] tipc: Resetting bearer [ 2627.083748][ T8738] tipc: Disabling bearer [ 2627.110662][ T8755] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 2627.268817][ T8765] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9382'. [ 2627.390839][ T8770] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9379'. [ 2627.561072][ T7914] usb 7-1: new high-speed USB device number 66 using dummy_hcd [ 2627.806108][ T7914] usb 7-1: Using ep0 maxpacket: 32 [ 2627.856542][ T7914] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2627.875212][ T7914] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2627.997915][ T7914] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2628.084706][ T7914] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2628.657436][ T7914] usb 7-1: config 0 descriptor?? [ 2628.678721][ T7914] hub 7-1:0.0: USB hub found [ 2628.893792][ T5931] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 2628.906013][ T7914] hub 7-1:0.0: config failed, can't read hub descriptor (err -90) [ 2629.071290][ T5931] usb 5-1: Using ep0 maxpacket: 16 [ 2629.079545][ T5931] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2629.098359][ T5931] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 2629.161923][ T5931] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2629.209103][ T5931] usb 5-1: config 0 descriptor?? [ 2629.323344][ T7914] hid-generic 0003:046D:C31C.00A4: item fetching failed at offset 0/1 [ 2629.336473][ T7914] hid-generic 0003:046D:C31C.00A4: probe with driver hid-generic failed with error -22 [ 2629.778631][ T5931] mcp2221 0003:04D8:00DD.00A5: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 2629.850115][ T8783] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2629.866064][ T8783] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2630.391126][ T5931] usb 5-1: USB disconnect, device number 48 [ 2630.573119][ T8809] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9391'. [ 2630.715673][ T8810] netlink: 100 bytes leftover after parsing attributes in process `syz.2.9391'. [ 2630.803069][ T8810] netlink: 100 bytes leftover after parsing attributes in process `syz.2.9391'. [ 2631.228568][ T8814] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9393'. [ 2631.581395][ T7914] usb 7-1: USB disconnect, device number 66 [ 2632.121051][ T5931] usb 7-1: new high-speed USB device number 67 using dummy_hcd [ 2632.458108][ T5931] usb 7-1: config 0 has no interfaces? [ 2632.471034][ T5931] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2632.671010][ T5931] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2632.699512][ T5931] usb 7-1: config 0 descriptor?? [ 2633.475606][ T8835] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2633.525353][ T8835] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2633.545230][ T7914] usb 7-1: USB disconnect, device number 67 [ 2634.251106][ T5975] usb 7-1: new high-speed USB device number 68 using dummy_hcd [ 2634.461292][ T5975] usb 7-1: Using ep0 maxpacket: 16 [ 2634.629306][ T5975] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2634.669724][ T5975] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2634.701551][ T5975] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 1.40 [ 2634.711049][ T5975] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2634.732258][ T5975] usb 7-1: Product: syz [ 2634.745626][ T5975] usb 7-1: Manufacturer: syz [ 2634.761169][ T5975] usb 7-1: SerialNumber: syz [ 2634.874404][ T5984] hid-generic 0000:0003:0000.00A6: unknown main item tag 0x0 [ 2634.888543][ T5984] hid-generic 0000:0003:0000.00A6: unknown main item tag 0x0 [ 2634.936569][ T5984] hid-generic 0000:0003:0000.00A6: hidraw0: HID v0.03 Device [syz0] on syz0 [ 2635.141247][ T5975] usb 7-1: 0:2 : does not exist [ 2635.146251][ T5975] usb 7-1: unit 5 not found! [ 2635.300409][ T5975] usb 7-1: USB disconnect, device number 68 [ 2635.528551][ T8212] udevd[8212]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2635.549477][ T8875] FAULT_INJECTION: forcing a failure. [ 2635.549477][ T8875] name failslab, interval 1, probability 0, space 0, times 0 [ 2635.578620][ T8875] CPU: 1 UID: 0 PID: 8875 Comm: syz.6.9408 Not tainted 6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 PREEMPT(full) [ 2635.578649][ T8875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2635.578661][ T8875] Call Trace: [ 2635.578669][ T8875] [ 2635.578678][ T8875] dump_stack_lvl+0x189/0x250 [ 2635.578704][ T8875] ? __pfx____ratelimit+0x10/0x10 [ 2635.578727][ T8875] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2635.578748][ T8875] ? __pfx__printk+0x10/0x10 [ 2635.578777][ T8875] ? __pfx___might_resched+0x10/0x10 [ 2635.578800][ T8875] should_fail_ex+0x414/0x560 [ 2635.578828][ T8875] should_failslab+0xa8/0x100 [ 2635.578855][ T8875] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 2635.578877][ T8875] ? __alloc_skb+0x112/0x2d0 [ 2635.578907][ T8875] __alloc_skb+0x112/0x2d0 [ 2635.578935][ T8875] netlink_sendmsg+0x5c6/0xb30 [ 2635.578970][ T8875] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2635.578997][ T8875] ? __import_iovec+0x5d4/0x7f0 [ 2635.579023][ T8875] ? aa_sock_msg_perm+0xf1/0x1d0 [ 2635.579051][ T8875] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2635.579070][ T8875] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2635.579095][ T8875] __sock_sendmsg+0x21c/0x270 [ 2635.579121][ T8875] ____sys_sendmsg+0x505/0x830 [ 2635.579145][ T8875] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2635.579180][ T8875] ___sys_sendmsg+0x21f/0x2a0 [ 2635.579201][ T8875] ? __pfx____sys_sendmsg+0x10/0x10 [ 2635.579256][ T8875] ? __fget_files+0x2a/0x420 [ 2635.579271][ T8875] ? __fget_files+0x3a0/0x420 [ 2635.579297][ T8875] __sys_sendmsg+0x164/0x220 [ 2635.579318][ T8875] ? __pfx___sys_sendmsg+0x10/0x10 [ 2635.579352][ T8875] ? lockdep_hardirqs_on+0x9c/0x150 [ 2635.579379][ T8875] __do_fast_syscall_32+0xb6/0x2b0 [ 2635.579403][ T8875] ? lockdep_hardirqs_on+0x9c/0x150 [ 2635.579430][ T8875] do_fast_syscall_32+0x34/0x80 [ 2635.579454][ T8875] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2635.579475][ T8875] RIP: 0023:0xf706e539 [ 2635.579491][ T8875] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 2635.579507][ T8875] RSP: 002b:00000000f545e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2635.579527][ T8875] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000140 [ 2635.579541][ T8875] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 2635.579552][ T8875] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2635.579562][ T8875] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2635.579574][ T8875] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2635.579605][ T8875] [ 2636.930983][ T30] audit: type=1326 audit(1755087258.002:19010): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8895 comm="syz.5.9413" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 2636.998597][ T30] audit: type=1326 audit(1755087258.002:19011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8895 comm="syz.5.9413" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 2637.021319][ T30] audit: type=1326 audit(1755087258.002:19012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8895 comm="syz.5.9413" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 2637.230296][ T8904] hub 9-0:1.0: USB hub found [ 2637.236058][ T8904] hub 9-0:1.0: 1 port detected [ 2637.332873][ T30] audit: type=1326 audit(1755087258.002:19013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8895 comm="syz.5.9413" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 2637.485725][ T30] audit: type=1326 audit(1755087258.002:19014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8895 comm="syz.5.9413" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 2637.514881][ T30] audit: type=1326 audit(1755087258.002:19015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8895 comm="syz.5.9413" exe="/root/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 2637.542253][ T30] audit: type=1326 audit(1755087258.002:19016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8895 comm="syz.5.9413" exe="/root/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 2637.666283][ T30] audit: type=1326 audit(1755087258.002:19017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8895 comm="syz.5.9413" exe="/root/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 2637.764914][ T30] audit: type=1326 audit(1755087258.002:19018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8895 comm="syz.5.9413" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 2637.812384][ T30] audit: type=1326 audit(1755087258.002:19019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8895 comm="syz.5.9413" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf708e539 code=0x7ffc0000 [ 2638.044114][ T8914] KVM: debugfs: duplicate directory 8914-6 [ 2638.191040][ T7061] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 2638.289102][ T8920] netlink: 27 bytes leftover after parsing attributes in process `syz.6.9420'. [ 2638.344306][ T7061] usb 6-1: config 0 has no interfaces? [ 2638.349838][ T7061] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2638.377143][ T7061] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2638.397227][ T7061] usb 6-1: config 0 descriptor?? [ 2638.723791][ T8912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2638.781449][ T8912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2638.808137][ T7061] usb 6-1: USB disconnect, device number 65 [ 2639.331254][T18030] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 2639.491101][T18030] usb 6-1: Using ep0 maxpacket: 16 [ 2639.512797][T18030] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2639.548530][T18030] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2639.577198][T18030] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 1.40 [ 2639.588717][T18030] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2639.605809][T18030] usb 6-1: Product: syz [ 2639.610024][T18030] usb 6-1: Manufacturer: syz [ 2639.615608][T18030] usb 6-1: SerialNumber: syz [ 2640.068398][T18030] usb 6-1: 0:2 : does not exist [ 2640.086112][T18030] usb 6-1: unit 5 not found! [ 2640.784625][ T8973] FAULT_INJECTION: forcing a failure. [ 2640.784625][ T8973] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2640.824036][ T8973] CPU: 0 UID: 0 PID: 8973 Comm: syz.2.9437 Not tainted 6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 PREEMPT(full) [ 2640.824063][ T8973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2640.824074][ T8973] Call Trace: [ 2640.824081][ T8973] [ 2640.824089][ T8973] dump_stack_lvl+0x189/0x250 [ 2640.824113][ T8973] ? __pfx____ratelimit+0x10/0x10 [ 2640.824134][ T8973] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2640.824152][ T8973] ? __pfx__printk+0x10/0x10 [ 2640.824174][ T8973] ? __might_fault+0xb0/0x130 [ 2640.824205][ T8973] should_fail_ex+0x414/0x560 [ 2640.824235][ T8973] _copy_from_user+0x2d/0xb0 [ 2640.824252][ T8973] get_compat_msghdr+0xad/0x4a0 [ 2640.824282][ T8973] ? __pfx_get_compat_msghdr+0x10/0x10 [ 2640.824309][ T8973] ? rcu_is_watching+0x15/0xb0 [ 2640.824325][ T8973] ? ___sys_recvmsg+0x1c4/0x510 [ 2640.824350][ T8973] ___sys_recvmsg+0x17f/0x510 [ 2640.824371][ T8973] ? __pfx____sys_recvmsg+0x10/0x10 [ 2640.824411][ T8973] ? __fget_files+0x3a0/0x420 [ 2640.824436][ T8973] do_recvmmsg+0x36a/0x770 [ 2640.824462][ T8973] ? __pfx_do_recvmmsg+0x10/0x10 [ 2640.824493][ T8973] ? __pfx_vfs_write+0x10/0x10 [ 2640.824537][ T8973] __sys_recvmmsg+0x19d/0x280 [ 2640.824558][ T8973] ? __pfx___sys_recvmmsg+0x10/0x10 [ 2640.824574][ T8973] ? ksys_write+0x22a/0x250 [ 2640.824605][ T8973] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 2640.824628][ T8973] __do_fast_syscall_32+0xb6/0x2b0 [ 2640.824654][ T8973] ? lockdep_hardirqs_on+0x9c/0x150 [ 2640.824678][ T8973] do_fast_syscall_32+0x34/0x80 [ 2640.824701][ T8973] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2640.824720][ T8973] RIP: 0023:0xf70ee539 [ 2640.824736][ T8973] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 2640.824749][ T8973] RSP: 002b:00000000f54de55c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 2640.824766][ T8973] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 2640.824777][ T8973] RDX: 0000000000000220 RSI: 0000000000000100 RDI: 0000000000000000 [ 2640.824788][ T8973] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2640.824797][ T8973] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2640.824807][ T8973] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2640.824831][ T8973] [ 2641.058923][ C0] vkms_vblank_simulate: vblank timer overrun [ 2641.091086][ T7061] usb 7-1: new full-speed USB device number 69 using dummy_hcd [ 2641.264481][ T7061] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2641.275888][ T7061] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2641.286574][ T7061] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 2641.311556][ T7061] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2641.323300][T18030] usb 6-1: USB disconnect, device number 66 [ 2641.363939][ T7061] usb 7-1: config 0 descriptor?? [ 2641.393634][ T5975] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 2641.551303][ T5975] usb 3-1: Using ep0 maxpacket: 32 [ 2641.558996][ T5975] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2641.570805][ T5975] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2641.581699][ T5975] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2641.593944][ T5975] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2641.614218][ T5975] usb 3-1: config 0 descriptor?? [ 2641.630080][ T5975] hub 3-1:0.0: USB hub found [ 2641.829964][ T5975] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 2641.848901][ T7061] savu 0003:1E7D:2D5A.00A7: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.6-1/input0 [ 2643.231094][ T7061] usb 7-1: reset full-speed USB device number 69 using dummy_hcd [ 2644.688156][T27737] usb 7-1: USB disconnect, device number 69 [ 2644.929202][T27737] usb 7-1: new high-speed USB device number 70 using dummy_hcd [ 2645.117618][T27737] usb 7-1: config 0 interface 0 has no altsetting 0 [ 2645.124505][T27737] usb 7-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 2645.159606][ T9024] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2645.190161][T27737] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2645.207026][ T9032] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9454'. [ 2645.219788][ T9032] openvswitch: netlink: Message has 1 unknown bytes. [ 2645.238972][T27737] usb 7-1: config 0 descriptor?? [ 2645.253158][ T9032] netlink: 16 bytes leftover after parsing attributes in process `syz.5.9454'. [ 2645.262428][ T9032] netlink: 12 bytes leftover after parsing attributes in process `syz.5.9454'. [ 2645.271542][ T9032] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9454'. [ 2645.567451][ T5975] usbhid 3-1:0.0: can't add hid device: -71 [ 2645.674339][ T9042] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9456'. [ 2645.711485][ T5975] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 2645.792438][ T5975] usb 3-1: USB disconnect, device number 98 [ 2646.355772][ T5975] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 2646.396903][T27737] radio-keene 7-1:0.0: V4L2 device registered as radio48 [ 2646.513416][ T5975] usb 3-1: config 1 has an invalid descriptor of length 107, skipping remainder of the config [ 2646.524160][ T5975] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2646.660824][ T5984] usb 7-1: USB disconnect, device number 70 [ 2646.703640][ T5975] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 2646.721827][ T5975] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 2646.749031][ T5975] usb 3-1: SerialNumber: syz [ 2646.992875][ T9044] [ 2646.995235][ T9044] ===================================================== [ 2647.002156][ T9044] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 2647.009611][ T9044] 6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 Not tainted [ 2647.016794][ T9044] ----------------------------------------------------- [ 2647.023738][ T9044] syz.2.9457/9044 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 2647.031384][ T9044] ffff88807f12fde0 (&new->fa_lock){...-}-{3:3}, at: kill_fasync+0x199/0x4d0 [ 2647.040104][ T9044] [ 2647.040104][ T9044] and this task is already holding: [ 2647.047551][ T9044] ffff888076b04028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 2647.057408][ T9044] which would create a new lock dependency: [ 2647.063295][ T9044] (&client->buffer_lock){..-.}-{3:3} -> (&new->fa_lock){...-}-{3:3} [ 2647.071647][ T9044] [ 2647.071647][ T9044] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 2647.081106][ T9044] (&client->buffer_lock){..-.}-{3:3} [ 2647.081131][ T9044] [ 2647.081131][ T9044] ... which became SOFTIRQ-irq-safe at: [ 2647.094206][ T9044] lock_acquire+0x120/0x360 [ 2647.098792][ T9044] _raw_spin_lock+0x2e/0x40 [ 2647.103370][ T9044] evdev_pass_values+0xb9/0xbd0 [ 2647.108397][ T9044] evdev_events+0x1e6/0x340 [ 2647.112989][ T9044] input_pass_values+0x285/0x890 [ 2647.118014][ T9044] input_event_dispose+0x3e5/0x6b0 [ 2647.123211][ T9044] input_inject_event+0x1dd/0x340 [ 2647.128319][ T9044] kd_sound_helper+0x101/0x210 [ 2647.133159][ T9044] input_handler_for_each_handle+0xfe/0x1c0 [ 2647.139133][ T9044] call_timer_fn+0x17e/0x5f0 [ 2647.143799][ T9044] __run_timer_base+0x61a/0x860 [ 2647.148728][ T9044] run_timer_softirq+0xb7/0x180 [ 2647.153652][ T9044] handle_softirqs+0x283/0x870 [ 2647.158500][ T9044] __irq_exit_rcu+0xca/0x1f0 [ 2647.163172][ T9044] irq_exit_rcu+0x9/0x30 [ 2647.167496][ T9044] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 2647.173206][ T9044] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2647.179276][ T9044] _raw_spin_unlock_irqrestore+0xa8/0x110 [ 2647.185153][ T9044] __wake_up_common_lock+0x190/0x1f0 [ 2647.190627][ T9044] __unix_dgram_recvmsg+0x486/0xd60 [ 2647.195930][ T9044] sock_recvmsg_nosec+0x183/0x1c0 [ 2647.201065][ T9044] ____sys_recvmsg+0x3aa/0x460 [ 2647.205917][ T9044] ___sys_recvmsg+0x1b5/0x510 [ 2647.210764][ T9044] do_recvmmsg+0x36a/0x770 [ 2647.215274][ T9044] __sys_recvmmsg+0x19d/0x280 [ 2647.220048][ T9044] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 2647.226314][ T9044] __do_fast_syscall_32+0xb6/0x2b0 [ 2647.231515][ T9044] do_fast_syscall_32+0x34/0x80 [ 2647.236551][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2647.242961][ T9044] [ 2647.242961][ T9044] to a SOFTIRQ-irq-unsafe lock: [ 2647.249962][ T9044] (tasklist_lock){.+.+}-{3:3} [ 2647.249986][ T9044] [ 2647.249986][ T9044] ... which became SOFTIRQ-irq-unsafe at: [ 2647.262679][ T9044] ... [ 2647.262688][ T9044] lock_acquire+0x120/0x360 [ 2647.269920][ T9044] _raw_read_lock+0x36/0x50 [ 2647.274510][ T9044] __do_wait+0xde/0x740 [ 2647.278753][ T9044] do_wait+0x1f8/0x520 [ 2647.282997][ T9044] kernel_wait+0xab/0x170 [ 2647.287415][ T9044] call_usermodehelper_exec_work+0xbe/0x230 [ 2647.293485][ T9044] process_scheduled_works+0xade/0x17b0 [ 2647.299199][ T9044] worker_thread+0x8a0/0xda0 [ 2647.303871][ T9044] kthread+0x70e/0x8a0 [ 2647.308012][ T9044] ret_from_fork+0x3f9/0x770 [ 2647.312675][ T9044] ret_from_fork_asm+0x1a/0x30 [ 2647.317526][ T9044] [ 2647.317526][ T9044] other info that might help us debug this: [ 2647.317526][ T9044] [ 2647.327824][ T9044] Chain exists of: [ 2647.327824][ T9044] &client->buffer_lock --> &new->fa_lock --> tasklist_lock [ 2647.327824][ T9044] [ 2647.340958][ T9044] Possible interrupt unsafe locking scenario: [ 2647.340958][ T9044] [ 2647.349274][ T9044] CPU0 CPU1 [ 2647.354632][ T9044] ---- ---- [ 2647.360074][ T9044] lock(tasklist_lock); [ 2647.364325][ T9044] local_irq_disable(); [ 2647.371169][ T9044] lock(&client->buffer_lock); [ 2647.378638][ T9044] lock(&new->fa_lock); [ 2647.385403][ T9044] [ 2647.388846][ T9044] lock(&client->buffer_lock); [ 2647.393870][ T9044] [ 2647.393870][ T9044] *** DEADLOCK *** [ 2647.393870][ T9044] [ 2647.402024][ T9044] 7 locks held by syz.2.9457/9044: [ 2647.407215][ T9044] #0: ffff888029698118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_write+0x1a1/0x480 [ 2647.416441][ T9044] #1: ffff888146ebb230 (&dev->event_lock#2){..-.}-{3:3}, at: input_inject_event+0xa5/0x340 [ 2647.426530][ T9044] #2: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xb6/0x340 [ 2647.436195][ T9044] #3: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: input_pass_values+0x8d/0x890 [ 2647.445858][ T9044] #4: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: evdev_events+0x79/0x340 [ 2647.455091][ T9044] #5: ffff888076b04028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 2647.465266][ T9044] #6: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x53/0x4d0 [ 2647.474396][ T9044] [ 2647.474396][ T9044] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 2647.484791][ T9044] -> (&client->buffer_lock){..-.}-{3:3} { [ 2647.490517][ T9044] IN-SOFTIRQ-W at: [ 2647.494481][ T9044] lock_acquire+0x120/0x360 [ 2647.500654][ T9044] _raw_spin_lock+0x2e/0x40 [ 2647.506827][ T9044] evdev_pass_values+0xb9/0xbd0 [ 2647.513324][ T9044] evdev_events+0x1e6/0x340 [ 2647.519467][ T9044] input_pass_values+0x285/0x890 [ 2647.526301][ T9044] input_event_dispose+0x3e5/0x6b0 [ 2647.533067][ T9044] input_inject_event+0x1dd/0x340 [ 2647.539732][ T9044] kd_sound_helper+0x101/0x210 [ 2647.546222][ T9044] input_handler_for_each_handle+0xfe/0x1c0 [ 2647.554015][ T9044] call_timer_fn+0x17e/0x5f0 [ 2647.560248][ T9044] __run_timer_base+0x61a/0x860 [ 2647.566752][ T9044] run_timer_softirq+0xb7/0x180 [ 2647.573250][ T9044] handle_softirqs+0x283/0x870 [ 2647.579651][ T9044] __irq_exit_rcu+0xca/0x1f0 [ 2647.585893][ T9044] irq_exit_rcu+0x9/0x30 [ 2647.591860][ T9044] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 2647.599228][ T9044] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2647.606854][ T9044] _raw_spin_unlock_irqrestore+0xa8/0x110 [ 2647.614215][ T9044] __wake_up_common_lock+0x190/0x1f0 [ 2647.621226][ T9044] __unix_dgram_recvmsg+0x486/0xd60 [ 2647.628247][ T9044] sock_recvmsg_nosec+0x183/0x1c0 [ 2647.634930][ T9044] ____sys_recvmsg+0x3aa/0x460 [ 2647.641333][ T9044] ___sys_recvmsg+0x1b5/0x510 [ 2647.647645][ T9044] do_recvmmsg+0x36a/0x770 [ 2647.653695][ T9044] __sys_recvmmsg+0x19d/0x280 [ 2647.660008][ T9044] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 2647.667821][ T9044] __do_fast_syscall_32+0xb6/0x2b0 [ 2647.674666][ T9044] do_fast_syscall_32+0x34/0x80 [ 2647.681166][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2647.689148][ T9044] INITIAL USE at: [ 2647.693056][ T9044] lock_acquire+0x120/0x360 [ 2647.699313][ T9044] _raw_spin_lock_irqsave+0xa7/0xf0 [ 2647.706076][ T9044] evdev_ioctl_handler+0x1969/0x1f10 [ 2647.712945][ T9044] __ia32_compat_sys_ioctl+0x543/0x840 [ 2647.720058][ T9044] __do_fast_syscall_32+0xb6/0x2b0 [ 2647.726744][ T9044] do_fast_syscall_32+0x34/0x80 [ 2647.733598][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2647.741595][ T9044] } [ 2647.744101][ T9044] ... key at: [] evdev_open.__key.25+0x0/0x20 [ 2647.752334][ T9044] [ 2647.752334][ T9044] the dependencies between the lock to be acquired [ 2647.752342][ T9044] and SOFTIRQ-irq-unsafe lock: [ 2647.765833][ T9044] -> (tasklist_lock){.+.+}-{3:3} { [ 2647.771125][ T9044] HARDIRQ-ON-R at: [ 2647.775350][ T9044] lock_acquire+0x120/0x360 [ 2647.781846][ T9044] _raw_read_lock+0x36/0x50 [ 2647.788421][ T9044] __do_wait+0xde/0x740 [ 2647.794560][ T9044] do_wait+0x1f8/0x520 [ 2647.800632][ T9044] kernel_wait+0xab/0x170 [ 2647.806956][ T9044] call_usermodehelper_exec_work+0xbe/0x230 [ 2647.814840][ T9044] process_scheduled_works+0xade/0x17b0 [ 2647.822384][ T9044] worker_thread+0x8a0/0xda0 [ 2647.828961][ T9044] kthread+0x70e/0x8a0 [ 2647.835024][ T9044] ret_from_fork+0x3f9/0x770 [ 2647.841697][ T9044] ret_from_fork_asm+0x1a/0x30 [ 2647.848533][ T9044] SOFTIRQ-ON-R at: [ 2647.852675][ T9044] lock_acquire+0x120/0x360 [ 2647.859163][ T9044] _raw_read_lock+0x36/0x50 [ 2647.865710][ T9044] __do_wait+0xde/0x740 [ 2647.872125][ T9044] do_wait+0x1f8/0x520 [ 2647.878208][ T9044] kernel_wait+0xab/0x170 [ 2647.884546][ T9044] call_usermodehelper_exec_work+0xbe/0x230 [ 2647.892450][ T9044] process_scheduled_works+0xade/0x17b0 [ 2647.900005][ T9044] worker_thread+0x8a0/0xda0 [ 2647.906606][ T9044] kthread+0x70e/0x8a0 [ 2647.912695][ T9044] ret_from_fork+0x3f9/0x770 [ 2647.919273][ T9044] ret_from_fork_asm+0x1a/0x30 [ 2647.926038][ T9044] INITIAL USE at: [ 2647.930198][ T9044] lock_acquire+0x120/0x360 [ 2647.936612][ T9044] _raw_write_lock_irq+0xa2/0xf0 [ 2647.943540][ T9044] copy_process+0x224f/0x3c00 [ 2647.950150][ T9044] kernel_clone+0x21e/0x840 [ 2647.956741][ T9044] user_mode_thread+0xdd/0x140 [ 2647.963505][ T9044] rest_init+0x23/0x300 [ 2647.969559][ T9044] start_kernel+0x3a9/0x410 [ 2647.975983][ T9044] x86_64_start_reservations+0x24/0x30 [ 2647.983341][ T9044] x86_64_start_kernel+0x143/0x1c0 [ 2647.990439][ T9044] common_startup_64+0x13e/0x147 [ 2647.997278][ T9044] INITIAL READ USE at: [ 2648.001772][ T9044] lock_acquire+0x120/0x360 [ 2648.008613][ T9044] _raw_read_lock+0x36/0x50 [ 2648.015466][ T9044] __do_wait+0xde/0x740 [ 2648.022051][ T9044] do_wait+0x1f8/0x520 [ 2648.028475][ T9044] kernel_wait+0xab/0x170 [ 2648.035206][ T9044] call_usermodehelper_exec_work+0xbe/0x230 [ 2648.043601][ T9044] process_scheduled_works+0xade/0x17b0 [ 2648.051480][ T9044] worker_thread+0x8a0/0xda0 [ 2648.058404][ T9044] kthread+0x70e/0x8a0 [ 2648.064893][ T9044] ret_from_fork+0x3f9/0x770 [ 2648.071813][ T9044] ret_from_fork_asm+0x1a/0x30 [ 2648.078916][ T9044] } [ 2648.081660][ T9044] ... key at: [] tasklist_lock+0x18/0x40 [ 2648.089988][ T9044] ... acquired at: [ 2648.093952][ T9044] lock_acquire+0x120/0x360 [ 2648.098621][ T9044] _raw_read_lock+0x36/0x50 [ 2648.103291][ T9044] send_sigurg+0x12b/0x420 [ 2648.107875][ T9044] sk_send_sigurg+0x6c/0x2e0 [ 2648.112625][ T9044] queue_oob+0x420/0x4f0 [ 2648.117027][ T9044] unix_stream_sendmsg+0xc3f/0xdf0 [ 2648.122388][ T9044] __sock_sendmsg+0x21c/0x270 [ 2648.127229][ T9044] ____sys_sendmsg+0x52d/0x830 [ 2648.132241][ T9044] ___sys_sendmsg+0x21f/0x2a0 [ 2648.137077][ T9044] __sys_sendmmsg+0x28e/0x430 [ 2648.141909][ T9044] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 2648.147654][ T9044] __do_fast_syscall_32+0xb6/0x2b0 [ 2648.152945][ T9044] do_fast_syscall_32+0x34/0x80 [ 2648.157959][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2648.164447][ T9044] [ 2648.166755][ T9044] -> (&f_owner->lock){....}-{3:3} { [ 2648.172040][ T9044] INITIAL USE at: [ 2648.176006][ T9044] lock_acquire+0x120/0x360 [ 2648.182244][ T9044] _raw_write_lock_irq+0xa2/0xf0 [ 2648.188913][ T9044] __f_setown+0x67/0x370 [ 2648.194887][ T9044] generic_setlease+0xd60/0x1240 [ 2648.201547][ T9044] fcntl_setlease+0x3a2/0x4c0 [ 2648.207945][ T9044] do_fcntl+0x6a9/0x1910 [ 2648.213910][ T9044] do_compat_fcntl64+0x477/0x720 [ 2648.220586][ T9044] __do_fast_syscall_32+0xb6/0x2b0 [ 2648.227425][ T9044] do_fast_syscall_32+0x34/0x80 [ 2648.234013][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2648.242082][ T9044] INITIAL READ USE at: [ 2648.246514][ T9044] lock_acquire+0x120/0x360 [ 2648.253182][ T9044] _raw_read_lock_irqsave+0xaf/0x100 [ 2648.260633][ T9044] send_sigio+0x38/0x370 [ 2648.267054][ T9044] kill_fasync+0x24d/0x4d0 [ 2648.273653][ T9044] sock_wake_async+0x137/0x160 [ 2648.280604][ T9044] sk_wake_async+0x184/0x280 [ 2648.287354][ T9044] unix_release_sock+0x768/0xd30 [ 2648.294454][ T9044] unix_release+0x92/0xd0 [ 2648.301116][ T9044] sock_close+0xc0/0x240 [ 2648.307596][ T9044] __fput+0x449/0xa70 [ 2648.313735][ T9044] task_work_run+0x1d4/0x260 [ 2648.320487][ T9044] get_signal+0x11ed/0x1340 [ 2648.327147][ T9044] arch_do_signal_or_restart+0x9a/0x750 [ 2648.334878][ T9044] exit_to_user_mode_loop+0x75/0x110 [ 2648.342324][ T9044] __do_fast_syscall_32+0x1f4/0x2b0 [ 2648.349777][ T9044] do_fast_syscall_32+0x34/0x80 [ 2648.356791][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2648.365286][ T9044] } [ 2648.368201][ T9044] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 2648.377128][ T9044] ... acquired at: [ 2648.381020][ T9044] lock_acquire+0x120/0x360 [ 2648.385689][ T9044] _raw_read_lock_irqsave+0xaf/0x100 [ 2648.391147][ T9044] send_sigio+0x38/0x370 [ 2648.395547][ T9044] kill_fasync+0x24d/0x4d0 [ 2648.400129][ T9044] sock_wake_async+0x137/0x160 [ 2648.405154][ T9044] sk_wake_async+0x184/0x280 [ 2648.410026][ T9044] unix_release_sock+0x768/0xd30 [ 2648.415211][ T9044] unix_release+0x92/0xd0 [ 2648.419710][ T9044] sock_close+0xc0/0x240 [ 2648.424113][ T9044] __fput+0x449/0xa70 [ 2648.428256][ T9044] task_work_run+0x1d4/0x260 [ 2648.433017][ T9044] get_signal+0x11ed/0x1340 [ 2648.437789][ T9044] arch_do_signal_or_restart+0x9a/0x750 [ 2648.443659][ T9044] exit_to_user_mode_loop+0x75/0x110 [ 2648.449135][ T9044] __do_fast_syscall_32+0x1f4/0x2b0 [ 2648.454597][ T9044] do_fast_syscall_32+0x34/0x80 [ 2648.459634][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2648.466129][ T9044] [ 2648.468440][ T9044] -> (&new->fa_lock){...-}-{3:3} { [ 2648.473551][ T9044] IN-SOFTIRQ-R at: [ 2648.477515][ T9044] lock_acquire+0x120/0x360 [ 2648.483744][ T9044] _raw_read_lock_irqsave+0xaf/0x100 [ 2648.490671][ T9044] kill_fasync+0x199/0x4d0 [ 2648.496743][ T9044] sock_wake_async+0x137/0x160 [ 2648.503145][ T9044] sock_def_readable+0x3bb/0x550 [ 2648.509720][ T9044] __sock_queue_rcv_skb+0x6a5/0x9c0 [ 2648.516562][ T9044] sock_queue_rcv_skb_reason+0xc0/0x190 [ 2648.523859][ T9044] raw_rcv+0x74b/0x9d0 [ 2648.529580][ T9044] raw_local_deliver+0x9ee/0xe90 [ 2648.536154][ T9044] ip_protocol_deliver_rcu+0x46/0x440 [ 2648.543368][ T9044] ip_local_deliver_finish+0x3bb/0x6f0 [ 2648.550486][ T9044] NF_HOOK+0x30c/0x3a0 [ 2648.556204][ T9044] NF_HOOK+0x30c/0x3a0 [ 2648.561914][ T9044] __netif_receive_skb+0x143/0x380 [ 2648.568691][ T9044] process_backlog+0x60e/0x14f0 [ 2648.575198][ T9044] __napi_poll+0xc7/0x360 [ 2648.581255][ T9044] net_rx_action+0x707/0xe30 [ 2648.587487][ T9044] handle_softirqs+0x283/0x870 [ 2648.593886][ T9044] do_softirq+0xec/0x180 [ 2648.599763][ T9044] __local_bh_enable_ip+0x17d/0x1c0 [ 2648.606606][ T9044] __dev_queue_xmit+0x1d79/0x3b50 [ 2648.613301][ T9044] ip_finish_output2+0xd03/0x1160 [ 2648.619966][ T9044] ip_output+0x2a1/0x3c0 [ 2648.625852][ T9044] ip_push_pending_frames+0xbe/0x150 [ 2648.632824][ T9044] raw_sendmsg+0x1440/0x18b0 [ 2648.639061][ T9044] __sock_sendmsg+0x19c/0x270 [ 2648.645380][ T9044] __sys_sendto+0x3bd/0x520 [ 2648.651524][ T9044] __ia32_sys_sendto+0xdd/0x100 [ 2648.658076][ T9044] __do_fast_syscall_32+0xb6/0x2b0 [ 2648.664852][ T9044] do_fast_syscall_32+0x34/0x80 [ 2648.671441][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2648.679404][ T9044] INITIAL USE at: [ 2648.683282][ T9044] lock_acquire+0x120/0x360 [ 2648.689344][ T9044] _raw_write_lock_irq+0xa2/0xf0 [ 2648.695835][ T9044] fasync_remove_entry+0xf1/0x1c0 [ 2648.702411][ T9044] lease_modify+0x1ca/0x3c0 [ 2648.708461][ T9044] locks_remove_file+0x4bf/0xea0 [ 2648.715037][ T9044] __fput+0x3ab/0xa70 [ 2648.720829][ T9044] task_work_run+0x1d4/0x260 [ 2648.727065][ T9044] exit_to_user_mode_loop+0xec/0x110 [ 2648.733938][ T9044] __do_fast_syscall_32+0x1f4/0x2b0 [ 2648.740800][ T9044] do_fast_syscall_32+0x34/0x80 [ 2648.747233][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2648.755123][ T9044] INITIAL READ USE at: [ 2648.759538][ T9044] lock_acquire+0x120/0x360 [ 2648.766047][ T9044] _raw_read_lock_irqsave+0xaf/0x100 [ 2648.773442][ T9044] kill_fasync+0x199/0x4d0 [ 2648.779846][ T9044] sock_wake_async+0x137/0x160 [ 2648.786692][ T9044] sk_wake_async+0x184/0x280 [ 2648.793801][ T9044] unix_release_sock+0x768/0xd30 [ 2648.800723][ T9044] unix_release+0x92/0xd0 [ 2648.807039][ T9044] sock_close+0xc0/0x240 [ 2648.813269][ T9044] __fput+0x449/0xa70 [ 2648.819236][ T9044] task_work_run+0x1d4/0x260 [ 2648.825816][ T9044] get_signal+0x11ed/0x1340 [ 2648.832302][ T9044] arch_do_signal_or_restart+0x9a/0x750 [ 2648.839860][ T9044] exit_to_user_mode_loop+0x75/0x110 [ 2648.847155][ T9044] __do_fast_syscall_32+0x1f4/0x2b0 [ 2648.854373][ T9044] do_fast_syscall_32+0x34/0x80 [ 2648.861231][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2648.869561][ T9044] } [ 2648.872081][ T9044] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 2648.880757][ T9044] ... acquired at: [ 2648.884571][ T9044] lock_acquire+0x120/0x360 [ 2648.889308][ T9044] _raw_read_lock_irqsave+0xaf/0x100 [ 2648.894797][ T9044] kill_fasync+0x199/0x4d0 [ 2648.899380][ T9044] evdev_pass_values+0x627/0xbd0 [ 2648.904483][ T9044] evdev_events+0x1e6/0x340 [ 2648.909238][ T9044] input_pass_values+0x285/0x890 [ 2648.914340][ T9044] input_event_dispose+0x330/0x6b0 [ 2648.919630][ T9044] input_inject_event+0x1dd/0x340 [ 2648.924833][ T9044] evdev_write+0x2fc/0x480 [ 2648.929440][ T9044] vfs_write+0x27b/0xb30 [ 2648.933860][ T9044] ksys_write+0x145/0x250 [ 2648.938368][ T9044] __do_fast_syscall_32+0xb6/0x2b0 [ 2648.943695][ T9044] do_fast_syscall_32+0x34/0x80 [ 2648.948712][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2648.955289][ T9044] [ 2648.957627][ T9044] [ 2648.957627][ T9044] stack backtrace: [ 2648.963540][ T9044] CPU: 1 UID: 0 PID: 9044 Comm: syz.2.9457 Not tainted 6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 PREEMPT(full) [ 2648.963562][ T9044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 2648.963571][ T9044] Call Trace: [ 2648.963581][ T9044] [ 2648.963589][ T9044] dump_stack_lvl+0x189/0x250 [ 2648.963611][ T9044] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2648.963629][ T9044] ? __pfx__printk+0x10/0x10 [ 2648.963651][ T9044] validate_chain+0x1f05/0x2140 [ 2648.963673][ T9044] __lock_acquire+0xab9/0xd20 [ 2648.963696][ T9044] ? kill_fasync+0x199/0x4d0 [ 2648.963711][ T9044] lock_acquire+0x120/0x360 [ 2648.963730][ T9044] ? kill_fasync+0x199/0x4d0 [ 2648.963749][ T9044] _raw_read_lock_irqsave+0xaf/0x100 [ 2648.963768][ T9044] ? kill_fasync+0x199/0x4d0 [ 2648.963783][ T9044] ? __pfx__raw_read_lock_irqsave+0x10/0x10 [ 2648.963800][ T9044] ? do_raw_spin_lock+0x121/0x290 [ 2648.963819][ T9044] kill_fasync+0x199/0x4d0 [ 2648.963834][ T9044] ? kill_fasync+0x53/0x4d0 [ 2648.963850][ T9044] evdev_pass_values+0x627/0xbd0 [ 2648.963877][ T9044] ? evdev_pass_values+0x5e1/0xbd0 [ 2648.963898][ T9044] evdev_events+0x1e6/0x340 [ 2648.963917][ T9044] ? evdev_events+0x79/0x340 [ 2648.963935][ T9044] ? input_pass_values+0x8d/0x890 [ 2648.963953][ T9044] input_pass_values+0x285/0x890 [ 2648.963974][ T9044] ? input_handle_event+0x70c/0xf30 [ 2648.963990][ T9044] input_event_dispose+0x330/0x6b0 [ 2648.964007][ T9044] input_inject_event+0x1dd/0x340 [ 2648.964023][ T9044] ? input_inject_event+0xb6/0x340 [ 2648.964039][ T9044] evdev_write+0x2fc/0x480 [ 2648.964061][ T9044] ? __pfx_evdev_write+0x10/0x10 [ 2648.964080][ T9044] ? bpf_lsm_file_permission+0x9/0x20 [ 2648.964098][ T9044] ? security_file_permission+0x75/0x290 [ 2648.964116][ T9044] ? rw_verify_area+0x255/0x4d0 [ 2648.964133][ T9044] ? __lock_acquire+0xab9/0xd20 [ 2648.964152][ T9044] ? __pfx_evdev_write+0x10/0x10 [ 2648.964171][ T9044] vfs_write+0x27b/0xb30 [ 2648.964191][ T9044] ? __pfx_vfs_write+0x10/0x10 [ 2648.964209][ T9044] ? __fget_files+0x2a/0x420 [ 2648.964222][ T9044] ? __fget_files+0x2a/0x420 [ 2648.964234][ T9044] ? __fget_files+0x3a0/0x420 [ 2648.964245][ T9044] ? __fget_files+0x2a/0x420 [ 2648.964260][ T9044] ksys_write+0x145/0x250 [ 2648.964278][ T9044] ? __pfx_ksys_write+0x10/0x10 [ 2648.964297][ T9044] ? lockdep_hardirqs_on+0x9c/0x150 [ 2648.964317][ T9044] __do_fast_syscall_32+0xb6/0x2b0 [ 2648.964337][ T9044] ? lockdep_hardirqs_on+0x9c/0x150 [ 2648.964356][ T9044] do_fast_syscall_32+0x34/0x80 [ 2648.964375][ T9044] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2648.964394][ T9044] RIP: 0023:0xf70ee539 [ 2648.964408][ T9044] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 2648.964422][ T9044] RSP: 002b:00000000f54de55c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 2648.964438][ T9044] RAX: ffffffffffffffda RBX: 000000000000000f RCX: 0000000080000040 [ 2648.964449][ T9044] RDX: 0000000000001068 RSI: 0000000000000000 RDI: 0000000000000000 [ 2648.964459][ T9044] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2648.964467][ T9044] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2648.964477][ T9044] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2648.964490][ T9044] [ 2649.290241][ T9053] IPVS: set_ctl: invalid protocol: 43 172.30.1.1:20001 [ 2649.517424][ T5975] usb 3-1: 0:2 : does not exist [ 2649.522539][ T5975] usb 3-1: unit 5: unexpected type 0x0c [ 2649.538316][ T5975] usb 3-1: USB disconnect, device number 99 [ 2649.554078][ T8212] udevd[8212]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2651.933406][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 2651.939745][ T1303] ieee802154 phy1 wpan1: encryption failed: -22