last executing test programs: 6.699096933s ago: executing program 0 (id=1200): r0 = socket$inet_tcp(0x2, 0x1, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f000000b640)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002c00)=[@rights={{0x14, 0x1, 0x1, [r1]}}, @rights={{0x14, 0x1, 0x1, [r2]}}], 0x30, 0x24040040}}], 0x1, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000000), &(0x7f00000000c0)=0x4) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x0, @loopback=0x7f000000}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x891c, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x0, @private=0xfffffffc}}) 6.605786705s ago: executing program 0 (id=1201): openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e010203010902"], 0x0) unshare(0x2a020400) pselect6(0x40, &(0x7f00000002c0)={0x0, 0xfffffffffffffff9, 0x1, 0x400, 0x800, 0x6, 0x8000001000000000}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x381, 0x9, 0x4, 0x9e22, 0x0, 0x300}, &(0x7f0000000280)={0x0, 0x989680}, 0x0) 5.433641925s ago: executing program 0 (id=1205): openat$binderfs(0xffffffffffffff9c, 0x0, 0x1002, 0x0) r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x8) socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) syz_kvm_setup_syzos_vm$x86(r2, &(0x7f00002ed000/0x400000)=nil) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) vmsplice(r3, &(0x7f0000000540)=[{&(0x7f00000003c0)="16", 0x1}], 0x1, 0xd) pipe2(&(0x7f0000000040), 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="5000000010000104000100008000000000000000", @ANYRES32=r6, @ANYBLOB="3f00000000000000300012800b00010062726964676500002000028005000700080000000c002e000300000003000000050017"], 0x50}}, 0x500000000000000) 4.311488402s ago: executing program 3 (id=1214): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x91}, [@ldst={0x4, 0x3, 0x0, 0x0, 0xa}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x700}, 0x0, 0x10, &(0x7f0000000080), 0xfffffffffffffffb}, 0x48) 4.248728383s ago: executing program 3 (id=1216): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$dvb_demux(0x0, 0x0, 0x41) syz_open_dev$dvb_demux(0x0, 0x0, 0x2000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r1}, 0x18) connect$can_j1939(0xffffffffffffffff, &(0x7f0000000140)={0x1d, r1}, 0x18) ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xaece, 0x0) pread64(r4, &(0x7f0000019040)=""/102351, 0x18fcf, 0x3a) syz_usb_connect$lan78xx(0x6, 0x0, 0x0, 0x0) r5 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0x3b5, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0x10000001, 0x0, 0x5, 0x255, 0x0, r10}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x20000, 0x2100, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x40000af, 0x0, r5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x20000003, 0xe4, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1e, 0x2, 0x2, 0x82000250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000340)={0x9, 0x7, 0x8, 0x9, 0xb, 0x8}) 3.882286826s ago: executing program 1 (id=1219): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010400000000000000240200000a0900010073797a300000000040000000030a010400000000000000000200000a0900010073797a30000000000900030073797a300000000014000480080001400000000308000240000000006c000000060a010400000000000000000200000a0900010073797a30000000000900020073797a30000000004000048020000180070001006374000014000280080001400000000108000240000000001c0001800a00010071756575650000000c000280060001"], 0xf4}}, 0x0) 3.867153321s ago: executing program 1 (id=1221): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340), 0x208083, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) socket$nl_route(0x10, 0x3, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882) syz_emit_vhci(&(0x7f00000000c0)=@HCI_VENDOR_PKT={0xff, 0x1}, 0x2) open$dir(&(0x7f0000000000)='./file0\x00', 0x101000, 0x110) (fail_nth: 2) 3.35357337s ago: executing program 3 (id=1223): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0x68}, [@ldst={0x5, 0x3, 0x0, 0x0, 0xa}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x60) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0xc0000, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r2, 0x1, 0x1, 0x0, 0x3443e88513de1af3) setsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000100)=0x63, 0x4) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000000)={0xa3, 0x0, 0xfffffffffffffffe}) ioctl$KVM_GET_SUPPORTED_HV_CPUID_cpu(0xffffffffffffffff, 0xc008aec1, &(0x7f0000000500)={0xa, 0x0, [{0x80000007, 0x4, 0x4, 0x6, 0x101, 0x400, 0x42}, {0x80000007, 0x200, 0x6, 0x7, 0x3, 0x6, 0x7}, {0xc0000000, 0x1, 0x0, 0x2, 0x8, 0xfffffffc, 0x6}, {0x4, 0x6, 0x6, 0x8, 0x2400, 0x2}, {0x40000000, 0x87, 0x5, 0x81, 0x14, 0x18000, 0x1ff}, {0xc0000001, 0x2, 0x4, 0xa27f, 0x39, 0x1, 0x4}, {0x7, 0x8, 0x4, 0x0, 0x8, 0x0, 0x10}, {0x1, 0x6, 0x2, 0x9, 0x1, 0x6}, {0x80000019, 0x4, 0x5, 0x7fff, 0x6, 0x57a, 0x3}, {0xa, 0x2, 0x0, 0x6, 0x7, 0x1, 0x10}]}) 3.310598704s ago: executing program 1 (id=1224): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000000000000000000000000200000a20000000000a05000000000000000000020000000900010073797a300000000040000000030a010100f4ff0000000000020000000900030073797a310000000014000480080002400000000008000140000000030900010073797a300000000070000000060a0b040000000000000000028000000900010073797a30000000000900020073797a310000000044000480400001800a0001006d617463680000003000028008000240000000010a0001006f776e6572000000180003"], 0xf0}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) 3.273139832s ago: executing program 3 (id=1225): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$NILFS_IOCTL_GET_BDESCS(r0, 0xc0186e87, &(0x7f0000000080)={&(0x7f0000000040), 0x0, 0x28, 0x3, 0x2}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x28}, 0x1, 0x0, 0x0, 0x400c091}, 0x10) setsockopt$inet6_int(r1, 0x29, 0x3, 0x0, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000280)=ANY=[], 0x8) recvmmsg(r1, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f0000000000)=0x7f, 0x4) r3 = socket(0x6, 0x80005, 0xffffffff) r4 = epoll_create(0x7e2) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000000)={0x10000001}) r5 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r5, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev={0xfe, 0x80, '\x00', 0x22}, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000100100000d000000aa0000006900000018000000000000001001000001"], 0x30}, 0x0) r6 = socket$rxrpc(0x21, 0x2, 0xa) r7 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r7, 0x110, 0x4, &(0x7f0000000040)=0x2, 0x4) connect$rxrpc(r7, &(0x7f0000000080)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast1}}, 0x24) sendmsg$inet(r7, &(0x7f0000000180)={0x0, 0xfffffffffffffd6b, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x18, 0x110}}], 0x18, 0x4c00}, 0x0) connect$rxrpc(r6, &(0x7f00000001c0)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e21, @private=0x961}}, 0x24) sendmsg$inet(r6, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@ip_tos_int={{0x14, 0x110}}], 0x18, 0x4c00}, 0x4041) sendto$inet6(r1, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) r8 = socket$pppl2tp(0x18, 0x1, 0x1) r9 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r8, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r9, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c0010"], 0x40}, 0x1, 0x0, 0x0, 0x40801}, 0x820) 3.226176882s ago: executing program 1 (id=1226): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'geneve1\x00', 0x0}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x3c, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000081}, 0x84) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000001500)={0x0, 0x0, &(0x7f00000000b0)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000013000100"/20, @ANYRES32=r9, @ANYBLOB='A'], 0x20}}, 0x0) (async, rerun: 64) r10 = socket$packet(0x11, 0x3, 0x300) (rerun: 64) bind$packet(r10, &(0x7f0000000700)={0x11, 0x300, r9}, 0x14) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x6c, 0x2, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x9}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4040000}, 0x20000000) (async, rerun: 32) write(r10, &(0x7f0000000600)='\x00', 0x1) (async, rerun: 32) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x0, 0xc6e}, 0x8) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYBLOB="580000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="15020000210000002800128009000100766c616e000000001800028006000100040000000c000200020000000100000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r3], 0x58}, 0x1, 0xba01}, 0x0) 3.110925979s ago: executing program 3 (id=1227): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x8, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x4}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0xbf}}]}, &(0x7f0000000040)='GPL\x00', 0x8, 0x2d, &(0x7f0000000280)=""/45, 0x40f00, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) 3.080541028s ago: executing program 3 (id=1228): r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x5, 0x10, r0, 0x855c9000) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r3, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000000)=0x1, 0xffffff2a) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x10000000400002, 0x8000000000000000, 0x1f3a000, 0x73, 0x2002, 0x2, 0x8, 0xfffffffffffffffc, 0x8000000000000000, 0x3, 0x0, 0xb, 0x9, 0x2000000000000000, 0x3, 0x2], 0xeeee8000, 0x2010d3}) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000440)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r5 = socket$inet_tcp(0x2, 0x1, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000180)={0x9, {{0xa, 0x4e21, 0x5d, @mcast1, 0xbfd}}, {{0xa, 0x4e20, 0x800005, @remote, 0xe}}}, 0x108) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x44081}, 0x40051) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000009, 0x13, r7, 0xdf127000) getsockopt$inet6_buf(r6, 0x29, 0x30, &(0x7f0000000180)=""/214, &(0x7f0000000080)=0xd6) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e21, @multicast1}, 0xfffffffffffffdd4) r9 = syz_usb_connect(0x0, 0x24, &(0x7f00000005c0)=ANY=[@ANYRES32=r4, @ANYRES16=0x0, @ANYRES16=r4, @ANYBLOB="d895039a1e16241d159cad5b22b82d52b4b130af4fcbbda7349e2c46f908fba5cd8d471b80e41a70fe846eac3ed5c539dbdd58158490552dff80d43067e17eb00f13fe39b313cdaa5557c173f9850f893f00001e1d725d07b07bb4183cc33d997d559f430a4ebb1b04642f5f81466c32cb673bc8eada9e248cb43442a444e672337fa2c7713069cf5872735d4402d9fce9e0c4add8a9f25fcd97ba4000eb870c09b818e9d27fefd94f7b1df7c15a41f628f8c24e90a4aefe8c4521e030e239895bac2202e7e1208144f847db", @ANYRES64=r5, @ANYRESOCT=r8, @ANYRES8=r3, @ANYRES16=r7, @ANYRES32=r7, @ANYRESDEC, @ANYRES8=r7, @ANYRES8=r4], 0x0) syz_usb_control_io(r9, 0x0, 0x0) syz_usb_control_io$uac3(r9, 0x0, 0x0) syz_usb_control_io$uac1(r9, 0x0, &(0x7f0000000200)={0x44, &(0x7f00000002c0)={0x40, 0x8, 0x2, "a3a5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r9, 0x0, &(0x7f0000000080)={0x44, &(0x7f0000000040)={0x40, 0x9, 0x2, "e180"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) listen(r5, 0x5) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) 2.925767636s ago: executing program 1 (id=1229): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5400000010000304000000000000000000000420", @ANYRES32=0x0, @ANYBLOB="00030000000000002c0012800b00010062726964676500001c00028008000500010000000500250001000000050029000000000008000a00", @ANYRES32=r1], 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8044) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[], 0xc0}}, 0x4008054) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r3, 0x89a2, &(0x7f0000000200)='bridge0\x00') r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000080)=0x2) read$dsp(r4, &(0x7f0000003100)=""/81, 0x51) r5 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r5, &(0x7f0000000240)={0xa, 0x4e20, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x712}, 0x1c) r6 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000300)=0x8df, 0x4) sendmsg$nl_route(r6, 0x0, 0x24008000) syz_emit_ethernet(0x7e, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000005c0)=ANY=[@ANYBLOB="f0000000100007000000000000000000ac1e0101000000000100000000000000fe80000000000000000000000000001a4e2000000000000000000000be0e24693c722628d9", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000004d33c000000ff01000000000000000000000000000100000000000000000000000000000000820000000000000000000000000000000000001000000000ffffffffffffffff00000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a000000000000000000000a0002003400000000000000"], 0xf0}}, 0x0) r7 = socket(0x11, 0x2, 0x10001) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000040)={'team0\x00', &(0x7f0000000080)=@ethtool_sfeatures={0x3b, 0x2, [{0x3f0, 0x6}, {0x10007, 0x30000080}]}}) syz_emit_ethernet(0x5a, 0x0, 0x0) 2.453610503s ago: executing program 4 (id=1235): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$dvb_demux(0x0, 0x0, 0x41) syz_open_dev$dvb_demux(0x0, 0x0, 0x2000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r1}, 0x18) connect$can_j1939(0xffffffffffffffff, &(0x7f0000000140)={0x1d, r1}, 0x18) ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x0) syz_usb_connect$lan78xx(0x6, 0x0, 0x0, 0x0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0x3b5, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup(r7) syz_ublk_setup_queues(r8, r6, &(0x7f0000000180)={0x0, 0x10000001, 0x0, 0x5, 0x255, 0x0, r7}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x20000, 0x2100, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x40000af, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x20000003, 0xe4, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1e, 0x2, 0x2, 0x82000250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000340)={0x9, 0x7, 0x8, 0x9, 0xb, 0x8}) 2.398508117s ago: executing program 0 (id=1236): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000800000000000070000000900014873797a30000000007c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d38001280140001800c000100636f756e7465720004000280200001800e000100636f6e6e6c696d69740000000c000280080001400000000808000340000001"], 0xc4}}, 0x20050890) 2.347455876s ago: executing program 0 (id=1237): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340), 0x208083, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) socket$nl_route(0x10, 0x3, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882) syz_emit_vhci(&(0x7f00000000c0)=@HCI_VENDOR_PKT={0xff, 0x1}, 0x2) open$dir(&(0x7f0000000000)='./file0\x00', 0x101000, 0x110) 2.336058758s ago: executing program 1 (id=1238): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000020900010073797a30000000004c000000090a010409000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff00080003400000000c2c0000000b0a05000000000000000000070000000900020073797a35000000000900010073797a30"], 0xc0}}, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0xcd, 0x82, 0x78, 0x40, 0xe41, 0x5057, 0x739f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x2, 0xc6, 0x0, 0x7, "", [{{0x9, 0x4, 0x45, 0x5, 0x0, 0x61, 0xe0, 0x12, 0x7f}}]}}]}}, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r1, &(0x7f0000000940)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x40, @string={0x40, 0x3, "d10a0747d4bb9d3a74d848813bf42c18618b3c525ca5f6fb9d00609065411da5e01f7938628fca938a2837cadac2ff732d24d0db438300f6012e426b691e"}}}, 0x0) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000002d80)={0x14, 0x0, &(0x7f0000002d40)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r2 = syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$rtl8150(r2, &(0x7f00000002c0)={0x14, &(0x7f0000000180)={0x20, 0x2, 0x8b, {0x8b, 0x1, "e0add119049653b6fd2627c806a9c73bc48c63fb0337ec07fae881726c46d44a2d71521f966187dac7d199802995177a33be85167a25d5b2298ca7c698e2d42aef1e4b198fa0ca353583859511f53bafa3bfd7cf58f09b58b7bb1dbc2360ec6b034d177b7c28f51090773a3d780f22e40d5de1e8d373179f0277aef5dfaf87aeeb06c754f2e0c6a79a"}}, &(0x7f0000000240)={0x0, 0x3, 0x59, @string={0x59, 0x3, "fd0e168abbe7d194170d77e811756f6c0f878a3befc47d0bce75753fec244cb5bcbed78d1e60bca136cb4932b01d8b7114be050beff850fa8dcd7479d40a4cbc73b9636fdf430612a93a9cb8dcf2a39de7167b52857278"}}}, &(0x7f00000004c0)={0x2c, &(0x7f0000000300)={0x40, 0x15, 0x99, "ea2aca33c77aad42c6fce8b3436e49c633da0b73288293c928669f2bb56f5879376f34613a944e674d77a418e7f7d11dd6ad7bfb7889140e95900cc99c8587c09c19d27d3a5c7525a49a14f623df5aca051501739c0ba053f53b894d8f2818e080dc0f7d47b8ecaea250e9585af6aaa666891fdbd8652126b557f12253ff22c1551d59d28b8db68cf170cb94a1675a00c2d23757a0d9af3cd1"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0xa}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000440)={0xc0, 0x5, 0x6, "8684c4303916"}, &(0x7f0000000480)={0x40, 0x5, 0x4, "641e183b"}}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) 1.889962327s ago: executing program 2 (id=1240): unshare(0x64000600) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000080)={0x48, 0x2, r1, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000400)={0x28, 0x2, r1, 0x0, &(0x7f0000003000/0x1000)=nil, 0x1000, 0x7ffffffe}) socket$packet(0x11, 0x3, 0x300) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000300)={0x1, 0x0, [{0x0, 0x2, &(0x7f0000000200)=""/2}]}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000400)={0x1, 0x0, &(0x7f0000010000), &(0x7f0000020000), &(0x7f0000018000)}) write(r4, &(0x7f0000010000)="000002000000000080", 0x9) write(r4, &(0x7f0000018000)="000001", 0x3) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000600)={0x1, r4}) write$tun(r4, &(0x7f0000000800)=ANY=[], 0x10) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000001c0)={'geneve1\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@delqdisc={0x258, 0x25, 0x4, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0xffe0}, {0xffff, 0xe}, {0x7, 0x10}}, [@TCA_RATE={0x6, 0x5, {0x5, 0x3}}, @TCA_STAB={0x70, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7, 0x5, 0x5, 0xc9, 0x2, 0x80000001, 0x5, 0x2}}, {0x8, 0x2, [0x0, 0x5d]}}, {{0x1c, 0x1, {0x89, 0x6, 0x3, 0x3, 0x0, 0x5, 0xb2800, 0x1}}, {0x6, 0x2, [0x8]}}, {{0x1c, 0x1, {0x2, 0x45, 0x1, 0xd79, 0x2, 0x2009, 0x1000, 0x1}}, {0x6, 0x2, [0x0]}}]}, @TCA_RATE={0x6, 0x5, {0x4, 0xf}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x80000001}, @TCA_STAB={0x2c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xe6, 0x80, 0xc2, 0x2, 0x0, 0xfffffff3, 0x3, 0x3}}, {0xa, 0x2, [0xfff, 0x23fd, 0x9]}}]}, @TCA_STAB={0x154, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xd, 0x3, 0xfffd, 0x54, 0x1, 0x4, 0x6, 0x2}}, {0x8, 0x2, [0xf, 0x8]}}, {{0x1c, 0x1, {0xc1, 0x1, 0x8, 0x0, 0x1, 0x400, 0x7, 0x1}}, {0x6, 0x2, [0x4]}}, {{0x1c, 0x1, {0x8, 0x4, 0x1, 0x8000, 0x0, 0xffff, 0x84, 0x1}}, {0x6, 0x2, [0x7]}}, {{0x1c, 0x1, {0x5, 0x1, 0x42, 0x80000001, 0x2, 0x9}}, {0x4}}, {{0x1c, 0x1, {0xc, 0x2, 0xf221, 0x67, 0x1, 0x7, 0x5, 0x3}}, {0xa, 0x2, [0x2, 0x9, 0xff]}}, {{0x1c, 0x1, {0x5, 0x9, 0xff, 0x4, 0x1, 0xaa62, 0x801}}, {0x4}}, {{0x1c, 0x1, {0x5, 0x7, 0x0, 0x1, 0x1, 0x71, 0xfffffff8, 0x4}}, {0xc, 0x2, [0x2, 0x7, 0x1000, 0x0]}}, {{0x1c, 0x1, {0x6, 0x6e, 0x100, 0xc, 0x2, 0x4, 0x2, 0x4}}, {0xc, 0x2, [0x97, 0x40, 0x9, 0x0]}}, {{0x1c, 0x1, {0xf9, 0x4, 0x3, 0x0, 0x0, 0x80c1a, 0xa582, 0x6}}, {0x10, 0x2, [0x4, 0x7, 0x7, 0x8, 0xf9f5, 0x4996]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x3}, @qdisc_kind_options=@q_taprio={{0xb}, {0x18, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x81}]}}]}, 0x258}}, 0x0) socket(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000040)=ANY=[@ANYRES8=0x0], 0xd8}, 0x1, 0x0, 0x0, 0x4004041}, 0x20004440) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r6, 0x0, 0x10001, 0x0, 0x1, 0x0, 0x3d742d}) ioctl$IOMMU_DESTROY$stdev(r0, 0x3b80, &(0x7f0000000180)={0x8, r2}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000240)={0x48, 0x2, r1}) socket$inet_udp(0x2, 0x2, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) 1.830583979s ago: executing program 4 (id=1241): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) io_uring_setup(0x4822, &(0x7f0000000100)={0x0, 0x0, 0x1, 0x3, 0xfb}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) io_uring_setup(0x136a, &(0x7f00000001c0)={0x0, 0xd7e7, 0x40, 0x1, 0xef}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) unshare(0x22020600) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000002f00090027bd9f0000000000040000000c00180002ac0f0009ac0f"], 0x24}, 0x1, 0x0, 0x0, 0x42804}, 0x4) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x319}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000280)=@IORING_OP_SENDMSG={0x9, 0x40, 0x1, r1, 0x0, &(0x7f0000000d00)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000740)="18cce47c4f857e825a0910e608bfed56b1eb5c3870e2e311c4ed5a7726fc9d6fd96f6ad9ceda0ff068d1a1d278ba454398d2c5c94c915c85c5a4714fd26ee625b54ea56fc7f30c9d0aa001bc2e5cb2549b324728f642268ef7df9a33cb88a8823fa104834e33a074a4d7898091a98322c600dcfc47a8d985f4e4fa261851f7e825b7d0fd82dea023d0a269a25e3dbc135bc5b09bdeeb4b382bdb65449f1d07347c5fc71961ecfaf44682dbcfae7e49c1a82ce20ee1c20f4641334ffe3eef9effaa", 0xc1}, {&(0x7f0000000840)="1ad41094e9cac7808c5b5c6247e75bb645c9970fd365f03be517f380d3e2d7a6d39d30c96f636e5d13b607ffd0d27c10f6044c8c49ac5aed7a1eb21b77ab8ace494f79b0341bde1b23fd88b65b00fc4162b3af7f79b481f7c9e96322ffa8836f78dbe716d3ac44d07e94711edc453506c90b1a", 0x73}], 0x2, &(0x7f0000001000)=ANY=[@ANYBLOB="9800000000000000ff00000002000000fc04bbd945f69325e33c94df94fcb14cae3d37b2b12d3332a5c0254da59cbf539223c8b814f66fb51923be6f33dcc23d213cb019b1039026ec12892c25d1155a33ff41993607ee7893fd27449250a816846e8f4875b894694ae0ca055e999fe22e4f70048d705fa7d855d27b82d374466597106b6ed2e38272d6c98cfc7148c5060000000000000010010000000000000b010000ffffffff3dc32cb72575fb9515ca2fcfa5f6ab9d88e6c93d8ef3e89a99fa29461b120fe17b7502714eef3e917129469e0e86238927b82ef318945ecedd8e46de2301e400b0e1c5f294db806323f6d1730a04ac9310fb5ae589e424daf2d97eb71b0c1eb3538833898371b9e0ce0d8ae6d9d6061f78fd1b7d64c3ed9266f86e48b1dddc5f41dc7ecb82154ff6553db021102e197b34a7b74e1eba711b8ae3901d5dbd887fd018807d3fdf1094df8e888d97e0983e0decb3a5f2de83926b49d4bfbed85379b72e9a1fd771916ca5ee132ee2a3970c865c452024704c76d26be9047d28f2fca0c02dd90eeaa4d01519e1e67a5956cab674e9eb3d2090fd17560548720000000000a00000000000000018010000090000009260b72c497fc04af9f1811e0e65965984b3b7a97090df6b83e1f7d6b4c12f812e11f0cf165af15f7cfe0ad6c2f8de40fd6e87521a5629adf04933cf8dec7ef25684fdce887389543dd6f4949aab8c722137dcf76add2c2950cd44a3e3604a206efc175ac6bb565eefaa4e7cc3eca1e69728c1df9fdf07f7cfdb52abc1aa766bdee19faddea4f916fa2c551075f85de7f8000000000000001901000002000000c9faad5b3846e7a4d43e898c138cd6986f96a3c4c54ebe7382b2bbd4be93604928fa3d7bfec32ada1826915be5033df5382a9edbb1b68700cad250c2c13794bdd30a8358d6227aaa0410a929cace8fbbf45251a1c6fe9a40ca3205a4ea8d338cf395269c56d1938d3e4218d29fd897e9ff7ecefb85c29880d84a2971c4539aa108058c9ead0b11181c028a3a953d0523c3262525c6bcf28db8c925e9d57433f1456f6dd2644c13e0f0f929e4e3251e380e3961f7668cb29aa8c4bfd4ea9c363814b8c151d1016eb74ca7f5398322d5ed562a6c21ef3e08099511840cd6686dd125c3000000000000a00000000000000004010000740000001a59270adab4c20bcaadbf2df4bcc7fbfafadd37d5678d39680935ce7d2449b20e06f2c45592e41d6ac296aebc41a81faa8aecf8c92d4736079e42903da1ae959980c22515badfc2b1bc411194da0cc2e09d3615a86a5dc6067e56088271d2f0510ff27ac1d17691939534e8a0c68788560f8c0cd2cfe1a60f2f1f59bb933c289b1f409988041fe93cdd61fd01000000ff16d694e38511d779e45a58fde581aef5f2093da901004eed5fdfac27b8e9ab20dbee825bdb914550e5ee49b0fedbad585279296335f49a06ffe50e31043d297fa3a0b49df7f0bda2db72f82deebb3d9164155a81ad49b8b9bb5eb3edcb6f251c26be6d980aaff2ea9fde5ba7dabd4e820c2ae1b072b521febc5456c71bcfc23fe2c531f49d720ab1828fc1bbaf76d124742f1cc86babeacb4ecf36b2f0d644f994e295340cf646e3460c678c4a00f296cfc208685cb0d63fe90113bf23c71b3df120e3adc3871da523095f22c6de90e93489480e318722ab99001270b1a1fc361d34847c095bf573552656ce99766a8ed991f4f33d910b3278ea95b472f2aa275f99e335131d082fe0377733f2410076d9906d2691998ee370ed8b25471a6712558f8989fb4945385f604425c7abf535c14183e20e044936b06deb9f86871f9cb03ab3"], 0x3e0}, 0x4, 0x10}) io_uring_enter(r3, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 1.73223177s ago: executing program 0 (id=1242): r0 = syz_usb_connect_ath9k(0x3, 0x87, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) r1 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x280, &(0x7f0000000400)={[{0xc2, 0x4e00, "3eae6fe606846fb256be35952d4849e7b579164600937bfc433290e73162c2cea2bb0ea82dfe3c7be2a488bf59ba2084a48d0bf0fdc6d4255acb9d3eda0a4b6c0899383df3c02a33546a7b5a0b3a89e676efad3208ac87fbc665563cf48c226d4d361db44e081e5f92de40b12296041d75e7e8847507820526ec7572363eddecc77f0b72de453c57ce2d818bcc2d61c20ebb508faa0e43c638f334ecc48e24b8c857c06b7a06c2683be87b91ac0d96a70fb02617ffc4e84369ede263364d39aa4c77"}, {0x9a, 0x4e00, "e6ba17fdbe8756e1b1c2982b2e6ce3720a67d93a431da0105366f7a70487dce72525e5e32b207733fb7895e8c0a22fa25fd6e3b31350b0460bfd120775e3183cd305dbf7d42dd8b65df7325e0f1053fec194b123f6a59f6fa7d14606ae412bfb3c414c6f7894e7019e0d3e12b7d5936d220ca3dc608ea28caf71a4c48599d49e9e980ce569517e3e5d3a1a4fb8f9227c4a03af3078db0568f7bd"}, {0xe8, 0x4e00, "474a507865002e35bba18df8d6ff8f012f84401fcdd02577708ad2ed861689acac68177611ce66ae8c4a342d5a1022b16d0e7548978f5a6f0551775b37ee436a90e472b3bb36f3fa20e49d3308e90c6ed85621f1cf01dde780c77b76f27a6165373b9804c8cc4cdd5cb711a3f43a87f1d1e8f9843d615e68c49dbc31efd23bcc5da33706cab89573c3875433818c9e87fbafccf1f8f2b00229a0285153f2130cdeb96aba865bcf89d143ae5a8ae8f4451ff1bb92817df178ea3ad08762f5e5a93303cf850f0d813c0aa3052b847028a6c229e256bfdb03f39bcb575176f788d97a02877ef11a0bb8"}, {0x27, 0x4e00, "2baf9a3caace5e6bfc6585fd1b06691d48c1819ffc58fd27df2800b9b605eeae7133b040a4cc61"}]}) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, "b326b0dc", {0x1, 0x8, 0x7, 0x9}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32, @ANYBLOB="3d000e00800000000802110000000802110000000802110000000000000000000002086903cd26bcbcb6"], 0x7c}}, 0x39db77225c63fa4c) (async) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32, @ANYBLOB="3d000e00800000000802110000000802110000000802110000000000000000000002086903cd26bcbcb6"], 0x7c}}, 0x39db77225c63fa4c) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="0c00004e155038aad51c1ee170"]) 1.625307075s ago: executing program 4 (id=1243): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x20, 0x3, 0x3, 0x200, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0xffffffffffffffff, 0xc25}}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x4000010) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000140000006c07010033d43afffe800000000000000000000003000010ff02000000000000000000000000000189"], 0x340a) 1.437298321s ago: executing program 4 (id=1244): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000000, 0x8031, 0xffffffffffffffff, 0x80000000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000000, 0x8031, 0xffffffffffffffff, 0x80000000) r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x8, 0x420000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000007c0)={&(0x7f00000006c0)=[0x0], &(0x7f0000000700)=[0x0, 0x0, 0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0], 0x1, 0x3, 0x3, 0x3}) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000007c0)={&(0x7f00000006c0)=[0x0], &(0x7f0000000700)=[0x0, 0x0, 0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0], 0x1, 0x3, 0x3, 0x3}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000800)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000500)=[{}, {}, {}], &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x5, 0x3, 0x0, r2}) (async) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000800)={&(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000500)=[{}, {}, {}], &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x3, 0x5, 0x3, 0x0, r2}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x5c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbbd, {0x0, 0x0, 0x0, r4, {0xb, 0xfff3}, {0x0, 0xfff3}, {0xd, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x5, 0x1, 0xa}, {0x9b600000, 0x4, 0x3, 0x0, 0x9}}}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20041010}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) sendto$unix(r5, &(0x7f00000004c0)="0434", 0x2, 0xd1, 0x0, 0x0) recvfrom$unix(r6, 0x0, 0x0, 0x10102, 0x0, 0x0) setsockopt$CAN_RAW_LOOPBACK(r0, 0x65, 0x3, &(0x7f0000000140), 0x4) socket$nl_route(0x10, 0x3, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'dummy0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x8933, &(0x7f0000000000)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="4c0000001000fbff27bd7002fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="14100400040004001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r8, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r10], 0x4c}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) (async) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="4c0000001000fbff27bd7002fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="14100400040004001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r8, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r10], 0x4c}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) 1.423486374s ago: executing program 2 (id=1245): ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000000140)={0x9f0000, 0xfffffffe, 0x401, 0xffffffffffffffff, 0x0, 0x0}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x12, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000ff0000000000000000001000032073797a6b616c6c65723000001800128008000100767266000c000280080001"], 0x48}}, 0x0) 1.409387633s ago: executing program 4 (id=1246): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$BTRFS_IOC_WAIT_SYNC(r0, 0x40089416, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1a010c005c6b4408070a64006e4001020303090224"], 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x22) landlock_restrict_self(r1, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000000)={0x1c48}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x1c0) r3 = landlock_create_ruleset(&(0x7f0000000200)={0x6010, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r3, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x8800) rt_sigqueueinfo(0x0, 0x20, &(0x7f0000000000)={0x27, 0x8, 0x7}) write$UHID_INPUT(r0, &(0x7f00000011c0)={0xfc, {"a483885aed0d09f91b5e070987f70e06d038e7ff7fc6e5539b0d3e0e8b089b3f073063030890e0879b0af8c6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d0773090acd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d3340c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd389aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801118c20b8f16bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399ea4727d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a040200b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a64002bebc2407aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef64ab253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bf068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827475e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcb32b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba36b37767b6b45a44957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b94025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b98e375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b03512629f46366e7205dd8d6f37525c1a0e94210dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9154f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d603994732d6b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21396532713e5b69cf767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285e6a89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeaf1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b627cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e46a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5c92441918145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed608000000a006e39336d07c2b80817a28ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030f81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c00004f5d374755534d7f68f679c4ff516e9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c00", 0x1000}}, 0x1006) 1.313712461s ago: executing program 2 (id=1247): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) ioctl$TCSBRKP(r1, 0x5425, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x4, 0x14, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x400}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@map_fd={0x18, 0x2, 0x1, 0x0, 0x1}, @cb_func={0x18, 0xa, 0x4, 0x0, 0xfffffffffffffff9}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000900)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x41100, 0x14, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000940)={0x5, 0x9, 0x1, 0xa6}, 0x10, 0x0, r0, 0x9, &(0x7f0000000980)=[0x1, 0x1, 0x1, 0xffffffffffffffff, r1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000009c0)=[{0x5, 0x5, 0x2, 0x9}, {0x5, 0x1, 0x1, 0xb}, {0x0, 0x1, 0xd}, {0x1, 0x5, 0x1}, {0x5, 0x4, 0x9}, {0x0, 0x3, 0x7}, {0x0, 0x5, 0x2, 0x6}, {0x0, 0x3, 0x5, 0xa}, {0x2, 0x1, 0xf, 0xa}], 0x10, 0x8}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000b40)={r3, r2, 0xc, 0x0, @val=@netfilter={0x1, 0x0, 0x0, 0x1}}, 0x20) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000b80)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2c000000010401010000000000000000020000020800054000000002080004400000004971928d0001000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000000104010200000180002000000100000008000540efffffff0500010001"], 0x24}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x24, 0x1, 0x4, 0x401, 0x0, 0x0, {0x5}, [@NFULA_CFG_CMD={0x5, 0x1, 0x2}, @NFULA_CFG_FLAGS={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000835}, 0x2002889c) 1.053876202s ago: executing program 2 (id=1248): r0 = fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='tesd]y_encryp\xde\x80\x17\x81', &(0x7f00000004c0)='v2\x00ul\x00\x00\x00\x00\x00Loc\x8d\x8b#\xe0\xb9\xbd \xeb.\xc7]\xa6\a\x97 \xc9\f|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xaf\x86\x1d\xf6(\xe6\x9em*\x8c\xa4\xa8\v\xda\xfa\xa1\x98\xa4_Xd\xe0\x8f\x87\xd8t{\xedaO\x86\xa1R\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98-$\x86\x10/\xa5\x12\xa4\x04Q]\xa7\xaf\xb3*\x9a\x95\xad\t\xac\xf26\xa7\\e\xf3\x92\xaf.\xdf\x1d\x8a\xb6\xf8f\x9a\x17f\'\xfe\xdf\x16e\f\xf8\xe6?M\xfe\xdb\x03\xa9\x8e\xc1?\xff?\x12\xd37\xact\xc9\xb8\xf9\x1a\xf7\xb9\v\x9e\x11u\xf4\x90a|/\xd0E\x8c\x85l\xb2\x05\xe4\xed\xbc\x04n\xc59\x1d\x80\xbd\xac\xf8\xc0f\x06\x88Pf\xffG\xeap\xce\"\xf0\x90\x88`\xe4\xb1\xcf:\xf9\xef\xc7#A\x92\af\x0e>\xbb\xaa\x81\xe3L\x1e*iK\xa1\x87\xe4\x12\xe4\xb6j1\xce1\xac`\x11V\xa2u(`\xdezH\xf2\x97~S\xb9k\x7fqb\x84\xd1J\xad\xd0g\x13\x04\xfbI7\x066\x8e\xa6\xde0\xb94\v\x1fF\xaa}\x86w\xb3\xd4\xd6d\xd8\x1a\x15\x06v\x1cTC\n\xb4\x17\xa8\x89\x1c\xc2\xcf\xea9Sh\xf7\xd9\xc7\x0eV\xa6\x17\xf7m\'@\xef\\a 9\xc7d\x8d9]\xc3[B\xb2\x18\xe2\xe2oK\xf6\xc1;K\xca \xcd\x02(\xb6\x9b\x02_\xc8\xd1_\xbf\x94a\xc0\f#\x86\xb5\xe21\x85\x19W\xc7/A!\f\xcf\x0e\xb4\xfb\xcd\xc0k\xbe\x0eu(\xff\xff\xa0\x86\xd3\xf0\xe56\xabG\x83)!`&\xf6s\xcd\xf62(\x87\xf2t\x16\x8f\xe1\xbe]\xf8\xe3\x7f\x89\x80X\xd8\xe7\xa2\x1dV\xa1e\xe4\xc2\xc4\xc3\x96\xa3\xf9\xe5\xc5\xa0Fg\xc1\xe0\xf5\xe5\xba\x15\x86\xe0B\xf9\xb0\xc8\xf7\xc6~\xf5\xd4\xf0!\xa6\xc3\x0e{', 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x4, 0x81, 0xffffffff, 0xffffffff}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000002c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha1\x00'}, 0x58) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="6000000054000500010000000000000007000000", @ANYRES32=r3, @ANYBLOB="20000100", @ANYRES32=r3, @ANYBLOB="01000000ef01010100000000000000000000000086ddffff2800028005000300010000001c0002800c000180080001000a0000010c000180080001"], 0x60}}, 0x0) r4 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) ioctl$BLKROSET(r4, 0x125d, &(0x7f0000000200)=0xd4) fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) (async) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) (async) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='tesd]y_encryp\xde\x80\x17\x81', &(0x7f00000004c0)='v2\x00ul\x00\x00\x00\x00\x00Loc\x8d\x8b#\xe0\xb9\xbd \xeb.\xc7]\xa6\a\x97 \xc9\f|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xaf\x86\x1d\xf6(\xe6\x9em*\x8c\xa4\xa8\v\xda\xfa\xa1\x98\xa4_Xd\xe0\x8f\x87\xd8t{\xedaO\x86\xa1R\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98-$\x86\x10/\xa5\x12\xa4\x04Q]\xa7\xaf\xb3*\x9a\x95\xad\t\xac\xf26\xa7\\e\xf3\x92\xaf.\xdf\x1d\x8a\xb6\xf8f\x9a\x17f\'\xfe\xdf\x16e\f\xf8\xe6?M\xfe\xdb\x03\xa9\x8e\xc1?\xff?\x12\xd37\xact\xc9\xb8\xf9\x1a\xf7\xb9\v\x9e\x11u\xf4\x90a|/\xd0E\x8c\x85l\xb2\x05\xe4\xed\xbc\x04n\xc59\x1d\x80\xbd\xac\xf8\xc0f\x06\x88Pf\xffG\xeap\xce\"\xf0\x90\x88`\xe4\xb1\xcf:\xf9\xef\xc7#A\x92\af\x0e>\xbb\xaa\x81\xe3L\x1e*iK\xa1\x87\xe4\x12\xe4\xb6j1\xce1\xac`\x11V\xa2u(`\xdezH\xf2\x97~S\xb9k\x7fqb\x84\xd1J\xad\xd0g\x13\x04\xfbI7\x066\x8e\xa6\xde0\xb94\v\x1fF\xaa}\x86w\xb3\xd4\xd6d\xd8\x1a\x15\x06v\x1cTC\n\xb4\x17\xa8\x89\x1c\xc2\xcf\xea9Sh\xf7\xd9\xc7\x0eV\xa6\x17\xf7m\'@\xef\\a 9\xc7d\x8d9]\xc3[B\xb2\x18\xe2\xe2oK\xf6\xc1;K\xca \xcd\x02(\xb6\x9b\x02_\xc8\xd1_\xbf\x94a\xc0\f#\x86\xb5\xe21\x85\x19W\xc7/A!\f\xcf\x0e\xb4\xfb\xcd\xc0k\xbe\x0eu(\xff\xff\xa0\x86\xd3\xf0\xe56\xabG\x83)!`&\xf6s\xcd\xf62(\x87\xf2t\x16\x8f\xe1\xbe]\xf8\xe3\x7f\x89\x80X\xd8\xe7\xa2\x1dV\xa1e\xe4\xc2\xc4\xc3\x96\xa3\xf9\xe5\xc5\xa0Fg\xc1\xe0\xf5\xe5\xba\x15\x86\xe0B\xf9\xb0\xc8\xf7\xc6~\xf5\xd4\xf0!\xa6\xc3\x0e{', 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x4, 0x81, 0xffffffff, 0xffffffff}) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) bind$alg(0xffffffffffffffff, &(0x7f00000002c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha1\x00'}, 0x58) (async) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) (async) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="6000000054000500010000000000000007000000", @ANYRES32=r3, @ANYBLOB="20000100", @ANYRES32=r3, @ANYBLOB="01000000ef01010100000000000000000000000086ddffff2800028005000300010000001c0002800c000180080001000a0000010c000180080001"], 0x60}}, 0x0) (async) syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$BLKROSET(r4, 0x125d, &(0x7f0000000200)=0xd4) (async) 986.516461ms ago: executing program 2 (id=1249): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newpolicy={0x17c, 0x13, 0x101, 0x0, 0x0, {{@in=@rand_addr=0x64010102, @in=@rand_addr=0x64010102, 0x100, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x3, 0x0, 0x8}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0xc4, 0x5, [{{@in=@remote, 0x4d2, 0x2b}, 0xa, @in6=@empty, 0x0, 0x1, 0x1, 0x1, 0x5, 0x2, 0x80000001}, {{@in=@dev={0xac, 0x14, 0x14, 0x18}, 0x4d4, 0x2b}, 0xa, @in6=@dev={0xfe, 0x80, '\x00', 0x1e}, 0x0, 0x4, 0x1, 0x3, 0x0, 0x2, 0x6}, {{@in=@multicast2, 0x4d4, 0x2b}, 0xa, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0x0, 0x3, 0xfffffff9, 0x103ff, 0xd9}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff02ffffeb2200000000000000000001"], 0xfdef) 765.865491ms ago: executing program 2 (id=1250): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000003c0), 0x123e00, 0x0) ioctl$TCSBRKP(r1, 0x5425, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r2}, &(0x7f0000bbdffc)=0x0) timer_settime(r3, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r4, 0x29, 0x3a, 0x0, 0x0) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x118) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB, @ANYRES32, @ANYBLOB="78aa2a1bea674e9b8e2bfc97", @ANYRES64=0x0], 0x20) ioctl$TCSETSW2(r1, 0x5408, &(0x7f0000000240)={0x4, 0x37, 0x783, 0xfff, 0x2, "b850e43615b1b70500000000000400", 0x800, 0x1}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000000)={0x1fa, 0x1, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f00000000c0)={0x6, 0x10000, 0x2, 0xffffffffffffffff, 0x8}) eventfd2(0x40, 0x80001) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044000000a80016000a0003402e60000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x60044084) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x8000) 0s ago: executing program 4 (id=1251): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010400000000000000400200000a0900010073797a300000000040000000030a010400000000000000000200000a0900010073797a30000000000900030073797a300000000014000480080001400000000308000240000000006c000000060a010400000000000000000200000a0900010073797a30000000000900020073797a30000000004000048020000180070001006374000014000280080001400000000108000240000000001c0001800a00010071756575650000000c000280060001"], 0xf4}}, 0x0) kernel console output (not intermixed with test programs): 202.884468][ T5702] usb 5-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 202.886666][ T5702] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 202.886702][ T5702] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 202.906417][ T5702] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.906444][ T5702] usb 5-1: Product: syz [ 202.906458][ T5702] usb 5-1: Manufacturer: syz [ 202.906472][ T5702] usb 5-1: SerialNumber: syz [ 203.185257][ T8365] program syz.0.842 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 203.188078][ T8364] netlink: 'syz.2.841': attribute type 6 has an invalid length. [ 203.188102][ T8364] netlink: 8 bytes leftover after parsing attributes in process `syz.2.841'. [ 203.196547][ T8364] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.197017][ T8364] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.366049][ T8369] netlink: 8 bytes leftover after parsing attributes in process `syz.0.844'. [ 203.581033][ T5702] usb 5-1: USB disconnect, device number 20 [ 203.620918][ T44] usb 4-1: new full-speed USB device number 27 using dummy_hcd [ 203.651650][ T5614] udevd[5614]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 203.771268][ T44] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 203.773135][ T44] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 203.773180][ T44] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 203.773207][ T44] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 203.775420][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 203.775443][ T44] usb 4-1: Product: syz [ 203.775458][ T44] usb 4-1: Manufacturer: syz [ 203.775471][ T44] usb 4-1: SerialNumber: syz [ 203.789263][ T8371] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 203.991074][ T8371] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 203.991209][ T8371] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 204.180592][ T7036] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 204.201454][ T37] IPVS: starting estimator thread 0... [ 204.209313][ T8389] xt_hashlimit: size too large, truncated to 1048576 [ 204.290367][ T8387] IPVS: using max 32 ests per chain, 76800 per kthread [ 204.343618][ T7036] usb 3-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 204.345019][ T7036] usb 3-1: config 0 has an invalid descriptor of length 81, skipping remainder of the config [ 204.345065][ T7036] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 204.345106][ T7036] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.349497][ T7036] usb 3-1: config 0 descriptor?? [ 204.396034][ T8391] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 204.405087][ T8386] ptrace attach of "ci-upstream-kasan-gce/syz-executor exec"[5638] was attempted by " Àÿ Ðÿ ð¥ Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ      rr @  @       À rr s¬ ÿÿ    üÿÿÿ   ÿÿÿÿ  & %½p ûÛß% \x07 gF- [ 204.421890][ T7036] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 204.429616][ T8391] netlink: 8 bytes leftover after parsing attributes in process `syz.0.851'. [ 204.611192][ T8371] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 204.611325][ T8371] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 204.814398][ T44] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 204.814439][ T44] cdc_ncm 4-1:1.0: dwNtbInMaxSize=1042 is too small. Using 2048 [ 204.814459][ T44] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 205.015486][ T44] cdc_ncm 4-1:1.0: setting tx_max = 48 [ 205.036159][ T44] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 205.045391][ T44] usb 4-1: USB disconnect, device number 27 [ 205.050776][ T44] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 205.570367][ T44] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 205.720327][ T44] usb 1-1: Using ep0 maxpacket: 16 [ 205.720998][ T44] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 205.721474][ T44] usb 1-1: config 0 has no interfaces? [ 205.733126][ T44] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.733152][ T44] usb 1-1: Product: syz [ 205.733165][ T44] usb 1-1: Manufacturer: syz [ 205.733179][ T44] usb 1-1: SerialNumber: syz [ 205.736883][ T44] usb 1-1: config 0 descriptor?? [ 206.090821][ T5702] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 206.120884][ T8420] ip6tnl3: entered allmulticast mode [ 206.221714][ T5702] usb 4-1: device descriptor read/64, error -71 [ 206.461164][ T5702] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 206.485598][ T989] usb 1-1: USB disconnect, device number 25 [ 206.608100][ T5702] usb 4-1: device descriptor read/64, error -71 [ 206.700047][ T8427] pim6reg: entered allmulticast mode [ 206.710848][ T5702] usb usb4-port1: attempt power cycle [ 206.946134][ T5615] usb 3-1: USB disconnect, device number 11 [ 207.050634][ T5702] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 207.072081][ T5702] usb 4-1: device descriptor read/8, error -71 [ 207.310360][ T5702] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 207.331010][ T7047] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 207.331549][ T5702] usb 4-1: device descriptor read/8, error -71 [ 207.441770][ T5702] usb usb4-port1: unable to enumerate USB device [ 207.481101][ T7047] usb 5-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 207.481956][ T7047] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 207.481989][ T7047] usb 5-1: config 1 interface 0 altsetting 1 endpoint 0x2 has invalid wMaxPacketSize 0 [ 207.482000][ T7047] usb 5-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 207.483837][ T7047] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.483860][ T7047] usb 5-1: Product: syz [ 207.483874][ T7047] usb 5-1: Manufacturer: syz [ 207.483888][ T7047] usb 5-1: SerialNumber: syz [ 207.489603][ T7047] usb-storage 5-1:1.0: USB Mass Storage device detected [ 207.507775][ T7047] usb-storage 5-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 207.508315][ T7047] scsi host1: usb-storage 5-1:1.0 [ 207.787759][ T8448] netlink: 4 bytes leftover after parsing attributes in process `syz.2.872'. [ 207.873683][ T7037] usb 5-1: USB disconnect, device number 21 [ 207.899153][ T8451] netlink: 12 bytes leftover after parsing attributes in process `syz.2.873'. [ 207.925030][ T8451] vlan5: entered allmulticast mode [ 207.925052][ T8451] bridge3: entered allmulticast mode [ 207.928200][ T8451] erspan0: left allmulticast mode [ 207.928216][ T8451] erspan0: left promiscuous mode [ 207.929892][ T8451] bridge2: port 1(erspan0) entered disabled state [ 207.966465][ T8451] bridge3: port 1(erspan0) entered blocking state [ 207.966562][ T8451] bridge3: port 1(erspan0) entered disabled state [ 207.966705][ T8451] erspan0: entered allmulticast mode [ 207.973542][ T8451] erspan0: entered promiscuous mode [ 207.974507][ T8451] bridge3: port 1(erspan0) entered blocking state [ 207.974613][ T8451] bridge3: port 1(erspan0) entered forwarding state [ 208.592192][ T8469] ptrace attach of "ci-upstream-kasan-gce/syz-executor exec"[5638] was attempted by "ci-upstream-kasan-gce/syz-executor exec"[8469] [ 209.194171][ T8493] ip_tables: iptables: counters copy to user failed while replacing table [ 209.264945][ T8496] netlink: 'syz.4.882': attribute type 2 has an invalid length. [ 209.340383][ T7037] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 209.470462][ T7037] usb 4-1: device descriptor read/64, error -71 [ 209.731253][ T7037] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 209.872644][ T7037] usb 4-1: device descriptor read/64, error -71 [ 209.876896][ T8517] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 209.900988][ T8517] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 209.980841][ T7037] usb usb4-port1: attempt power cycle [ 210.160582][ T7036] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 210.211293][ T30] kauditd_printk_skb: 281 callbacks suppressed [ 210.211312][ T30] audit: type=1326 audit(1790914624.820:5793): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8520 comm="syz.1.891" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa09619e159 code=0x7ffc0000 [ 210.211434][ T30] audit: type=1326 audit(1790914624.820:5794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8520 comm="syz.1.891" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa09619e159 code=0x7ffc0000 [ 210.211623][ T30] audit: type=1326 audit(1790914624.820:5795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8520 comm="syz.1.891" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa09619e159 code=0x7ffc0000 [ 210.211738][ T30] audit: type=1326 audit(1790914624.820:5796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8520 comm="syz.1.891" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa09619e159 code=0x7ffc0000 [ 210.211889][ T30] audit: type=1326 audit(1790914624.820:5797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8520 comm="syz.1.891" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fa09619e159 code=0x7ffc0000 [ 210.240529][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 210.250998][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 210.291458][ T30] audit: type=1326 audit(1790914624.900:5798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8520 comm="syz.1.891" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa09619e159 code=0x7ffc0000 [ 210.291510][ T30] audit: type=1326 audit(1790914624.900:5799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8520 comm="syz.1.891" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa09619e159 code=0x7ffc0000 [ 210.293909][ T30] audit: type=1326 audit(1790914624.900:5800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8520 comm="syz.1.891" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fa09619e159 code=0x7ffc0000 [ 210.294575][ T30] audit: type=1326 audit(1790914624.900:5801): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8520 comm="syz.1.891" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa09619e159 code=0x7ffc0000 [ 210.294615][ T30] audit: type=1326 audit(1790914624.900:5802): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8520 comm="syz.1.891" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa09619e159 code=0x7ffc0000 [ 210.414965][ T7037] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 210.465251][ T7037] usb 4-1: device descriptor read/8, error -71 [ 210.505559][ T7036] usb 5-1: unable to get BOS descriptor or descriptor too short [ 210.505612][ T7036] usb 5-1: New USB device found, idVendor=0421, idProduct=02e3, bcdDevice=43.b7 [ 210.506563][ T7036] usb 5-1: config 0 has an invalid interface number: 59 but max is 2 [ 210.506588][ T7036] usb 5-1: config 0 has an invalid interface number: 59 but max is 2 [ 210.506607][ T7036] usb 5-1: config 0 has an invalid interface number: 56 but max is 2 [ 210.506627][ T7036] usb 5-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 210.506648][ T7036] usb 5-1: config 0 has no interface number 0 [ 210.506664][ T7036] usb 5-1: config 0 has no interface number 1 [ 210.507271][ T7036] usb 5-1: config 0 interface 59 has no altsetting 0 [ 210.507289][ T7036] usb 5-1: config 0 interface 59 has no altsetting 1 [ 210.507305][ T7036] usb 5-1: config 0 interface 56 has no altsetting 0 [ 210.509205][ T7036] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.509229][ T7036] usb 5-1: Product: syz [ 210.509244][ T7036] usb 5-1: Manufacturer: syz [ 210.509259][ T7036] usb 5-1: SerialNumber: syz [ 210.602072][ T8526] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.605195][ T8526] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.633602][ T7036] usb 5-1: config 0 descriptor?? [ 210.649130][ T8528] netlink: 8 bytes leftover after parsing attributes in process `syz.2.893'. [ 210.667742][ T8528] macvlan3: entered allmulticast mode [ 210.720449][ T7037] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 210.729453][ T8532] binder: 8529:8532 ioctl c0306201 0 returned -14 [ 210.750901][ T7037] usb 4-1: device descriptor read/8, error -71 [ 210.848664][ T8513] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.849218][ T8513] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.868729][ T7037] usb usb4-port1: unable to enumerate USB device [ 210.871560][ T7036] rndis_host 5-1:0.59: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 210.872128][ T7036] cdc_acm 5-1:0.59: Zero length descriptor references [ 210.872150][ T7036] cdc_acm 5-1:0.59: probe with driver cdc_acm failed with error -22 [ 210.885601][ T7036] usb 5-1: USB disconnect, device number 22 [ 211.257163][ T8540] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 211.408560][ T8544] input: syz1 as /devices/virtual/input/input12 [ 211.464715][ T8544] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 211.540245][ T8545] netlink: 'syz.0.898': attribute type 21 has an invalid length. [ 211.583547][ T8545] netlink: 156 bytes leftover after parsing attributes in process `syz.0.898'. [ 211.684598][ T8553] batman_adv: batadv0: Adding interface: gretap1 [ 211.684614][ T8553] batman_adv: batadv0: Interface activated: gretap1 [ 211.707508][ T12] nvmet: connect request for invalid subsystem t! [ 211.707783][ T8544] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "t" [ 211.892229][ T8557] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 212.035601][ T8562] syzkaller0: entered promiscuous mode [ 212.035615][ T8562] syzkaller0: entered allmulticast mode [ 212.285802][ T8565] binder: 8563:8565 ioctl c0306201 0 returned -14 [ 212.287616][ T8565] binder: 8563:8565 ioctl ae45 ffffffffffffffff returned -22 [ 212.511833][ T8568] netlink: 'syz.0.907': attribute type 12 has an invalid length. [ 212.511857][ T8568] netlink: 4 bytes leftover after parsing attributes in process `syz.0.907'. [ 212.828081][ T8575] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 212.884436][ T8579] netlink: 'syz.1.912': attribute type 12 has an invalid length. [ 213.060378][ T7036] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 213.159843][ T8593] ip_tables: iptables: counters copy to user failed while replacing table [ 213.211435][ T7036] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 213.212597][ T7036] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 213.212730][ T7036] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 213.214047][ T7036] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 213.214062][ T7036] usb 5-1: Manufacturer: syz [ 213.217836][ T7036] usb 5-1: config 0 descriptor?? [ 213.331035][ T7036] rc_core: IR keymap rc-hauppauge not found [ 213.331047][ T7036] Registered IR keymap rc-empty [ 213.332738][ T7036] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 213.334717][ T7036] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input13 [ 213.341210][ T5615] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 213.490425][ T5615] usb 2-1: Using ep0 maxpacket: 16 [ 213.491818][ T5615] usb 2-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 213.493777][ T5615] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.496081][ T5615] usb 2-1: config 0 descriptor?? [ 213.509654][ T5615] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 213.886440][ T8598] xt_hashlimit: size too large, truncated to 1048576 [ 213.911504][ T5615] gspca_sonixj: reg_r err -71 [ 213.913301][ T5615] sonixj 2-1:0.0: probe with driver sonixj failed with error -71 [ 213.918309][ T5615] usb 2-1: USB disconnect, device number 31 [ 213.981490][ T8600] sock: sock_timestamping_bind_phc: sock not bind to device [ 214.009182][ T8599] netlink: 36 bytes leftover after parsing attributes in process `syz.4.911'. [ 214.346398][ T8608] xt_hashlimit: size too large, truncated to 1048576 [ 214.555518][ T8618] netlink: 4 bytes leftover after parsing attributes in process `syz.1.923'. [ 214.555578][ T8618] netlink: 4 bytes leftover after parsing attributes in process `syz.1.923'. [ 214.555611][ T8618] netlink: 20 bytes leftover after parsing attributes in process `syz.1.923'. [ 215.211354][ T8635] netlink: 8 bytes leftover after parsing attributes in process `syz.3.927'. [ 215.234727][ T8635] macvlan2: entered allmulticast mode [ 215.234751][ T8635] gretap0: entered allmulticast mode [ 215.380399][ T30] kauditd_printk_skb: 109 callbacks suppressed [ 215.380417][ T30] audit: type=1326 audit(1790914629.980:5912): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8639 comm="syz.0.929" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 215.381036][ T30] audit: type=1326 audit(1790914629.980:5913): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8639 comm="syz.0.929" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 215.383935][ T30] audit: type=1326 audit(1790914629.990:5914): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8639 comm="syz.0.929" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 215.384003][ T30] audit: type=1326 audit(1790914629.990:5915): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8639 comm="syz.0.929" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 215.384042][ T30] audit: type=1326 audit(1790914629.990:5916): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8639 comm="syz.0.929" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 215.387110][ T30] audit: type=1326 audit(1790914629.990:5917): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8639 comm="syz.0.929" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 215.407368][ T30] audit: type=1326 audit(1790914630.010:5918): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8639 comm="syz.0.929" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 215.407418][ T30] audit: type=1326 audit(1790914630.010:5919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8639 comm="syz.0.929" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 215.419056][ T30] audit: type=1326 audit(1790914630.020:5920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8639 comm="syz.0.929" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 215.419521][ T30] audit: type=1326 audit(1790914630.020:5921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8639 comm="syz.0.929" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 215.864542][ T5702] usb 5-1: USB disconnect, device number 23 [ 215.884781][ T8637] warning: `syz.3.928' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 215.939644][ T8651] FAULT_INJECTION: forcing a failure. [ 215.939644][ T8651] name failslab, interval 1, probability 0, space 0, times 0 [ 215.939679][ T8651] CPU: 0 UID: 0 PID: 8651 Comm: syz.4.933 Tainted: G L syzkaller #0 PREEMPT(full) [ 215.939706][ T8651] Tainted: [L]=SOFTLOCKUP [ 215.939713][ T8651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 215.939725][ T8651] Call Trace: [ 215.939732][ T8651] [ 215.939741][ T8651] dump_stack_lvl+0xe8/0x150 [ 215.939773][ T8651] should_fail_ex+0x410/0x560 [ 215.939801][ T8651] ? __alloc_skb+0x1db/0x7a0 [ 215.939824][ T8651] should_failslab+0xa8/0x100 [ 215.939851][ T8651] ? __alloc_skb+0x1db/0x7a0 [ 215.939874][ T8651] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 215.939895][ T8651] ? __alloc_skb+0x18d/0x7a0 [ 215.939919][ T8651] ? __alloc_skb+0x1db/0x7a0 [ 215.939950][ T8651] __alloc_skb+0x1db/0x7a0 [ 215.939977][ T8651] audit_log_start+0x1b3/0xa10 [ 215.940010][ T8651] ? __pfx_audit_log_start+0x10/0x10 [ 215.940040][ T8651] ? __lock_acquire+0x747/0x2de0 [ 215.940071][ T8651] audit_seccomp+0x63/0x190 [ 215.940095][ T8651] ? clear_bhb_loop+0x70/0xc0 [ 215.940114][ T8651] ? clear_bhb_loop+0xe/0xc0 [ 215.940139][ T8651] __seccomp_filter+0xd14/0x1de0 [ 215.940173][ T8651] ? __pfx___seccomp_filter+0x10/0x10 [ 215.940200][ T8651] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 215.940229][ T8651] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 215.940250][ T8651] ? rcu_preempt_deferred_qs_irqrestore+0x7b7/0xb90 [ 215.940291][ T8651] ? __seccomp_permit_syscall+0xe7/0x2b0 [ 215.940321][ T8651] do_syscall_64+0x11f/0x520 [ 215.940347][ T8651] ? trace_irq_disable+0x3b/0x140 [ 215.940368][ T8651] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.940388][ T8651] ? clear_bhb_loop+0x70/0xc0 [ 215.940411][ T8651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.940430][ T8651] RIP: 0033:0x7fe9b5b5e98e [ 215.940448][ T8651] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 215.940464][ T8651] RSP: 002b:00007fe9b6adcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 215.940485][ T8651] RAX: ffffffffffffffda RBX: 00007fe9b6add6c0 RCX: 00007fe9b5b5e98e [ 215.940498][ T8651] RDX: 000000000000000f RSI: 00007fe9b6add0a0 RDI: 0000000000000003 [ 215.940510][ T8651] RBP: 00007fe9b6add090 R08: 0000000000000000 R09: 0000000000000000 [ 215.940522][ T8651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 215.940540][ T8651] R13: 00007fe9b5e26038 R14: 00007fe9b5e25fa0 R15: 00007fe9b5f4fa48 [ 215.940570][ T8651] [ 216.120920][ T8656] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 216.130909][ T5615] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 216.281112][ T5615] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 216.286911][ T5615] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.286938][ T5615] usb 2-1: Product: syz [ 216.286952][ T5615] usb 2-1: Manufacturer: syz [ 216.286967][ T5615] usb 2-1: SerialNumber: syz [ 216.478266][ T8669] netlink: 12 bytes leftover after parsing attributes in process `syz.2.940'. [ 216.521651][ T8669] vlan6: entered allmulticast mode [ 216.521673][ T8669] bridge4: entered allmulticast mode [ 216.525993][ T8669] erspan0: left allmulticast mode [ 216.526018][ T8669] erspan0: left promiscuous mode [ 216.526244][ T8669] bridge3: port 1(erspan0) entered disabled state [ 216.536517][ T5615] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 216.536575][ T5615] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 216.576544][ T8669] bridge4: port 1(erspan0) entered blocking state [ 216.576671][ T8669] bridge4: port 1(erspan0) entered disabled state [ 216.576821][ T8669] erspan0: entered allmulticast mode [ 216.586547][ T8669] erspan0: entered promiscuous mode [ 216.587576][ T8669] bridge4: port 1(erspan0) entered blocking state [ 216.587679][ T8669] bridge4: port 1(erspan0) entered forwarding state [ 216.650359][ T5702] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 216.688332][ T8677] ip_tables: iptables: counters copy to user failed while replacing table [ 216.784471][ T8682] netlink: 8 bytes leftover after parsing attributes in process `syz.2.944'. [ 216.804586][ T5702] usb 5-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=d2.4b [ 216.805889][ T5702] usb 5-1: config 127 has an invalid interface number: 57 but max is 0 [ 216.805915][ T5702] usb 5-1: config 127 has no interface number 0 [ 216.805955][ T5702] usb 5-1: config 127 interface 57 altsetting 0 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 216.809141][ T5702] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.809163][ T5702] usb 5-1: Product: syz [ 216.809178][ T5702] usb 5-1: Manufacturer: syz [ 216.809192][ T5702] usb 5-1: SerialNumber: syz [ 216.875532][ T8660] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 216.947025][ T8687] xt_hashlimit: size too large, truncated to 1048576 [ 217.059386][ T8692] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 217.064078][ T8692] netlink: 8 bytes leftover after parsing attributes in process `syz.2.946'. [ 217.085445][ T8660] netlink: 288 bytes leftover after parsing attributes in process `syz.4.936'. [ 217.085508][ T8660] netlink: 28 bytes leftover after parsing attributes in process `syz.4.936'. [ 217.290934][ T8660] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 217.370482][ T5615] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000040. ret = -EPROTO [ 217.372346][ T5615] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 217.374184][ T5615] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 217.374272][ T5615] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 217.432112][ T5615] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 217.453888][ T5615] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 217.470301][ T5615] usb 2-1: USB disconnect, device number 32 [ 217.487271][ T5619] udevd[5619]: setting owner of /dev/bus/usb/002/032 to uid=0, gid=0 failed: No such file or directory [ 217.506965][ T5702] asix 5-1:127.57 (unnamed net_device) (uninitialized): invalid hw address, using random [ 217.708658][ T5702] asix 5-1:127.57 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 217.708678][ T5702] asix 5-1:127.57 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 217.708809][ T5702] asix 5-1:127.57: probe with driver asix failed with error -71 [ 217.733072][ T5702] usb 5-1: USB disconnect, device number 24 [ 218.035912][ T8711] ip6tnl3: entered allmulticast mode [ 218.810358][ T989] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 218.961558][ T989] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 218.964294][ T989] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.992785][ T989] usb 2-1: config 0 descriptor?? [ 219.203665][ T989] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 219.230177][ T8755] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 219.340462][ T7047] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 219.458978][ T989] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 1 [ 219.459006][ T989] [drm] Initialized udl on minor 1 [ 219.500346][ T7047] usb 3-1: Using ep0 maxpacket: 16 [ 219.524578][ T7047] usb 3-1: unable to get BOS descriptor or descriptor too short [ 219.524609][ T7047] usb 3-1: New USB device found, idVendor=0499, idProduct=1509, bcdDevice= 0.40 [ 219.625620][ T7047] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.625655][ T7047] usb 3-1: Product: syz [ 219.625663][ T7047] usb 3-1: Manufacturer: syz [ 219.625671][ T7047] usb 3-1: SerialNumber: syz [ 219.674710][ T7047] usb 3-1: 1:1 : unsupported format bits 0xfffe0000 [ 219.674735][ T7047] usb 3-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 219.678215][ T989] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 219.678481][ T989] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 219.738088][ T5702] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 219.747369][ T989] usb 2-1: USB disconnect, device number 33 [ 219.820730][ T5702] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 219.840514][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 220.320378][ T5615] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 220.388731][ T8771] openvswitch: netlink: Flow actions attr not present in new flow. [ 220.485776][ T5615] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 220.506572][ T5615] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 220.506598][ T5615] usb 5-1: Product: syz [ 220.506607][ T5615] usb 5-1: SerialNumber: syz [ 220.529151][ T5615] usb 5-1: config 0 descriptor?? [ 220.861553][ T989] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 220.911558][ T8775] pim6reg: entered allmulticast mode [ 221.011259][ T989] usb 2-1: Using ep0 maxpacket: 8 [ 221.013129][ T989] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 221.024035][ T989] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 221.024103][ T989] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.035010][ T989] usb 2-1: config 0 descriptor?? [ 221.270877][ T989] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 221.959214][ T8786] IPVS: sync thread started: state = MASTER, mcast_ifn = bridge0, syncid = 4, id = 0 [ 222.400840][ T989] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 222.553362][ T989] usb 4-1: unable to get BOS descriptor or descriptor too short [ 222.553404][ T989] usb 4-1: New USB device found, idVendor=0421, idProduct=02e3, bcdDevice=43.b7 [ 222.559907][ T989] usb 4-1: config 0 has an invalid interface number: 59 but max is 2 [ 222.559934][ T989] usb 4-1: config 0 has an invalid interface number: 59 but max is 2 [ 222.559974][ T989] usb 4-1: config 0 has an invalid interface number: 56 but max is 2 [ 222.559985][ T989] usb 4-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 222.559996][ T989] usb 4-1: config 0 has no interface number 0 [ 222.560005][ T989] usb 4-1: config 0 has no interface number 1 [ 222.581609][ T989] usb 4-1: config 0 interface 59 has no altsetting 0 [ 222.581634][ T989] usb 4-1: config 0 interface 59 has no altsetting 1 [ 222.581652][ T989] usb 4-1: config 0 interface 56 has no altsetting 0 [ 222.675858][ T989] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.675884][ T989] usb 4-1: Product: syz [ 222.675899][ T989] usb 4-1: Manufacturer: syz [ 222.675936][ T989] usb 4-1: SerialNumber: syz [ 222.738410][ T989] usb 4-1: config 0 descriptor?? [ 222.781044][ T7047] usb 3-1: failed to enable PITCH for EP 0x1 [ 222.825281][ T7047] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 223.029533][ T5615] usb 5-1: USB disconnect, device number 25 [ 223.155882][ T8785] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 223.170672][ T8785] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 223.309131][ T7047] usb 3-1: USB disconnect, device number 12 [ 223.349167][ T989] rndis_host 4-1:0.59: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 223.363143][ T989] cdc_acm 4-1:0.59: Zero length descriptor references [ 223.363161][ T989] cdc_acm 4-1:0.59: probe with driver cdc_acm failed with error -22 [ 223.471711][ T989] usb 4-1: USB disconnect, device number 36 [ 223.772535][ T8804] syz.0.979: vmalloc error: size 16384, failed to allocate pages, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 223.800195][ T6318] udevd[6318]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 223.837061][ T8804] [ 223.837083][ T8804] CPU: 0 UID: 0 PID: 8804 Comm: syz.0.979 Tainted: G L syzkaller #0 PREEMPT(full) [ 223.837113][ T8804] Tainted: [L]=SOFTLOCKUP [ 223.837120][ T8804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 223.837133][ T8804] Call Trace: [ 223.837141][ T8804] [ 223.837149][ T8804] dump_stack_lvl+0xe8/0x150 [ 223.837185][ T8804] warn_alloc+0x24d/0x270 [ 223.837215][ T8804] ? __pfx_warn_alloc+0x10/0x10 [ 223.837243][ T8804] ? alloc_pages_mpol+0x256/0x390 [ 223.837281][ T8804] __vmalloc_node_range_noprof+0x11a9/0x1540 [ 223.837342][ T8804] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 223.837374][ T8804] ? nft_array_may_resize+0x354/0x570 [ 223.837404][ T8804] ? rcu_is_watching+0x16/0xb0 [ 223.837431][ T8804] ? nft_array_may_resize+0x354/0x570 [ 223.837459][ T8804] ? rcu_is_watching+0x16/0xb0 [ 223.837488][ T8804] ? nft_array_may_resize+0x354/0x570 [ 223.837517][ T8804] __kvmalloc_node_noprof+0x5a1/0x820 [ 223.837542][ T8804] ? nft_array_may_resize+0x354/0x570 [ 223.837571][ T8804] ? __kmalloc_cache_noprof+0x321/0x600 [ 223.837594][ T8804] ? nft_array_may_resize+0x32d/0x570 [ 223.837621][ T8804] ? nft_array_may_resize+0x354/0x570 [ 223.837657][ T8804] nft_array_may_resize+0x354/0x570 [ 223.837692][ T8804] nft_rbtree_insert+0x11e/0x2510 [ 223.837723][ T8804] ? __kmalloc_noprof+0x1ab/0x720 [ 223.837742][ T8804] ? nft_trans_alloc+0x22/0x2a0 [ 223.837779][ T8804] ? nft_trans_alloc+0x40/0x2a0 [ 223.837812][ T8804] nf_tables_newsetelem+0x2aa4/0x4200 [ 223.837883][ T8804] ? __pfx_nf_tables_newsetelem+0x10/0x10 [ 223.837914][ T8804] ? lock_acquire+0x115/0x350 [ 223.837954][ T8804] ? nla_validate_array+0xfc/0x260 [ 223.838013][ T8804] ? __pfx___nla_validate_parse+0x10/0x10 [ 223.838052][ T8804] ? __pfx_nf_tables_newset+0x10/0x10 [ 223.838086][ T8804] ? lock_acquire+0x115/0x350 [ 223.838108][ T8804] ? nfnl_pernet+0x23/0x240 [ 223.838147][ T8804] ? __nla_parse+0x40/0x60 [ 223.838178][ T8804] nfnetlink_rcv+0x1288/0x28c0 [ 223.838240][ T8804] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 223.838288][ T8804] ? ref_tracker_free+0x689/0x830 [ 223.838338][ T8804] ? skb_clone+0x246/0x3a0 [ 223.838371][ T8804] ? __netlink_deliver_tap+0x811/0x860 [ 223.838400][ T8804] ? netlink_deliver_tap+0x2e/0x1b0 [ 223.838422][ T8804] ? netlink_deliver_tap+0x2e/0x1b0 [ 223.838448][ T8804] netlink_unicast+0x7bd/0x940 [ 223.838490][ T8804] netlink_sendmsg+0x813/0xb40 [ 223.838521][ T8804] ? __pfx_netlink_sendmsg+0x10/0x10 [ 223.838550][ T8804] ? apparmor_socket_sendmsg+0x98/0x360 [ 223.838579][ T8804] ? __pfx_netlink_sendmsg+0x10/0x10 [ 223.838599][ T8804] sock_sendmsg_nosec+0x13a/0x180 [ 223.838625][ T8804] ____sys_sendmsg+0x54e/0x850 [ 223.838661][ T8804] ? __pfx_____sys_sendmsg+0x10/0x10 [ 223.838711][ T8804] ? import_iovec+0x73/0xa0 [ 223.838741][ T8804] ___sys_sendmsg+0x2a5/0x360 [ 223.838770][ T8804] ? __lock_acquire+0x747/0x2de0 [ 223.838795][ T8804] ? __pfx____sys_sendmsg+0x10/0x10 [ 223.838828][ T8804] ? futex_wait+0x2a2/0x390 [ 223.838874][ T8804] ? __fget_files+0x2a/0x420 [ 223.838904][ T8804] ? __fget_files+0x3a2/0x420 [ 223.838950][ T8804] __x64_sys_sendmsg+0x1b1/0x290 [ 223.838984][ T8804] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 223.839036][ T8804] do_syscall_64+0x166/0x520 [ 223.839064][ T8804] ? trace_irq_disable+0x3b/0x140 [ 223.839087][ T8804] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.839108][ T8804] ? clear_bhb_loop+0x70/0xc0 [ 223.839133][ T8804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.839154][ T8804] RIP: 0033:0x7f0bed59e159 [ 223.839174][ T8804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 223.839192][ T8804] RSP: 002b:00007f0bee4bd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 223.839213][ T8804] RAX: ffffffffffffffda RBX: 00007f0bed825fa0 RCX: 00007f0bed59e159 [ 223.839229][ T8804] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000006 [ 223.839243][ T8804] RBP: 00007f0bed63506b R08: 0000000000000000 R09: 0000000000000000 [ 223.839256][ T8804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 223.839269][ T8804] R13: 00007f0bed826038 R14: 00007f0bed825fa0 R15: 00007f0bed94fa48 [ 223.839302][ T8804] [ 224.092860][ T8804] Mem-Info: [ 224.092874][ T8804] active_anon:32343 inactive_anon:1 isolated_anon:0 [ 224.092874][ T8804] active_file:0 inactive_file:59699 isolated_file:0 [ 224.092874][ T8804] unevictable:0 dirty:396 writeback:0 [ 224.092874][ T8804] slab_reclaimable:11752 slab_unreclaimable:103466 [ 224.092874][ T8804] mapped:42645 shmem:26531 pagetables:1410 [ 224.092874][ T8804] sec_pagetables:0 bounce:0 [ 224.092874][ T8804] kernel_misc_reclaimable:0 [ 224.092874][ T8804] free:1263108 free_pcp:17497 free_cma:0 [ 224.092937][ T8804] Node 0 active_anon:129372kB inactive_anon:4kB active_file:0kB inactive_file:232448kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:170552kB dirty:1568kB writeback:0kB shmem:106124kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13128kB pagetables:5500kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 224.093018][ T8804] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:6348kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:16kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 224.093072][ T8804] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 224.093156][ T8804] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 224.093192][ T8804] Node 0 DMA32 free:1133160kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:129372kB inactive_anon:4kB active_file:0kB inactive_file:232448kB unevictable:0kB writepending:1568kB zspages:0kB present:3129332kB managed:2546864kB mlocked:0kB bounce:0kB free_pcp:39872kB local_pcp:12832kB free_cma:0kB [ 224.093254][ T8804] lowmem_reserve[]: 0 0 0 0 0 [ 224.093309][ T8804] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 224.093365][ T8804] lowmem_reserve[]: 0 0 0 0 0 [ 224.093399][ T8804] Node 1 Normal free:3903912kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:6348kB unevictable:0kB writepending:16kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:30116kB local_pcp:372kB free_cma:0kB [ 224.093476][ T8804] lowmem_reserve[]: 0 0 0 0 0 [ 224.093510][ T8804] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 224.093676][ T8804] Node 0 DMA32: 153*4kB (UE) 891*8kB (UME) 319*16kB (UME) 2*32kB (ME) 5*64kB (UME) 3*128kB (UM) 11*256kB (UM) 3*512kB (U) 13*1024kB (UME) 2*2048kB (UM) 268*4096kB (UM) = 1133100kB [ 224.102824][ T8804] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 224.102955][ T8804] Node 1 Normal: 9*4kB (UM) 41*8kB (UM) 23*16kB (UM) 24*32kB (UM) 28*64kB (UM) 18*128kB (UM) 8*256kB (UM) 4*512kB (UM) 3*1024kB (UM) 2*2048kB (UM) 949*4096kB (UM) = 3903964kB [ 224.103157][ T8804] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 224.103174][ T8804] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 224.103190][ T8804] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 224.103206][ T8804] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 224.103223][ T8804] 86222 total pagecache pages [ 224.103231][ T8804] 1 pages in swap cache [ 224.103238][ T8804] Free swap = 124992kB [ 224.103246][ T8804] Total swap = 124996kB [ 224.103254][ T8804] 2097051 pages RAM [ 224.103279][ T8804] 0 pages HighMem/MovableOnly [ 224.103286][ T8804] 428719 pages reserved [ 224.103293][ T8804] 0 pages cma reserved [ 224.709578][ T989] usb 2-1: USB disconnect, device number 34 [ 224.820100][ T8807] __nla_validate_parse: 3 callbacks suppressed [ 224.820120][ T8807] netlink: 8 bytes leftover after parsing attributes in process `syz.1.980'. [ 225.044146][ T8809] netlink: 'syz.3.981': attribute type 4 has an invalid length. [ 225.680435][ T7037] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 225.726970][ T8825] netlink: 4 bytes leftover after parsing attributes in process `syz.1.985'. [ 225.815654][ T8829] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 225.833690][ T7037] usb 1-1: unable to get BOS descriptor or descriptor too short [ 225.833742][ T7037] usb 1-1: New USB device found, idVendor=0421, idProduct=02e3, bcdDevice=43.b7 [ 225.835922][ T7037] usb 1-1: config 0 has an invalid interface number: 59 but max is 2 [ 225.835946][ T7037] usb 1-1: config 0 has an invalid interface number: 59 but max is 2 [ 225.835965][ T7037] usb 1-1: config 0 has an invalid interface number: 56 but max is 2 [ 225.835983][ T7037] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 225.836002][ T7037] usb 1-1: config 0 has no interface number 0 [ 225.836017][ T7037] usb 1-1: config 0 has no interface number 1 [ 225.836075][ T7037] usb 1-1: config 0 interface 59 has no altsetting 0 [ 225.836094][ T7037] usb 1-1: config 0 interface 59 has no altsetting 1 [ 225.836112][ T7037] usb 1-1: config 0 interface 56 has no altsetting 0 [ 225.838110][ T7037] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.838135][ T7037] usb 1-1: Product: syz [ 225.838150][ T7037] usb 1-1: Manufacturer: syz [ 225.838164][ T7037] usb 1-1: SerialNumber: syz [ 225.951181][ T7037] usb 1-1: config 0 descriptor?? [ 226.265806][ T8816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 226.269339][ T8816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 226.307813][ T8835] l2tp_ppp: sess 2/0: no socket in recv [ 226.475935][ T7037] rndis_host 1-1:0.59: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 226.476273][ T7037] cdc_acm 1-1:0.59: Zero length descriptor references [ 226.476286][ T7037] cdc_acm 1-1:0.59: probe with driver cdc_acm failed with error -22 [ 226.563299][ T7037] usb 1-1: USB disconnect, device number 27 [ 227.092009][ T7037] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 227.243450][ T7037] usb 2-1: unable to get BOS descriptor or descriptor too short [ 227.243502][ T7037] usb 2-1: New USB device found, idVendor=0421, idProduct=02e3, bcdDevice=43.b7 [ 227.246003][ T7037] usb 2-1: config 0 has an invalid interface number: 59 but max is 2 [ 227.246020][ T7037] usb 2-1: config 0 has an invalid interface number: 59 but max is 2 [ 227.246031][ T7037] usb 2-1: config 0 has an invalid interface number: 56 but max is 2 [ 227.246041][ T7037] usb 2-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 227.246052][ T7037] usb 2-1: config 0 has no interface number 0 [ 227.246060][ T7037] usb 2-1: config 0 has no interface number 1 [ 227.246098][ T7037] usb 2-1: config 0 interface 59 has no altsetting 0 [ 227.246107][ T7037] usb 2-1: config 0 interface 59 has no altsetting 1 [ 227.246116][ T7037] usb 2-1: config 0 interface 56 has no altsetting 0 [ 227.320904][ T7037] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 227.320920][ T7037] usb 2-1: Product: syz [ 227.320928][ T7037] usb 2-1: Manufacturer: syz [ 227.320936][ T7037] usb 2-1: SerialNumber: syz [ 227.387949][ T7037] usb 2-1: config 0 descriptor?? [ 227.453922][ T30] kauditd_printk_skb: 87 callbacks suppressed [ 227.453940][ T30] audit: type=1326 audit(1790914642.060:6007): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.2.993" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac339e159 code=0x7ffc0000 [ 227.454017][ T30] audit: type=1326 audit(1790914642.060:6008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.2.993" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac339e159 code=0x7ffc0000 [ 227.463962][ T30] audit: type=1326 audit(1790914642.070:6009): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.2.993" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac339e159 code=0x7ffc0000 [ 227.464007][ T30] audit: type=1326 audit(1790914642.070:6010): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.2.993" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac339e159 code=0x7ffc0000 [ 227.467205][ T30] audit: type=1326 audit(1790914642.070:6011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.2.993" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f9ac339e159 code=0x7ffc0000 [ 227.550928][ T30] audit: type=1326 audit(1790914642.160:6012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.2.993" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac339e159 code=0x7ffc0000 [ 227.550978][ T30] audit: type=1326 audit(1790914642.160:6013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.2.993" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac339e159 code=0x7ffc0000 [ 227.615422][ T30] audit: type=1326 audit(1790914642.220:6014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.2.993" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f9ac339e159 code=0x7ffc0000 [ 227.615471][ T30] audit: type=1326 audit(1790914642.220:6015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.2.993" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac339e159 code=0x7ffc0000 [ 227.615507][ T30] audit: type=1326 audit(1790914642.220:6016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8849 comm="syz.2.993" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9ac339e159 code=0x7ffc0000 [ 227.807412][ T8847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 227.807906][ T8847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.182204][ T8855] syzkaller1: entered promiscuous mode [ 228.182227][ T8855] syzkaller1: entered allmulticast mode [ 228.833311][ T7037] rndis_host 2-1:0.59: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 228.833923][ T7037] cdc_acm 2-1:0.59: Zero length descriptor references [ 228.833948][ T7037] cdc_acm 2-1:0.59: probe with driver cdc_acm failed with error -22 [ 228.878965][ T7037] usb 2-1: USB disconnect, device number 35 [ 228.896022][ T8865] netlink: 4 bytes leftover after parsing attributes in process `syz.4.997'. [ 229.020466][ T7036] usb 4-1: new full-speed USB device number 37 using dummy_hcd [ 229.181260][ T7036] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 229.182293][ T7036] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 229.182323][ T7036] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 229.182360][ T7036] usb 4-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 229.182397][ T7036] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 229.182423][ T7036] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 229.184355][ T7036] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.184378][ T7036] usb 4-1: Product: syz [ 229.184393][ T7036] usb 4-1: Manufacturer: syz [ 229.184407][ T7036] usb 4-1: SerialNumber: syz [ 229.188271][ T8864] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 229.280559][ T989] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 229.436750][ T989] usb 1-1: Using ep0 maxpacket: 32 [ 229.445010][ T989] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 229.446876][ T989] usb 1-1: config 1 has an invalid descriptor of length 239, skipping remainder of the config [ 229.446913][ T989] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 229.448983][ T989] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.449006][ T989] usb 1-1: Product: syz [ 229.449020][ T989] usb 1-1: Manufacturer: syz [ 229.449033][ T989] usb 1-1: SerialNumber: syz [ 229.492961][ T8875] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 229.780335][ T7047] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 229.942102][ T7047] usb 2-1: Using ep0 maxpacket: 8 [ 229.942795][ T7047] usb 2-1: New USB device found, idVendor=0079, idProduct=1803, bcdDevice= 0.00 [ 229.943777][ T7047] usb 2-1: config 0 has an invalid descriptor of length 193, skipping remainder of the config [ 229.943822][ T7047] usb 2-1: config 0 interface 0 altsetting 8 has 0 endpoint descriptors, different from the interface descriptor's value: 13 [ 229.943861][ T7047] usb 2-1: config 0 interface 0 has no altsetting 0 [ 229.943892][ T7047] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 229.976015][ T7047] usb 2-1: config 0 descriptor?? [ 230.010686][ T7047] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 230.130951][ T8864] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 230.268286][ T8885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.268687][ T8885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.365261][ T7036] cdc_ncm 4-1:1.0: bind() failure [ 230.389474][ T7036] cdc_ncm 4-1:1.1: probe with driver cdc_ncm failed with error -71 [ 230.390147][ T7036] cdc_mbim 4-1:1.1: probe with driver cdc_mbim failed with error -71 [ 230.408761][ T7036] usbtest 4-1:1.1: probe with driver usbtest failed with error -71 [ 230.425665][ T7036] usb 4-1: USB disconnect, device number 37 [ 230.536321][ T989] usb 1-1: USB disconnect, device number 28 [ 230.573314][ T8895] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1008'. [ 230.712462][ T8901] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 230.996953][ T8907] ptrace attach of "ci-upstream-kasan-gce/syz-executor exec"[5633] was attempted by " Àÿ Ðÿ ð¥ Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ      rr @  @       À rr s¬ ÿÿ    üÿÿÿ   ÿÿÿÿ  & %½p ûÛß% \x07 gF- [ 231.038751][ T8909] batman_adv: batadv0: Adding interface: gretap1 [ 231.038775][ T8909] batman_adv: batadv0: Interface activated: gretap1 [ 231.247073][ T8915] openvswitch: netlink: IPv4 tunnel dst address is zero [ 231.247106][ T8915] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 231.408854][ T8917] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1020'. [ 231.503760][ T8923] netlink: 'syz.3.1019': attribute type 12 has an invalid length. [ 231.720322][ T7036] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 231.800731][ T8935] netlink: 'syz.3.1025': attribute type 12 has an invalid length. [ 231.870327][ T7036] usb 5-1: Using ep0 maxpacket: 32 [ 231.872540][ T7036] usb 5-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 231.873651][ T7036] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 231.876791][ T7036] usb 5-1: config 0 descriptor?? [ 231.909622][ T7036] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 231.970336][ T7047] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 232.050348][ T989] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 232.124926][ T7047] usb 3-1: unable to get BOS descriptor or descriptor too short [ 232.124978][ T7047] usb 3-1: New USB device found, idVendor=0421, idProduct=02e3, bcdDevice=43.b7 [ 232.126059][ T7047] usb 3-1: config 0 has an invalid interface number: 59 but max is 2 [ 232.126083][ T7047] usb 3-1: config 0 has an invalid interface number: 59 but max is 2 [ 232.126102][ T7047] usb 3-1: config 0 has an invalid interface number: 56 but max is 2 [ 232.126121][ T7047] usb 3-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 232.126142][ T7047] usb 3-1: config 0 has no interface number 0 [ 232.126157][ T7047] usb 3-1: config 0 has no interface number 1 [ 232.126210][ T7047] usb 3-1: config 0 interface 59 has no altsetting 0 [ 232.126220][ T7047] usb 3-1: config 0 interface 59 has no altsetting 1 [ 232.126229][ T7047] usb 3-1: config 0 interface 56 has no altsetting 0 [ 232.129283][ T7047] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.129309][ T7047] usb 3-1: Product: syz [ 232.129323][ T7047] usb 3-1: Manufacturer: syz [ 232.129338][ T7047] usb 3-1: SerialNumber: syz [ 232.133287][ T7047] usb 3-1: config 0 descriptor?? [ 232.200310][ T989] usb 1-1: Using ep0 maxpacket: 16 [ 232.209101][ T989] usb 1-1: New USB device found, idVendor=0458, idProduct=5012, bcdDevice= 0.00 [ 232.222216][ T989] usb 1-1: config 0 interface 0 has no altsetting 0 [ 232.222262][ T989] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.228405][ T989] usb 1-1: config 0 descriptor?? [ 232.426624][ T8926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.428869][ T8926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 232.454269][ T7047] rndis_host 3-1:0.59: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 232.459091][ T7047] cdc_acm 3-1:0.59: Zero length descriptor references [ 232.459142][ T7047] cdc_acm 3-1:0.59: probe with driver cdc_acm failed with error -22 [ 232.488420][ T7047] usb 3-1: USB disconnect, device number 13 [ 232.518410][ T30] kauditd_printk_skb: 436 callbacks suppressed [ 232.518428][ T30] audit: type=1326 audit(1790914647.120:6453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8921 comm="syz.4.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9b5b9e159 code=0x7ffc0000 [ 232.518490][ T30] audit: type=1326 audit(1790914647.120:6454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8921 comm="syz.4.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9b5b9e159 code=0x7ffc0000 [ 232.524857][ T30] audit: type=1326 audit(1790914647.130:6455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8921 comm="syz.4.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe9b5b9ddeb code=0x7ffc0000 [ 232.524927][ T30] audit: type=1326 audit(1790914647.130:6456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8921 comm="syz.4.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe9b5b9ddeb code=0x7ffc0000 [ 232.525147][ T30] audit: type=1326 audit(1790914647.130:6457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8921 comm="syz.4.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fe9b5b5e98e code=0x7ffc0000 [ 232.641109][ T989] usbhid 1-1:0.0: can't add hid device: -32 [ 232.641214][ T989] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 232.709243][ T7047] usb 2-1: USB disconnect, device number 36 [ 232.727987][ T30] audit: type=1326 audit(1790914647.330:6458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8921 comm="syz.4.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9b5b9e159 code=0x7ffc0000 [ 232.728036][ T30] audit: type=1326 audit(1790914647.330:6459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8921 comm="syz.4.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9b5b9e159 code=0x7ffc0000 [ 232.739420][ T30] audit: type=1326 audit(1790914647.340:6460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8921 comm="syz.4.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe9b5b9ddeb code=0x7ffc0000 [ 232.739467][ T30] audit: type=1326 audit(1790914647.340:6461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8921 comm="syz.4.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe9b5b9ddeb code=0x7ffc0000 [ 232.755655][ T30] audit: type=1326 audit(1790914647.360:6462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8921 comm="syz.4.1021" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fe9b5b5e98e code=0x7ffc0000 [ 232.977612][ T8962] FAULT_INJECTION: forcing a failure. [ 232.977612][ T8962] name failslab, interval 1, probability 0, space 0, times 0 [ 232.977647][ T8962] CPU: 1 UID: 0 PID: 8962 Comm: syz.1.1030 Tainted: G L syzkaller #0 PREEMPT(full) [ 232.977672][ T8962] Tainted: [L]=SOFTLOCKUP [ 232.977679][ T8962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 232.977690][ T8962] Call Trace: [ 232.977698][ T8962] [ 232.977706][ T8962] dump_stack_lvl+0xe8/0x150 [ 232.977738][ T8962] should_fail_ex+0x410/0x560 [ 232.977763][ T8962] should_failslab+0xa8/0x100 [ 232.977781][ T8962] __kmalloc_noprof+0xfe/0x720 [ 232.977802][ T8962] ? tomoyo_encode+0x2ad/0x570 [ 232.977828][ T8962] ? tomoyo_encode+0x2ad/0x570 [ 232.977862][ T8962] tomoyo_encode+0x2ad/0x570 [ 232.977884][ T8962] tomoyo_realpath_from_path+0x5fa/0x640 [ 232.977903][ T8962] ? tomoyo_path_number_perm+0x219/0x5f0 [ 232.977916][ T8962] tomoyo_path_number_perm+0x246/0x5f0 [ 232.977931][ T8962] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 232.977953][ T8962] ? __lock_acquire+0x747/0x2de0 [ 232.977991][ T8962] ? hook_file_ioctl+0x1f2/0x600 [ 232.978026][ T8962] ? __fget_files+0x2a/0x420 [ 232.978043][ T8962] ? __fget_files+0x2a/0x420 [ 232.978057][ T8962] ? __fget_files+0x3a2/0x420 [ 232.978070][ T8962] ? __fget_files+0x2a/0x420 [ 232.978094][ T8962] security_file_ioctl+0xc3/0x2a0 [ 232.978119][ T8962] __se_sys_ioctl+0x47/0x170 [ 232.978145][ T8962] do_syscall_64+0x166/0x520 [ 232.978170][ T8962] ? trace_irq_disable+0x3b/0x140 [ 232.978181][ T8962] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.978192][ T8962] ? clear_bhb_loop+0x70/0xc0 [ 232.978205][ T8962] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.978215][ T8962] RIP: 0033:0x7fa09619e159 [ 232.978236][ T8962] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 232.978254][ T8962] RSP: 002b:00007fa097110028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 232.978275][ T8962] RAX: ffffffffffffffda RBX: 00007fa096426090 RCX: 00007fa09619e159 [ 232.978289][ T8962] RDX: 0000200000000080 RSI: 000000000000890c RDI: 0000000000000003 [ 232.978301][ T8962] RBP: 00007fa097110090 R08: 0000000000000000 R09: 0000000000000000 [ 232.978314][ T8962] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 232.978327][ T8962] R13: 00007fa096426128 R14: 00007fa096426090 R15: 00007fa09654fa48 [ 232.978357][ T8962] [ 232.978370][ T8962] ERROR: Out of memory at tomoyo_realpath_from_path. [ 233.113046][ T8965] CUSE: unknown device info "€" [ 233.113061][ T8965] CUSE: unknown device info "Ö" [ 233.113068][ T8965] CUSE: unknown device info "" [ 233.113076][ T8965] CUSE: unknown device info "€" [ 233.113083][ T8965] CUSE: unknown device info "ðÿÿÿ" [ 233.113092][ T8965] CUSE: unknown device info "ƒ" [ 233.113099][ T8965] CUSE: unknown device info "" [ 233.113106][ T8965] CUSE: unknown device info "" [ 233.113121][ T8965] CUSE: unknown device info "" [ 233.113128][ T8965] CUSE: unknown device info "ýÿÿÿÿÿÿÿ#Û" [ 233.113136][ T8965] CUSE: unknown device info "ÿÿÿÿ" [ 233.113143][ T8965] CUSE: unknown device info "" [ 233.113151][ T8965] CUSE: unknown device info "€" [ 233.113159][ T8965] CUSE: DEVNAME unspecified [ 233.227352][ T8966] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.227784][ T8966] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.380426][ T989] usb 4-1: new full-speed USB device number 38 using dummy_hcd [ 233.531747][ T989] usb 4-1: New USB device found, idVendor=0409, idProduct=0063, bcdDevice=28.16 [ 233.532897][ T989] usb 4-1: config 7 has an invalid interface number: 105 but max is 0 [ 233.532921][ T989] usb 4-1: config 7 has no interface number 0 [ 233.532941][ T989] usb 4-1: config 7 interface 105 has no altsetting 0 [ 233.551782][ T989] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.551809][ T989] usb 4-1: Product: syz [ 233.551823][ T989] usb 4-1: Manufacturer: syz [ 233.551837][ T989] usb 4-1: SerialNumber: syz [ 233.749283][ T8974] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 233.786716][ T989] upd78f0730 4-1:7.105: upd78f0730 converter detected [ 233.803004][ T989] usb 4-1: upd78f0730 converter now attached to ttyUSB0 [ 233.820476][ T989] usb 4-1: USB disconnect, device number 38 [ 233.865619][ T989] upd78f0730 ttyUSB0: upd78f0730 converter now disconnected from ttyUSB0 [ 233.866010][ T989] upd78f0730 4-1:7.105: device disconnected [ 233.912553][ T8975] ptrace attach of "ci-upstream-kasan-gce/syz-executor exec"[5633] was attempted by " Àÿ Ðÿ ð¥ Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ      rr @  @       À rr s¬ ÿÿ    üÿÿÿ   ÿÿÿÿ  & %½p ûÛß% \x07 gF- [ 234.037948][ T7036] gspca_vc032x: reg_w err -71 [ 234.037983][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.037995][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038027][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038037][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038045][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038054][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038063][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038072][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038080][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038088][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038097][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038105][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038114][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038122][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038131][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038139][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038147][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038156][ T7036] gspca_vc032x: I2c Bus Busy Wait 00 [ 234.038193][ T7036] gspca_vc032x: Unknown sensor... [ 234.038266][ T7036] vc032x 5-1:0.0: probe with driver vc032x failed with error -22 [ 234.167274][ T7036] usb 5-1: USB disconnect, device number 26 [ 234.180611][ T44] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 234.350389][ T44] usb 2-1: Using ep0 maxpacket: 16 [ 234.351084][ T44] usb 2-1: New USB device found, idVendor=28bd, idProduct=0078, bcdDevice= 0.00 [ 234.352073][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 253, changing to 11 [ 234.352103][ T44] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 234.352142][ T44] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.355943][ T44] usb 2-1: config 0 descriptor?? [ 234.513905][ T8987] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 234.564352][ T44] usbhid 2-1:0.0: can't add hid device: -71 [ 234.564453][ T44] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 234.568805][ T44] usb 2-1: USB disconnect, device number 37 [ 234.930357][ T7036] usb 3-1: new full-speed USB device number 14 using dummy_hcd [ 234.980087][ T44] usb 1-1: USB disconnect, device number 29 [ 235.084274][ T7036] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 235.085126][ T7036] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 235.085147][ T7036] usb 3-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 235.085167][ T7036] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 235.091749][ T7036] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 235.091772][ T7036] usb 3-1: SerialNumber: syz [ 235.396741][ T9010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.397171][ T9010] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.429797][ T9010] syzkaller0: entered promiscuous mode [ 235.429821][ T9010] syzkaller0: entered allmulticast mode [ 235.499035][ T9014] IPVS: set_ctl: invalid protocol: 135 0.0.0.0:20003 [ 235.990451][ T989] usb 1-1: new full-speed USB device number 30 using dummy_hcd [ 236.098789][ T9024] ptrace attach of "ci-upstream-kasan-gce/syz-executor exec"[5638] was attempted by " Àÿ Ðÿ ð¥ Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ      rr @  @       À rr s¬ ÿÿ    üÿÿÿ   ÿÿÿÿ  & %½p ûÛß% \x07 gF- [ 236.120411][ T989] usb 1-1: device descriptor read/64, error -71 [ 236.361929][ T989] usb 1-1: new full-speed USB device number 31 using dummy_hcd [ 236.490823][ T989] usb 1-1: device descriptor read/64, error -71 [ 236.602753][ T989] usb usb1-port1: attempt power cycle [ 236.942490][ T989] usb 1-1: new full-speed USB device number 32 using dummy_hcd [ 236.962190][ T989] usb 1-1: device descriptor read/8, error -71 [ 237.132115][ T9036] bridge0: port 3(veth0) entered blocking state [ 237.132216][ T9036] bridge0: port 3(veth0) entered disabled state [ 237.133337][ T9036] veth0: entered allmulticast mode [ 237.158800][ T9036] veth0: entered promiscuous mode [ 237.201088][ T989] usb 1-1: new full-speed USB device number 33 using dummy_hcd [ 237.226355][ T989] usb 1-1: device descriptor read/8, error -71 [ 237.334230][ T989] usb usb1-port1: unable to enumerate USB device [ 237.640393][ T989] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 237.741426][ T9046] pimreg1: tun_chr_ioctl cmd 1074025677 [ 237.741525][ T9046] pimreg1: linktype set to 773 [ 237.765500][ T5702] usb 3-1: USB disconnect, device number 14 [ 237.802155][ T989] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 237.803396][ T989] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 237.803426][ T989] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 237.803462][ T989] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.816520][ T989] usb 4-1: config 0 descriptor?? [ 238.239404][ T989] cm6533_jd 0003:0D8C:0022.0004: item fetching failed at offset 2/5 [ 238.240124][ T989] cm6533_jd 0003:0D8C:0022.0004: parse failed [ 238.242811][ T989] cm6533_jd 0003:0D8C:0022.0004: probe with driver cm6533_jd failed with error -22 [ 238.394825][ T9058] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 238.501788][ T7034] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 238.589199][ T30] kauditd_printk_skb: 24 callbacks suppressed [ 238.589218][ T30] audit: type=1804 audit(1790914653.190:6487): pid=9043 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.1053" name="bus" dev="ramfs" ino=28277 res=1 errno=0 [ 238.672169][ T7034] usb 5-1: unable to get BOS descriptor or descriptor too short [ 238.672223][ T7034] usb 5-1: New USB device found, idVendor=0421, idProduct=02e3, bcdDevice=43.b7 [ 238.673178][ T7034] usb 5-1: config 0 has an invalid interface number: 59 but max is 2 [ 238.673201][ T7034] usb 5-1: config 0 has an invalid interface number: 59 but max is 2 [ 238.673218][ T7034] usb 5-1: config 0 has an invalid interface number: 56 but max is 2 [ 238.673228][ T7034] usb 5-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 238.673238][ T7034] usb 5-1: config 0 has no interface number 0 [ 238.673247][ T7034] usb 5-1: config 0 has no interface number 1 [ 238.673281][ T7034] usb 5-1: config 0 interface 59 has no altsetting 0 [ 238.673297][ T7034] usb 5-1: config 0 interface 59 has no altsetting 1 [ 238.673306][ T7034] usb 5-1: config 0 interface 56 has no altsetting 0 [ 238.675099][ T30] audit: type=1800 audit(1790914653.280:6488): pid=9065 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1053" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 238.677116][ T7034] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 238.677130][ T7034] usb 5-1: Product: syz [ 238.677138][ T7034] usb 5-1: Manufacturer: syz [ 238.677145][ T7034] usb 5-1: SerialNumber: syz [ 238.731500][ T9067] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1061'. [ 238.733680][ T7034] usb 5-1: config 0 descriptor?? [ 238.741178][ T7036] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 238.901094][ T7036] usb 3-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 238.902144][ T7036] usb 3-1: config 2 has an invalid interface number: 5 but max is 0 [ 238.902168][ T7036] usb 3-1: config 2 has no interface number 0 [ 238.902209][ T7036] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.943046][ T7036] ums-realtek 3-1:2.5: USB Mass Storage device detected [ 238.984855][ T9050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 238.987802][ T9050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 239.060704][ T7034] rndis_host 5-1:0.59: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 239.063003][ T7034] cdc_acm 5-1:0.59: Zero length descriptor references [ 239.063032][ T7034] cdc_acm 5-1:0.59: probe with driver cdc_acm failed with error -22 [ 239.112680][ T9079] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1064'. [ 239.114298][ T7034] usb 5-1: USB disconnect, device number 27 [ 239.143125][ T9079] netlink: 'syz.1.1064': attribute type 1 has an invalid length. [ 239.145233][ T9079] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1064'. [ 239.167988][ T9061] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 239.175463][ T9061] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 239.214595][ T5702] usb 3-1: USB disconnect, device number 15 [ 239.410345][ T989] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 239.561588][ T989] usb 2-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 239.562712][ T989] usb 2-1: config 6 has an invalid interface number: 14 but max is 0 [ 239.562728][ T989] usb 2-1: config 6 has no interface number 0 [ 239.562751][ T989] usb 2-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid wMaxPacketSize 0 [ 239.562763][ T989] usb 2-1: config 6 interface 14 has no altsetting 0 [ 239.565060][ T989] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.565074][ T989] usb 2-1: Product: syz [ 239.565082][ T989] usb 2-1: Manufacturer: syz [ 239.565090][ T989] usb 2-1: SerialNumber: syz [ 239.819026][ T989] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 239.819173][ T989] command write [95] error -8 [ 239.885061][ T989] usb 2-1: USB disconnect, device number 38 [ 240.108453][ T9094] bridge4: port 1(erspan0) entered disabled state [ 240.120389][ T44] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 240.274599][ T44] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 240.276852][ T44] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 240.276902][ T44] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 240.286369][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.286395][ T44] usb 5-1: Product: syz [ 240.286409][ T44] usb 5-1: Manufacturer: syz [ 240.286422][ T44] usb 5-1: SerialNumber: syz [ 240.445146][ T7041] usb 4-1: USB disconnect, device number 39 [ 240.463779][ T9094] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 240.493609][ T9094] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 240.552463][ T9108] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 240.612970][ T9111] netlink: 'syz.3.1070': attribute type 1 has an invalid length. [ 240.721547][ T991] usb 5-1: USB disconnect, device number 28 [ 240.762509][ T9094] batman_adv: batadv0: Interface deactivated: gretap1 [ 240.794146][ T9094] gretap0: left allmulticast mode [ 241.015776][ T9119] ip6tnl4: entered allmulticast mode [ 241.176932][ T12] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.176964][ T12] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.176985][ T12] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.177003][ T12] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.470465][ T5776] usb 4-1: new full-speed USB device number 40 using dummy_hcd [ 241.593433][ T9139] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1079'. [ 241.593470][ T9139] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1079'. [ 241.620875][ T5776] usb 4-1: New USB device found, idVendor=07c0, idProduct=1125, bcdDevice= 0.00 [ 241.621865][ T5776] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 241.621894][ T5776] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 241.621915][ T5776] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 241.621941][ T5776] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.623817][ T5776] usb 4-1: config 0 descriptor?? [ 241.675591][ T5615] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 241.880397][ T5615] usb 2-1: Using ep0 maxpacket: 8 [ 241.880982][ T5615] usb 2-1: New USB device found, idVendor=056a, idProduct=0039, bcdDevice= 0.40 [ 241.882039][ T5615] usb 2-1: config 1 interface 0 altsetting 253 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 241.882113][ T5615] usb 2-1: config 1 interface 0 altsetting 253 endpoint 0x81 has invalid wMaxPacketSize 0 [ 241.882135][ T5615] usb 2-1: config 1 interface 0 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 241.882162][ T5615] usb 2-1: config 1 interface 0 has no altsetting 0 [ 241.889378][ T5615] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.889403][ T5615] usb 2-1: Product: syz [ 241.889417][ T5615] usb 2-1: Manufacturer: syz [ 241.889431][ T5615] usb 2-1: SerialNumber: syz [ 242.180430][ T7051] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 242.214859][ T5615] usbhid 2-1:1.0: can't add hid device: -71 [ 242.214969][ T5615] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 242.217789][ T5615] usb 2-1: USB disconnect, device number 39 [ 242.310813][ T7051] usb 3-1: device descriptor read/64, error -71 [ 242.386046][ T9154] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 242.386329][ T9154] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 242.551199][ T7051] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 242.690866][ T7051] usb 3-1: device descriptor read/64, error -71 [ 242.764497][ T9154] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 242.778094][ T9154] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 242.802315][ T7051] usb usb3-port1: attempt power cycle [ 242.817467][ T9159] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 242.903083][ T9163] warn_alloc: 2 callbacks suppressed [ 242.903104][ T9163] syz.1.1086: vmalloc error: size 16384, failed to allocate pages, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 242.903170][ T9163] CPU: 0 UID: 0 PID: 9163 Comm: syz.1.1086 Tainted: G L syzkaller #0 PREEMPT(full) [ 242.903198][ T9163] Tainted: [L]=SOFTLOCKUP [ 242.903206][ T9163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 242.903217][ T9163] Call Trace: [ 242.903225][ T9163] [ 242.903234][ T9163] dump_stack_lvl+0xe8/0x150 [ 242.903269][ T9163] warn_alloc+0x24d/0x270 [ 242.903300][ T9163] ? __pfx_warn_alloc+0x10/0x10 [ 242.903328][ T9163] ? alloc_pages_mpol+0x256/0x390 [ 242.903366][ T9163] __vmalloc_node_range_noprof+0x11a9/0x1540 [ 242.903429][ T9163] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 242.903465][ T9163] ? nft_array_may_resize+0x354/0x570 [ 242.903494][ T9163] ? rcu_is_watching+0x16/0xb0 [ 242.903525][ T9163] ? nft_array_may_resize+0x354/0x570 [ 242.903556][ T9163] ? rcu_is_watching+0x16/0xb0 [ 242.903585][ T9163] ? nft_array_may_resize+0x354/0x570 [ 242.903611][ T9163] __kvmalloc_node_noprof+0x5a1/0x820 [ 242.903637][ T9163] ? nft_array_may_resize+0x354/0x570 [ 242.903667][ T9163] ? __kmalloc_cache_noprof+0x321/0x600 [ 242.903692][ T9163] ? nft_array_may_resize+0x32d/0x570 [ 242.903721][ T9163] ? nft_array_may_resize+0x354/0x570 [ 242.903756][ T9163] nft_array_may_resize+0x354/0x570 [ 242.903792][ T9163] nft_rbtree_insert+0x11e/0x2510 [ 242.903826][ T9163] ? __kmalloc_noprof+0x1ab/0x720 [ 242.903847][ T9163] ? nft_trans_alloc+0x22/0x2a0 [ 242.903886][ T9163] ? nft_trans_alloc+0x40/0x2a0 [ 242.903920][ T9163] nf_tables_newsetelem+0x2aa4/0x4200 [ 242.903998][ T9163] ? __pfx_nf_tables_newsetelem+0x10/0x10 [ 242.904032][ T9163] ? lock_acquire+0x115/0x350 [ 242.904065][ T9163] ? nla_validate_array+0xfc/0x260 [ 242.904125][ T9163] ? __pfx___nla_validate_parse+0x10/0x10 [ 242.904161][ T9163] ? __pfx_nf_tables_newset+0x10/0x10 [ 242.904190][ T9163] ? nft_pernet+0x23/0x240 [ 242.904225][ T9163] ? lock_acquire+0x115/0x350 [ 242.904249][ T9163] ? nfnl_pernet+0x23/0x240 [ 242.904288][ T9163] ? __nla_parse+0x40/0x60 [ 242.904320][ T9163] nfnetlink_rcv+0x1288/0x28c0 [ 242.904384][ T9163] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 242.904463][ T9163] ? lock_acquire+0x115/0x350 [ 242.904495][ T9163] ? netlink_deliver_tap+0x2e/0x1b0 [ 242.904517][ T9163] ? netlink_deliver_tap+0x2e/0x1b0 [ 242.904544][ T9163] netlink_unicast+0x7bd/0x940 [ 242.904589][ T9163] netlink_sendmsg+0x813/0xb40 [ 242.904620][ T9163] ? __pfx_netlink_sendmsg+0x10/0x10 [ 242.904652][ T9163] ? apparmor_socket_sendmsg+0x98/0x360 [ 242.904681][ T9163] ? __pfx_netlink_sendmsg+0x10/0x10 [ 242.904703][ T9163] sock_sendmsg_nosec+0x13a/0x180 [ 242.904731][ T9163] ____sys_sendmsg+0x54e/0x850 [ 242.904768][ T9163] ? __pfx_____sys_sendmsg+0x10/0x10 [ 242.904807][ T9163] ? import_iovec+0x73/0xa0 [ 242.904838][ T9163] ___sys_sendmsg+0x2a5/0x360 [ 242.904868][ T9163] ? __lock_acquire+0x747/0x2de0 [ 242.904893][ T9163] ? __pfx____sys_sendmsg+0x10/0x10 [ 242.904926][ T9163] ? futex_wait+0x2a2/0x390 [ 242.904982][ T9163] ? __fget_files+0x2a/0x420 [ 242.905014][ T9163] ? __fget_files+0x3a2/0x420 [ 242.905055][ T9163] __x64_sys_sendmsg+0x1b1/0x290 [ 242.905090][ T9163] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 242.905143][ T9163] do_syscall_64+0x166/0x520 [ 242.905172][ T9163] ? trace_irq_disable+0x3b/0x140 [ 242.905195][ T9163] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 242.905217][ T9163] ? clear_bhb_loop+0x70/0xc0 [ 242.905243][ T9163] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 242.905265][ T9163] RIP: 0033:0x7fa09619e159 [ 242.905286][ T9163] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 242.905305][ T9163] RSP: 002b:00007fa097131028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 242.905328][ T9163] RAX: ffffffffffffffda RBX: 00007fa096425fa0 RCX: 00007fa09619e159 [ 242.905345][ T9163] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000006 [ 242.905359][ T9163] RBP: 00007fa09623506b R08: 0000000000000000 R09: 0000000000000000 [ 242.905374][ T9163] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 242.905388][ T9163] R13: 00007fa096426038 R14: 00007fa096425fa0 R15: 00007fa09654fa48 [ 242.905422][ T9163] [ 242.907086][ T9163] Mem-Info: [ 242.907099][ T9163] active_anon:9130 inactive_anon:1 isolated_anon:0 [ 242.907099][ T9163] active_file:0 inactive_file:60534 isolated_file:0 [ 242.907099][ T9163] unevictable:0 dirty:1060 writeback:0 [ 242.907099][ T9163] slab_reclaimable:11856 slab_unreclaimable:103557 [ 242.907099][ T9163] mapped:35135 shmem:3394 pagetables:1305 [ 242.907099][ T9163] sec_pagetables:0 bounce:0 [ 242.907099][ T9163] kernel_misc_reclaimable:0 [ 242.907099][ T9163] free:1277236 free_pcp:26717 free_cma:0 [ 242.907156][ T9163] Node 0 active_anon:36520kB inactive_anon:4kB active_file:0kB inactive_file:235788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:140512kB dirty:4240kB writeback:0kB shmem:13576kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13444kB pagetables:5080kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 242.907218][ T9163] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:6348kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:28kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 242.907274][ T9163] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 242.907335][ T9163] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 242.907374][ T9163] Node 0 DMA32 free:1188740kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:36520kB inactive_anon:4kB active_file:0kB inactive_file:235888kB unevictable:0kB writepending:4240kB zspages:0kB present:3129332kB managed:2546864kB mlocked:0kB bounce:0kB free_pcp:77612kB local_pcp:55364kB free_cma:0kB [ 242.907436][ T9163] lowmem_reserve[]: 0 0 0 0 0 [ 242.907472][ T9163] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 242.907529][ T9163] lowmem_reserve[]: 0 0 0 0 0 [ 242.907565][ T9163] Node 1 Normal free:3904844kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:6348kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:29236kB local_pcp:28756kB free_cma:0kB [ 242.907627][ T9163] lowmem_reserve[]: 0 0 0 0 0 [ 242.907662][ T9163] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 242.907782][ T9163] Node 0 DMA32: 1967*4kB (UME) 1310*8kB (UME) 890*16kB (UM) 632*32kB (UME) 288*64kB (UM) 128*128kB (UME) 55*256kB (UME) 9*512kB (M) 9*1024kB (U) 6*2048kB (UM) 259*4096kB (UM) = 1188684kB [ 242.907946][ T9163] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 242.908057][ T9163] Node 1 Normal: 3*4kB (UM) 6*8kB (UM) 17*16kB (UM) 26*32kB (UM) 27*64kB (UM) 22*128kB (UM) 9*256kB (UM) 5*512kB (UM) 3*1024kB (UM) 2*2048kB (UM) 949*4096kB (UM) = 3904844kB [ 242.908219][ T9163] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 242.908237][ T9163] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 242.908253][ T9163] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 242.908271][ T9163] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 242.908286][ T9163] 63971 total pagecache pages [ 242.908294][ T9163] 1 pages in swap cache [ 242.908302][ T9163] Free swap = 124992kB [ 242.908309][ T9163] Total swap = 124996kB [ 242.908317][ T9163] 2097051 pages RAM [ 242.908325][ T9163] 0 pages HighMem/MovableOnly [ 242.908333][ T9163] 428719 pages reserved [ 242.908341][ T9163] 0 pages cma reserved [ 243.041986][ T25] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 243.140859][ T7051] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 243.162100][ T7051] usb 3-1: device descriptor read/8, error -71 [ 243.170398][ T25] usb 5-1: device descriptor read/64, error -71 [ 243.400475][ T7051] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 243.410647][ T25] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 243.421227][ T7051] usb 3-1: device descriptor read/8, error -71 [ 243.533029][ T7051] usb usb3-port1: unable to enumerate USB device [ 243.543106][ T25] usb 5-1: device descriptor read/64, error -71 [ 243.647504][ T5776] usbhid 4-1:0.0: can't add hid device: -71 [ 243.647610][ T5776] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 243.652206][ T25] usb usb5-port1: attempt power cycle [ 243.666842][ T5776] usb 4-1: USB disconnect, device number 40 [ 243.691053][ T5680] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 243.843403][ T5680] usb 2-1: unable to get BOS descriptor or descriptor too short [ 243.843455][ T5680] usb 2-1: New USB device found, idVendor=0421, idProduct=02e3, bcdDevice=43.b7 [ 243.844379][ T5680] usb 2-1: config 0 has an invalid interface number: 59 but max is 2 [ 243.844403][ T5680] usb 2-1: config 0 has an invalid interface number: 59 but max is 2 [ 243.844423][ T5680] usb 2-1: config 0 has an invalid interface number: 56 but max is 2 [ 243.844442][ T5680] usb 2-1: config 0 has 2 interfaces, different from the descriptor's value: 3 [ 243.844461][ T5680] usb 2-1: config 0 has no interface number 0 [ 243.844476][ T5680] usb 2-1: config 0 has no interface number 1 [ 243.844511][ T5680] usb 2-1: config 0 interface 59 has no altsetting 0 [ 243.844520][ T5680] usb 2-1: config 0 interface 59 has no altsetting 1 [ 243.844529][ T5680] usb 2-1: config 0 interface 56 has no altsetting 0 [ 243.849138][ T5680] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.849153][ T5680] usb 2-1: Product: syz [ 243.849161][ T5680] usb 2-1: Manufacturer: syz [ 243.849169][ T5680] usb 2-1: SerialNumber: syz [ 243.859172][ T5680] usb 2-1: config 0 descriptor?? [ 243.967755][ T9175] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1089'. [ 243.990440][ T25] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 244.011136][ T25] usb 5-1: device descriptor read/8, error -71 [ 244.075085][ T9170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 244.075850][ T9170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 244.110102][ T5680] rndis_host 2-1:0.59: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 244.113460][ T5680] cdc_acm 2-1:0.59: Zero length descriptor references [ 244.113487][ T5680] cdc_acm 2-1:0.59: probe with driver cdc_acm failed with error -22 [ 244.136699][ T5680] usb 2-1: USB disconnect, device number 40 [ 244.250495][ T25] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 244.276309][ T25] usb 5-1: device descriptor read/8, error -71 [ 244.380737][ T25] usb usb5-port1: unable to enumerate USB device [ 244.638006][ T9194] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1097'. [ 244.700370][ T25] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 244.820364][ T5615] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 244.850728][ T25] usb 1-1: Using ep0 maxpacket: 8 [ 244.853099][ T25] usb 1-1: New USB device found, idVendor=056a, idProduct=0039, bcdDevice= 0.40 [ 244.855291][ T25] usb 1-1: config 1 interface 0 altsetting 253 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 244.855321][ T25] usb 1-1: config 1 interface 0 altsetting 253 endpoint 0x81 has invalid wMaxPacketSize 0 [ 244.855343][ T25] usb 1-1: config 1 interface 0 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 244.855369][ T25] usb 1-1: config 1 interface 0 has no altsetting 0 [ 244.858690][ T25] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.858725][ T25] usb 1-1: Product: syz [ 244.858741][ T25] usb 1-1: Manufacturer: syz [ 244.858755][ T25] usb 1-1: SerialNumber: syz [ 244.879113][ T9202] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1100'. [ 244.980403][ T5615] usb 4-1: Using ep0 maxpacket: 16 [ 244.982714][ T5615] usb 4-1: unable to get BOS descriptor or descriptor too short [ 244.982763][ T5615] usb 4-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 244.983842][ T5615] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 244.986616][ T5615] usb 4-1: string descriptor 0 read error: -22 [ 244.986712][ T5615] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.004544][ T5615] snd-ua101 4-1:1.0: invalid num_altsetting [ 245.030471][ T7035] usb 2-1: new low-speed USB device number 41 using dummy_hcd [ 245.060996][ T7044] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 245.083981][ T25] usbhid 1-1:1.0: can't add hid device: -71 [ 245.084041][ T25] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 245.087364][ T25] usb 1-1: USB disconnect, device number 34 [ 245.180473][ T7035] usb 2-1: Invalid ep0 maxpacket: 64 [ 245.190594][ T7044] usb 3-1: device descriptor read/64, error -71 [ 245.204855][ T5776] usb 4-1: USB disconnect, device number 41 [ 245.311612][ T7035] usb 2-1: new low-speed USB device number 42 using dummy_hcd [ 245.430371][ T7044] usb 3-1: new full-speed USB device number 21 using dummy_hcd [ 245.460354][ T7035] usb 2-1: Invalid ep0 maxpacket: 64 [ 245.461865][ T7035] usb usb2-port1: attempt power cycle [ 245.560395][ T7044] usb 3-1: device descriptor read/64, error -71 [ 245.629890][ T9211] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 245.670611][ T7044] usb usb3-port1: attempt power cycle [ 245.675930][ T9213] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1105'. [ 245.699036][ T9213] vlan4: entered allmulticast mode [ 245.699056][ T9213] bridge3: entered allmulticast mode [ 245.703260][ T9213] bridge3: port 1(erspan0) entered blocking state [ 245.703424][ T9213] bridge3: port 1(erspan0) entered disabled state [ 245.703573][ T9213] erspan0: entered allmulticast mode [ 245.705423][ T9213] erspan0: entered promiscuous mode [ 245.707743][ T9213] bridge3: port 1(erspan0) entered blocking state [ 245.707850][ T9213] bridge3: port 1(erspan0) entered forwarding state [ 245.800507][ T7035] usb 2-1: new low-speed USB device number 43 using dummy_hcd [ 245.820819][ T7035] usb 2-1: Invalid ep0 maxpacket: 64 [ 245.844902][ T9218] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 245.882135][ T30] audit: type=1326 audit(1790914660.490:6489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9217 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 245.882802][ T30] audit: type=1326 audit(1790914660.490:6490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9217 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 245.883065][ T30] audit: type=1326 audit(1790914660.490:6491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9217 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 245.883238][ T30] audit: type=1326 audit(1790914660.490:6492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9217 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 245.883737][ T30] audit: type=1326 audit(1790914660.490:6493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9217 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=252 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 245.884479][ T30] audit: type=1326 audit(1790914660.490:6494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9217 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 245.887028][ T30] audit: type=1326 audit(1790914660.490:6495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9217 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 245.887284][ T30] audit: type=1326 audit(1790914660.490:6496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9217 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 245.950350][ T7035] usb 2-1: new low-speed USB device number 44 using dummy_hcd [ 246.001614][ T7035] usb 2-1: Invalid ep0 maxpacket: 64 [ 246.001996][ T7035] usb usb2-port1: unable to enumerate USB device [ 246.020421][ T7044] usb 3-1: new full-speed USB device number 22 using dummy_hcd [ 246.051114][ T7044] usb 3-1: device descriptor read/8, error -71 [ 246.151126][ T30] audit: type=1326 audit(1790914660.760:6497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9217 comm="syz.0.1106" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f0bed59e159 code=0x7ffc0000 [ 246.291007][ T7044] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 246.311441][ T7044] usb 3-1: device descriptor read/8, error -71 [ 246.420770][ T7044] usb usb3-port1: unable to enumerate USB device [ 247.020433][ T5776] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 247.192558][ T5776] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 247.193648][ T5776] usb 1-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 247.193680][ T5776] usb 1-1: config 0 interface 0 altsetting 255 endpoint 0x8F has invalid wMaxPacketSize 0 [ 247.193703][ T5776] usb 1-1: config 0 interface 0 has no altsetting 0 [ 247.197335][ T5776] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 247.197361][ T5776] usb 1-1: Product: syz [ 247.197376][ T5776] usb 1-1: Manufacturer: syz [ 247.197391][ T5776] usb 1-1: SerialNumber: syz [ 247.224552][ T5776] usb 1-1: config 0 descriptor?? [ 247.275698][ T5776] usb 1-1: selecting invalid altsetting 0 [ 247.413521][ T9247] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 247.465319][ T9250] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1119'. [ 247.510430][ T7044] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 247.532923][ T5701] usb 1-1: USB disconnect, device number 35 [ 247.566907][ T9250] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 247.640452][ T7044] usb 4-1: device descriptor read/64, error -71 [ 247.880503][ T7044] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 247.919032][ T9260] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1121'. [ 248.000555][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 248.011287][ T7044] usb 4-1: device descriptor read/64, error -71 [ 248.122302][ T7044] usb usb4-port1: attempt power cycle [ 248.236029][ T9273] ip_tables: iptables: counters copy to user failed while replacing table [ 248.277670][ T9270] xt_CT: No such helper "snmp_trap" [ 248.375790][ T9269] xt_CT: No such helper "snmp_trap" [ 248.454106][ T9284] openvswitch: netlink: Key type 7174 is out of range max 32 [ 248.461136][ T7044] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 248.482520][ T7044] usb 4-1: device descriptor read/8, error -71 [ 248.727466][ T9288] vlan0: entered promiscuous mode [ 248.727487][ T9288] bridge0: entered promiscuous mode [ 248.732243][ T7044] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 248.751561][ T7044] usb 4-1: device descriptor read/8, error -71 [ 248.825582][ T9292] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 248.860810][ T7044] usb usb4-port1: unable to enumerate USB device [ 248.905969][ T9296] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1130'. [ 249.086043][ T9304] netlink: Conntrack attr has 4 unknown bytes [ 249.086079][ T9304] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 249.427653][ T9310] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1134'. [ 249.980390][ T7044] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 250.130327][ T7044] usb 3-1: Using ep0 maxpacket: 32 [ 250.131177][ T7044] usb 3-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 250.134179][ T7044] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.134206][ T7044] usb 3-1: Product: syz [ 250.134220][ T7044] usb 3-1: Manufacturer: syz [ 250.134234][ T7044] usb 3-1: SerialNumber: syz [ 250.138405][ T7044] usb 3-1: config 0 descriptor?? [ 250.342804][ T9332] binder: 9329:9332 ioctl c0306201 2000000001c0 returned -14 [ 250.538921][ T9336] batman_adv: batadv0: Adding interface: gretap1 [ 250.538944][ T9336] batman_adv: batadv0: Interface activated: gretap1 [ 250.549257][ T7044] airspy 3-1:0.0: Board ID: 00 [ 250.549278][ T7044] airspy 3-1:0.0: Firmware version: [ 250.807011][ T9318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 250.808486][ T9318] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 250.815083][ T7044] airspy 3-1:0.0: usb_control_msg() failed -71 request 11 [ 250.824037][ T7044] airspy 3-1:0.0: Registered as swradio24 [ 250.824058][ T7044] airspy 3-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 250.834265][ T7044] usb 3-1: USB disconnect, device number 24 [ 251.813794][ T5776] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 251.828363][ T9363] IPVS: set_ctl: invalid protocol: 135 0.0.0.0:20003 [ 251.857346][ T9366] netlink: 'syz.3.1156': attribute type 12 has an invalid length. [ 251.971456][ T5776] usb 1-1: Using ep0 maxpacket: 16 [ 251.972188][ T5776] usb 1-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 251.976332][ T5776] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 252.009826][ T5776] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.009856][ T5776] usb 1-1: Product: syz [ 252.009950][ T5776] usb 1-1: Manufacturer: syz [ 252.009966][ T5776] usb 1-1: SerialNumber: syz [ 252.068015][ T5776] usb 1-1: config 0 descriptor?? [ 252.069414][ T9370] program syz.4.1158 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 252.085891][ T5776] hub 1-1:0.0: bad descriptor, ignoring hub [ 252.085916][ T5776] hub 1-1:0.0: probe with driver hub failed with error -5 [ 252.107479][ T5776] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 252.461339][ T9382] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1151'. [ 252.461368][ T9382] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1151'. [ 252.461615][ T5776] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 252.611474][ T5776] usb 4-1: Using ep0 maxpacket: 32 [ 252.612369][ T5776] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 252.613574][ T5776] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 252.613604][ T5776] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 252.613653][ T5776] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 252.613675][ T5776] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 252.613697][ T5776] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 252.613749][ T5776] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 252.616429][ T5776] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.616453][ T5776] usb 4-1: Product: syz [ 252.616468][ T5776] usb 4-1: Manufacturer: syz [ 252.616507][ T5776] usb 4-1: SerialNumber: syz [ 252.725373][ T5776] usb 4-1: config 0 descriptor?? [ 252.905521][ T9399] ptrace attach of "ci-upstream-kasan-gce/syz-executor exec"[5633] was attempted by " Àÿ Ðÿ ð¥ Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ      rr @  @       À rr s¬ ÿÿ    üÿÿÿ   ÿÿÿÿ  & %½p ûÛß% \x07 gF- [ 252.949037][ T5776] usb 4-1: USB disconnect, device number 46 [ 253.218405][ T9401] netlink: 'syz.2.1169': attribute type 12 has an invalid length. [ 253.396672][ T9405] FAULT_INJECTION: forcing a failure. [ 253.396672][ T9405] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 253.396706][ T9405] CPU: 0 UID: 0 PID: 9405 Comm: syz.2.1171 Tainted: G L syzkaller #0 PREEMPT(full) [ 253.396729][ T9405] Tainted: [L]=SOFTLOCKUP [ 253.396736][ T9405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 253.396747][ T9405] Call Trace: [ 253.396755][ T9405] [ 253.396763][ T9405] dump_stack_lvl+0xe8/0x150 [ 253.396796][ T9405] should_fail_ex+0x410/0x560 [ 253.396824][ T9405] _copy_from_user+0x2d/0xb0 [ 253.396851][ T9405] __se_sys_io_uring_setup+0x1b4/0x2c0 [ 253.396875][ T9405] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 253.396904][ T9405] ? __pfx___se_sys_io_uring_setup+0x10/0x10 [ 253.396942][ T9405] ? __pfx_ksys_write+0x10/0x10 [ 253.396970][ T9405] do_syscall_64+0x166/0x520 [ 253.396995][ T9405] ? trace_irq_disable+0x3b/0x140 [ 253.397014][ T9405] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.397033][ T9405] ? clear_bhb_loop+0x70/0xc0 [ 253.397056][ T9405] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 253.397077][ T9405] RIP: 0033:0x7f9ac339e159 [ 253.397094][ T9405] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 253.397118][ T9405] RSP: 002b:00007f9ac42eeee8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 253.397139][ T9405] RAX: ffffffffffffffda RBX: 0000200000000508 RCX: 00007f9ac339e159 [ 253.397153][ T9405] RDX: 0000200000000588 RSI: 0000200000000508 RDI: 00000000000003b5 [ 253.397164][ T9405] RBP: 0000200000000500 R08: 0000200000000340 R09: 0000000000000000 [ 253.397176][ T9405] R10: 0000200000000590 R11: 0000000000000206 R12: 0000200000000588 [ 253.397189][ T9405] R13: 0000200000000590 R14: 00007f9ac42eefd8 R15: 0000000000000000 [ 253.397217][ T9405] [ 253.671863][ T9414] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1175'. [ 253.675954][ T9412] ip6tnl4: entered allmulticast mode [ 253.687609][ T9414] macvlan3: entered allmulticast mode [ 253.797121][ T9422] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 253.976891][ T9430] netlink: 'syz.1.1182': attribute type 1 has an invalid length. [ 254.049015][ T9434] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1183'. [ 254.140425][ T5701] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 254.190901][ T5680] hsr0: entered promiscuous mode [ 254.290374][ T5701] usb 4-1: Using ep0 maxpacket: 8 [ 254.292097][ T5701] usb 4-1: New USB device found, idVendor=a168, idProduct=0617, bcdDevice=a7.e8 [ 254.293441][ T5701] usb 4-1: config index 0 descriptor too short (expected 18, got 10) [ 254.293466][ T5701] usb 4-1: config 0 descriptor has 1 excess byte, ignoring [ 254.293484][ T5701] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 254.297510][ T5701] usb 4-1: string descriptor 0 read error: -22 [ 254.297621][ T5701] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.315574][ T5701] usb 4-1: config 0 descriptor?? [ 254.440398][ T5680] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 254.582892][ T5701] usb 1-1: USB disconnect, device number 36 [ 254.594251][ T5680] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 254.596216][ T5680] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 254.596246][ T5680] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 254.596267][ T5680] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 254.596306][ T5680] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.602221][ T5680] usb 5-1: config 0 descriptor?? [ 255.087356][ T5680] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 255.130510][ T5776] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 255.281480][ T5776] usb 2-1: device descriptor read/64, error -71 [ 255.290394][ T5701] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 255.450343][ T5701] usb 3-1: Using ep0 maxpacket: 8 [ 255.451044][ T5701] usb 3-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 255.452020][ T5701] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 255.454069][ T5701] usb 3-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 255.454093][ T5701] usb 3-1: Product: syz [ 255.454107][ T5701] usb 3-1: Manufacturer: syz [ 255.454121][ T5701] usb 3-1: SerialNumber: syz [ 255.520674][ T5776] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 255.650433][ T5776] usb 2-1: device descriptor read/64, error -71 [ 255.666812][ T5701] usb 3-1: Invalid connection information received from device [ 255.692245][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.692299][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.710712][ T991] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 255.771149][ T5776] usb usb2-port1: attempt power cycle [ 255.851319][ T991] usb 1-1: Using ep0 maxpacket: 16 [ 255.852197][ T991] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 255.852809][ T991] usb 1-1: config 0 has no interfaces? [ 255.854739][ T991] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.854762][ T991] usb 1-1: Product: syz [ 255.854776][ T991] usb 1-1: Manufacturer: syz [ 255.854789][ T991] usb 1-1: SerialNumber: syz [ 255.857327][ T991] usb 1-1: config 0 descriptor?? [ 255.870745][ T991] usb 3-1: USB disconnect, device number 25 [ 256.130419][ T5776] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 256.150968][ T5776] usb 2-1: device descriptor read/8, error -71 [ 256.384783][ C1] plantronics 0003:047F:FFFF.0005: usb_submit_urb(ctrl) failed: -1 [ 256.422446][ T5776] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 256.451354][ T5776] usb 2-1: device descriptor read/8, error -71 [ 256.560759][ T5776] usb usb2-port1: unable to enumerate USB device [ 256.601434][ T25] usb 1-1: USB disconnect, device number 37 [ 256.885890][ T5701] usb 4-1: USB disconnect, device number 47 [ 256.932758][ T9503] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 257.224248][ T5680] usb 5-1: USB disconnect, device number 33 [ 257.251636][ T9516] xt_hashlimit: size too large, truncated to 1048576 [ 257.358513][ T9516] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 257.370762][ T9516] FAULT_INJECTION: forcing a failure. [ 257.370762][ T9516] name failslab, interval 1, probability 0, space 0, times 0 [ 257.370790][ T9516] CPU: 0 UID: 0 PID: 9516 Comm: syz.4.1211 Tainted: G L syzkaller #0 PREEMPT(full) [ 257.370815][ T9516] Tainted: [L]=SOFTLOCKUP [ 257.370820][ T9516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 257.370826][ T9516] Call Trace: [ 257.370831][ T9516] [ 257.370836][ T9516] dump_stack_lvl+0xe8/0x150 [ 257.370855][ T9516] should_fail_ex+0x410/0x560 [ 257.370872][ T9516] should_failslab+0xa8/0x100 [ 257.370886][ T9516] ? skb_clone+0x212/0x3a0 [ 257.370901][ T9516] kmem_cache_alloc_noprof+0xa1/0x600 [ 257.370912][ T9516] ? lock_acquire+0x115/0x350 [ 257.370924][ T9516] ? skb_clone+0x212/0x3a0 [ 257.370942][ T9516] skb_clone+0x212/0x3a0 [ 257.370956][ T9516] ? dev_queue_xmit_nit+0x25c/0xac0 [ 257.370971][ T9516] dev_queue_xmit_nit+0x28d/0xac0 [ 257.370984][ T9516] ? dev_queue_xmit_nit+0x2d/0xac0 [ 257.371001][ T9516] dev_hard_start_xmit+0x1c1/0x830 [ 257.371024][ T9516] __dev_queue_xmit+0x14d1/0x3920 [ 257.371034][ T9516] ? do_syscall_64+0x166/0x520 [ 257.371051][ T9516] ? __dev_queue_xmit+0x29b/0x3920 [ 257.371070][ T9516] ? __pfx___dev_queue_xmit+0x10/0x10 [ 257.371086][ T9516] ? __copy_skb_header+0xa3/0x4a0 [ 257.371101][ T9516] ? __asan_memcpy+0x40/0x70 [ 257.371117][ T9516] ? __skb_clone+0x5c/0x6c0 [ 257.371147][ T9516] ? __skb_clone+0x449/0x6c0 [ 257.371179][ T9516] ? skb_clone+0x246/0x3a0 [ 257.371211][ T9516] __netlink_deliver_tap+0x5b4/0x860 [ 257.371232][ T9516] ? netlink_deliver_tap+0x2e/0x1b0 [ 257.371243][ T9516] netlink_deliver_tap+0x19c/0x1b0 [ 257.371254][ T9516] netlink_unicast+0x781/0x940 [ 257.371275][ T9516] netlink_sendmsg+0x813/0xb40 [ 257.371290][ T9516] ? __pfx_netlink_sendmsg+0x10/0x10 [ 257.371313][ T9516] ? apparmor_socket_sendmsg+0x98/0x360 [ 257.371327][ T9516] ? __pfx_netlink_sendmsg+0x10/0x10 [ 257.371337][ T9516] sock_sendmsg_nosec+0x13a/0x180 [ 257.371350][ T9516] ____sys_sendmsg+0x54e/0x850 [ 257.371368][ T9516] ? __pfx_____sys_sendmsg+0x10/0x10 [ 257.371387][ T9516] ? import_iovec+0x73/0xa0 [ 257.371403][ T9516] ___sys_sendmsg+0x2a5/0x360 [ 257.371417][ T9516] ? __lock_acquire+0x747/0x2de0 [ 257.371430][ T9516] ? __pfx____sys_sendmsg+0x10/0x10 [ 257.371462][ T9516] ? __fget_files+0x2a/0x420 [ 257.371476][ T9516] ? __fget_files+0x3a2/0x420 [ 257.371495][ T9516] __x64_sys_sendmsg+0x1b1/0x290 [ 257.371511][ T9516] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 257.371536][ T9516] do_syscall_64+0x166/0x520 [ 257.371549][ T9516] ? trace_irq_disable+0x3b/0x140 [ 257.371560][ T9516] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.371571][ T9516] ? clear_bhb_loop+0x70/0xc0 [ 257.371583][ T9516] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.371593][ T9516] RIP: 0033:0x7fe9b5b9e159 [ 257.371605][ T9516] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 257.371614][ T9516] RSP: 002b:00007fe9b6add028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 257.371626][ T9516] RAX: ffffffffffffffda RBX: 00007fe9b5e25fa0 RCX: 00007fe9b5b9e159 [ 257.371633][ T9516] RDX: 0000000000000010 RSI: 0000200000000080 RDI: 000000000000000b [ 257.371640][ T9516] RBP: 00007fe9b6add090 R08: 0000000000000000 R09: 0000000000000000 [ 257.371647][ T9516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 257.371653][ T9516] R13: 00007fe9b5e26038 R14: 00007fe9b5e25fa0 R15: 00007fe9b5f4fa48 [ 257.371669][ T9516] [ 257.371712][ T9516] all: renamed from bridge_slave_0 (while UP) [ 258.059454][ T9534] netlink: 'syz.1.1218': attribute type 10 has an invalid length. [ 258.072217][ T9534] team0 (unregistering): Port device team_slave_0 removed [ 258.075658][ T9534] team0 (unregistering): Port device team_slave_1 removed [ 258.171121][ T37] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.171612][ T37] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.171674][ T37] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.172101][ T99] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 258.236390][ T9542] FAULT_INJECTION: forcing a failure. [ 258.236390][ T9542] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 258.236425][ T9542] CPU: 1 UID: 0 PID: 9542 Comm: syz.1.1221 Tainted: G L syzkaller #0 PREEMPT(full) [ 258.236451][ T9542] Tainted: [L]=SOFTLOCKUP [ 258.236459][ T9542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 258.236470][ T9542] Call Trace: [ 258.236479][ T9542] [ 258.236487][ T9542] dump_stack_lvl+0xe8/0x150 [ 258.236520][ T9542] should_fail_ex+0x410/0x560 [ 258.236548][ T9542] strncpy_from_user+0x36/0x2c0 [ 258.236575][ T9542] do_getname+0x77/0x250 [ 258.236604][ T9542] do_sys_openat2+0xcc/0x200 [ 258.236632][ T9542] ? __pfx_do_sys_openat2+0x10/0x10 [ 258.236658][ T9542] ? ksys_write+0x242/0x270 [ 258.236679][ T9542] ? __pfx_ksys_write+0x10/0x10 [ 258.236704][ T9542] __x64_sys_open+0x11e/0x150 [ 258.236734][ T9542] do_syscall_64+0x166/0x520 [ 258.236760][ T9542] ? trace_irq_disable+0x3b/0x140 [ 258.236781][ T9542] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.236802][ T9542] ? clear_bhb_loop+0x70/0xc0 [ 258.236826][ T9542] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.236846][ T9542] RIP: 0033:0x7fa09619e159 [ 258.236864][ T9542] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 258.236881][ T9542] RSP: 002b:00007fa097131028 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 258.236902][ T9542] RAX: ffffffffffffffda RBX: 00007fa096425fa0 RCX: 00007fa09619e159 [ 258.236917][ T9542] RDX: 0000000000000110 RSI: 0000000000101000 RDI: 0000200000000000 [ 258.236931][ T9542] RBP: 00007fa097131090 R08: 0000000000000000 R09: 0000000000000000 [ 258.236943][ T9542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 258.236955][ T9542] R13: 00007fa096426038 R14: 00007fa096425fa0 R15: 00007fa09654fa48 [ 258.236986][ T9542] [ 258.279998][ T5701] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 258.471067][ T5701] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 258.472188][ T5701] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 258.472234][ T5701] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 258.473228][ T5701] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 258.473251][ T5701] usb 5-1: SerialNumber: syz [ 258.490764][ T5701] cdc_ether 5-1:1.0: GUID doesn't match [ 258.681378][ T7035] usb 5-1: USB disconnect, device number 34 [ 258.830417][ T5701] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 258.980818][ T5701] usb 3-1: Using ep0 maxpacket: 8 [ 258.981517][ T5701] usb 3-1: New USB device found, idVendor=0413, idProduct=6a04, bcdDevice=27.2b [ 258.986180][ T5701] usb 3-1: config 135 interface 0 has no altsetting 0 [ 258.990028][ T5701] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.990052][ T5701] usb 3-1: Product: syz [ 258.990066][ T5701] usb 3-1: Manufacturer: syz [ 258.990081][ T5701] usb 3-1: SerialNumber: syz [ 259.127866][ T9566] bridge1: entered promiscuous mode [ 259.127881][ T9566] bridge1: entered allmulticast mode [ 259.330425][ T7044] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 259.460676][ T7044] usb 4-1: device descriptor read/64, error -71 [ 259.506442][ T5701] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 259.513343][ T5701] dvb_usb_af9015 3-1:135.0: probe with driver dvb_usb_af9015 failed with error -22 [ 259.519647][ T5701] usb 3-1: USB disconnect, device number 26 [ 259.700355][ T7044] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 259.830602][ T7044] usb 4-1: device descriptor read/64, error -71 [ 259.940713][ T7044] usb usb4-port1: attempt power cycle [ 259.990361][ T5701] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 260.142588][ T5701] usb 2-1: unable to get BOS descriptor or descriptor too short [ 260.142640][ T5701] usb 2-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice=73.9f [ 260.143608][ T5701] usb 2-1: config 2 has an invalid interface number: 69 but max is 0 [ 260.143631][ T5701] usb 2-1: config 2 has no interface number 0 [ 260.143660][ T5701] usb 2-1: config 2 interface 69 has no altsetting 0 [ 260.145613][ T5701] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.145644][ T5701] usb 2-1: Product: syz [ 260.145659][ T5701] usb 2-1: Manufacturer: syz [ 260.145673][ T5701] usb 2-1: SerialNumber: syz [ 260.248056][ T9593] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 260.277792][ T9595] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1241'. [ 260.290122][ T7044] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 260.313754][ T7044] usb 4-1: device descriptor read/8, error -71 [ 260.550386][ T7044] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 260.571019][ T7044] usb 4-1: device descriptor read/8, error -71 [ 260.620789][ T991] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 260.681458][ T7044] usb usb4-port1: unable to enumerate USB device [ 260.771051][ T991] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 260.774939][ T991] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 260.774966][ T991] usb 1-1: Product: syz [ 260.774980][ T991] usb 1-1: Manufacturer: syz [ 260.774995][ T991] usb 1-1: SerialNumber: syz [ 260.784377][ T9613] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1247'. [ 260.814670][ T991] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 260.916738][ T9614] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 260.917427][ T9614] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 260.960471][ T7044] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 261.021233][ T9601] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.024142][ T9601] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.120404][ T7044] usb 5-1: Using ep0 maxpacket: 8 [ 261.121942][ T7044] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 261.123303][ T7044] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 261.123326][ T7044] usb 5-1: config 0 has no interfaces? [ 261.125767][ T7044] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 261.125792][ T7044] usb 5-1: config 0 has no interfaces? [ 261.127737][ T7044] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 261.127760][ T7044] usb 5-1: config 0 has no interfaces? [ 261.145616][ T7044] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.145652][ T7044] usb 5-1: Product: syz [ 261.145668][ T7044] usb 5-1: Manufacturer: syz [ 261.145681][ T7044] usb 5-1: SerialNumber: syz [ 261.218291][ T7044] usb 5-1: config 0 descriptor?? [ 261.462124][ T7044] usb 5-1: USB disconnect, device number 35 [ 261.497846][ T5680] usb 1-1: USB disconnect, device number 38 [ 261.810671][ T7051] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 261.981703][ T7051] usb 3-1: Using ep0 maxpacket: 16 [ 261.983675][ T7051] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 261.984772][ T7051] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 261.984795][ T7051] usb 3-1: config 0 has no interface number 0 [ 261.987953][ T7051] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.987976][ T7051] usb 3-1: Product: syz [ 261.987991][ T7051] usb 3-1: Manufacturer: syz [ 261.988005][ T7051] usb 3-1: SerialNumber: syz [ 261.993612][ T7051] usb 3-1: config 0 descriptor?? [ 262.035999][ T7051] hub 3-1:0.132: bad descriptor, ignoring hub [ 262.036025][ T7051] hub 3-1:0.132: probe with driver hub failed with error -5 [ 262.053582][ T7051] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.132/input/input15 [ 262.082953][ T991] usb 1-1: Service connection timeout for: 256 [ 262.082975][ T991] ath9k_htc 1-1:1.0: ath9k_htc: Unable to initialize HTC services [ 262.083411][ T991] ath9k_htc: Failed to initialize the device [ 262.083509][ C1] ================================================================== [ 262.083519][ C1] BUG: KASAN: slab-use-after-free in tasklet_action_common+0x103/0x490 [ 262.083548][ C1] Read of size 8 at addr ffff88807a83a158 by task kworker/1:4/991 [ 262.083562][ C1] [ 262.083572][ C1] CPU: 1 UID: 0 PID: 991 Comm: kworker/1:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 262.083591][ C1] Tainted: [L]=SOFTLOCKUP [ 262.083596][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 262.083605][ C1] Workqueue: events request_firmware_work_func [ 262.083624][ C1] Call Trace: [ 262.083630][ C1] [ 262.083637][ C1] dump_stack_lvl+0xe8/0x150 [ 262.083661][ C1] print_address_description+0x55/0x1e0 [ 262.083685][ C1] ? tasklet_action_common+0x103/0x490 [ 262.083703][ C1] print_report+0x58/0x70 [ 262.083718][ C1] kasan_report+0x117/0x150 [ 262.083739][ C1] ? tasklet_action_common+0x103/0x490 [ 262.083764][ C1] tasklet_action_common+0x103/0x490 [ 262.083789][ C1] handle_softirqs+0x226/0x860 [ 262.083811][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 262.083836][ C1] __irq_exit_rcu+0xcb/0x220 [ 262.083855][ C1] irq_exit_rcu+0x9/0x30 [ 262.083873][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 262.083894][ C1] [ 262.083899][ C1] [ 262.083905][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 262.083924][ C1] RIP: 0010:lock_acquire+0x232/0x350 [ 262.083944][ C1] Code: ff ff ff e8 b0 9d 43 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 42 48 f2 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 87 56 da [ 262.083959][ C1] RSP: 0018:ffffc90004ef74e0 EFLAGS: 00000292 [ 262.083976][ C1] RAX: d5cb48ed26a8a700 RBX: 0000000000000000 RCX: 0000000000000046 [ 262.083986][ C1] RDX: 00000000f85f422c RSI: ffffffff8e69f504 RDI: ffffffff8c6dad80 [ 262.083996][ C1] RBP: ffff88802760ddc0 R08: ffffffff8177f1df R09: 0000000000000000 [ 262.084006][ C1] R10: ffffc90004ef7618 R11: ffffffff81b2a310 R12: ffffffff8ed5c8a0 [ 262.084016][ C1] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 [ 262.084027][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 262.084044][ C1] ? unwind_next_frame+0x8f/0x2550 [ 262.084069][ C1] ? ret_from_fork+0x514/0xb70 [ 262.084081][ C1] ? unwind_next_frame+0x8f/0x2550 [ 262.084097][ C1] unwind_next_frame+0xac/0x2550 [ 262.084114][ C1] ? unwind_next_frame+0x8f/0x2550 [ 262.084134][ C1] ? kthread+0x38b/0x480 [ 262.084150][ C1] ? unwind_next_frame+0x8f/0x2550 [ 262.084169][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 262.084187][ C1] arch_stack_walk+0x11b/0x150 [ 262.084209][ C1] ? ret_from_fork+0x514/0xb70 [ 262.084223][ C1] stack_trace_save+0xa9/0x100 [ 262.084238][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 262.084253][ C1] ? __lock_acquire+0x747/0x2de0 [ 262.084273][ C1] save_stack+0x122/0x230 [ 262.084294][ C1] ? __pfx_save_stack+0x10/0x10 [ 262.084311][ C1] ? free_pages_prepare+0x9eb/0xaf0 [ 262.084330][ C1] ? __free_contig_range_common+0x174/0x340 [ 262.084367][ C1] ? free_pages_bulk+0x48/0x120 [ 262.084381][ C1] ? vfree+0x231/0x490 [ 262.084399][ C1] ? free_fw_priv+0x34b/0x500 [ 262.084419][ C1] ? release_firmware+0x72/0xb0 [ 262.084430][ C1] ? ath9k_hif_usb_firmware_cb+0x2a5/0x4b0 [ 262.084454][ C1] ? request_firmware_work_func+0xf7/0x2d0 [ 262.084467][ C1] ? process_scheduled_works+0xc3d/0x1630 [ 262.084485][ C1] ? worker_thread+0xa47/0xfb0 [ 262.084502][ C1] ? kthread+0x38b/0x480 [ 262.084514][ C1] ? ret_from_fork+0x514/0xb70 [ 262.084530][ C1] ? page_ext_put+0x97/0xc0 [ 262.084548][ C1] __reset_page_owner+0x71/0x1f0 [ 262.084566][ C1] free_pages_prepare+0x9eb/0xaf0 [ 262.084590][ C1] __free_contig_range_common+0x174/0x340 [ 262.084613][ C1] free_pages_bulk+0x48/0x120 [ 262.084631][ C1] vfree+0x231/0x490 [ 262.084652][ C1] free_fw_priv+0x34b/0x500 [ 262.084673][ C1] release_firmware+0x72/0xb0 [ 262.084689][ C1] ath9k_hif_usb_firmware_cb+0x2a5/0x4b0 [ 262.084711][ C1] ? __pfx_ath9k_hif_usb_firmware_cb+0x10/0x10 [ 262.084730][ C1] request_firmware_work_func+0xf7/0x2d0 [ 262.084745][ C1] ? rcu_is_watching+0x16/0xb0 [ 262.084765][ C1] ? process_scheduled_works+0x97a/0x1630 [ 262.084786][ C1] process_scheduled_works+0xc3d/0x1630 [ 262.084816][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 262.084839][ C1] ? assign_work+0x3cf/0x5d0 [ 262.084861][ C1] worker_thread+0xa47/0xfb0 [ 262.084885][ C1] ? __kthread_parkme+0x71/0x1f0 [ 262.084907][ C1] kthread+0x38b/0x480 [ 262.084923][ C1] ? __pfx_worker_thread+0x10/0x10 [ 262.084946][ C1] ? __pfx_kthread+0x10/0x10 [ 262.084963][ C1] ret_from_fork+0x514/0xb70 [ 262.084980][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 262.084992][ C1] ? __switch_to+0xc89/0x1420 [ 262.085011][ C1] ? __pfx_kthread+0x10/0x10 [ 262.085024][ C1] ret_from_fork_asm+0x1a/0x30 [ 262.085048][ C1] [ 262.085053][ C1] [ 262.085057][ C1] Allocated by task 991: [ 262.085064][ C1] kasan_save_track+0x3e/0x80 [ 262.085079][ C1] __kasan_kmalloc+0x93/0xb0 [ 262.085093][ C1] __kmalloc_cache_noprof+0x321/0x600 [ 262.085108][ C1] ath9k_init_wmi+0x4f/0x2b0 [ 262.085124][ C1] ath9k_htc_probe_device+0x1e5/0x2370 [ 262.085140][ C1] ath9k_htc_hw_init+0x32/0x70 [ 262.085155][ C1] ath9k_hif_usb_firmware_cb+0x214/0x4b0 [ 262.085172][ C1] request_firmware_work_func+0xf7/0x2d0 [ 262.085188][ C1] process_scheduled_works+0xc3d/0x1630 [ 262.085205][ C1] worker_thread+0xa47/0xfb0 [ 262.085223][ C1] kthread+0x38b/0x480 [ 262.085237][ C1] ret_from_fork+0x514/0xb70 [ 262.085250][ C1] ret_from_fork_asm+0x1a/0x30 [ 262.085271][ C1] [ 262.085274][ C1] Freed by task 991: [ 262.085281][ C1] kasan_save_track+0x3e/0x80 [ 262.085297][ C1] kasan_save_free_info+0x40/0x50 [ 262.085318][ C1] __kasan_slab_free+0x5c/0x80 [ 262.085334][ C1] kfree+0x1c5/0x650 [ 262.085357][ C1] ath9k_htc_probe_device+0x11a9/0x2370 [ 262.085374][ C1] ath9k_htc_hw_init+0x32/0x70 [ 262.085392][ C1] ath9k_hif_usb_firmware_cb+0x214/0x4b0 [ 262.085408][ C1] request_firmware_work_func+0xf7/0x2d0 [ 262.085421][ C1] process_scheduled_works+0xc3d/0x1630 [ 262.085436][ C1] worker_thread+0xa47/0xfb0 [ 262.085465][ C1] kthread+0x38b/0x480 [ 262.085479][ C1] ret_from_fork+0x514/0xb70 [ 262.085492][ C1] ret_from_fork_asm+0x1a/0x30 [ 262.085515][ C1] [ 262.085521][ C1] The buggy address belongs to the object at ffff88807a83a000 [ 262.085521][ C1] which belongs to the cache kmalloc-2k of size 2048 [ 262.085537][ C1] The buggy address is located 344 bytes inside of [ 262.085537][ C1] freed 2048-byte region [ffff88807a83a000, ffff88807a83a800) [ 262.085555][ C1] [ 262.085560][ C1] The buggy address belongs to the physical page: [ 262.085569][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a838 [ 262.085586][ C1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 262.085601][ C1] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 262.085618][ C1] page_type: f5(slab) [ 262.085635][ C1] raw: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 262.085651][ C1] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 262.085669][ C1] head: 00fff00000000040 ffff88801b042000 dead000000000100 dead000000000122 [ 262.085685][ C1] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 262.085699][ C1] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 262.085714][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 262.085724][ C1] page dumped because: kasan: bad access detected [ 262.085744][ C1] page_owner tracks the page as allocated [ 262.085752][ C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5633, tgid 5633 (syz-executor), ts 80100708589 [ 262.085785][ C1] post_alloc_hook+0x1f9/0x250 [ 262.085812][ C1] get_page_from_freelist+0x2209/0x2280 [ 262.085832][ C1] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 262.085853][ C1] allocate_slab+0x7d/0x620 [ 262.085876][ C1] refill_objects+0x2d5/0x350 [ 262.085900][ C1] __pcs_replace_empty_main+0x2c8/0x6c0 [ 262.085924][ C1] __kmalloc_cache_node_noprof+0x44b/0x620 [ 262.085943][ C1] page_pool_create_percpu+0x73/0xc70 [ 262.085964][ C1] nsim_open+0x3ca/0xa10 [ 262.085984][ C1] __dev_open+0x46f/0x850 [ 262.086002][ C1] __dev_change_flags+0x329/0x820 [ 262.086026][ C1] netif_change_flags+0x7c/0x1b0 [ 262.086051][ C1] do_setlink+0xdd6/0x4670 [ 262.086076][ C1] rtnl_newlink+0x15a3/0x1c30 [ 262.086100][ C1] rtnetlink_rcv_msg+0x802/0xc00 [ 262.086123][ C1] netlink_rcv_skb+0x226/0x4a0 [ 262.086140][ C1] page last free pid 5309 tgid 5309 ts 45173425255 stack trace: [ 262.086155][ C1] __free_frozen_pages+0xc93/0xd90 [ 262.086172][ C1] __slab_free+0x274/0x2c0 [ 262.086191][ C1] qlist_free_all+0x99/0x100 [ 262.086209][ C1] kasan_quarantine_reduce+0x148/0x160 [ 262.086228][ C1] __kasan_slab_alloc+0x22/0x80 [ 262.086250][ C1] __kmalloc_noprof+0x307/0x720 [ 262.086267][ C1] tomoyo_realpath_from_path+0xef/0x640 [ 262.086294][ C1] tomoyo_path_perm+0x283/0x560 [ 262.086314][ C1] security_inode_getattr+0x12b/0x310 [ 262.086331][ C1] __x64_sys_newfstat+0x133/0x270 [ 262.086355][ C1] do_syscall_64+0x166/0x520 [ 262.086381][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.086400][ C1] [ 262.086404][ C1] Memory state around the buggy address: [ 262.086416][ C1] ffff88807a83a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 262.086430][ C1] ffff88807a83a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 262.086451][ C1] >ffff88807a83a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 262.086462][ C1] ^ [ 262.086474][ C1] ffff88807a83a180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 262.086487][ C1] ffff88807a83a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 262.086497][ C1] ================================================================== [ 262.086546][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 263.090571][ C1] CPU: 1 UID: 0 PID: 991 Comm: kworker/1:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 263.101412][ C1] Tainted: [L]=SOFTLOCKUP [ 263.105718][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 263.115757][ C1] Workqueue: events request_firmware_work_func [ 263.121914][ C1] Call Trace: [ 263.125180][ C1] [ 263.128015][ C1] vpanic+0x56d/0xa60 [ 263.131994][ C1] ? rcu_is_watching+0x16/0xb0 [ 263.136756][ C1] ? __pfx_vpanic+0x10/0x10 [ 263.141258][ C1] panic+0xc5/0xd0 [ 263.144973][ C1] ? __pfx_panic+0x10/0x10 [ 263.149381][ C1] ? tasklet_action_common+0x103/0x490 [ 263.154840][ C1] ? tasklet_action_common+0x103/0x490 [ 263.160298][ C1] check_panic_on_warn+0x89/0xb0 [ 263.165229][ C1] ? tasklet_action_common+0x103/0x490 [ 263.170706][ C1] end_report+0x73/0x170 [ 263.174946][ C1] ? tasklet_action_common+0x103/0x490 [ 263.180399][ C1] kasan_report+0x128/0x150 [ 263.184898][ C1] ? tasklet_action_common+0x103/0x490 [ 263.190356][ C1] tasklet_action_common+0x103/0x490 [ 263.195640][ C1] handle_softirqs+0x226/0x860 [ 263.200403][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 263.205161][ C1] __irq_exit_rcu+0xcb/0x220 [ 263.209742][ C1] irq_exit_rcu+0x9/0x30 [ 263.213978][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 263.219607][ C1] [ 263.222524][ C1] [ 263.225442][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 263.231414][ C1] RIP: 0010:lock_acquire+0x232/0x350 [ 263.236688][ C1] Code: ff ff ff e8 b0 9d 43 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 42 48 f2 11 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 87 56 da [ 263.256281][ C1] RSP: 0018:ffffc90004ef74e0 EFLAGS: 00000292 [ 263.262340][ C1] RAX: d5cb48ed26a8a700 RBX: 0000000000000000 RCX: 0000000000000046 [ 263.270301][ C1] RDX: 00000000f85f422c RSI: ffffffff8e69f504 RDI: ffffffff8c6dad80 [ 263.278266][ C1] RBP: ffff88802760ddc0 R08: ffffffff8177f1df R09: 0000000000000000 [ 263.286225][ C1] R10: ffffc90004ef7618 R11: ffffffff81b2a310 R12: ffffffff8ed5c8a0 [ 263.294184][ C1] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 [ 263.302145][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 263.308292][ C1] ? unwind_next_frame+0x8f/0x2550 [ 263.313402][ C1] ? ret_from_fork+0x514/0xb70 [ 263.318153][ C1] ? unwind_next_frame+0x8f/0x2550 [ 263.323256][ C1] unwind_next_frame+0xac/0x2550 [ 263.328181][ C1] ? unwind_next_frame+0x8f/0x2550 [ 263.333284][ C1] ? kthread+0x38b/0x480 [ 263.337513][ C1] ? unwind_next_frame+0x8f/0x2550 [ 263.342619][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 263.348785][ C1] arch_stack_walk+0x11b/0x150 [ 263.353544][ C1] ? ret_from_fork+0x514/0xb70 [ 263.358302][ C1] stack_trace_save+0xa9/0x100 [ 263.363059][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 263.368422][ C1] ? __lock_acquire+0x747/0x2de0 [ 263.373351][ C1] save_stack+0x122/0x230 [ 263.377681][ C1] ? __pfx_save_stack+0x10/0x10 [ 263.382518][ C1] ? free_pages_prepare+0x9eb/0xaf0 [ 263.387709][ C1] ? __free_contig_range_common+0x174/0x340 [ 263.393598][ C1] ? free_pages_bulk+0x48/0x120 [ 263.398439][ C1] ? vfree+0x231/0x490 [ 263.402505][ C1] ? free_fw_priv+0x34b/0x500 [ 263.407179][ C1] ? release_firmware+0x72/0xb0 [ 263.412017][ C1] ? ath9k_hif_usb_firmware_cb+0x2a5/0x4b0 [ 263.417811][ C1] ? request_firmware_work_func+0xf7/0x2d0 [ 263.423612][ C1] ? process_scheduled_works+0xc3d/0x1630 [ 263.429329][ C1] ? worker_thread+0xa47/0xfb0 [ 263.434087][ C1] ? kthread+0x38b/0x480 [ 263.438320][ C1] ? ret_from_fork+0x514/0xb70 [ 263.443081][ C1] ? page_ext_put+0x97/0xc0 [ 263.447579][ C1] __reset_page_owner+0x71/0x1f0 [ 263.452507][ C1] free_pages_prepare+0x9eb/0xaf0 [ 263.457528][ C1] __free_contig_range_common+0x174/0x340 [ 263.463245][ C1] free_pages_bulk+0x48/0x120 [ 263.467912][ C1] vfree+0x231/0x490 [ 263.471806][ C1] free_fw_priv+0x34b/0x500 [ 263.476311][ C1] release_firmware+0x72/0xb0 [ 263.480978][ C1] ath9k_hif_usb_firmware_cb+0x2a5/0x4b0 [ 263.486608][ C1] ? __pfx_ath9k_hif_usb_firmware_cb+0x10/0x10 [ 263.492756][ C1] request_firmware_work_func+0xf7/0x2d0 [ 263.498377][ C1] ? rcu_is_watching+0x16/0xb0 [ 263.503132][ C1] ? process_scheduled_works+0x97a/0x1630 [ 263.508847][ C1] process_scheduled_works+0xc3d/0x1630 [ 263.514400][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 263.520373][ C1] ? assign_work+0x3cf/0x5d0 [ 263.524957][ C1] worker_thread+0xa47/0xfb0 [ 263.529549][ C1] ? __kthread_parkme+0x71/0x1f0 [ 263.534480][ C1] kthread+0x38b/0x480 [ 263.538562][ C1] ? __pfx_worker_thread+0x10/0x10 [ 263.543664][ C1] ? __pfx_kthread+0x10/0x10 [ 263.548240][ C1] ret_from_fork+0x514/0xb70 [ 263.552823][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 263.557926][ C1] ? __switch_to+0xc89/0x1420 [ 263.562600][ C1] ? __pfx_kthread+0x10/0x10 [ 263.567267][ C1] ret_from_fork_asm+0x1a/0x30 [ 263.572033][ C1] [ 263.575291][ C1] Kernel Offset: disabled [ 263.579643][ C1] Rebooting in 86400 seconds..