last executing test programs: 6.601410381s ago: executing program 2 (id=2330): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x4, @private1, 0xffffffff}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)="18", 0x1}], 0x1}}], 0x1, 0x8000) r3 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) write$sysctl(r3, &(0x7f0000000140)='1\x00', 0x2) shutdown(r2, 0x1) poll(&(0x7f00000000c0)=[{r2, 0x1040, 0x700}, {r1, 0x91f7}], 0x2, 0x406) 6.387170002s ago: executing program 2 (id=2332): openat$sequencer(0xffffffffffffff9c, 0x0, 0x80100, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x181603, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000000)=@e={0xff, 0xb, 0x0, 0x7, @SEQ_NOTEON=@special, 0x7, 0x8, 0xb}) r1 = mq_open(&(0x7f0000000040)='\x00', 0x40, 0x1a, &(0x7f00000000c0)={0x80000001, 0xfffffffffffffffa, 0x2, 0x1}) mq_notify(r1, &(0x7f0000000500)={0x0, 0x27, 0x2, @thr={&(0x7f00000003c0)="3de38014b8d09c23bdcec9c5056a7d68263629bbaaf59b8204d84eb6edbde849d0e410f88606279d483d7530f3508fe10ae203602dafb83a6e946d07d1ee785ec364d8c27fd0898130ab0d1b721cb4a3d3e17ba46efd701a59152d28a46db49a5d3fe4f0da1304224a7f6a69353d5b7fd49740cfc9a405ab5bb4445e22a0a480b7d013561d484948fc2c7aaa8e4a637d685558c3df912ebfef08", &(0x7f0000000480)="dd3016034dbbc3b085e9abe35be9586c5079583c4de0773dfc7a5cc24fda6f879b1aff5e3a8a679c4a68be701e02d489a854aef637820143835ff1d3fd5d4027f58609fbe9bb5024c85c7cf6d538f86faef1eccb3e2ef3a40d853b0ce956a8fffc51a7a658852ac4415194ca406095010c88"}}) 6.225652927s ago: executing program 2 (id=2335): syz_usb_connect$uac2(0x3, 0x9a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102000000200c201810400001020301090288000301018008080b0001010c200609040000000101200009240103000428000408240a05004000020c24030207030503050303001424060305689844a979bf"], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000010900010073797a30000000002c000000030a01010000000000000000010000000900010073797a3000000000090003756a9bca182b3b438457e80073797a300000000058000000060a010400000000000000000100000208000be40a0000ff2f0004802c0001800b00010065787468647200001c000280080001400000000c080004400000002205000200070000000900010073797a3000000000140000001100010000000000000000000700000abc6d75c6be14b4a77412f4187761e835c7d32d7696707741ff73520af56cdb9463bbc0176470fbb2749920ebef3d73b59acd198ee8265615aab8566be0c8f22b8593060cb6390a09b9bf74bdadc52ed641b2845941178c7880eaa07570c8b5e257a6164d5c47b2d73db54a0b9f5c9bd3db8ce4946f07ce507e636a189ccfd204603950c72fbe758a84b064f5e41b2b0d8f81ccfc6123e976be6bff791dcfe0c0c60360ca5a136ff6492b152dff2c086a60"], 0xcc}, 0x1, 0x0, 0x0, 0x20008840}, 0x4) 4.780684665s ago: executing program 0 (id=2341): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB="580000000c06030000"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004080) (fail_nth: 6) 3.95447611s ago: executing program 2 (id=2343): openat$sequencer(0xffffffffffffff9c, 0x0, 0x80100, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x181603, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000000)=@e={0xff, 0xb, 0x0, 0x7, @SEQ_NOTEON=@special, 0x7, 0x8, 0xb}) r1 = mq_open(&(0x7f0000000040)='\x00', 0x40, 0x1a, &(0x7f00000000c0)={0x80000001, 0xfffffffffffffffa, 0x2, 0x1}) mq_notify(r1, &(0x7f0000000500)={0x0, 0x27, 0x2, @thr={&(0x7f00000003c0)="3de38014b8d09c23bdcec9c5056a7d68263629bbaaf59b8204d84eb6edbde849d0e410f88606279d483d7530f3508fe10ae203602dafb83a6e946d07d1ee785ec364d8c27fd0898130ab0d1b721cb4a3d3e17ba46efd701a59152d28a46db49a5d3fe4f0da1304224a7f6a69353d5b7fd49740cfc9a405ab5bb4445e22a0a480b7d013561d484948fc2c7aaa8e4a637d685558c3df912ebfef08", &(0x7f0000000480)="dd3016034dbbc3b085e9abe35be9586c5079583c4de0773dfc7a5cc24fda6f879b1aff5e3a8a679c4a68be701e02d489a854aef637820143835ff1d3fd5d4027f58609fbe9bb5024c85c7cf6d538f86faef1eccb3e2ef3a40d853b0ce956a8fffc51a7a658852ac4415194ca406095010c88"}}) 3.851928996s ago: executing program 0 (id=2345): ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x20}) socket$nl_rdma(0x10, 0x3, 0x14) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) r2 = syz_open_dev$cec(&(0x7f00000001c0), 0xffffffffffffffff, 0x200) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f0000000340)={'\x00\f\x00', 0x0, 0x5, 0x2, 0x200000, 0x9, "00000000020000000900", "00004702", "03000800", "97ad3700", ["fdffffff84a438dfc5d5c010", "d78cb8b0211a83be12ff0bff"]}) syz_usb_connect$midi(0x0, 0x24, &(0x7f0000001a40)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x499, 0x7010, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x2, 0xf0, 0xa, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x30, 0xe5}}}}}]}}, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f00000002c0)={"4497acf4", 0x3, 0x80, 0x0, 0x8000006, 0x1000002, "5500c80100", "5922b1fa", "0725ebde", '\'q6O', ["2f7984214422244777b5e8a7", "00000000000000deff00", "fa0700f62b42b0023be516d1", "00000017f800"]}) syslog(0x3, &(0x7f00000003c0), 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000280)={0xf0f022}) syz_open_dev$vbi(&(0x7f0000000040), 0x1, 0x2) mount(&(0x7f0000000340)=@nullb, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='cramfs\x00', 0x800, 0x0) 3.392022316s ago: executing program 2 (id=2346): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x2000000, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x604ab000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4080, 0xfffffffffffffdcc, 0x0, 0x0, 0xffffffffffffff87}, &(0x7f0000000000)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000740)={&(0x7f0000fff000/0x1000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffc8, 0x1, 0x0}, &(0x7f0000000780)=0x40) (fail_nth: 9) 2.659278727s ago: executing program 2 (id=2348): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) file_getattr(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', &(0x7f00000000c0), 0xfffffffffffffedb, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001b61e308d016a91052300102030109021b0001000000000904000001ff7f880009050302"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000700)={0x84, &(0x7f0000000280)=ANY=[@ANYBLOB="20171e004000d63508413ed88d5f3aa30ddb149c466d0c0759af83a8c1c19aabd60ef379"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r6 = socket$vsock_stream(0x28, 0x1, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000001d80)={0x0, @in6={{0xa, 0x4e22, 0x20006, @empty, 0x6}}, 0x7f, 0x2, 0x0, 0x5, 0x392, 0x94, 0x1}, 0x9c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x1c, &(0x7f0000000240)=[@in6={0xa, 0x4e24, 0x40, @private1, 0x1}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000140)={r8, @in6={{0xa, 0x4e24, 0x800, @private1, 0x9}}, 0x7, 0xfe00, 0x2, 0x3, 0x54, 0x6, 0xf5}, &(0x7f0000000480)=0x9c) ioctl$BTRFS_IOC_SEND(r6, 0x40489426, &(0x7f0000000180)={{r0}, 0x6, &(0x7f0000000140)=[0xb, 0x8, 0x80, 0x6, 0x813, 0x10], 0x4, 0x6, 0x1}) r9 = accept4$x25(0xffffffffffffffff, 0x0, &(0x7f0000000640), 0x800) ioctl$SIOCX25GFACILITIES(r9, 0x89e2, &(0x7f0000000680)) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000200)=ANY=[@ANYBLOB="a3aa00e0", @ANYRES16=r5, @ANYBLOB="cf0425bd7000fcdbdb251300000008000300", @ANYRES32=r10, @ANYBLOB="040013000a00060008021100000000000600100080050000060012000400000004008100"], 0x40}, 0x1, 0x0, 0x0, 0x40080c3}, 0x24000000) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000600)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000005c0)={&(0x7f00000002c0)={0x2e4, r5, 0x2, 0x70bd26, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x5, 0xd}}}}, [@NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0xe, 0xcd, [0x6, 0x6, 0xc, 0x0, 0x2]}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x8, 0xcd, [0x0, 0xb]}, @NL80211_ATTR_FRAME={0x28d, 0x33, @beacon={{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1}, {0x1}, @broadcast, @device_a, @from_mac=@broadcast, {0x0, 0x2}, @value=@ver_80211n={0x0, 0x76b, 0x2, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1}}, 0x668, @default, 0x0, @void, @val={0x1, 0x4, [{0x24, 0x1}, {0x30}, {0x1b}, {0x60, 0x1}]}, @val={0x3, 0x1, 0xaf}, @val={0x4, 0x6, {0x7, 0xd, 0x4, 0xfffb}}, @void, @val={0x5, 0xe2, {0x4, 0xbb, 0x9, "550fec97058aff1955160f5024923efc230c4194fe567885331d68044170989e74783fe76090968cf4014e364bcd9c8315408c8249695a2e11d63dc24eca58f34d97cd7870d1bf04ee078d27a87663cb199c067da22943e4fae88982b8f30ed3c566da044d23494cfd8ef43421c20a3ad78185d0eaf5aba89e06ef6b62d1cb6775fc6628ed85868c7290b9eb91d1200c667b61e1d9322632a8a2cb5afbd3de34511fd4986f578b014af960187b6bc25451aa684ffe9d06e9fdfc1babff7c53b2f770de8e38678b9f98222d3090f47e79caede2b1922feb6517586b82eae6ba"}}, @void, @void, @void, @void, @val={0x72, 0x6}, @void, @val={0x76, 0x6, {0xd, 0xff, 0x22}}, [{0xdd, 0x56, "5c3477ad5cd686bc98184b163b1aa9efe2d34cb5565d439f2179115f09d2f8ea6b64625b25168e7dfbebd711259d9bbbccff3f45a71b8df36ba09bcca8f6d074f0e7ac4a75fb57137ab07c85fe2f8fb4bbd473476b73"}, {0xdd, 0x2f, "775d8f7b35ce109490714273818917ae947c76533e4e6751cdc5d98577fd0f00a1fa3ddf6aca939341bf56e33016e1"}, {0xdd, 0x27, "a2591f9bcd13dd8985fbf36cc8d54b980ceb8aa9996e3537a5e5f9b0f7f3513823dc33a54d1b45"}, {0xdd, 0x29, "116d3c3a6a4ad11eb1f2346f61fb3ab0f08261c225da54bd7c8fa038dcca4b874cb23544cdaa1e5840"}, {0xdd, 0x7d, "65ce7c17cd1333e5af131970f56b27d7be023b369f7ecde65f9fac93cc75317e8dc15fee18d4d5627e4b2718c6eeb4fdcc5f99f285a68f750d58db29c01baa22be282d1c9c005907a2182e3f7f661737ea9eb0450733e7a17601fd04cf8eb6f2b240d9cec2ccf2610f0574d4104cdf6187ec364a8e516e22cad50ec4fb"}]}}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x84c}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0xa, 0xcd, [0x7, 0x5, 0xd]}]}, 0x2e4}}, 0x0) mlock(&(0x7f0000ffe000/0x1000)=nil, 0x1000) 1.903637085s ago: executing program 0 (id=2352): capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000180)={0x200005, 0x200027, 0x801, 0x4, 0x7}) open(&(0x7f0000000180)='./bus\x00', 0x149a7e, 0x0) mount(0x0, &(0x7f0000000500)='./bus\x00', &(0x7f0000000540)='virtiofs\x00', 0x808080, &(0x7f0000000580)='dax\x00~,\"\xefAv') mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x8) mount$overlay(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000040)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) 1.667080339s ago: executing program 0 (id=2353): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000002c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412b", 0xf}, {0x0}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f", 0xa8}], 0x3}], 0x1, 0x40800) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f00000000c0)=""/97, 0x61}, {&(0x7f0000000340)=""/99, 0x63}, {&(0x7f00000001c0)=""/64, 0x40}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000001600)=""/165, 0xd0}], 0x5}, 0x40000021) 1.535758427s ago: executing program 0 (id=2356): r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$6lowpan_control(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x75) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@mcast1, @in6=@mcast1, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20, 0x29}, {0xfffffefffffffffd, 0xeca, 0x80002d, 0x0, 0x0, 0x0, 0x8000000000778a, 0xfffd}, {0x3, 0x6, 0x9}}, {{@in=@rand_addr=0x64010102, 0x4d6, 0x3c}, 0x0, @in=@multicast1, 0x0, 0x0, 0x1}}, 0xe8) close(r1) 1.403225611s ago: executing program 0 (id=2358): syz_usb_connect$uac1(0x3, 0x72, &(0x7f00000003c0)=ANY=[@ANYRES16=0x0], &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x2, &(0x7f0000000080)=ANY=[@ANYBLOB="08dbbe6c8368180b1930cc287d63a700"]}, {0x0, 0x0}, {0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="10033ebdf7c800"/16]}]}) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x105702, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18}, './file0\x00'}) 1.224185923s ago: executing program 3 (id=2360): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x2000000, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000003, 0x12, r0, 0xca129000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4080, 0xfffffffffffffdcc, 0x0, 0x0, 0xffffffffffffff87}, &(0x7f0000000000)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000740)={&(0x7f0000fff000/0x1000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffc8, 0x1, 0x0}, &(0x7f0000000780)=0x40) 1.081226297s ago: executing program 3 (id=2361): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='children\x00') r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008000}, 0x40000) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x36, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000090003007379"], 0x7c}}, 0x800) bind$inet(0xffffffffffffffff, 0x0, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfd, 0x0, 0xe4}]}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200047fd, 0x0, 0x0) sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[], 0x134}, 0x1, 0x0, 0x0, 0x800}, 0x20048009) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r3 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) setresuid(0x0, 0xee00, 0x0) write$UHID_CREATE(r3, &(0x7f0000000240)={0x0, {'syz1\x00', 'syz0\x00', 'syz1\x00', 0x0, 0x0, 0x747, 0x8, 0x5, 0x4, 0xc08}}, 0x120) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000000c0)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f00000003c0)={r4, 0x7}, 0x8) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat2$dir(0xffffff9c, &(0x7f0000000140)='./cgroup/../file0/file0/file0\x00', &(0x7f00000002c0)={0x800, 0x0, 0x5}, 0x18) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) write$cgroup_int(r6, &(0x7f0000000200)=0x1, 0x12) mkdir(&(0x7f0000000400)='./cgroup/../file0\x00', 0x25) mkdir(&(0x7f00000001c0)='./cgroup/../file0/file0/file0\x00', 0x0) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x100, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r9, r10, r11, &(0x7f0000000980)=@IORING_OP_SOCKET={0x2d, 0x0, 0x0, 0x2, 0x5, 0x0, 0x8, 0x0, 0x0, {0x0, 0x0, 0x5}}) syz_ublk_add_dev(r8, r9, r10, r11, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f0000000440)) r12 = openat$cgroup_ro(r7, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) mkdirat$cgroup(r7, &(0x7f0000000080)='syz1\x00', 0x1ff) write$cgroup_int(r12, &(0x7f0000000100)=0x1, 0x12) 774.591708ms ago: executing program 3 (id=2362): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket(0x2, 0x3, 0xff) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000240)=0x7d27, 0x4) sendto$inet(r2, &(0x7f00000002c0)="b401fcc8cd1bb8b66f7ee68e052af9c34b7d7494", 0x14, 0x800, &(0x7f0000000040)={0x2, 0x0, @dev}, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002"], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8890}, 0x20004450) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="38000000070a010100000006000000000a0040010900010073797a3100"], 0x38}}, 0x44054) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) r5 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f00000002c0)={0x1, @pix_mp={0x6dc, 0xdaf1, 0x34324152, 0x2, 0x2, [{0x1, 0x1}, {0x3, 0xa}, {0x4, 0x200}, {0xc061, 0x405}, {0xfffffff8, 0x1}, {0x1, 0x4}, {0x4, 0x8}, {0x3, 0x400}], 0xeb, 0x9b, 0x0, 0x0, 0x5}}) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=[@iv={0x14, 0x117, 0x2, 0x8, "a0aefa1fbdb92717"}], 0x20}], 0x1, 0x40800) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000080)=@rnullb, 0x0, &(0x7f00000001c0)='./file0\x00') ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x20, r8, 0x1, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_TX_RATES={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x4004040}, 0x24000) sendmsg$NL80211_CMD_NEW_KEY(r4, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000400)={0xa4, r6, 0x10, 0x70bd2c, 0x25dfdbf7, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x58ce, 0x13}}}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY={0x74, 0x50, 0x0, 0x1, [@NL80211_KEY_SEQ={0x13, 0x4, "f5389ed545171686280075123fe463"}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "3c4a0167f28ed781d8180281e0"}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "6e794b91a1e61ca42d6206e31b"}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_SEQ={0xb, 0x4, "e001b325a1b453"}, @NL80211_KEY_IDX={0x5, 0x2, 0x22}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x80}, 0x4040815) r10 = dup(r0) write$binfmt_script(r10, 0x0, 0x0) 644.449495ms ago: executing program 3 (id=2363): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0)="0503", 0x2, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r2, 0x1, 0x68, 0x6, @multicast}, 0x14) r3 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r3, 0x0, 0x0) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000002700), 0x8401, 0x0) writev(r4, &(0x7f00000041c0)=[{&(0x7f00000030c0)="740dc3a90686a4", 0x7}], 0x1) 504.429067ms ago: executing program 1 (id=2365): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0xc2) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000000)={'\x00', 0xc, 0x2, 0x803fd, 0x1, 0x800}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_int(r2, 0x6, 0x6, 0x0, &(0x7f0000000040)) ioctl$SNDCTL_DSP_GETOSPACE(r1, 0x8010500c, &(0x7f00000000c0)) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x2a) dup(r0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x32, &(0x7f0000000080)=0xff, 0x4) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000100)={0x2, "a32d1d3fd828b72537a72637a8100ccd679fff79db452160ef1f561bb3c0b3d4"}) socket$kcm(0x29, 0x0, 0x0) 394.830422ms ago: executing program 3 (id=2366): openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80100, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x181603, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000000)=@e={0xff, 0xb, 0x0, 0x7, @SEQ_NOTEON=@special, 0x7, 0x8, 0xb}) r1 = mq_open(&(0x7f0000000040)='\x00', 0x40, 0x1a, &(0x7f00000000c0)={0x80000001, 0xfffffffffffffffa, 0x2, 0x1}) mq_notify(r1, &(0x7f0000000500)={0x0, 0x27, 0x2, @thr={&(0x7f00000003c0)="3de38014b8d09c23bdcec9c5056a7d68263629bbaaf59b8204d84eb6edbde849d0e410f88606279d483d7530f3508fe10ae203602dafb83a6e946d07d1ee785ec364d8c27fd0898130ab0d1b721cb4a3d3e17ba46efd701a59152d28a46db49a5d3fe4f0da1304224a7f6a69353d5b7fd49740cfc9a405ab5bb4445e22a0a480b7d013561d484948fc2c7aaa8e4a637d685558c3df912ebfef08", &(0x7f0000000480)="dd3016034dbbc3b085e9abe35be9586c5079583c4de0773dfc7a5cc24fda6f879b1aff5e3a8a679c4a68be701e02d489a854aef637820143835ff1d3fd5d4027f58609fbe9bb5024c85c7cf6d538f86faef1eccb3e2ef3a40d853b0ce956a8fffc51a7a658852ac4415194ca406095010c88"}}) 394.565045ms ago: executing program 1 (id=2367): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x4}, 0x8) sendto$inet6(r1, &(0x7f0000000280)='0', 0xffe0, 0x854, &(0x7f0000000300)={0xa, 0x4e21, 0xbe7, @loopback, 0x4}, 0x1c) close(r0) bind$alg(0xffffffffffffffff, &(0x7f0000000640)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000003c0)={0x0, 0x0, 0x0, 'queue1\x00', 0x4}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r2, 0x4040534e, &(0x7f0000000140)={0x1e6, @time={0x4af9a7a, 0xcaa}}) 333.901907ms ago: executing program 1 (id=2368): r0 = syz_open_procfs(0x0, &(0x7f0000000480)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x40305829, &(0x7f0000000180)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f0000000500)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) r1 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000080)={'veth1_to_bond\x00', &(0x7f0000000040)=@ethtool_rxfh={0x46, 0xff, 0x4, 0x0, 0xcd, "a5834b", 0x3}}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)={[{@inode32}]}) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r1, 0xc2604110, &(0x7f0000000280)={0x0, [[0x7ff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2], [0xfffffffc, 0x3ff, 0x5], [0x0, 0x20000232, 0x200006, 0x0, 0x4, 0x98, 0x1]], '\x00', [{0x0, 0x7, 0x1}, {0x47, 0x4}, {}, {0x0, 0x1}, {0x400000}, {0xfffffffc}, {0xfffffffe}, {0xfffffffe}, {0x40000, 0x9}, {}, {0x7, 0xfffffffd}], '\x00', 0x1}) 251.746461ms ago: executing program 3 (id=2369): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x200000, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x61) r1 = openat$binfmt_register(0xffffff9c, &(0x7f0000000040), 0x1, 0x0) pwrite64(r1, &(0x7f0000000600)="e67ab1415f2ce290f4681ef5c755f60473b17b7887d68440dd9005bc69f6c3c5238bebfbce42365029d64c6bdf5fc2251eda45a465e645e685865063ff5f776983521685b3a3206ce46af9d586dd02dda5defa42c86b8c26de340e02c25f5801ca2e4fe456d3c9dc8599f9a3fc2b5152b9d2f123697defb2c35e0800", 0x7c, 0x800) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x244) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000380)={0x40, 0xc}, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r2, 0xc0189379, &(0x7f0000000200)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) ioctl$KVM_CAP_X2APIC_API(r3, 0x4068aea3, &(0x7f00000000c0)={0x81, 0x0, 0x3}) symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') 197.446179ms ago: executing program 1 (id=2370): capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000340)={0x200000, 0x200000, 0x0, 0x0, 0x5989}) (async) fanotify_init(0x40, 0x101c00) (async) syz_clone3(&(0x7f0000000100)={0x101100000, 0x0, 0x0, 0x0, {0xe}, 0x0, 0x0, 0x0, 0x0}, 0x58) 58.909755ms ago: executing program 1 (id=2371): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x20, 0x3, 0x8, 0x401, 0x0, 0x0, {0x7, 0x0, 0x7}, [@CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @gre}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x11}]}, 0x20}, 0x1, 0x0, 0x0, 0x8004}, 0x20004094) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000"], 0x3c}, 0x1, 0x0, 0x0, 0x24004881}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff038}, {0x20, 0x0, 0x0, 0xfffff00c}, {0x6, 0x0, 0x6, 0xfffffffe}]}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000080), 0xffffffffffffffff) 0s ago: executing program 1 (id=2372): r0 = socket$inet6(0xa, 0x5, 0x0) r1 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x8082) syz_open_dev$sg(&(0x7f0000000280), 0x0, 0x782) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) getsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000000000), &(0x7f00000000c0)) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e1c, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, 0x1c) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e22, 0x0, @private1}, 0x1c) r2 = socket$inet6(0xa, 0x5, 0x0) r3 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c) ioctl$SG_BLKSECTGET(r1, 0x1267, &(0x7f0000000100)) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @mcast1, 0x6}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="640000001900010029bd7000000000001d01090050000f8008", @ANYBLOB="763198e602238014d879d57f8d898a7e0f502f7a987839ac25584cc6ad0dba254d660611f455c30d1fa0e7d957f3aba0a88e4d527e66bb0e6221e14deb507f936e92154b7baaeb15"], 0x64}, 0x1, 0x0, 0x0, 0x4}, 0x804) r5 = syz_open_dev$dvb_frontend(&(0x7f0000000040), 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0x4a, &(0x7f0000000000), 0x4) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) ioctl$FE_SET_PROPERTY(r5, 0x40086f52, &(0x7f0000000080)={0x1, 0x0}) kernel console output (not intermixed with test programs): 493.316312][ T5709] usb 3-1: Manufacturer: syz [ 493.316323][ T5709] usb 3-1: SerialNumber: syz [ 493.346745][ T5709] usb 3-1: config 0 descriptor?? [ 493.568255][T11368] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.568887][T11368] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.589547][T11368] sg_write: data in/out 401472/136 bytes for SCSI command 0x0-- guessing data in; [ 493.589547][T11368] program syz.2.2031 not setting count and/or reply_len properly [ 493.689275][T11378] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2035'. [ 493.993424][ T5768] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 494.046784][ T5709] usb 3-1: Firmware version (0.0) predates our first public release. [ 494.046816][ T5709] usb 3-1: Please update to version 0.2 or newer [ 494.170205][ T5768] usb 1-1: unable to get BOS descriptor or descriptor too short [ 494.175382][ T5768] usb 1-1: config 1 interface 0 altsetting 156 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 494.175456][ T5768] usb 1-1: config 1 interface 0 has no altsetting 0 [ 494.218000][ T5768] usb 1-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.40 [ 494.218024][ T5768] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.218040][ T5768] usb 1-1: Product: syz [ 494.218051][ T5768] usb 1-1: Manufacturer: syz [ 494.218063][ T5768] usb 1-1: SerialNumber: syz [ 494.671496][ T5775] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 494.698651][ T5709] usb 3-1: USB disconnect, device number 86 [ 494.781962][ T5768] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input29 [ 494.811536][ T5775] usb 4-1: device descriptor read/64, error -71 [ 494.846089][ T4960] bcm5974 1-1:1.0: could not read from device [ 494.883312][ T5768] usb 1-1: USB disconnect, device number 110 [ 495.071671][ T5775] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 495.232688][ T32] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 495.235575][ T5775] usb 4-1: device descriptor read/64, error -71 [ 495.357566][ T5775] usb usb4-port1: attempt power cycle [ 495.365543][ T32] usb 2-1: device descriptor read/64, error -71 [ 495.611430][ T32] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 495.741481][ T32] usb 2-1: device descriptor read/64, error -71 [ 495.743152][ T5775] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 495.774151][ T5775] usb 4-1: device descriptor read/8, error -71 [ 495.851967][ T32] usb usb2-port1: attempt power cycle [ 495.929176][T11410] FAULT_INJECTION: forcing a failure. [ 495.929176][T11410] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 495.929209][T11410] CPU: 1 UID: 0 PID: 11410 Comm: syz.2.2045 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 495.929232][T11410] Tainted: [L]=SOFTLOCKUP [ 495.929239][T11410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 495.929249][T11410] Call Trace: [ 495.929256][T11410] [ 495.929263][T11410] dump_stack_lvl+0xe8/0x150 [ 495.929286][T11410] should_fail_ex+0x46b/0x600 [ 495.929313][T11410] _copy_from_iter+0x1d3/0x1670 [ 495.929349][T11410] ? __pfx__copy_from_iter+0x10/0x10 [ 495.929373][T11410] ? sock_alloc_send_pskb+0x8a2/0x9a0 [ 495.929400][T11410] ? __pfx__copy_from_iter+0x10/0x10 [ 495.929431][T11410] copy_page_from_iter+0x220/0x2d0 [ 495.929461][T11410] skb_copy_datagram_from_iter+0x306/0x710 [ 495.929492][T11410] packet_sendmsg+0x35be/0x4fd0 [ 495.929531][T11410] ? _parse_integer_limit+0x192/0x1e0 [ 495.929560][T11410] ? __lock_acquire+0x6b5/0x2d10 [ 495.929592][T11410] ? __pfx_packet_sendmsg+0x10/0x10 [ 495.929619][T11410] ? aa_sk_perm+0x703/0x950 [ 495.929652][T11410] ? __pfx_aa_sk_perm+0x10/0x10 [ 495.929677][T11410] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 495.929708][T11410] ? aa_sock_msg_perm+0x122/0x200 [ 495.929726][T11410] ? __pfx_packet_sendmsg+0x10/0x10 [ 495.929749][T11410] sock_sendmsg_nosec+0x13a/0x180 [ 495.929777][T11410] __sys_sendto+0x41a/0x5a0 [ 495.929797][T11410] ? __pfx___sys_sendto+0x10/0x10 [ 495.929834][T11410] ? __pfx_ksys_write+0x10/0x10 [ 495.929859][T11410] __x64_sys_sendto+0xde/0x100 [ 495.929882][T11410] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.929900][T11410] do_syscall_64+0x174/0x580 [ 495.929922][T11410] ? trace_irq_disable+0x3b/0x140 [ 495.929966][T11410] ? clear_bhb_loop+0x40/0x90 [ 495.929995][T11410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.930018][T11410] RIP: 0033:0x7f13b5b3ce59 [ 495.930040][T11410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 495.930060][T11410] RSP: 002b:00007f13b3d8e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 495.930085][T11410] RAX: ffffffffffffffda RBX: 00007f13b5db5fa0 RCX: 00007f13b5b3ce59 [ 495.930108][T11410] RDX: 000000000000fce0 RSI: 00002000000002c0 RDI: 0000000000000003 [ 495.930126][T11410] RBP: 00007f13b3d8e090 R08: 0000200000000140 R09: 0000000000000014 [ 495.930137][T11410] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 495.930147][T11410] R13: 00007f13b5db6038 R14: 00007f13b5db5fa0 R15: 00007ffc7cd55e88 [ 495.930172][T11410] [ 496.111609][ T5775] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 496.138021][ T5775] usb 4-1: device descriptor read/8, error -71 [ 496.243354][ T5775] usb usb4-port1: unable to enumerate USB device [ 496.271750][ T32] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 496.291136][T11414] fuse: Bad value for 'fd' [ 496.297869][ T32] usb 2-1: device descriptor read/8, error -71 [ 496.471392][ T5709] usb 1-1: new low-speed USB device number 111 using dummy_hcd [ 496.531515][ T32] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 496.551966][ T32] usb 2-1: device descriptor read/8, error -71 [ 496.623575][ T5709] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 496.623606][ T5709] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 496.623661][ T5709] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 496.623707][ T5709] usb 1-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 496.623725][ T5709] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.630979][T11412] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 496.681855][ T32] usb usb2-port1: unable to enumerate USB device [ 496.697735][ T5709] hub 1-1:1.0: bad descriptor, ignoring hub [ 496.697774][ T5709] hub 1-1:1.0: probe with driver hub failed with error -5 [ 496.698875][ T5709] cdc_wdm 1-1:1.0: skipping garbage [ 496.698893][ T5709] cdc_wdm 1-1:1.0: skipping garbage [ 496.698908][ T5709] cdc_wdm 1-1:1.0: skipping garbage [ 496.737459][ T5709] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 496.737562][ T5709] cdc_wdm 1-1:1.0: Unknown control protocol [ 496.840139][T11412] 9pnet_fd: Insufficient options for proto=fd [ 496.951755][ T5709] usb 1-1: USB disconnect, device number 111 [ 501.695308][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.695425][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 511.508850][T11423] program syz.3.2051 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 511.732112][T11433] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2054'. [ 511.781369][ T32] usb 3-1: new full-speed USB device number 87 using dummy_hcd [ 511.949044][T11425] sg_write: data in/out 335936/136 bytes for SCSI command 0x0-- guessing data in; [ 511.949044][T11425] program syz.2.2050 not setting count and/or reply_len properly [ 512.061377][ T5775] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 512.132821][ T32] usb 3-1: unable to get BOS descriptor or descriptor too short [ 512.136175][ T32] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 512.136216][ T32] usb 3-1: can't read configurations, error -71 [ 512.179371][T11438] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2056'. [ 512.234915][ T5775] usb 2-1: unable to get BOS descriptor or descriptor too short [ 512.237840][ T5775] usb 2-1: config 1 interface 0 altsetting 156 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 512.237882][ T5775] usb 2-1: config 1 interface 0 has no altsetting 0 [ 512.300159][ T5775] usb 2-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.40 [ 512.300195][ T5775] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.300219][ T5775] usb 2-1: Product: syz [ 512.300236][ T5775] usb 2-1: Manufacturer: syz [ 512.300253][ T5775] usb 2-1: SerialNumber: syz [ 512.533596][T11442] syzkaller1: entered promiscuous mode [ 512.533633][T11442] syzkaller1: entered allmulticast mode [ 512.613042][T11444] FAULT_INJECTION: forcing a failure. [ 512.613042][T11444] name failslab, interval 1, probability 0, space 0, times 0 [ 512.613084][T11444] CPU: 0 UID: 0 PID: 11444 Comm: syz.0.2058 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 512.613119][T11444] Tainted: [L]=SOFTLOCKUP [ 512.613129][T11444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 512.613144][T11444] Call Trace: [ 512.613154][T11444] [ 512.613164][T11444] dump_stack_lvl+0xe8/0x150 [ 512.613197][T11444] should_fail_ex+0x46b/0x600 [ 512.613274][T11444] should_failslab+0xa8/0x100 [ 512.613305][T11444] __kmalloc_noprof+0xfe/0x7e0 [ 512.613337][T11444] ? sock_kmalloc+0xd6/0x160 [ 512.613365][T11444] ? sock_kmalloc+0xd6/0x160 [ 512.613406][T11444] sock_kmalloc+0xd6/0x160 [ 512.613430][T11444] hash_accept_parent_nokey+0x52/0x250 [ 512.613480][T11444] ? __pfx_hash_accept_parent+0x10/0x10 [ 512.613512][T11444] af_alg_accept+0x177/0x520 [ 512.613544][T11444] hash_accept+0x169/0x280 [ 512.613580][T11444] do_accept+0x6ca/0x930 [ 512.613604][T11444] ? __pfx_do_accept+0x10/0x10 [ 512.613667][T11444] __sys_accept4+0x139/0x230 [ 512.613696][T11444] ? __pfx___sys_accept4+0x10/0x10 [ 512.613719][T11444] ? __pfx_ksys_write+0x10/0x10 [ 512.613755][T11444] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.613773][T11444] __x64_sys_accept+0x7d/0x90 [ 512.613811][T11444] do_syscall_64+0x174/0x580 [ 512.613842][T11444] ? trace_irq_disable+0x3b/0x140 [ 512.613871][T11444] ? clear_bhb_loop+0x40/0x90 [ 512.613898][T11444] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 512.613925][T11444] RIP: 0033:0x7fe0bac4ce59 [ 512.613941][T11444] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 512.613970][T11444] RSP: 002b:00007fe0b8ea6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002b [ 512.613995][T11444] RAX: ffffffffffffffda RBX: 00007fe0baec5fa0 RCX: 00007fe0bac4ce59 [ 512.614014][T11444] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 512.614030][T11444] RBP: 00007fe0b8ea6090 R08: 0000000000000000 R09: 0000000000000000 [ 512.614044][T11444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 512.614058][T11444] R13: 00007fe0baec6038 R14: 00007fe0baec5fa0 R15: 00007ffe109ee408 [ 512.614096][T11444] [ 512.620374][T11442] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993 [ 513.241577][ T9] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 513.287508][ T5775] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input30 [ 513.344524][ T4960] bcm5974 2-1:1.0: could not read from device [ 513.401369][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 513.401432][ T5775] usb 2-1: USB disconnect, device number 122 [ 513.403827][ T9] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 513.403859][ T9] usb 1-1: config 0 has no interface number 0 [ 513.406433][ T9] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 513.406725][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.406750][ T9] usb 1-1: Product: syz [ 513.406767][ T9] usb 1-1: Manufacturer: syz [ 513.406783][ T9] usb 1-1: SerialNumber: syz [ 513.461667][ T4960] bcm5974 2-1:1.0: could not read from device [ 513.494369][ T9] usb 1-1: config 0 descriptor?? [ 513.508439][ T9] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 513.733629][T11457] syzkaller1: entered promiscuous mode [ 513.733662][T11457] syzkaller1: entered allmulticast mode [ 513.781606][ T9] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 513.804206][ T9] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 513.977121][T11451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 513.979656][T11451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 514.004458][ C0] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 18 [ 514.241030][ C0] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 514.260818][ T9] usb 1-1: USB disconnect, device number 112 [ 514.294175][ T9] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 514.344114][ T9] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 514.345731][ T9] quatech2 1-1:0.51: device disconnected [ 514.840271][T11469] program syz.0.2065 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 515.111439][ T9] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 515.261381][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 515.264248][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 515.264283][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 515.264319][ T9] usb 4-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 515.264344][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.269361][ T9] usb 4-1: config 0 descriptor?? [ 515.649894][T11478] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2070'. [ 515.717115][T11479] netlink: 'syz.1.2069': attribute type 10 has an invalid length. [ 515.717141][T11479] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2069'. [ 515.776462][T11479] team0: entered promiscuous mode [ 515.776488][T11479] team_slave_0: entered promiscuous mode [ 515.776876][T11479] team_slave_1: entered promiscuous mode [ 515.777131][T11479] bridge0: entered promiscuous mode [ 515.783636][T11479] team0: entered allmulticast mode [ 515.783790][T11479] team_slave_0: entered allmulticast mode [ 515.784101][T11479] team_slave_1: entered allmulticast mode [ 515.784313][T11479] bridge0: entered allmulticast mode [ 515.901405][T11479] bridge0: port 3(team0) entered blocking state [ 515.901821][T11479] bridge0: port 3(team0) entered disabled state [ 516.077325][ T5768] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 516.130302][T11479] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 516.171516][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 516.171665][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 516.190718][ T9] usb 4-1: USB disconnect, device number 115 [ 516.225006][ T5768] usb 1-1: unable to get BOS descriptor or descriptor too short [ 516.228093][ T5768] usb 1-1: config 1 interface 0 altsetting 156 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 516.228122][ T5768] usb 1-1: config 1 interface 0 has no altsetting 0 [ 516.232990][ T5768] usb 1-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.40 [ 516.233085][ T5768] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.233142][ T5768] usb 1-1: Product: syz [ 516.233184][ T5768] usb 1-1: Manufacturer: syz [ 516.233228][ T5768] usb 1-1: SerialNumber: syz [ 516.711434][ T9] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 516.861553][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 516.864172][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 516.867553][ T9] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 516.867584][ T9] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 516.867809][ T9] usb 2-1: Product: syz [ 516.867822][ T9] usb 2-1: Manufacturer: syz [ 516.867834][ T9] usb 2-1: SerialNumber: syz [ 516.950704][ T9] usb 2-1: config 0 descriptor?? [ 516.957868][T11485] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 516.975202][ T9] hub 2-1:0.0: bad descriptor, ignoring hub [ 516.975584][ T9] hub 2-1:0.0: probe with driver hub failed with error -5 [ 517.298323][T11492] FAULT_INJECTION: forcing a failure. [ 517.298323][T11492] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 517.298365][T11492] CPU: 0 UID: 0 PID: 11492 Comm: syz.3.2073 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 517.298397][T11492] Tainted: [L]=SOFTLOCKUP [ 517.298406][T11492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 517.298420][T11492] Call Trace: [ 517.298430][T11492] [ 517.298440][T11492] dump_stack_lvl+0xe8/0x150 [ 517.298476][T11492] should_fail_ex+0x46b/0x600 [ 517.298517][T11492] _copy_to_user+0x31/0xb0 [ 517.298545][T11492] video_usercopy+0xe0a/0x1450 [ 517.298589][T11492] ? __pfx___video_do_ioctl+0x10/0x10 [ 517.298628][T11492] ? __pfx_video_usercopy+0x10/0x10 [ 517.298680][T11492] ? __fget_files+0x2a/0x420 [ 517.298708][T11492] ? __fget_files+0x2a/0x420 [ 517.298730][T11492] ? __fget_files+0x3a6/0x420 [ 517.298769][T11492] v4l2_ioctl+0x190/0x1e0 [ 517.298804][T11492] ? __pfx_v4l2_ioctl+0x10/0x10 [ 517.298839][T11492] __se_sys_ioctl+0xff/0x170 [ 517.298868][T11492] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.298898][T11492] do_syscall_64+0x174/0x580 [ 517.298919][T11492] ? trace_irq_disable+0x3b/0x140 [ 517.298940][T11492] ? clear_bhb_loop+0x40/0x90 [ 517.298960][T11492] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.298977][T11492] RIP: 0033:0x7fc2544bce59 [ 517.298993][T11492] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 517.299007][T11492] RSP: 002b:00007fc25270e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 517.299025][T11492] RAX: ffffffffffffffda RBX: 00007fc254735fa0 RCX: 00007fc2544bce59 [ 517.299038][T11492] RDX: 0000200000000040 RSI: 00000000c008561c RDI: 0000000000000003 [ 517.299052][T11492] RBP: 00007fc25270e090 R08: 0000000000000000 R09: 0000000000000000 [ 517.299063][T11492] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 517.299073][T11492] R13: 00007fc254736038 R14: 00007fc254735fa0 R15: 00007ffc93a371d8 [ 517.299097][T11492] [ 517.351977][ T5768] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input31 [ 517.537619][ T4960] bcm5974 1-1:1.0: could not read from device [ 517.597942][ T5768] usb 1-1: USB disconnect, device number 113 [ 517.722700][T11496] FAULT_INJECTION: forcing a failure. [ 517.722700][T11496] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 517.722753][T11496] CPU: 1 UID: 0 PID: 11496 Comm: syz.3.2074 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 517.722786][T11496] Tainted: [L]=SOFTLOCKUP [ 517.722795][T11496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 517.722809][T11496] Call Trace: [ 517.722819][T11496] [ 517.722829][T11496] dump_stack_lvl+0xe8/0x150 [ 517.722865][T11496] should_fail_ex+0x46b/0x600 [ 517.722903][T11496] _copy_from_user+0x2d/0xb0 [ 517.722932][T11496] iommufd_fops_ioctl+0x461/0x5d0 [ 517.722964][T11496] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 517.722997][T11496] ? __fget_files+0x2a/0x420 [ 517.723029][T11496] ? __fget_files+0x2a/0x420 [ 517.723057][T11496] ? bpf_lsm_file_ioctl+0x9/0x20 [ 517.723086][T11496] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 517.723115][T11496] __se_sys_ioctl+0xff/0x170 [ 517.723147][T11496] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.723174][T11496] do_syscall_64+0x174/0x580 [ 517.723205][T11496] ? trace_irq_disable+0x3b/0x140 [ 517.723234][T11496] ? clear_bhb_loop+0x40/0x90 [ 517.723264][T11496] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.723289][T11496] RIP: 0033:0x7fc2544bce59 [ 517.723310][T11496] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 517.723332][T11496] RSP: 002b:00007fc2526ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 517.723357][T11496] RAX: ffffffffffffffda RBX: 00007fc254736090 RCX: 00007fc2544bce59 [ 517.723375][T11496] RDX: 00002000000002c0 RSI: 0000000000003ba0 RDI: 0000000000000003 [ 517.723390][T11496] RBP: 00007fc2526ed090 R08: 0000000000000000 R09: 0000000000000000 [ 517.723406][T11496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 517.723421][T11496] R13: 00007fc254736128 R14: 00007fc254736090 R15: 00007ffc93a371d8 [ 517.723456][T11496] [ 517.981970][T11484] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 517.982543][T11484] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.207513][T11498] 9p: Unknown access argument 18446744073709551615: -34 [ 518.560446][T11503] program syz.0.2077 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 518.634451][T11505] netlink: 'syz.0.2078': attribute type 13 has an invalid length. [ 518.662579][ T9] usb 2-1: reset high-speed USB device number 123 using dummy_hcd [ 518.741416][ T5768] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 518.790699][T11507] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2079'. [ 518.860170][ T9] usb 2-1: device descriptor read/64, error -71 [ 518.871451][ T5768] usb 4-1: device descriptor read/64, error -71 [ 519.893198][ T5768] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 520.012139][ T9] usb 2-1: reset high-speed USB device number 123 using dummy_hcd [ 520.038104][ T5768] usb 4-1: device descriptor read/64, error -71 [ 520.141820][ T5768] usb usb4-port1: attempt power cycle [ 520.481673][ T5768] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 520.504826][ T5768] usb 4-1: device descriptor read/8, error -71 [ 520.571952][T11521] netlink: 'syz.0.2083': attribute type 10 has an invalid length. [ 520.741852][ T5768] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 520.767544][ T5768] usb 4-1: device descriptor read/8, error -71 [ 520.889894][ T5768] usb usb4-port1: unable to enumerate USB device [ 520.947787][T11525] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2085'. [ 520.973959][ T9] usb 2-1: USB disconnect, device number 123 [ 521.341444][ T9] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 521.455178][T11528] program syz.0.2086 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 521.504912][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 521.507275][ T9] usb 2-1: config 1 interface 0 altsetting 156 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 521.507313][ T9] usb 2-1: config 1 interface 0 has no altsetting 0 [ 521.509762][ T9] usb 2-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.40 [ 521.509794][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.509817][ T9] usb 2-1: Product: syz [ 521.509833][ T9] usb 2-1: Manufacturer: syz [ 521.509850][ T9] usb 2-1: SerialNumber: syz [ 521.921541][ T5774] usb 1-1: new full-speed USB device number 114 using dummy_hcd [ 522.710029][T11526] syz_tun (unregistering): left allmulticast mode [ 522.755018][ T5774] usb 1-1: unable to get BOS descriptor or descriptor too short [ 522.755778][ T5774] usb 1-1: not running at top speed; connect to a high speed hub [ 522.757345][ T5774] usb 1-1: config 6 has an invalid interface number: 21 but max is 1 [ 522.757374][ T5774] usb 1-1: config 6 has an invalid descriptor of length 255, skipping remainder of the config [ 522.757398][ T5774] usb 1-1: config 6 has 1 interface, different from the descriptor's value: 2 [ 522.757424][ T5774] usb 1-1: config 6 has no interface number 0 [ 522.757489][ T5774] usb 1-1: config 6 interface 21 altsetting 9 endpoint 0x4 has invalid maxpacket 1033, setting to 64 [ 522.757523][ T5774] usb 1-1: config 6 interface 21 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 522.757611][ T5774] usb 1-1: config 6 interface 21 has no altsetting 0 [ 522.760716][ T5774] usb 1-1: New USB device found, idVendor=050d, idProduct=0109, bcdDevice=b7.96 [ 522.760749][ T5774] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.760774][ T5774] usb 1-1: Product: syz [ 522.760791][ T5774] usb 1-1: Manufacturer: syz [ 522.760808][ T5774] usb 1-1: SerialNumber: syz [ 522.923972][T11530] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 523.061401][ T5709] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 523.140689][ T5774] mct_u232 1-1:6.21: MCT U232 converter detected [ 523.149849][ T5774] mct_u232 ttyUSB0: expected endpoint missing [ 523.165157][ T5774] usb 1-1: USB disconnect, device number 114 [ 523.183380][ T5774] mct_u232 1-1:6.21: device disconnected [ 523.215360][ T5709] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 523.215507][ T5709] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 523.215555][ T5709] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 523.215644][ T5709] usb 3-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 523.394760][ T9] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input32 [ 523.399575][ T4960] bcm5974 2-1:1.0: could not read from device [ 523.400700][ T5709] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 523.400732][ T5709] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.400754][ T5709] usb 3-1: Product: syz [ 523.400772][ T5709] usb 3-1: Manufacturer: syz [ 523.400789][ T5709] usb 3-1: SerialNumber: syz [ 523.504743][ T5709] cdc_mbim 3-1:1.0: skipping garbage [ 523.513866][ T9] usb 2-1: USB disconnect, device number 124 [ 523.591416][ T32] usb 4-1: new low-speed USB device number 120 using dummy_hcd [ 523.700947][T11536] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 523.721519][ T32] usb 4-1: device descriptor read/64, error -71 [ 523.973479][ T32] usb 4-1: new low-speed USB device number 121 using dummy_hcd [ 524.111680][ T32] usb 4-1: device descriptor read/64, error -71 [ 524.222296][ T32] usb usb4-port1: attempt power cycle [ 524.310476][T11536] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 524.471333][ T5622] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 524.513133][T11536] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.514582][T11536] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 524.522762][ T5709] cdc_mbim 3-1:1.0: bind() failure [ 524.561714][ T32] usb 4-1: new low-speed USB device number 122 using dummy_hcd [ 524.566796][ T5709] cdc_ncm 3-1:1.1: probe with driver cdc_ncm failed with error -71 [ 524.567578][ T5709] cdc_mbim 3-1:1.1: probe with driver cdc_mbim failed with error -71 [ 524.568917][ T5709] usbtest 3-1:1.1: probe with driver usbtest failed with error -71 [ 524.582722][ T5709] usb 3-1: USB disconnect, device number 89 [ 524.608998][ T32] usb 4-1: device descriptor read/8, error -71 [ 524.651410][ T5622] usb 2-1: Using ep0 maxpacket: 32 [ 524.653745][ T5622] usb 2-1: unable to get BOS descriptor or descriptor too short [ 524.654978][ T5622] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 524.655006][ T5622] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 524.655032][ T5622] usb 2-1: config 14 has no interface number 0 [ 524.655052][ T5622] usb 2-1: config 14 has no interface number 1 [ 524.655140][ T5622] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 524.655170][ T5622] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 524.655199][ T5622] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 524.655230][ T5622] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 524.655261][ T5622] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 524.655292][ T5622] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 524.655323][ T5622] usb 2-1: config 14 interface 57 has no altsetting 0 [ 524.655344][ T5622] usb 2-1: config 14 interface 228 has no altsetting 0 [ 524.660611][ T5622] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 524.660643][ T5622] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 524.660666][ T5622] usb 2-1: Product: syz [ 524.660683][ T5622] usb 2-1: Manufacturer: syz [ 524.660700][ T5622] usb 2-1: SerialNumber: syz [ 524.878612][T11552] program syz.0.2095 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 524.951360][ T32] usb 4-1: new low-speed USB device number 123 using dummy_hcd [ 524.975809][ T32] usb 4-1: device descriptor read/8, error -71 [ 525.082075][ T32] usb usb4-port1: unable to enumerate USB device [ 525.191387][ T5709] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 525.232540][T11556] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2097'. [ 525.256155][T11549] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2094'. [ 525.256700][T11549] x_tables: ip_tables: udp match: only valid for protocol 17 [ 525.298666][ T5622] legousbtower 2-1:14.57: interrupt endpoints not found [ 525.341368][ T5709] usb 1-1: Using ep0 maxpacket: 32 [ 525.347171][ T5709] usb 1-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 525.347205][ T5709] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.347229][ T5709] usb 1-1: Product: syz [ 525.347246][ T5709] usb 1-1: Manufacturer: syz [ 525.347263][ T5709] usb 1-1: SerialNumber: syz [ 525.372588][ T5709] usb 1-1: config 0 descriptor?? [ 525.405098][ T5709] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 525.424153][ T5709] dvb-usb: bulk message failed: -22 (2/0) [ 525.433457][ T5709] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 525.434269][ T5709] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 525.434315][ T5709] usb 1-1: media controller created [ 525.469439][T11558] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2098'. [ 525.566004][ T5709] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 525.588450][ T5709] usb 1-1: selecting invalid altsetting 7 [ 525.588489][ T5709] cxusb: set interface failed [ 525.588506][ T5709] dvb-usb: bulk message failed: -22 (1/0) [ 525.613697][T11554] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 525.614398][T11554] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.703532][ T5622] legousbtower 2-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 525.707991][ T5622] legousbtower 2-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 525.736795][ T5709] DVB: Unable to find symbol lgdt330x_attach() [ 525.736813][ T5709] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 525.861538][ T5709] rc_core: IR keymap rc-dvico-portable not found [ 525.861556][ T5709] Registered IR keymap rc-empty [ 525.862825][ T5709] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 525.865881][ T5709] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input33 [ 525.867974][ T5709] dvb-usb: schedule remote query interval to 100 msecs. [ 525.868000][ T5709] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 525.956983][ T5709] usb 1-1: USB disconnect, device number 115 [ 526.097223][ T5709] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 526.293287][T11570] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2102'. [ 526.612125][ C0] usb 2-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 526.634526][T11574] veth0: entered promiscuous mode [ 526.712711][ T5709] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 526.738839][ T9] usb 2-1: USB disconnect, device number 125 [ 526.790385][ T9] legousbtower 2-1:14.228: LEGO USB Tower #-160 now disconnected [ 526.886596][ T5709] usb 1-1: unable to get BOS descriptor or descriptor too short [ 526.929289][ T5709] usb 1-1: config 1 interface 0 altsetting 156 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 526.929333][ T5709] usb 1-1: config 1 interface 0 has no altsetting 0 [ 526.954629][ T5709] usb 1-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.40 [ 526.954654][ T5709] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.954670][ T5709] usb 1-1: Product: syz [ 526.954682][ T5709] usb 1-1: Manufacturer: syz [ 526.954693][ T5709] usb 1-1: SerialNumber: syz [ 527.112743][T11577] program syz.2.2104 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 527.693188][T11573] veth0: left promiscuous mode [ 528.127454][ T5709] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input34 [ 528.144178][ T4960] bcm5974 1-1:1.0: could not read from device [ 528.255067][ T4960] bcm5974 1-1:1.0: could not read from device [ 528.277740][ T5709] usb 1-1: USB disconnect, device number 116 [ 528.291729][T11597] program syz.2.2113 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 528.381427][ T9] usb 2-1: new full-speed USB device number 126 using dummy_hcd [ 528.534123][ T9] usb 2-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 528.534164][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 528.534203][ T9] usb 2-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 528.534229][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 528.614174][ T9] usb 2-1: config 0 descriptor?? [ 528.615094][T11594] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 528.983608][T11603] netlink: 260 bytes leftover after parsing attributes in process `syz.3.2115'. [ 529.080625][ T9] hid-led 0003:1D34:000A.0013: unknown main item tag 0x1 [ 529.080739][ T9] hid-led 0003:1D34:000A.0013: ignoring exceeding usage max [ 529.315046][ T9] hid-led 0003:1D34:000A.0013: hidraw0: USB HID v0.c1 Device [HID 1d34:000a] on usb-dummy_hcd.1-1/input0 [ 529.368374][T11610] FAULT_INJECTION: forcing a failure. [ 529.368374][T11610] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 529.368417][T11610] CPU: 0 UID: 0 PID: 11610 Comm: syz.3.2119 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 529.368449][T11610] Tainted: [L]=SOFTLOCKUP [ 529.368458][T11610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 529.368473][T11610] Call Trace: [ 529.368482][T11610] [ 529.368492][T11610] dump_stack_lvl+0xe8/0x150 [ 529.368521][T11610] should_fail_ex+0x46b/0x600 [ 529.368560][T11610] _copy_from_user+0x2d/0xb0 [ 529.368586][T11610] kstrtouint_from_user+0xd6/0x180 [ 529.368621][T11610] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 529.368682][T11610] proc_fail_nth_write+0x8e/0x210 [ 529.368706][T11610] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 529.368736][T11610] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 529.368763][T11610] vfs_write+0x2a3/0xba0 [ 529.368802][T11610] ? __pfx_vfs_write+0x10/0x10 [ 529.368833][T11610] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 529.368863][T11610] ? lockdep_hardirqs_on+0x7a/0x110 [ 529.368893][T11610] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 529.368923][T11610] ? mutex_lock_nested+0x152/0x1d0 [ 529.368958][T11610] ? fdget_pos+0x252/0x320 [ 529.368992][T11610] ksys_write+0x156/0x270 [ 529.369022][T11610] ? __pfx_ksys_write+0x10/0x10 [ 529.369060][T11610] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.369085][T11610] do_syscall_64+0x174/0x580 [ 529.369112][T11610] ? trace_irq_disable+0x3b/0x140 [ 529.369142][T11610] ? clear_bhb_loop+0x40/0x90 [ 529.369171][T11610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.369194][T11610] RIP: 0033:0x7fc25447d68e [ 529.369216][T11610] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 529.369237][T11610] RSP: 002b:00007fc25270dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 529.369262][T11610] RAX: ffffffffffffffda RBX: 00007fc25270e6c0 RCX: 00007fc25447d68e [ 529.369281][T11610] RDX: 0000000000000001 RSI: 00007fc25270e0a0 RDI: 0000000000000004 [ 529.369335][T11610] RBP: 00007fc25270e090 R08: 0000000000000000 R09: 0000000000000000 [ 529.369384][T11610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 529.369399][T11610] R13: 00007fc254736038 R14: 00007fc254735fa0 R15: 00007ffc93a371d8 [ 529.369442][T11610] [ 529.421010][T11594] Bluetooth: MGMT ver 1.23 [ 529.675484][T11613] netlink: 'syz.0.2116': attribute type 10 has an invalid length. [ 529.988663][T11613] veth0_vlan: left promiscuous mode [ 530.000945][T11613] veth0_vlan: entered promiscuous mode [ 530.030932][T11613] team0: Device veth0_vlan failed to register rx_handler [ 530.112209][ T5709] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 530.280290][ T5709] usb 4-1: config 1 has an invalid descriptor of length 238, skipping remainder of the config [ 530.280323][ T5709] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 530.305886][ T5709] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 530.305912][ T5709] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 530.305928][ T5709] usb 4-1: SerialNumber: syz [ 530.356079][T11622] program syz.1.2122 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 530.494484][T11626] netlink: 'syz.1.2124': attribute type 29 has an invalid length. [ 530.496436][T11626] netlink: 'syz.1.2124': attribute type 29 has an invalid length. [ 530.569332][T11628] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2125'. [ 530.584947][ T9] hid-led 0003:1D34:000A.0013: Dream Cheeky Webmail Notifier initialized [ 530.642205][T11629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.646170][T11629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.705226][ T9] usb 2-1: USB disconnect, device number 126 [ 530.752340][ T5709] usb 4-1: 0:2 : does not exist [ 531.045674][ T5709] usb 4-1: USB disconnect, device number 124 [ 531.327696][T11637] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2128'. [ 531.340866][T11637] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2128'. [ 531.457108][T11539] udevd[11539]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 531.588205][T11645] program syz.3.2131 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 531.617823][ T5768] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 531.731344][ T9] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 531.768636][ T5768] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 531.768669][ T5768] usb 1-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 531.768691][ T5768] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 531.768714][ T5768] usb 1-1: config 220 has no interface number 2 [ 531.768789][ T5768] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 531.768820][ T5768] usb 1-1: config 220 interface 0 has no altsetting 0 [ 531.768841][ T5768] usb 1-1: config 220 interface 76 has no altsetting 0 [ 531.768862][ T5768] usb 1-1: config 220 interface 1 has no altsetting 0 [ 531.780642][ T5768] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 531.780730][ T5768] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.780792][ T5768] usb 1-1: Product: syz [ 531.780837][ T5768] usb 1-1: Manufacturer: syz [ 531.780881][ T5768] usb 1-1: SerialNumber: syz [ 531.883971][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 531.885464][ T9] usb 2-1: config 1 interface 0 altsetting 156 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 531.885496][ T9] usb 2-1: config 1 interface 0 has no altsetting 0 [ 531.889097][ T9] usb 2-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.40 [ 531.889119][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.889135][ T9] usb 2-1: Product: syz [ 531.889147][ T9] usb 2-1: Manufacturer: syz [ 531.889352][ T9] usb 2-1: SerialNumber: syz [ 532.142494][ T5768] usb 1-1: selecting invalid altsetting 0 [ 532.231312][ T5768] uvcvideo 1-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 532.231351][ T5768] uvcvideo 1-1:220.0: No valid video chain found. [ 532.301446][ T32] usb 3-1: new full-speed USB device number 90 using dummy_hcd [ 532.312253][ T5768] usb 1-1: selecting invalid altsetting 0 [ 532.312306][ T5768] usbtest 1-1:220.1: probe with driver usbtest failed with error -22 [ 532.347639][ T9] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input35 [ 532.350673][ T5768] usb 1-1: USB disconnect, device number 117 [ 532.400235][ T4960] bcm5974 2-1:1.0: could not read from device [ 532.433559][ T32] usb 3-1: device descriptor read/64, error -71 [ 532.466798][ T9] usb 2-1: USB disconnect, device number 127 [ 532.478080][T11656] FAULT_INJECTION: forcing a failure. [ 532.478080][T11656] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 532.478111][T11656] CPU: 0 UID: 0 PID: 11656 Comm: syz.3.2134 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 532.478134][T11656] Tainted: [L]=SOFTLOCKUP [ 532.478140][T11656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 532.478151][T11656] Call Trace: [ 532.478158][T11656] [ 532.478165][T11656] dump_stack_lvl+0xe8/0x150 [ 532.478190][T11656] should_fail_ex+0x46b/0x600 [ 532.478219][T11656] _copy_to_user+0x31/0xb0 [ 532.478239][T11656] simple_read_from_buffer+0xe1/0x170 [ 532.478261][T11656] proc_fail_nth_read+0x1be/0x230 [ 532.478282][T11656] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 532.478301][T11656] ? rw_verify_area+0x2ac/0x4e0 [ 532.478321][T11656] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 532.478339][T11656] vfs_read+0x212/0xa80 [ 532.478365][T11656] ? __pfx_vfs_read+0x10/0x10 [ 532.478386][T11656] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 532.478408][T11656] ? lockdep_hardirqs_on+0x7a/0x110 [ 532.478437][T11656] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 532.478458][T11656] ? mutex_lock_nested+0x152/0x1d0 [ 532.478484][T11656] ? fdget_pos+0x252/0x320 [ 532.478507][T11656] ksys_read+0x156/0x270 [ 532.478528][T11656] ? __pfx_ksys_read+0x10/0x10 [ 532.478554][T11656] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.478572][T11656] do_syscall_64+0x174/0x580 [ 532.478593][T11656] ? trace_irq_disable+0x3b/0x140 [ 532.478614][T11656] ? clear_bhb_loop+0x40/0x90 [ 532.478634][T11656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 532.478650][T11656] RIP: 0033:0x7fc25447d68e [ 532.478666][T11656] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 532.478680][T11656] RSP: 002b:00007fc2526ecfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 532.478698][T11656] RAX: ffffffffffffffda RBX: 00007fc2526ed6c0 RCX: 00007fc25447d68e [ 532.478710][T11656] RDX: 000000000000000f RSI: 00007fc2526ed0a0 RDI: 0000000000000005 [ 532.478721][T11656] RBP: 00007fc2526ed090 R08: 0000000000000000 R09: 0000000000000000 [ 532.478732][T11656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 532.478742][T11656] R13: 00007fc254736128 R14: 00007fc254736090 R15: 00007ffc93a371d8 [ 532.478767][T11656] [ 532.791343][ T32] usb 3-1: new full-speed USB device number 91 using dummy_hcd [ 532.921310][ T32] usb 3-1: device descriptor read/64, error -71 [ 533.032090][ T32] usb usb3-port1: attempt power cycle [ 533.373878][ T32] usb 3-1: new full-speed USB device number 92 using dummy_hcd [ 533.404424][ T32] usb 3-1: device descriptor read/8, error -71 [ 533.641383][ T32] usb 3-1: new full-speed USB device number 93 using dummy_hcd [ 533.667512][ T32] usb 3-1: device descriptor read/8, error -71 [ 533.771726][ T32] usb usb3-port1: unable to enumerate USB device [ 534.142130][T11676] FAULT_INJECTION: forcing a failure. [ 534.142130][T11676] name failslab, interval 1, probability 0, space 0, times 0 [ 534.142173][T11676] CPU: 1 UID: 0 PID: 11676 Comm: syz.3.2141 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 534.142205][T11676] Tainted: [L]=SOFTLOCKUP [ 534.142215][T11676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 534.142230][T11676] Call Trace: [ 534.142240][T11676] [ 534.142251][T11676] dump_stack_lvl+0xe8/0x150 [ 534.142285][T11676] should_fail_ex+0x46b/0x600 [ 534.142325][T11676] should_failslab+0xa8/0x100 [ 534.142354][T11676] kmem_cache_alloc_noprof+0xa4/0x6c0 [ 534.142391][T11676] ? security_file_alloc+0x34/0x310 [ 534.142423][T11676] ? security_file_alloc+0x34/0x310 [ 534.142463][T11676] security_file_alloc+0x34/0x310 [ 534.142499][T11676] init_file+0x96/0x2d0 [ 534.142524][T11676] alloc_empty_file+0x74/0x1d0 [ 534.142548][T11676] alloc_file_pseudo+0x115/0x1e0 [ 534.142574][T11676] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 534.142608][T11676] __shmem_file_setup+0x2e9/0x370 [ 534.142645][T11676] ? __pfx___shmem_file_setup+0x10/0x10 [ 534.142687][T11676] ? drm_gem_private_object_init+0x297/0x390 [ 534.142717][T11676] drm_gem_object_init+0x39/0x90 [ 534.142753][T11676] __drm_gem_shmem_create+0x179/0x2e0 [ 534.142790][T11676] drm_gem_shmem_dumb_create+0x72/0x120 [ 534.142827][T11676] drm_mode_create_dumb_ioctl+0x2c0/0x350 [ 534.142870][T11676] drm_ioctl_kernel+0x2e2/0x3b0 [ 534.142906][T11676] ? __pfx_drm_mode_create_dumb_ioctl+0x10/0x10 [ 534.142942][T11676] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 534.142984][T11676] drm_ioctl+0x6c0/0xb80 [ 534.143020][T11676] ? __pfx_drm_mode_create_dumb_ioctl+0x10/0x10 [ 534.143063][T11676] ? __pfx_drm_ioctl+0x10/0x10 [ 534.143107][T11676] ? __fget_files+0x2a/0x420 [ 534.143134][T11676] ? bpf_lsm_file_ioctl+0x9/0x20 [ 534.143162][T11676] ? __pfx_drm_ioctl+0x10/0x10 [ 534.143191][T11676] __se_sys_ioctl+0xff/0x170 [ 534.143222][T11676] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.143249][T11676] do_syscall_64+0x174/0x580 [ 534.143278][T11676] ? trace_irq_disable+0x3b/0x140 [ 534.143308][T11676] ? clear_bhb_loop+0x40/0x90 [ 534.143337][T11676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.143361][T11676] RIP: 0033:0x7fc2544bce59 [ 534.143381][T11676] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 534.143400][T11676] RSP: 002b:00007fc25270e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 534.143424][T11676] RAX: ffffffffffffffda RBX: 00007fc254735fa0 RCX: 00007fc2544bce59 [ 534.143442][T11676] RDX: 0000200000000040 RSI: 00000000c02064b2 RDI: 0000000000000004 [ 534.143459][T11676] RBP: 00007fc25270e090 R08: 0000000000000000 R09: 0000000000000000 [ 534.143475][T11676] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 534.143490][T11676] R13: 00007fc254736038 R14: 00007fc254735fa0 R15: 00007ffc93a371d8 [ 534.143525][T11676] [ 534.951379][ T822] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 535.113228][ T822] usb 4-1: Using ep0 maxpacket: 32 [ 535.116232][ T822] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 535.116264][ T822] usb 4-1: config 0 has no interface number 0 [ 535.116316][ T822] usb 4-1: config 0 interface 12 has no altsetting 0 [ 535.118827][ T822] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 535.118861][ T822] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 535.118885][ T822] usb 4-1: Product: syz [ 535.118903][ T822] usb 4-1: Manufacturer: syz [ 535.118920][ T822] usb 4-1: SerialNumber: syz [ 535.176014][ T822] usb 4-1: config 0 descriptor?? [ 535.418741][ T822] f81534 4-1:0.12: f81534_set_register: reg: 1002 data: 3 failed: -71 [ 535.418894][ T822] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 535.418916][ T822] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 535.419016][ T822] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 535.469440][ T822] usb 4-1: USB disconnect, device number 125 [ 535.545459][ T60] Bluetooth: hci2: unexpected event for opcode 0x2019 [ 535.697716][T11695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 535.699273][T11695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 535.811323][ T32] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 535.951366][ T9] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 535.987113][ T32] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 535.987187][ T32] usb 2-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x7F, changing to 0xF [ 535.987219][ T32] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 536.033240][ T32] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 536.033278][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 536.033302][ T32] usb 2-1: Product: syz [ 536.033320][ T32] usb 2-1: Manufacturer: syz [ 536.033338][ T32] usb 2-1: SerialNumber: syz [ 536.101302][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 536.106080][ T9] usb 1-1: config index 0 descriptor too short (expected 6427, got 27) [ 536.106114][ T9] usb 1-1: config 0 has an invalid interface number: 21 but max is 0 [ 536.106136][ T9] usb 1-1: config 0 has no interface number 0 [ 536.106184][ T9] usb 1-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 536.106215][ T9] usb 1-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 536.106246][ T9] usb 1-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 536.106294][ T9] usb 1-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 536.106322][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 536.210302][ T9] usb 1-1: config 0 descriptor?? [ 536.218613][T11694] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 536.416897][ T32] cdc_ncm 2-1:1.0: bind() failure [ 536.460069][ T9] usb 1-1: USB disconnect, device number 118 [ 536.498338][ T32] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 536.498390][ T32] cdc_ncm 2-1:1.1: bind() failure [ 536.544420][ T32] usb 2-1: USB disconnect, device number 2 [ 536.891468][ T5775] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 537.042521][ T5775] usb 4-1: Using ep0 maxpacket: 32 [ 537.046579][ T5775] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 537.046609][ T5775] usb 4-1: config 0 has no interface number 0 [ 537.046657][ T5775] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 537.068891][ T5775] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 537.068980][ T5775] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.069050][ T5775] usb 4-1: Product: syz [ 537.069101][ T5775] usb 4-1: Manufacturer: syz [ 537.069145][ T5775] usb 4-1: SerialNumber: syz [ 537.137020][ T5775] usb 4-1: config 0 descriptor?? [ 537.171692][ T5775] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 537.171723][ T5775] em28xx 4-1:0.132: Video interface 132 found: [ 537.251397][ T32] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 537.401900][ T32] usb 3-1: Using ep0 maxpacket: 16 [ 537.404718][ T32] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 537.404748][ T32] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 537.407170][ T32] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 537.407202][ T32] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.407230][ T32] usb 3-1: Product: syz [ 537.407241][ T32] usb 3-1: Manufacturer: syz [ 537.407252][ T32] usb 3-1: SerialNumber: syz [ 537.521161][ T32] usb 3-1: 0:2 : does not exist [ 537.521457][ T32] usb 3-1: unit 9 not found! [ 537.559821][ T5775] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 537.606993][ T9] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 537.751533][ T5768] usb 3-1: USB disconnect, device number 94 [ 537.751706][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 537.776516][ T9] usb 1-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 537.776552][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.776575][ T9] usb 1-1: Product: syz [ 537.776592][ T9] usb 1-1: Manufacturer: syz [ 537.776609][ T9] usb 1-1: SerialNumber: syz [ 537.825363][ T822] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 537.867942][ T9] usb 1-1: config 0 descriptor?? [ 537.923516][ T9] gspca_main: sq930x-2.14.0 probing 2770:930c [ 538.006440][ T5775] em28xx 4-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=0) [ 538.006481][ T5775] em28xx 4-1:0.132: board has no eeprom [ 538.018401][ T822] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 538.018514][ T822] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 538.018698][ T822] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 538.018774][ T822] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 538.261912][ T5775] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 538.261946][ T5775] em28xx 4-1:0.132: analog set to bulk mode. [ 538.288669][ T822] usb 2-1: GET_CAPABILITIES returned 0 [ 538.288729][ T822] usbtmc 2-1:16.0: can't read capabilities [ 538.326328][ T5775] usb 4-1: USB disconnect, device number 126 [ 538.357417][ T5622] em28xx 4-1:0.132: Registering V4L2 extension [ 538.374032][ T5775] em28xx 4-1:0.132: Disconnecting em28xx [ 538.485850][ T822] usb 2-1: USB disconnect, device number 3 [ 538.517776][T11722] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.522136][T11722] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 538.601762][ T9] gspca_sq930x: reg_w 0305 fd00 failed -71 [ 538.606304][ T5622] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 538.606334][ T5622] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 538.606350][ T5622] em28xx 4-1:0.132: No AC97 audio processor [ 538.699804][ T5622] usb 4-1: Decoder not found [ 538.699835][ T5622] em28xx 4-1:0.132: failed to create media graph [ 538.699865][ T5622] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 538.742900][ T5622] em28xx 4-1:0.132: Remote control support is not available for this card. [ 538.742975][ T5775] em28xx 4-1:0.132: Closing input extension [ 538.831322][ T9] gspca_sq930x: Sensor ov9630 not yet treated [ 538.831434][ T9] sq930x 1-1:0.0: probe with driver sq930x failed with error -22 [ 538.901412][ T9] usb 1-1: USB disconnect, device number 119 [ 539.091766][ T5775] em28xx 4-1:0.132: Freeing device [ 539.095115][T11733] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2162'. [ 539.357353][T11740] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2166'. [ 539.374268][T11740] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2166'. [ 539.374427][T11740] FAULT_INJECTION: forcing a failure. [ 539.374427][T11740] name failslab, interval 1, probability 0, space 0, times 0 [ 539.374463][T11740] CPU: 0 UID: 0 PID: 11740 Comm: syz.0.2166 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 539.374496][T11740] Tainted: [L]=SOFTLOCKUP [ 539.374506][T11740] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 539.374522][T11740] Call Trace: [ 539.374532][T11740] [ 539.374543][T11740] dump_stack_lvl+0xe8/0x150 [ 539.374577][T11740] should_fail_ex+0x46b/0x600 [ 539.374616][T11740] should_failslab+0xa8/0x100 [ 539.374646][T11740] kmem_cache_alloc_noprof+0xa4/0x6c0 [ 539.374686][T11740] ? xfrm_state_lookup+0x45/0x1e0 [ 539.374718][T11740] ? xfrm_state_alloc+0x24/0x2f0 [ 539.374743][T11740] ? xfrm_state_alloc+0x24/0x2f0 [ 539.374778][T11740] xfrm_state_alloc+0x24/0x2f0 [ 539.374807][T11740] ipcomp4_init_state+0x2c4/0xb30 [ 539.374852][T11740] __xfrm_init_state+0xac9/0x1460 [ 539.374888][T11740] ? __xfrm_init_state+0x842/0x1460 [ 539.374929][T11740] xfrm_add_sa+0x30e8/0x4200 [ 539.374999][T11740] ? __pfx_xfrm_add_sa+0x10/0x10 [ 539.375032][T11740] ? apparmor_capable+0x126/0x170 [ 539.375068][T11740] ? __nla_parse+0x40/0x60 [ 539.375095][T11740] xfrm_user_rcv_msg+0x7cb/0xfc0 [ 539.375137][T11740] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 539.375211][T11740] ? __lock_acquire+0x6b5/0x2d10 [ 539.375247][T11740] ? netlink_deliver_tap+0x19c/0x1b0 [ 539.375276][T11740] ? netlink_unicast+0x754/0x920 [ 539.375300][T11740] ? netlink_sendmsg+0x813/0xb40 [ 539.375329][T11740] ? sock_sendmsg_nosec+0x13a/0x180 [ 539.375370][T11740] ? ____sys_sendmsg+0x55c/0x870 [ 539.375398][T11740] ? ___sys_sendmsg+0x2a5/0x360 [ 539.375424][T11740] ? __x64_sys_sendmsg+0x1b7/0x290 [ 539.375462][T11740] netlink_rcv_skb+0x232/0x4b0 [ 539.375491][T11740] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 539.375528][T11740] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 539.375570][T11740] ? lockdep_hardirqs_on+0x7a/0x110 [ 539.375604][T11740] ? mutex_lock_nested+0x152/0x1d0 [ 539.375640][T11740] ? xfrm_netlink_rcv+0x6a/0x90 [ 539.375679][T11740] xfrm_netlink_rcv+0x79/0x90 [ 539.375713][T11740] netlink_unicast+0x780/0x920 [ 539.375752][T11740] netlink_sendmsg+0x813/0xb40 [ 539.375793][T11740] ? __pfx_netlink_sendmsg+0x10/0x10 [ 539.375827][T11740] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 539.375861][T11740] ? aa_sock_msg_perm+0x122/0x200 [ 539.375887][T11740] ? __pfx_netlink_sendmsg+0x10/0x10 [ 539.375917][T11740] sock_sendmsg_nosec+0x13a/0x180 [ 539.375956][T11740] ____sys_sendmsg+0x55c/0x870 [ 539.375992][T11740] ? __pfx_____sys_sendmsg+0x10/0x10 [ 539.376033][T11740] ? import_iovec+0x73/0xa0 [ 539.376063][T11740] ___sys_sendmsg+0x2a5/0x360 [ 539.376092][T11740] ? __lock_acquire+0x6b5/0x2d10 [ 539.376127][T11740] ? __pfx____sys_sendmsg+0x10/0x10 [ 539.376196][T11740] ? __fget_files+0x2a/0x420 [ 539.376220][T11740] ? __fget_files+0x3a6/0x420 [ 539.376255][T11740] __x64_sys_sendmsg+0x1b7/0x290 [ 539.376289][T11740] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 539.376339][T11740] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.376374][T11740] do_syscall_64+0x174/0x580 [ 539.376404][T11740] ? trace_irq_disable+0x3b/0x140 [ 539.376433][T11740] ? clear_bhb_loop+0x40/0x90 [ 539.376462][T11740] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.376486][T11740] RIP: 0033:0x7fe0bac4ce59 [ 539.376508][T11740] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 539.376528][T11740] RSP: 002b:00007fe0b8ea6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 539.376552][T11740] RAX: ffffffffffffffda RBX: 00007fe0baec5fa0 RCX: 00007fe0bac4ce59 [ 539.376569][T11740] RDX: 0000000000000844 RSI: 0000200000000040 RDI: 0000000000000004 [ 539.376585][T11740] RBP: 00007fe0b8ea6090 R08: 0000000000000000 R09: 0000000000000000 [ 539.376601][T11740] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 539.376614][T11740] R13: 00007fe0baec6038 R14: 00007fe0baec5fa0 R15: 00007ffe109ee408 [ 539.376651][T11740] [ 539.601469][ T60] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 539.672163][ T5775] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 539.756947][ T60] Bluetooth: hci2: Injecting HCI hardware error event [ 539.760603][ T5615] Bluetooth: hci2: hardware error 0x00 [ 539.921362][ T5775] usb 4-1: Using ep0 maxpacket: 32 [ 539.923683][ T5775] usb 4-1: config 0 has no interfaces? [ 539.927536][ T5775] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 539.927572][ T5775] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 539.927597][ T5775] usb 4-1: Product: syz [ 539.927616][ T5775] usb 4-1: Manufacturer: syz [ 539.927633][ T5775] usb 4-1: SerialNumber: syz [ 539.944754][ T5775] usb 4-1: config 0 descriptor?? [ 540.201863][ T5775] usb 4-1: USB disconnect, device number 127 [ 540.557254][T11753] netlink: 108 bytes leftover after parsing attributes in process `syz.2.2170'. [ 540.812262][ T5775] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 540.867914][T11757] program syz.0.2171 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 540.975345][ T5775] usb 3-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 540.975385][ T5775] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 540.975418][ T5775] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 540.975468][ T5775] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 540.975503][ T5775] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 541.038649][T11753] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 541.268192][T11768] sg_write: data in/out 270400/136 bytes for SCSI command 0x0-- guessing data in; [ 541.268192][T11768] program syz.1.2176 not setting count and/or reply_len properly [ 541.921622][ T5615] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 542.101377][ T5768] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 542.256901][ T5768] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 542.259649][ T5768] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 542.259685][ T5768] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 542.259709][ T5768] usb 2-1: Product: syz [ 542.259727][ T5768] usb 2-1: Manufacturer: syz [ 542.259744][ T5768] usb 2-1: SerialNumber: syz [ 542.281485][ T5622] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 542.318084][ T5768] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 542.412251][ T5775] aiptek 3-1:17.0: Aiptek using 400 ms programming speed [ 542.413665][T11753] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2170'. [ 542.415859][ T5775] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:17.0/input/input37 [ 542.472769][ T5622] usb 1-1: config 0 has an invalid interface number: 48 but max is 0 [ 542.472804][ T5622] usb 1-1: config 0 has no interface number 0 [ 542.472839][ T5622] usb 1-1: too many endpoints for config 0 interface 48 altsetting 48: 48, using maximum allowed: 30 [ 542.472893][ T5622] usb 1-1: config 0 interface 48 altsetting 48 has 0 endpoint descriptors, different from the interface descriptor's value: 48 [ 542.472928][ T5622] usb 1-1: config 0 interface 48 has no altsetting 0 [ 542.472967][ T5622] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 542.472996][ T5622] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.612291][ T5622] usb 1-1: config 0 descriptor?? [ 542.755889][ T5768] usb 2-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 542.828035][ C1] raw-gadget.2 gadget.0: ignoring, device is not running [ 542.829046][ C1] raw-gadget.2 gadget.0: ignoring, device is not running [ 542.830291][ C1] raw-gadget.2 gadget.0: ignoring, device is not running [ 542.830742][ T5622] usb 1-1: string descriptor 0 read error: -32 [ 542.876082][ T5622] cp210x 1-1:0.48: cp210x converter detected [ 542.886034][ T5622] cp210x 1-1:0.48: failed to get vendor val 0x370b size 1: -71 [ 542.886069][ T5622] cp210x 1-1:0.48: querying part number failed [ 542.901708][ C1] aiptek 3-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 542.910631][ T5775] usb 3-1: USB disconnect, device number 95 [ 542.919476][ T5768] usb 2-1: USB disconnect, device number 4 [ 542.962027][ T5622] usb 1-1: cp210x converter now attached to ttyUSB0 [ 542.990550][ T5622] usb 1-1: USB disconnect, device number 120 [ 543.101959][ T5622] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 543.119594][ T5622] cp210x 1-1:0.48: device disconnected [ 543.311430][ T5768] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 543.319243][T11780] program syz.2.2181 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 543.465779][ T5768] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 543.468341][ T5768] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 543.468373][ T5768] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.468398][ T5768] usb 2-1: Product: syz [ 543.468410][ T5768] usb 2-1: Manufacturer: syz [ 543.468421][ T5768] usb 2-1: SerialNumber: syz [ 543.534387][ T5768] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 543.811376][ T9] usb 3-1: new full-speed USB device number 96 using dummy_hcd [ 543.904528][T11787] nvme_fabrics: missing parameter 'transport=%s' [ 543.904548][T11787] nvme_fabrics: missing parameter 'nqn=%s' [ 543.964281][ T9] usb 3-1: config 150 has an invalid interface number: 204 but max is 2 [ 543.964315][ T9] usb 3-1: config 150 has 2 interfaces, different from the descriptor's value: 3 [ 543.964570][ T9] usb 3-1: config 150 has no interface number 0 [ 543.964617][ T9] usb 3-1: config 150 interface 204 has no altsetting 0 [ 543.982362][ T9] usb 3-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 544.018554][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.018645][ T9] usb 3-1: Product: syz [ 544.018664][ T9] usb 3-1: Manufacturer: syz [ 544.018681][ T9] usb 3-1: SerialNumber: syz [ 544.215537][ T5768] usb 2-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 544.316586][ T9] xr_serial 3-1:150.204: skipping garbage [ 544.316663][ T9] xr_serial 3-1:150.204: xr_serial converter detected [ 544.463796][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2186'. [ 544.463827][T11793] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2186'. [ 544.600504][T11796] sg_write: data in/out 270400/136 bytes for SCSI command 0x0-- guessing data in; [ 544.600504][T11796] program syz.3.2187 not setting count and/or reply_len properly [ 544.850786][T11803] program syz.0.2190 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 544.980210][T11806] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2191'. [ 545.115042][ T9] usb 3-1: xr_serial converter now attached to ttyUSB0 [ 545.293123][ T5775] usb 2-1: USB disconnect, device number 5 [ 545.332571][ T32] usb 3-1: USB disconnect, device number 96 [ 545.360252][ T32] xr_serial ttyUSB0: xr_serial converter now disconnected from ttyUSB0 [ 545.371093][ T32] xr_serial 3-1:150.204: device disconnected [ 545.431424][ T5622] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 545.584142][ T5622] usb 1-1: Using ep0 maxpacket: 16 [ 545.596415][ T5622] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 545.596456][ T5622] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 545.596482][ T5622] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 545.596531][ T5622] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 545.596557][ T5622] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 545.659750][ T5622] usb 1-1: config 0 descriptor?? [ 545.928698][T11825] program syz.1.2199 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 546.096636][T11828] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2200'. [ 546.111537][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 546.265280][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 546.266963][ T9] usb 4-1: config index 0 descriptor too short (expected 64584, got 27) [ 546.266993][ T9] usb 4-1: config 53 has too many interfaces: 179, using maximum allowed: 32 [ 546.267018][ T9] usb 4-1: config 53 has an invalid interface descriptor of length 5, skipping [ 546.267040][ T9] usb 4-1: config 53 has an invalid descriptor of length 0, skipping remainder of the config [ 546.267063][ T9] usb 4-1: config 53 has 0 interfaces, different from the descriptor's value: 179 [ 546.273334][ T9] usb 4-1: string descriptor 0 read error: -22 [ 546.273598][ T9] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=2a.ad [ 546.273641][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.322300][ T5771] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 546.331872][T11809] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.2192'. [ 546.371474][ T5768] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 546.419877][T11830] IPVS: set_ctl: invalid protocol: 135 172.20.20.187:20003 [ 546.447417][T11809] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.2192'. [ 546.448457][T11809] tmpfs: Bad value for 'mpol' [ 546.497676][ T5771] usb 2-1: unable to get BOS descriptor or descriptor too short [ 546.506870][ T5771] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 546.506918][ T5771] usb 2-1: can't read configurations, error -71 [ 546.521378][ T5768] usb 3-1: Using ep0 maxpacket: 16 [ 546.531924][ T5768] usb 3-1: unable to get BOS descriptor or descriptor too short [ 546.542631][ T5768] usb 3-1: New USB device found, idVendor=10f5, idProduct=0200, bcdDevice= 0.40 [ 546.542667][ T5768] usb 3-1: New USB device strings: Mfr=1, Product=231, SerialNumber=3 [ 546.542691][ T5768] usb 3-1: Product: syz [ 546.542708][ T5768] usb 3-1: Manufacturer: syz [ 546.542724][ T5768] usb 3-1: SerialNumber: syz [ 546.617809][T11824] netlink: 'syz.3.2198': attribute type 46 has an invalid length. [ 546.763155][ T5622] usbhid 1-1:0.0: can't add hid device: -71 [ 546.763285][ T5622] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 546.782741][ T5622] usb 1-1: USB disconnect, device number 121 [ 546.852594][ T5768] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 546.865621][ T5768] usb 3-1: USB disconnect, device number 97 [ 547.174418][ T5768] usb 4-1: USB disconnect, device number 2 [ 547.561702][ T5771] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 547.714356][ T5771] usb 2-1: Using ep0 maxpacket: 32 [ 547.716377][ T5771] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 547.737486][ T5771] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 547.737525][ T5771] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.737542][ T5771] usb 2-1: Product: syz [ 547.737553][ T5771] usb 2-1: Manufacturer: syz [ 547.737564][ T5771] usb 2-1: SerialNumber: syz [ 547.801519][ T5771] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 547.801680][ T5771] imon 2-1:155.0: unable to initialize intf0, err -19 [ 547.801702][ T5771] imon:imon_probe: failed to initialize context! [ 547.801716][ T5771] imon 2-1:155.0: unable to register, err -19 [ 547.801890][ T5622] usb 1-1: new full-speed USB device number 122 using dummy_hcd [ 547.956305][ T5622] usb 1-1: unable to get BOS descriptor or descriptor too short [ 547.959184][ T5622] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 547.959233][ T5622] usb 1-1: can't read configurations, error -71 [ 548.941974][T11879] FAULT_INJECTION: forcing a failure. [ 548.941974][T11879] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 548.942016][T11879] CPU: 1 UID: 0 PID: 11879 Comm: syz.1.2218 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 548.942049][T11879] Tainted: [L]=SOFTLOCKUP [ 548.942059][T11879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 548.942087][T11879] Call Trace: [ 548.942097][T11879] [ 548.942116][T11879] dump_stack_lvl+0xe8/0x150 [ 548.942151][T11879] should_fail_ex+0x46b/0x600 [ 548.942191][T11879] _copy_from_user+0x2d/0xb0 [ 548.942219][T11879] kstrtouint_from_user+0xd6/0x180 [ 548.942257][T11879] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 548.942310][T11879] proc_fail_nth_write+0x8e/0x210 [ 548.942336][T11879] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 548.942368][T11879] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 548.942396][T11879] vfs_write+0x2a3/0xba0 [ 548.942434][T11879] ? __pfx_vfs_write+0x10/0x10 [ 548.942466][T11879] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 548.942499][T11879] ? lockdep_hardirqs_on+0x7a/0x110 [ 548.942537][T11879] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 548.942566][T11879] ? mutex_lock_nested+0x152/0x1d0 [ 548.942602][T11879] ? fdget_pos+0x252/0x320 [ 548.942638][T11879] ksys_write+0x156/0x270 [ 548.942670][T11879] ? __pfx_ksys_write+0x10/0x10 [ 548.942708][T11879] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.942735][T11879] do_syscall_64+0x174/0x580 [ 548.942765][T11879] ? trace_irq_disable+0x3b/0x140 [ 548.942795][T11879] ? clear_bhb_loop+0x40/0x90 [ 548.942825][T11879] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.942850][T11879] RIP: 0033:0x7f764182d68e [ 548.942872][T11879] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 548.942893][T11879] RSP: 002b:00007f763fa83fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 548.942917][T11879] RAX: ffffffffffffffda RBX: 00007f763fa846c0 RCX: 00007f764182d68e [ 548.942936][T11879] RDX: 0000000000000001 RSI: 00007f763fa840a0 RDI: 000000000000000b [ 548.942952][T11879] RBP: 00007f763fa84090 R08: 0000000000000000 R09: 0000000000000000 [ 548.942967][T11879] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 548.942982][T11879] R13: 00007f7641ae6218 R14: 00007f7641ae6180 R15: 00007ffc1229acf8 [ 548.943020][T11879] [ 549.334034][T11882] netlink: 188 bytes leftover after parsing attributes in process `syz.3.2221'. [ 549.519099][T11890] FAULT_INJECTION: forcing a failure. [ 549.519099][T11890] name failslab, interval 1, probability 0, space 0, times 0 [ 549.519141][T11890] CPU: 1 UID: 0 PID: 11890 Comm: syz.1.2225 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 549.519175][T11890] Tainted: [L]=SOFTLOCKUP [ 549.519183][T11890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 549.519199][T11890] Call Trace: [ 549.519209][T11890] [ 549.519219][T11890] dump_stack_lvl+0xe8/0x150 [ 549.519253][T11890] should_fail_ex+0x46b/0x600 [ 549.519293][T11890] should_failslab+0xa8/0x100 [ 549.519323][T11890] kmem_cache_alloc_node_noprof+0xae/0x710 [ 549.519364][T11890] ? __alloc_skb+0x1d0/0x7d0 [ 549.519388][T11890] ? __alloc_skb+0x1d0/0x7d0 [ 549.519420][T11890] __alloc_skb+0x1d0/0x7d0 [ 549.519452][T11890] tipc_nl_compat_dumpit+0x34d/0x7b0 [ 549.519496][T11890] tipc_nl_compat_recv+0x899/0xcf0 [ 549.519523][T11890] ? __pfx_tipc_nl_compat_recv+0x10/0x10 [ 549.519547][T11890] ? __pfx_tipc_nl_node_dump_link+0x10/0x10 [ 549.519577][T11890] ? __pfx_tipc_nl_compat_link_dump+0x10/0x10 [ 549.519604][T11890] ? __lock_acquire+0x6b5/0x2d10 [ 549.519644][T11890] ? snprintf+0xe8/0x140 [ 549.519670][T11890] ? genl_family_rcv_msg_attrs_parse+0xe9/0x2f0 [ 549.519704][T11890] genl_family_rcv_msg_doit+0x22a/0x330 [ 549.519750][T11890] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 549.519799][T11890] ? lockdep_hardirqs_on+0x7a/0x110 [ 549.519830][T11890] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 549.519868][T11890] genl_rcv_msg+0x61c/0x7a0 [ 549.519912][T11890] ? __pfx_genl_rcv_msg+0x10/0x10 [ 549.519952][T11890] ? ref_tracker_free+0x673/0x820 [ 549.519988][T11890] ? __pfx_tipc_nl_compat_recv+0x10/0x10 [ 549.520013][T11890] ? ____sys_sendmsg+0x55c/0x870 [ 549.520040][T11890] ? ___sys_sendmsg+0x2a5/0x360 [ 549.520081][T11890] netlink_rcv_skb+0x232/0x4b0 [ 549.520113][T11890] ? __pfx_genl_rcv_msg+0x10/0x10 [ 549.520157][T11890] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 549.520211][T11890] genl_rcv+0x28/0x40 [ 549.520245][T11890] netlink_unicast+0x780/0x920 [ 549.520283][T11890] netlink_sendmsg+0x813/0xb40 [ 549.520324][T11890] ? __pfx_netlink_sendmsg+0x10/0x10 [ 549.520356][T11890] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 549.520391][T11890] ? aa_sock_msg_perm+0x122/0x200 [ 549.520417][T11890] ? __pfx_netlink_sendmsg+0x10/0x10 [ 549.520447][T11890] sock_sendmsg_nosec+0x13a/0x180 [ 549.520492][T11890] ____sys_sendmsg+0x55c/0x870 [ 549.520529][T11890] ? __pfx_____sys_sendmsg+0x10/0x10 [ 549.520567][T11890] ? import_iovec+0x73/0xa0 [ 549.520596][T11890] ___sys_sendmsg+0x2a5/0x360 [ 549.520625][T11890] ? __lock_acquire+0x6b5/0x2d10 [ 549.520659][T11890] ? __pfx____sys_sendmsg+0x10/0x10 [ 549.520724][T11890] ? __fget_files+0x2a/0x420 [ 549.520748][T11890] ? __fget_files+0x3a6/0x420 [ 549.520783][T11890] __x64_sys_sendmsg+0x1b7/0x290 [ 549.520817][T11890] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 549.520868][T11890] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.520896][T11890] do_syscall_64+0x174/0x580 [ 549.520925][T11890] ? trace_irq_disable+0x3b/0x140 [ 549.520955][T11890] ? clear_bhb_loop+0x40/0x90 [ 549.521000][T11890] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.521025][T11890] RIP: 0033:0x7f764186ce59 [ 549.521046][T11890] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 549.521067][T11890] RSP: 002b:00007f763fac6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 549.521092][T11890] RAX: ffffffffffffffda RBX: 00007f7641ae5fa0 RCX: 00007f764186ce59 [ 549.521110][T11890] RDX: 0000000000008004 RSI: 0000200000000200 RDI: 0000000000000003 [ 549.521126][T11890] RBP: 00007f763fac6090 R08: 0000000000000000 R09: 0000000000000000 [ 549.521141][T11890] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 549.521156][T11890] R13: 00007f7641ae6038 R14: 00007f7641ae5fa0 R15: 00007ffc1229acf8 [ 549.521190][T11890] [ 549.951352][ T5622] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 550.107563][ T5622] usb 3-1: New USB device found, idVendor=0403, idProduct=f850, bcdDevice= 1.4b [ 550.107600][ T5622] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 550.107624][ T5622] usb 3-1: Product: syz [ 550.107641][ T5622] usb 3-1: SerialNumber: syz [ 550.409882][ T5622] ftdi_sio 3-1:2.0: FTDI USB Serial Device converter detected [ 550.430636][ T5622] usb 3-1: Detected SIO [ 550.441022][ T5622] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 550.462365][ T5622] usb 3-1: USB disconnect, device number 98 [ 550.485832][ T5622] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 550.486646][ T5622] ftdi_sio 3-1:2.0: device disconnected [ 551.371370][ T5768] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 551.521447][ T5768] usb 1-1: Using ep0 maxpacket: 16 [ 551.538621][ T5768] usb 1-1: unable to get BOS descriptor or descriptor too short [ 551.564918][ T5768] usb 1-1: New USB device found, idVendor=0763, idProduct=0150, bcdDevice= 0.40 [ 551.564953][ T5768] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.564976][ T5768] usb 1-1: Product: syz [ 551.564993][ T5768] usb 1-1: Manufacturer: syz [ 551.565010][ T5768] usb 1-1: SerialNumber: syz [ 551.866201][T11915] IPv6: Can't replace route, no match found [ 551.882677][T11915] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2234'. [ 552.879600][T11928] syz.1.2239 (11928) used greatest stack depth: 17288 bytes left [ 553.238294][T11950] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2245'. [ 553.445441][T11954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 553.445994][T11954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.113179][ T5768] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 554.113240][ T5768] usb 1-1: MIDIStreaming interface descriptor not found [ 554.408090][ T5768] usb 1-1: USB disconnect, device number 124 [ 554.727442][T11439] udevd[11439]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 554.838612][ T32] hid-generic 0000:0000:0000.0014: unknown main item tag 0x0 [ 554.941144][ T32] hid-generic 0000:0000:0000.0014: hidraw0: HID v0.00 Device [syz1] on syz0 [ 555.560488][T11982] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 555.561106][T11982] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 555.781361][ T32] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 555.912551][ T32] usb 4-1: device descriptor read/64, error -71 [ 556.082874][T12007] 9p: Bad value for 'rfdno' [ 556.171423][ T32] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 556.287979][T11999] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 556.288194][T11999] block device autoloading is deprecated and will be removed. [ 556.312593][ T32] usb 4-1: device descriptor read/64, error -71 [ 556.397444][T12012] netlink: 'syz.0.2266': attribute type 10 has an invalid length. [ 556.397469][T12012] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2266'. [ 556.421755][ T32] usb usb4-port1: attempt power cycle [ 556.441496][ T5768] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 556.594387][ T5768] usb 3-1: Using ep0 maxpacket: 16 [ 556.596629][ T5768] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 556.596665][ T5768] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 556.599644][ T5768] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 556.599684][ T5768] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.599700][ T5768] usb 3-1: Product: syz [ 556.599711][ T5768] usb 3-1: Manufacturer: syz [ 556.599723][ T5768] usb 3-1: SerialNumber: syz [ 556.629502][ T5768] usb 3-1: config 0 descriptor?? [ 556.679462][ T5768] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 556.679502][ T5768] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 556.761487][ T32] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 556.782287][ T32] usb 4-1: device descriptor read/8, error -71 [ 556.933571][T12021] FAULT_INJECTION: forcing a failure. [ 556.933571][T12021] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 556.933613][T12021] CPU: 1 UID: 0 PID: 12021 Comm: syz.1.2269 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 556.933646][T12021] Tainted: [L]=SOFTLOCKUP [ 556.933656][T12021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 556.933671][T12021] Call Trace: [ 556.933681][T12021] [ 556.933692][T12021] dump_stack_lvl+0xe8/0x150 [ 556.933727][T12021] should_fail_ex+0x46b/0x600 [ 556.933768][T12021] _copy_to_user+0x31/0xb0 [ 556.933803][T12021] simple_read_from_buffer+0xe1/0x170 [ 556.933835][T12021] proc_fail_nth_read+0x1be/0x230 [ 556.933872][T12021] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 556.933900][T12021] ? rw_verify_area+0x2ac/0x4e0 [ 556.933929][T12021] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 556.933955][T12021] vfs_read+0x212/0xa80 [ 556.933992][T12021] ? __pfx_vfs_read+0x10/0x10 [ 556.934024][T12021] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 556.934054][T12021] ? lockdep_hardirqs_on+0x7a/0x110 [ 556.934083][T12021] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 556.934112][T12021] ? mutex_lock_nested+0x152/0x1d0 [ 556.934147][T12021] ? fdget_pos+0x252/0x320 [ 556.934182][T12021] ksys_read+0x156/0x270 [ 556.934213][T12021] ? __pfx_ksys_read+0x10/0x10 [ 556.934250][T12021] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 556.934274][T12021] do_syscall_64+0x174/0x580 [ 556.934305][T12021] ? trace_irq_disable+0x3b/0x140 [ 556.934335][T12021] ? clear_bhb_loop+0x40/0x90 [ 556.934365][T12021] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 556.934388][T12021] RIP: 0033:0x7f764182d68e [ 556.934409][T12021] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 556.934429][T12021] RSP: 002b:00007f763fac5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 556.934454][T12021] RAX: ffffffffffffffda RBX: 00007f763fac66c0 RCX: 00007f764182d68e [ 556.934473][T12021] RDX: 000000000000000f RSI: 00007f763fac60a0 RDI: 0000000000000006 [ 556.934489][T12021] RBP: 00007f763fac6090 R08: 0000000000000000 R09: 0000000000000000 [ 556.934505][T12021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 556.934517][T12021] R13: 00007f7641ae6038 R14: 00007f7641ae5fa0 R15: 00007ffc1229acf8 [ 556.934553][T12021] [ 556.994434][ T5709] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 557.271386][ T32] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 557.292197][ T32] usb 4-1: device descriptor read/8, error -71 [ 557.382208][ T5709] usb 1-1: Using ep0 maxpacket: 16 [ 557.401645][ T32] usb usb4-port1: unable to enumerate USB device [ 557.416666][ T5709] usb 1-1: config index 0 descriptor too short (expected 51443, got 18) [ 557.443389][ T5709] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 557.443484][ T5709] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.443510][ T5709] usb 1-1: Product: syz [ 557.443528][ T5709] usb 1-1: Manufacturer: syz [ 557.443545][ T5709] usb 1-1: SerialNumber: syz [ 557.446219][ T5768] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 557.447399][ T5768] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 557.513699][ T5709] r8152-cfgselector 1-1: Unknown version 0x0000 [ 557.513720][ T5709] r8152-cfgselector 1-1: config 0 descriptor?? [ 558.197028][ T5768] em28xx 3-1:0.0: Unknown AC97 audio processor detected! [ 558.349809][T12037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.350452][T12037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.400436][ T5768] em28xx 3-1:0.0: couldn't setup AC97 register 2 [ 558.400906][ T5768] em28xx 3-1:0.0: couldn't setup AC97 register 4 [ 558.401880][ T5768] em28xx 3-1:0.0: couldn't setup AC97 register 6 [ 558.402676][ T5768] em28xx 3-1:0.0: couldn't setup AC97 register 54 [ 558.403527][ T5768] em28xx 3-1:0.0: couldn't setup AC97 register 56 [ 558.450187][ T5768] usb 3-1: USB disconnect, device number 99 [ 558.780395][T12052] FAULT_INJECTION: forcing a failure. [ 558.780395][T12052] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 558.780444][T12052] CPU: 1 UID: 0 PID: 12052 Comm: syz.1.2277 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 558.780468][T12052] Tainted: [L]=SOFTLOCKUP [ 558.780502][T12052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 558.780517][T12052] Call Trace: [ 558.780527][T12052] [ 558.780537][T12052] dump_stack_lvl+0xe8/0x150 [ 558.780576][T12052] should_fail_ex+0x46b/0x600 [ 558.780617][T12052] _copy_from_user+0x2d/0xb0 [ 558.780642][T12052] binder_ioctl_write_read+0x167/0xa470 [ 558.780663][T12052] ? is_bpf_text_address+0x26/0x2b0 [ 558.780697][T12052] ? try_to_take_rt_mutex+0x840/0xb00 [ 558.780715][T12052] ? __kernel_text_address+0xd/0x30 [ 558.780743][T12052] ? __lock_acquire+0x6b5/0x2d10 [ 558.780769][T12052] ? __pfx_binder_ioctl_write_read+0x10/0x10 [ 558.780789][T12052] ? stack_depot_save_flags+0x33/0x810 [ 558.780819][T12052] ? do_raw_spin_lock+0x12b/0x2f0 [ 558.780845][T12052] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 558.780866][T12052] ? lockdep_hardirqs_on+0x7a/0x110 [ 558.780888][T12052] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 558.780908][T12052] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 558.780924][T12052] ? reacquire_held_locks+0x104/0x190 [ 558.780948][T12052] ? rt_spin_lock+0x1e0/0x400 [ 558.780965][T12052] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 558.780983][T12052] ? rt_spin_unlock+0x14f/0x200 [ 558.781005][T12052] ? binder_get_thread+0x177/0x6d0 [ 558.781025][T12052] binder_ioctl+0x426/0x1b10 [ 558.781043][T12052] ? tomoyo_path_number_perm+0x219/0x630 [ 558.781069][T12052] ? tomoyo_path_number_perm+0x219/0x630 [ 558.781097][T12052] ? do_vfs_ioctl+0x117b/0x1540 [ 558.781126][T12052] ? __pfx_binder_ioctl+0x10/0x10 [ 558.781143][T12052] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 558.781221][T12052] ? __fget_files+0x2a/0x420 [ 558.781248][T12052] ? __fget_files+0x2a/0x420 [ 558.781270][T12052] ? __fget_files+0x3a6/0x420 [ 558.781291][T12052] ? __fget_files+0x2a/0x420 [ 558.781318][T12052] ? bpf_lsm_file_ioctl+0x9/0x20 [ 558.781347][T12052] ? __pfx_binder_ioctl+0x10/0x10 [ 558.781373][T12052] __se_sys_ioctl+0xff/0x170 [ 558.781394][T12052] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 558.781411][T12052] do_syscall_64+0x174/0x580 [ 558.781432][T12052] ? trace_irq_disable+0x3b/0x140 [ 558.781452][T12052] ? clear_bhb_loop+0x40/0x90 [ 558.781472][T12052] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 558.781489][T12052] RIP: 0033:0x7f764186ce59 [ 558.781504][T12052] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 558.781519][T12052] RSP: 002b:00007f763fac6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 558.781536][T12052] RAX: ffffffffffffffda RBX: 00007f7641ae5fa0 RCX: 00007f764186ce59 [ 558.781549][T12052] RDX: 0000200000004a40 RSI: 00000000c0306201 RDI: 0000000000000005 [ 558.781560][T12052] RBP: 00007f763fac6090 R08: 0000000000000000 R09: 0000000000000000 [ 558.781570][T12052] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 558.781581][T12052] R13: 00007f7641ae6038 R14: 00007f7641ae5fa0 R15: 00007ffc1229acf8 [ 558.781633][T12052] [ 558.785383][T12052] binder: 12049:12052 ioctl c0306201 200000004a40 returned -14 [ 559.818344][ T5768] r8152-cfgselector 1-1: USB disconnect, device number 125 [ 560.422876][ T5775] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 560.428001][T12086] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 560.454277][T12086] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 560.583921][ T5775] usb 1-1: Using ep0 maxpacket: 16 [ 560.589540][ T5775] usb 1-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 560.589573][ T5775] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.589598][ T5775] usb 1-1: Product: syz [ 560.589615][ T5775] usb 1-1: Manufacturer: syz [ 560.589627][ T5775] usb 1-1: SerialNumber: syz [ 560.615308][ T5775] usb 1-1: config 0 descriptor?? [ 560.639063][ T5775] ssu100 1-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 560.691412][ T5768] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 560.861466][ T5768] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 560.861494][ T5768] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 560.870845][ T5768] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 560.870879][ T5768] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 560.870904][ T5768] usb 4-1: Product: syz [ 560.870920][ T5768] usb 4-1: Manufacturer: syz [ 560.870938][ T5768] usb 4-1: SerialNumber: syz [ 561.230271][ T32] usb 4-1: USB disconnect, device number 7 [ 561.390538][T12090] befs: (nullb0): invalid magic header [ 561.556346][T12102] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.559367][T12102] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.564950][ T5775] ssu100 1-1:0.0: probe with driver ssu100 failed with error -110 [ 561.671435][ T5768] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 561.821395][ T5768] usb 3-1: Using ep0 maxpacket: 8 [ 561.827330][ T5768] usb 3-1: config 0 has an invalid interface number: 143 but max is 0 [ 561.827363][ T5768] usb 3-1: config 0 has no interface number 0 [ 561.827422][ T5768] usb 3-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 561.827475][ T5768] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.879688][ T5768] usb 3-1: config 0 descriptor?? [ 561.992062][ T5768] viperboard 3-1:0.143: version 0.00 found at bus 003 address 100 [ 562.138933][ T5768] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 562.138970][ T5768] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 562.210810][ T5768] usb 3-1: USB disconnect, device number 100 [ 562.943689][T12075] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 563.009008][ T5768] usb 1-1: USB disconnect, device number 126 [ 563.150063][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.150187][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.208764][T12120] FAULT_INJECTION: forcing a failure. [ 563.208764][T12120] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 563.208815][T12120] CPU: 1 UID: 0 PID: 12120 Comm: syz.2.2298 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 563.208847][T12120] Tainted: [L]=SOFTLOCKUP [ 563.208857][T12120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 563.208872][T12120] Call Trace: [ 563.208881][T12120] [ 563.208891][T12120] dump_stack_lvl+0xe8/0x150 [ 563.208926][T12120] should_fail_ex+0x46b/0x600 [ 563.208964][T12120] _copy_from_user+0x2d/0xb0 [ 563.208993][T12120] do_sys_poll+0x2a0/0xf50 [ 563.209030][T12120] ? __lock_acquire+0x6b5/0x2d10 [ 563.209058][T12120] ? __pfx_do_sys_poll+0x10/0x10 [ 563.209099][T12120] ? aa_file_perm+0x192/0x15f0 [ 563.209214][T12120] ? set_user_sigmask+0xcd/0x1c0 [ 563.209249][T12120] ? __pfx_set_user_sigmask+0x10/0x10 [ 563.209281][T12120] ? rt_mutex_slowunlock+0x1cb/0x300 [ 563.209305][T12120] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 563.209334][T12120] __se_sys_ppoll+0x209/0x2b0 [ 563.209370][T12120] ? fput+0xa0/0xd0 [ 563.209394][T12120] ? __pfx___se_sys_ppoll+0x10/0x10 [ 563.209434][T12120] ? __pfx_ksys_write+0x10/0x10 [ 563.209468][T12120] ? __x64_sys_ppoll+0x20/0xc0 [ 563.209502][T12120] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.209527][T12120] do_syscall_64+0x174/0x580 [ 563.209555][T12120] ? trace_irq_disable+0x3b/0x140 [ 563.209585][T12120] ? clear_bhb_loop+0x40/0x90 [ 563.209613][T12120] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.209636][T12120] RIP: 0033:0x7f13b5b3ce59 [ 563.209659][T12120] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 563.209680][T12120] RSP: 002b:00007f13b3d8e028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 563.209705][T12120] RAX: ffffffffffffffda RBX: 00007f13b5db5fa0 RCX: 00007f13b5b3ce59 [ 563.209723][T12120] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0 [ 563.209738][T12120] RBP: 00007f13b3d8e090 R08: 0000000000000000 R09: 0000000000000000 [ 563.209754][T12120] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 563.209778][T12120] R13: 00007f13b5db6038 R14: 00007f13b5db5fa0 R15: 00007ffc7cd55e88 [ 563.209814][T12120] [ 563.670188][T12127] fuse: fd is not a fuse device [ 563.711335][ T5597] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 563.872421][ T5597] usb 4-1: Using ep0 maxpacket: 32 [ 563.891639][ T5597] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 563.891725][ T5597] usb 4-1: config 1 interface 1 has no altsetting 0 [ 563.912559][ T5597] usb 4-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 563.912617][ T5597] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.912683][ T5597] usb 4-1: Product: syz [ 563.912726][ T5597] usb 4-1: Manufacturer: syz [ 563.912769][ T5597] usb 4-1: SerialNumber: syz [ 564.021387][T12137] FAULT_INJECTION: forcing a failure. [ 564.021387][T12137] name failslab, interval 1, probability 0, space 0, times 0 [ 564.021439][T12137] CPU: 0 UID: 0 PID: 12137 Comm: syz.1.2305 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 564.021467][T12137] Tainted: [L]=SOFTLOCKUP [ 564.021473][T12137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 564.021484][T12137] Call Trace: [ 564.021492][T12137] [ 564.021500][T12137] dump_stack_lvl+0xe8/0x150 [ 564.021526][T12137] should_fail_ex+0x46b/0x600 [ 564.021554][T12137] should_failslab+0xa8/0x100 [ 564.021575][T12137] __kmalloc_noprof+0xfe/0x7e0 [ 564.021593][T12137] ? __d_alloc+0xc2/0x6f0 [ 564.021610][T12137] ? __d_alloc+0xc2/0x6f0 [ 564.021633][T12137] __d_alloc+0xc2/0x6f0 [ 564.021656][T12137] d_alloc+0x4b/0x190 [ 564.021673][T12137] ? lookup_one_qstr_excl+0xc4/0x360 [ 564.021694][T12137] lookup_one_qstr_excl+0xd8/0x360 [ 564.021725][T12137] filename_create+0x20e/0x370 [ 564.021772][T12137] ? __pfx_filename_create+0x10/0x10 [ 564.021808][T12137] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.021838][T12137] filename_mkdirat+0xd2/0x520 [ 564.021880][T12137] ? __pfx_filename_mkdirat+0x10/0x10 [ 564.021905][T12137] ? do_getname+0x151/0x250 [ 564.021930][T12137] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.021948][T12137] __se_sys_mkdirat+0x35/0x150 [ 564.021970][T12137] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.021988][T12137] do_syscall_64+0x174/0x580 [ 564.022009][T12137] ? trace_irq_disable+0x3b/0x140 [ 564.022030][T12137] ? clear_bhb_loop+0x40/0x90 [ 564.022050][T12137] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 564.022067][T12137] RIP: 0033:0x7f764186ce59 [ 564.022083][T12137] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 564.022097][T12137] RSP: 002b:00007f763fac6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 564.022115][T12137] RAX: ffffffffffffffda RBX: 00007f7641ae5fa0 RCX: 00007f764186ce59 [ 564.022127][T12137] RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000000000000004 [ 564.022138][T12137] RBP: 00007f763fac6090 R08: 0000000000000000 R09: 0000000000000000 [ 564.022149][T12137] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 564.022159][T12137] R13: 00007f7641ae6038 R14: 00007f7641ae5fa0 R15: 00007ffc1229acf8 [ 564.022185][T12137] [ 564.132529][ T5768] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 564.361415][ T5768] usb 3-1: Using ep0 maxpacket: 32 [ 564.365983][ T5768] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 564.366045][ T5768] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 564.366077][ T5768] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 564.366111][ T5768] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 26 [ 564.380689][ T5768] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 564.380787][ T5768] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 564.380853][ T5768] usb 3-1: SerialNumber: syz [ 564.460059][ T5768] cdc_acm 3-1:1.0: Control and data interfaces are not separated! [ 564.460086][ T5768] cdc_acm 3-1:1.0: This needs exactly 3 endpoints [ 564.460128][ T5768] cdc_acm 3-1:1.0: probe with driver cdc_acm failed with error -22 [ 564.555046][ T5597] snd-ua101 4-1:1.1: invalid num_altsetting [ 564.555083][ T5597] snd-ua101 4-1:1.0: invalid num_altsetting [ 564.555916][ T5597] usb 4-1: selecting invalid altsetting 0 [ 564.604832][ T5597] usb 4-1: selecting invalid altsetting 0 [ 564.604875][ T5597] usbtest 4-1:1.1: probe with driver usbtest failed with error -22 [ 564.656058][ T5775] usb 3-1: USB disconnect, device number 101 [ 564.661534][ T5597] usb 4-1: selecting invalid altsetting 0 [ 564.661589][ T5597] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 564.684542][ T5597] usb 4-1: selecting invalid altsetting 0 [ 564.684584][ T5597] snd-ua101 4-1:1.1: probe with driver snd-ua101 failed with error -22 [ 564.756799][ T5597] usb 4-1: USB disconnect, device number 8 [ 564.821841][T12142] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 564.822491][T12142] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 565.080043][T12150] FAULT_INJECTION: forcing a failure. [ 565.080043][T12150] name failslab, interval 1, probability 0, space 0, times 0 [ 565.080087][T12150] CPU: 1 UID: 0 PID: 12150 Comm: syz.3.2311 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 565.080136][T12150] Tainted: [L]=SOFTLOCKUP [ 565.080145][T12150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 565.080160][T12150] Call Trace: [ 565.080170][T12150] [ 565.080181][T12150] dump_stack_lvl+0xe8/0x150 [ 565.080214][T12150] should_fail_ex+0x46b/0x600 [ 565.080253][T12150] should_failslab+0xa8/0x100 [ 565.080282][T12150] __kvmalloc_node_noprof+0x181/0x910 [ 565.080310][T12150] ? rcu_is_watching+0x15/0xb0 [ 565.080347][T12150] ? __rhashtable_init_noprof+0x56d/0xae0 [ 565.080383][T12150] ? __rhashtable_init_noprof+0x56d/0xae0 [ 565.080426][T12150] __rhashtable_init_noprof+0x56d/0xae0 [ 565.080471][T12150] __rhltable_init_noprof+0x26/0x70 [ 565.080496][T12150] nf_tables_newtable+0x696/0x1910 [ 565.080541][T12150] nfnetlink_rcv+0x1247/0x27b0 [ 565.080604][T12150] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 565.080648][T12150] ? __pfx_save_netdev_trace_buffer+0x10/0x10 [ 565.080686][T12150] ? ref_tracker_free+0x673/0x820 [ 565.080751][T12150] ? __netlink_deliver_tap+0x866/0x8b0 [ 565.080792][T12150] ? netlink_deliver_tap+0x2e/0x1b0 [ 565.080821][T12150] ? netlink_deliver_tap+0x2e/0x1b0 [ 565.080856][T12150] netlink_unicast+0x780/0x920 [ 565.080894][T12150] netlink_sendmsg+0x813/0xb40 [ 565.080935][T12150] ? __pfx_netlink_sendmsg+0x10/0x10 [ 565.080967][T12150] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 565.081001][T12150] ? aa_sock_msg_perm+0x122/0x200 [ 565.081026][T12150] ? __pfx_netlink_sendmsg+0x10/0x10 [ 565.081056][T12150] sock_sendmsg_nosec+0x13a/0x180 [ 565.081093][T12150] ____sys_sendmsg+0x55c/0x870 [ 565.081139][T12150] ? __pfx_____sys_sendmsg+0x10/0x10 [ 565.081177][T12150] ? import_iovec+0x73/0xa0 [ 565.081203][T12150] ___sys_sendmsg+0x2a5/0x360 [ 565.081232][T12150] ? __lock_acquire+0x6b5/0x2d10 [ 565.081266][T12150] ? __pfx____sys_sendmsg+0x10/0x10 [ 565.081333][T12150] ? __fget_files+0x2a/0x420 [ 565.081358][T12150] ? __fget_files+0x3a6/0x420 [ 565.081394][T12150] __x64_sys_sendmsg+0x1b7/0x290 [ 565.081428][T12150] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 565.081478][T12150] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.081505][T12150] do_syscall_64+0x174/0x580 [ 565.081535][T12150] ? trace_irq_disable+0x3b/0x140 [ 565.081564][T12150] ? clear_bhb_loop+0x40/0x90 [ 565.081594][T12150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.081619][T12150] RIP: 0033:0x7fc2544bce59 [ 565.081642][T12150] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.081662][T12150] RSP: 002b:00007fc25270e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 565.081688][T12150] RAX: ffffffffffffffda RBX: 00007fc254735fa0 RCX: 00007fc2544bce59 [ 565.081706][T12150] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 565.081722][T12150] RBP: 00007fc25270e090 R08: 0000000000000000 R09: 0000000000000000 [ 565.081738][T12150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 565.081752][T12150] R13: 00007fc254736038 R14: 00007fc254735fa0 R15: 00007ffc93a371d8 [ 565.081789][T12150] [ 565.485236][T12154] nbd: must specify an index to disconnect [ 565.595623][T12158] sg_write: data in/out 366944/136 bytes for SCSI command 0x0-- guessing data in; [ 565.595623][T12158] program syz.3.2315 not setting count and/or reply_len properly [ 565.678202][T12160] 9pnet_fd: p9_fd_create_unix (12160): problem connecting socket: ./file0: -111 [ 565.985599][T12170] FAULT_INJECTION: forcing a failure. [ 565.985599][T12170] name failslab, interval 1, probability 0, space 0, times 0 [ 565.985637][T12170] CPU: 0 UID: 0 PID: 12170 Comm: syz.0.2320 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 565.985665][T12170] Tainted: [L]=SOFTLOCKUP [ 565.985673][T12170] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 565.985685][T12170] Call Trace: [ 565.985693][T12170] [ 565.985702][T12170] dump_stack_lvl+0xe8/0x150 [ 565.985729][T12170] should_fail_ex+0x46b/0x600 [ 565.985761][T12170] should_failslab+0xa8/0x100 [ 565.985788][T12170] __kmalloc_cache_noprof+0xa0/0x6d0 [ 565.985809][T12170] ? nfnetlink_rcv+0xfe8/0x27b0 [ 565.985829][T12170] ? nfnetlink_rcv+0xfe8/0x27b0 [ 565.985855][T12170] nfnetlink_rcv+0xfe8/0x27b0 [ 565.985902][T12170] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 565.985936][T12170] ? __pfx_save_netdev_trace_buffer+0x10/0x10 [ 565.985964][T12170] ? ref_tracker_free+0x673/0x820 [ 565.986016][T12170] ? __netlink_deliver_tap+0x866/0x8b0 [ 565.986049][T12170] ? netlink_deliver_tap+0x2e/0x1b0 [ 565.986073][T12170] ? netlink_deliver_tap+0x2e/0x1b0 [ 565.986102][T12170] netlink_unicast+0x780/0x920 [ 565.986143][T12170] netlink_sendmsg+0x813/0xb40 [ 565.986178][T12170] ? __pfx_netlink_sendmsg+0x10/0x10 [ 565.986202][T12170] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 565.986228][T12170] ? aa_sock_msg_perm+0x122/0x200 [ 565.986248][T12170] ? __pfx_netlink_sendmsg+0x10/0x10 [ 565.986270][T12170] sock_sendmsg_nosec+0x13a/0x180 [ 565.986300][T12170] ____sys_sendmsg+0x55c/0x870 [ 565.986327][T12170] ? __pfx_____sys_sendmsg+0x10/0x10 [ 565.986357][T12170] ? import_iovec+0x73/0xa0 [ 565.986379][T12170] ___sys_sendmsg+0x2a5/0x360 [ 565.986400][T12170] ? __lock_acquire+0x6b5/0x2d10 [ 565.986426][T12170] ? __pfx____sys_sendmsg+0x10/0x10 [ 565.986476][T12170] ? __fget_files+0x2a/0x420 [ 565.986494][T12170] ? __fget_files+0x3a6/0x420 [ 565.986521][T12170] __x64_sys_sendmsg+0x1b7/0x290 [ 565.986546][T12170] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 565.986583][T12170] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.986603][T12170] do_syscall_64+0x174/0x580 [ 565.986625][T12170] ? trace_irq_disable+0x3b/0x140 [ 565.986650][T12170] ? clear_bhb_loop+0x40/0x90 [ 565.986673][T12170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.986691][T12170] RIP: 0033:0x7fe0bac4ce59 [ 565.986709][T12170] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.986725][T12170] RSP: 002b:00007fe0b8ea6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 565.986744][T12170] RAX: ffffffffffffffda RBX: 00007fe0baec5fa0 RCX: 00007fe0bac4ce59 [ 565.986759][T12170] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 565.986772][T12170] RBP: 00007fe0b8ea6090 R08: 0000000000000000 R09: 0000000000000000 [ 565.986785][T12170] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 565.986797][T12170] R13: 00007fe0baec6038 R14: 00007fe0baec5fa0 R15: 00007ffe109ee408 [ 565.986826][T12170] [ 566.546478][T12180] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2324'. [ 567.215733][T12201] sg_write: data in/out 24576/136 bytes for SCSI command 0x0-- guessing data in; [ 567.215733][T12201] program syz.0.2331 not setting count and/or reply_len properly [ 567.748455][ T5768] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 567.918871][ T5768] usb 3-1: Using ep0 maxpacket: 32 [ 567.927266][ T5768] usb 3-1: unable to get BOS descriptor or descriptor too short [ 567.929126][ T5768] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 567.929153][ T5768] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 567.973498][T12220] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2337'. [ 567.973530][T12220] nbd: couldn't find device at index 16 [ 567.979634][ T5768] usb 3-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 567.979669][ T5768] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.979694][ T5768] usb 3-1: Product: syz [ 567.979717][ T5768] usb 3-1: Manufacturer: syz [ 567.979734][ T5768] usb 3-1: SerialNumber: syz [ 568.321899][ T5597] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 568.407387][T12225] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.408099][T12225] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.446543][ T5768] usb 3-1: 3:0: failed to get current value for ch 1 (-71) [ 568.448890][ T5768] usb 3-1: 3:0: cannot get min/max values for control 3 (id 3) [ 568.451078][ T5768] usb 3-1: 3:0: cannot get min/max values for control 4 (id 3) [ 568.453931][ T5768] usb 3-1: 3:0: cannot get min/max values for control 4 (id 3) [ 568.457307][ T5768] usb 3-1: 3:0: cannot get min/max values for control 5 (id 3) [ 568.464841][ T5768] usb 3-1: 3:0: failed to get current value for ch 1 (-71) [ 568.526215][ T5597] usb 4-1: Using ep0 maxpacket: 32 [ 568.527258][ T5768] usb 3-1: 3:0: failed to get current value for ch 0 (-71) [ 568.547476][ T5597] usb 4-1: unable to get BOS descriptor or descriptor too short [ 568.549949][ T5597] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 568.550102][ T5597] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 568.593642][ T5768] usb 3-1: 3:0: failed to get current value for ch 0 (-71) [ 568.596053][ T5768] usb 3-1: 3:0: cannot get min/max values for control 12 (id 3) [ 568.599099][ T5768] usb 3-1: 3:0: failed to get current value for ch 0 (-71) [ 568.641987][ T5597] usb 4-1: New USB device found, idVendor=200c, idProduct=1018, bcdDevice= 0.40 [ 568.642019][ T5597] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.642039][ T5597] usb 4-1: Product: syz [ 568.642053][ T5597] usb 4-1: Manufacturer: syz [ 568.642068][ T5597] usb 4-1: SerialNumber: syz [ 568.823195][ T5768] usb 3-1: 3:0: cannot get min/max values for control 3 (id 3) [ 568.854174][ T5768] usb 3-1: 3:0: cannot get min/max values for control 5 (id 3) [ 568.897660][ T5768] usb 3-1: USB disconnect, device number 102 [ 569.036988][T12221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 569.040033][T12221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 569.066545][T12221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 569.068018][T12221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 569.118738][T12228] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2341'. [ 569.118776][T12228] FAULT_INJECTION: forcing a failure. [ 569.118776][T12228] name failslab, interval 1, probability 0, space 0, times 0 [ 569.118872][T12228] CPU: 0 UID: 0 PID: 12228 Comm: syz.0.2341 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 569.118906][T12228] Tainted: [L]=SOFTLOCKUP [ 569.118915][T12228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 569.118928][T12228] Call Trace: [ 569.118938][T12228] [ 569.118948][T12228] dump_stack_lvl+0xe8/0x150 [ 569.118982][T12228] should_fail_ex+0x46b/0x600 [ 569.119020][T12228] should_failslab+0xa8/0x100 [ 569.119049][T12228] kmem_cache_alloc_node_noprof+0xae/0x710 [ 569.119088][T12228] ? __alloc_skb+0x1d0/0x7d0 [ 569.119112][T12228] ? __alloc_skb+0x1d0/0x7d0 [ 569.119144][T12228] __alloc_skb+0x1d0/0x7d0 [ 569.119169][T12228] ? netlink_ack_tlv_len+0x6c/0x210 [ 569.119215][T12228] netlink_ack+0x146/0xa50 [ 569.119248][T12228] ? __lock_acquire+0x6b5/0x2d10 [ 569.119276][T12228] ? sock_sendmsg_nosec+0x13a/0x180 [ 569.119318][T12228] netlink_rcv_skb+0x2b6/0x4b0 [ 569.119347][T12228] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 569.119376][T12228] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 569.119416][T12228] ? bpf_lsm_capable+0x9/0x20 [ 569.119446][T12228] ? security_capable+0x7e/0x2c0 [ 569.119490][T12228] nfnetlink_rcv+0x2c0/0x27b0 [ 569.119520][T12228] ? sock_sendmsg_nosec+0x13a/0x180 [ 569.119557][T12228] ? __pfx_snprintf+0x10/0x10 [ 569.119585][T12228] ? unwind_get_return_address+0x4d/0x90 [ 569.119618][T12228] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 569.119655][T12228] ? trim_netdev_trace+0x7ac/0x840 [ 569.119694][T12228] ? __pfx_trim_netdev_trace+0x10/0x10 [ 569.119727][T12228] ? stack_trace_save+0xa9/0x100 [ 569.119756][T12228] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 569.119783][T12228] ? __lock_acquire+0x6b5/0x2d10 [ 569.119817][T12228] ? save_netdev_trace_buffer+0x4cf/0x5f0 [ 569.119858][T12228] ? __pfx_save_netdev_trace_buffer+0x10/0x10 [ 569.119891][T12228] ? ref_tracker_free+0x673/0x820 [ 569.119921][T12228] ? __netlink_deliver_tap+0x636/0x8b0 [ 569.119946][T12228] ? netlink_deliver_tap+0x19c/0x1b0 [ 569.119974][T12228] ? netlink_unicast+0x754/0x920 [ 569.119998][T12228] ? netlink_sendmsg+0x813/0xb40 [ 569.120026][T12228] ? sock_sendmsg_nosec+0x13a/0x180 [ 569.120060][T12228] ? ____sys_sendmsg+0x55c/0x870 [ 569.120087][T12228] ? ___sys_sendmsg+0x2a5/0x360 [ 569.120121][T12228] ? do_raw_spin_lock+0x12b/0x2f0 [ 569.120158][T12228] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 569.120189][T12228] ? lockdep_hardirqs_on+0x7a/0x110 [ 569.120227][T12228] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 569.120255][T12228] ? rcu_preempt_deferred_qs_irqrestore+0x856/0xc60 [ 569.120305][T12228] netlink_unicast+0x780/0x920 [ 569.120341][T12228] netlink_sendmsg+0x813/0xb40 [ 569.120382][T12228] ? __pfx_netlink_sendmsg+0x10/0x10 [ 569.120415][T12228] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 569.120449][T12228] ? aa_sock_msg_perm+0x122/0x200 [ 569.120475][T12228] ? __pfx_netlink_sendmsg+0x10/0x10 [ 569.120503][T12228] sock_sendmsg_nosec+0x13a/0x180 [ 569.120542][T12228] ____sys_sendmsg+0x55c/0x870 [ 569.120578][T12228] ? __pfx_____sys_sendmsg+0x10/0x10 [ 569.120619][T12228] ? import_iovec+0x73/0xa0 [ 569.120647][T12228] ___sys_sendmsg+0x2a5/0x360 [ 569.120677][T12228] ? __lock_acquire+0x6b5/0x2d10 [ 569.120712][T12228] ? __pfx____sys_sendmsg+0x10/0x10 [ 569.120778][T12228] ? __fget_files+0x2a/0x420 [ 569.120801][T12228] ? __fget_files+0x3a6/0x420 [ 569.120837][T12228] __x64_sys_sendmsg+0x1b7/0x290 [ 569.120869][T12228] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 569.120916][T12228] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.120943][T12228] do_syscall_64+0x174/0x580 [ 569.120971][T12228] ? trace_irq_disable+0x3b/0x140 [ 569.121001][T12228] ? clear_bhb_loop+0x40/0x90 [ 569.121031][T12228] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.121055][T12228] RIP: 0033:0x7fe0bac4ce59 [ 569.121078][T12228] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 569.121100][T12228] RSP: 002b:00007fe0b8ea6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 569.121126][T12228] RAX: ffffffffffffffda RBX: 00007fe0baec5fa0 RCX: 00007fe0bac4ce59 [ 569.121144][T12228] RDX: 0000000020004080 RSI: 00002000000003c0 RDI: 0000000000000003 [ 569.121160][T12228] RBP: 00007fe0b8ea6090 R08: 0000000000000000 R09: 0000000000000000 [ 569.121173][T12228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 569.121187][T12228] R13: 00007fe0baec6038 R14: 00007fe0baec5fa0 R15: 00007ffe109ee408 [ 569.121228][T12228] [ 569.890981][ T5597] usb 4-1: 3:0: failed to get current value for ch 1 (-71) [ 569.929384][ T5597] usb 4-1: 3:0: cannot get min/max values for control 3 (id 3) [ 569.941566][ T5597] usb 4-1: 3:0: cannot get min/max values for control 4 (id 3) [ 569.955727][ T5597] usb 4-1: 3:0: cannot get min/max values for control 4 (id 3) [ 569.977803][ T5597] usb 4-1: 3:0: cannot get min/max values for control 5 (id 3) [ 569.986422][ T5597] usb 4-1: 3:0: failed to get current value for ch 1 (-71) [ 570.092154][ T5597] usb 4-1: 3:0: failed to get current value for ch 0 (-71) [ 570.099880][T11539] udevd[11539]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 570.102527][ T5597] usb 4-1: 3:0: failed to get current value for ch 0 (-71) [ 570.150221][ T5597] usb 4-1: 3:0: cannot get min/max values for control 12 (id 3) [ 570.165515][ T5597] usb 4-1: 3:0: failed to get current value for ch 0 (-71) [ 570.448613][ T5597] usb 4-1: 3:0: cannot get min/max values for control 3 (id 3) [ 570.449816][ T5597] usb 4-1: 3:0: cannot get min/max values for control 5 (id 3) [ 570.503030][ T5709] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 570.536806][T12246] FAULT_INJECTION: forcing a failure. [ 570.536806][T12246] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 570.536847][T12246] CPU: 0 UID: 0 PID: 12246 Comm: syz.2.2346 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 570.536879][T12246] Tainted: [L]=SOFTLOCKUP [ 570.536888][T12246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 570.536902][T12246] Call Trace: [ 570.536912][T12246] [ 570.536923][T12246] dump_stack_lvl+0xe8/0x150 [ 570.536957][T12246] should_fail_ex+0x46b/0x600 [ 570.536996][T12246] _copy_from_user+0x2d/0xb0 [ 570.537023][T12246] kstrtouint_from_user+0xd6/0x180 [ 570.537062][T12246] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 570.537126][T12246] proc_fail_nth_write+0x8e/0x210 [ 570.537151][T12246] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 570.537183][T12246] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 570.537209][T12246] vfs_write+0x2a3/0xba0 [ 570.537248][T12246] ? __pfx_vfs_write+0x10/0x10 [ 570.537278][T12246] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 570.537308][T12246] ? lockdep_hardirqs_on+0x7a/0x110 [ 570.537336][T12246] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 570.537365][T12246] ? mutex_lock_nested+0x152/0x1d0 [ 570.537399][T12246] ? fdget_pos+0x252/0x320 [ 570.537432][T12246] ksys_write+0x156/0x270 [ 570.537465][T12246] ? __pfx_ksys_write+0x10/0x10 [ 570.537504][T12246] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 570.537529][T12246] do_syscall_64+0x174/0x580 [ 570.537558][T12246] ? trace_irq_disable+0x3b/0x140 [ 570.537587][T12246] ? clear_bhb_loop+0x40/0x90 [ 570.537616][T12246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 570.537639][T12246] RIP: 0033:0x7f13b5afd68e [ 570.537661][T12246] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 570.537682][T12246] RSP: 002b:00007f13b3d6cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 570.537706][T12246] RAX: ffffffffffffffda RBX: 00007f13b3d6d6c0 RCX: 00007f13b5afd68e [ 570.537723][T12246] RDX: 0000000000000001 RSI: 00007f13b3d6d0a0 RDI: 0000000000000004 [ 570.537739][T12246] RBP: 00007f13b3d6d090 R08: 0000000000000000 R09: 0000000000000000 [ 570.537754][T12246] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 570.537768][T12246] R13: 00007f13b5db6128 R14: 00007f13b5db6090 R15: 00007ffc7cd55e88 [ 570.537800][T12246] [ 570.850328][ T5597] usb 4-1: USB disconnect, device number 9 [ 570.918157][T12238] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 571.023317][T12238] cramfs: wrong magic [ 571.026370][ T5709] usb 1-1: unable to get BOS descriptor or descriptor too short [ 571.027426][ T5709] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 571.027465][ T5709] usb 1-1: can't read configurations, error -71 [ 571.307637][T12254] FAULT_INJECTION: forcing a failure. [ 571.307637][T12254] name failslab, interval 1, probability 0, space 0, times 0 [ 571.307676][T12254] CPU: 1 UID: 0 PID: 12254 Comm: syz.3.2350 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 571.307702][T12254] Tainted: [L]=SOFTLOCKUP [ 571.307709][T12254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 571.307721][T12254] Call Trace: [ 571.307728][T12254] [ 571.307737][T12254] dump_stack_lvl+0xe8/0x150 [ 571.307766][T12254] should_fail_ex+0x46b/0x600 [ 571.307798][T12254] should_failslab+0xa8/0x100 [ 571.307822][T12254] __kvmalloc_node_noprof+0x181/0x910 [ 571.307846][T12254] ? io_alloc_cache_init+0x42/0x140 [ 571.307868][T12254] ? io_alloc_cache_init+0x42/0x140 [ 571.307895][T12254] io_alloc_cache_init+0x42/0x140 [ 571.307919][T12254] io_ring_ctx_alloc+0x545/0xd20 [ 571.307961][T12254] io_uring_create+0x50/0x9a0 [ 571.307994][T12254] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 571.308021][T12254] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 571.308041][T12254] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 571.308080][T12254] ? __pfx_ksys_write+0x10/0x10 [ 571.308114][T12254] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.308138][T12254] do_syscall_64+0x174/0x580 [ 571.308165][T12254] ? trace_irq_disable+0x3b/0x140 [ 571.308188][T12254] ? clear_bhb_loop+0x40/0x90 [ 571.308209][T12254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.308227][T12254] RIP: 0033:0x7fc2544bce59 [ 571.308246][T12254] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 571.308262][T12254] RSP: 002b:00007fc25270dee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 571.308282][T12254] RAX: ffffffffffffffda RBX: 0000200000000808 RCX: 00007fc2544bce59 [ 571.308295][T12254] RDX: 0000200000000888 RSI: 0000200000000808 RDI: 0000000000000e2a [ 571.308308][T12254] RBP: 0000200000000800 R08: 0000200000000340 R09: 0000000000000000 [ 571.308320][T12254] R10: 0000200000000890 R11: 0000000000000206 R12: 0000200000000888 [ 571.308332][T12254] R13: 0000200000000890 R14: 00007fc25270dfd8 R15: 0000000000000000 [ 571.308358][T12254] [ 571.344653][ T32] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 571.571362][ T32] usb 3-1: Using ep0 maxpacket: 8 [ 571.574279][ T32] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 571.574314][ T32] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 571.578010][ T32] usb 3-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 571.578046][ T32] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.578070][ T32] usb 3-1: Product: syz [ 571.578088][ T32] usb 3-1: Manufacturer: syz [ 571.578105][ T32] usb 3-1: SerialNumber: syz [ 571.636936][ T32] usb 3-1: config 0 descriptor?? [ 571.650263][T12256] netlink: 'syz.1.2351': attribute type 10 has an invalid length. [ 571.650522][T12256] ipvlan0: entered allmulticast mode [ 571.650536][T12256] veth0_vlan: entered allmulticast mode [ 571.701715][T12257] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2351'. [ 571.807077][T12259] No source specified [ 571.809492][T12259] overlay: ./bus is not a directory [ 571.827012][T12256] team0: Device ipvlan0 failed to register rx_handler [ 572.501340][ T32] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 572.631720][ T32] usb 1-1: device descriptor read/64, error -71 [ 572.677102][T12282] UHID_CREATE from different security context by process 1385 (syz.3.2361), this is not allowed. [ 572.872380][ T32] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 572.874755][T12286] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2362'. [ 573.002210][ T32] usb 1-1: device descriptor read/64, error -71 [ 573.111855][ T32] usb usb1-port1: attempt power cycle [ 573.472786][ T32] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 573.493864][ T32] usb 1-1: device descriptor read/8, error -71 [ 573.662425][ T5775] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 573.732964][ T32] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 573.752519][ T32] usb 1-1: device descriptor read/8, error -71 [ 573.787081][T12307] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI [ 573.787105][T12307] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 573.787125][T12307] CPU: 1 UID: 0 PID: 12307 Comm: syz.1.2372 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 573.787151][T12307] Tainted: [L]=SOFTLOCKUP [ 573.787158][T12307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 573.787170][T12307] RIP: 0010:__schedule+0x4030/0x5550 [ 573.787196][T12307] Code: 24 80 00 00 00 e8 80 97 f2 f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 [ 573.787212][T12307] RSP: 0018:ffffc900062777c0 EFLAGS: 00010003 [ 573.787229][T12307] RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 [ 573.787241][T12307] RDX: 0000000000000003 RSI: 0000000000000001 RDI: ffff8880b863c918 [ 573.787254][T12307] RBP: ffffc900062779b8 R08: ffffffff8fcf38f7 R09: 1ffffffff1f9e71e [ 573.787268][T12307] R10: dffffc0000000000 R11: fffffbfff1f9e71f R12: ffff8880b873c658 [ 573.787283][T12307] R13: ffff888125b6b000 R14: 1ffff110170e7922 R15: 0000000000000014 [ 573.787296][T12307] FS: 00005555853ce500(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000 [ 573.787313][T12307] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 573.787325][T12307] CR2: 0000200000000100 CR3: 0000000032640000 CR4: 00000000003526f0 [ 573.787351][T12307] Call Trace: [ 573.787358][T12307] [ 573.787377][T12307] ? __pfx___schedule+0x10/0x10 [ 573.787397][T12307] ? irqentry_exit+0x218/0x8c0 [ 573.787421][T12307] ? irqentry_exit+0x218/0x8c0 [ 573.787442][T12307] ? trace_irq_disable+0x3b/0x140 [ 573.787469][T12307] preempt_schedule_notrace+0x57/0x90 [ 573.787491][T12307] preempt_schedule_notrace_thunk+0x16/0x30 [ 573.787522][T12307] ? posixtimer_send_sigqueue+0x63/0xa60 [ 573.787549][T12307] rcu_is_watching+0x7f/0xb0 [ 573.787576][T12307] lock_acquire+0x5f/0x350 [ 573.787598][T12307] ? rb_erase_linked+0x159/0x190 [ 573.787623][T12307] ? posixtimer_send_sigqueue+0x63/0xa60 [ 573.787649][T12307] posixtimer_send_sigqueue+0x80/0xa60 [ 573.787675][T12307] ? posixtimer_send_sigqueue+0x63/0xa60 [ 573.787700][T12307] ? lockdep_hardirqs_on+0x7a/0x110 [ 573.787721][T12307] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 573.787746][T12307] posixtimer_deliver_signal+0x3fa/0x550 [ 573.787779][T12307] dequeue_signal+0x24d/0x370 [ 573.787803][T12307] get_signal+0x55d/0x1330 [ 573.787837][T12307] arch_do_signal_or_restart+0xbc/0x840 [ 573.787858][T12307] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 573.787884][T12307] exit_to_user_mode_loop+0x104/0x710 [ 573.787907][T12307] ? rcu_is_watching+0x15/0xb0 [ 573.787933][T12307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.787952][T12307] do_syscall_64+0x353/0x580 [ 573.787975][T12307] ? clear_bhb_loop+0x40/0x90 [ 573.787995][T12307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.788013][T12307] RIP: 0033:0x7f764173600f [ 573.788028][T12307] Code: 5a 66 2e 0f 1f 84 00 00 00 00 00 8b 78 24 45 31 c0 83 ff 3f 7f 18 ba 01 00 00 00 89 f9 45 31 c0 48 d3 e2 48 23 15 a9 f6 ed 00 <41> 0f 95 c0 48 8d b0 98 00 00 00 44 89 d1 44 89 ca e9 6b f5 ff ff [ 573.788045][T12307] RSP: 002b:00007ffc1229ae08 EFLAGS: 00000246 [ 573.788059][T12307] RAX: 00007f7641ae6090 RBX: 000000000008bfc8 RCX: 0000000000000012 [ 573.788072][T12307] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000012 [ 573.788083][T12307] RBP: 00007f7641ae60a0 R08: 0000000000000000 R09: 0000000000000003 [ 573.788094][T12307] R10: 0000000000000000 R11: 0000000000000000 R12: 00007f7641ae6090 [ 573.788106][T12307] R13: 0000200000000000 R14: 00007ffc1229ae18 R15: 00007f7641ae6090 [ 573.788125][T12307] [ 573.788138][T12307] Modules linked in: [ 573.788155][T12307] ---[ end trace 0000000000000000 ]--- [ 573.788172][T12307] RIP: 0010:__schedule+0x4030/0x5550 [ 573.788201][T12307] Code: 24 80 00 00 00 e8 80 97 f2 f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 [ 573.788216][T12307] RSP: 0018:ffffc900062777c0 EFLAGS: 00010003 [ 573.788231][T12307] RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 [ 573.788243][T12307] RDX: 0000000000000003 RSI: 0000000000000001 RDI: ffff8880b863c918 [ 573.788254][T12307] RBP: ffffc900062779b8 R08: ffffffff8fcf38f7 R09: 1ffffffff1f9e71e [ 573.788269][T12307] R10: dffffc0000000000 R11: fffffbfff1f9e71f R12: ffff8880b873c658 [ 573.788283][T12307] R13: ffff888125b6b000 R14: 1ffff110170e7922 R15: 0000000000000014 [ 573.788300][T12307] FS: 00005555853ce500(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000 [ 573.788316][T12307] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 573.788329][T12307] CR2: 0000200000000100 CR3: 0000000032640000 CR4: 00000000003526f0 [ 573.788357][T12307] Kernel panic - not syncing: Fatal exception [ 574.891918][T12307] Shutting down cpus with NMI [ 574.892166][T12307] Kernel Offset: disabled