last executing test programs: 42.021500413s ago: executing program 2 (id=823): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x11) r2 = fanotify_init(0x20, 0x80000) mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x84, &(0x7f0000000c00)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) (async, rerun: 64) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000000)={[0x1000, 0x7, 0xa81, 0x10, 0x5, 0x0, 0x6, 0x9, 0x7, 0xffffffffffffffff, 0xf91f, 0x3, 0xfff, 0xc, 0xffffffffffffffff, 0x8000000000000001], 0x41000, 0x3d0444}) (async, rerun: 64) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d05, 0x0, 0x1}]}) 41.789382764s ago: executing program 2 (id=825): openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x42, 0x80) acct(&(0x7f0000000180)='./file1\x00') acct(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip_vs\x00') sendto$phonet(r0, &(0x7f00000001c0)="619c2b0c0c71a61514f348e1acd57f4c5c6d92ae47af9bbc215bb4741e4abda6a5dd1ad6a9f3c93e92bde62e4d7f6ec39a7fc884c93a98ea4f95141df44bcc7ad98d94f46aac0e481980a739bb097955c3798c83a7a2bd8b4491c974fa2dc6dbbecfaea18fdb0ca92ccbc12f856fd9b3c7e5bafc1e775133b286b56c874037d2ce4f4404c16acc4d991e186d520b65d7b75e71bb0bfd547bbeef02104e5540fbd53b4045b0f50764708589884801bd79ac76eab12624577d1d78660d376f94b3eb034d2f171c7b5ad8dff6c9d5224afbe8df89e0afb4a37d523a7a4015789b816d1a8e", 0xe3, 0x40000, &(0x7f00000000c0)={0x23, 0x9, 0x6, 0x8f}, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x181c42, 0x56) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) renameat2(r0, &(0x7f0000000100)='./file1\x00', r0, &(0x7f0000000140)='./file1\x00', 0x8) read$FUSE(r1, 0x0, 0x0) 41.786848732s ago: executing program 2 (id=826): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000080)=0x40000) (async) write$dsp(r1, 0x0, 0xfffffe59) (async) r2 = syz_open_dev$video(&(0x7f00000001c0), 0x3, 0x2500) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000008c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) (async, rerun: 32) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (rerun: 32) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, &(0x7f0000001dc0)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f00000021c0)={0x0, 0x2, 0x1}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f00000025c0)={0x0, 0x5, 0x5}) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f00000029c0)={0x6, 0x0, {0x7, @usage=0x8000000000000000, r4, 0x5, 0x100, 0x7, 0x8, 0x1, 0xa0, @struct={0xc7, 0x10}, 0x31d, 0x7fffffff, [0x7, 0x3, 0x1, 0x4, 0x4]}, {0x1000, @struct={0x2, 0x8}, r5, 0x0, 0x4, 0x1, 0x200c000, 0x7ffc, 0x46, @usage=0x1, 0x1, 0xc821, [0xecf, 0xc34, 0x7fff, 0xfffffffffffffc01, 0x8, 0xffff]}, {0x703df03f, @struct={0x4, 0x5}, r6, 0xff, 0x5, 0x9, 0x5, 0x100, 0x491, @usage, 0x9, 0x7fffffff, [0x9, 0x400, 0xffffffff, 0x1000000000, 0x0, 0x9]}, {0x6, 0xb, 0x4}}) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000019800)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0xffffffffffffff43, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="000308"], 0x128}, 0x0) (async) recvmsg$unix(r7, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) (async) write$UHID_INPUT(r3, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3591bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22ebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed499cfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a", 0x1000}}, 0x1006) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x12, r3, 0x0) ioctl$PTP_PIN_SETFUNC2(r0, 0x40603d10, &(0x7f0000000200)={'\x00', 0x7fffffff}) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_MAX_BURST(r9, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0, 0x8}, 0x8) (async) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000040)={0x3, 0x980914, 0x3}) (async) write$binfmt_misc(r0, &(0x7f0000000540)="37825b8615f740fc0a4d7ebdd1152b4f580121b487a7c6cc5d5d80e89de1d056ef0d3e8054d575ff5e55842e312cd9797032fa469aaa267d74b803005a9d23abd1d19adc3fb07a343f11c049675539c1b02e48a0c5d97a54e541ad9d68d8c99ea2e9b1b5e38f28687161ba50d842043a4e7247882d665d091271facfdcd87c7fc7282886f520c3bfdd4dc1d5883f70b30c4dd454e9d4c3076e74c24d2718ec9bac1011426537e9da3c1c1553a6561622de8a3deae06e358a92e4abc5ce7105761f0a043a2b71a620be452edfe9a0f049dafffaabc7b7fcbf0e5cbd0bea6c0869299eda2ba9b38700ad4b590f78b0fad814a425a89e878685228c800f5717f0ee9ff644f0f1", 0xfffffffffffffffa) (async) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000000140)=""/104) (async) ioctl$PPPIOCSMRU(r0, 0x40047452, &(0x7f0000000300)=0x26) (async, rerun: 64) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000000400)={r0, 0x10000000, {0x2a00, 0x80010000, 0x0, 0x2, 0x800000000000208, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000020000ffffffffff000000000000000000000100", "2809e8dbe108598948224ad54afac11d875397bd3c5240f45f819e01177d2d458dd4992861ac00", "90bc8b1c551a0023000c547d03d800030000001d0000dfff00", [0x0, 0x6]}}) (async, rerun: 64) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) (async) r10 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r10, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x7ffffffe, {0x3, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x2}}, 0x2e) ioctl$BLKRRPART(0xffffffffffffffff, 0x125f, 0x0) (async, rerun: 64) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f00000000c0)={0x1, 0x6, 0x1}) (rerun: 64) 41.685478577s ago: executing program 2 (id=827): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000001c0)={0x3b, 0x0}) (fail_nth: 2) 41.536136334s ago: executing program 2 (id=828): r0 = socket$inet(0x2, 0x80001, 0x84) bind$inet(r0, &(0x7f0000000180)={0x2, 0xce20, @empty}, 0x10) r1 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2a242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f00000002c0)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(r1, &(0x7f00000000c0), 0x2) read(r1, &(0x7f00000001c0)=""/93, 0x5d) write$USERIO_CMD_SEND_INTERRUPT(r1, &(0x7f0000000440)={0x2, 0xfe}, 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000017c0), r2) sendmsg$NLBL_CALIPSO_C_LIST(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001880)={&(0x7f0000000000)={0x14, r3, 0x1, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x24844}, 0x0) dup2(0xffffffffffffffff, r0) socket$inet(0x2, 0x80001, 0x84) (async) bind$inet(r0, &(0x7f0000000180)={0x2, 0xce20, @empty}, 0x10) (async) openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2a242, 0x0) (async) write$USERIO_CMD_SET_PORT_TYPE(r1, &(0x7f00000002c0)={0x1, 0x5}, 0x2) (async) write$USERIO_CMD_REGISTER(r1, &(0x7f00000000c0), 0x2) (async) read(r1, &(0x7f00000001c0)=""/93, 0x5d) (async) write$USERIO_CMD_SEND_INTERRUPT(r1, &(0x7f0000000440)={0x2, 0xfe}, 0x2) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000017c0), r2) (async) sendmsg$NLBL_CALIPSO_C_LIST(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001880)={&(0x7f0000000000)={0x14, r3, 0x1, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x24844}, 0x0) (async) dup2(0xffffffffffffffff, r0) (async) 41.208763032s ago: executing program 2 (id=829): r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x3, &(0x7f0000000200)=[{0x15, 0x0, 0xfc, 0xb7a}, {0x2c, 0xe, 0x0, 0x3}, {0x6, 0x0, 0x8, 0x7ffffcb9}]}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.stat\x00', 0x275a, 0x0) (async) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000200), 0x20a00, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000480)=0x1) ioctl$TCSETSF2(r2, 0x8910, &(0x7f0000000000)={0x10008a, 0x4, 0x8, 0x2, 0xc, "a533b6aaf9f659ff35036bf79d8b4c2a246305", 0x6, 0x8}) (async) ioctl$BTRFS_IOC_DEFRAG(r0, 0x50009402, 0x0) (async, rerun: 32) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (rerun: 32) pwritev(r3, &(0x7f0000002340)=[{&(0x7f00000020c0)='[', 0x1}], 0x1, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) (async) r4 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x801, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000080)=0x74000000) (async, rerun: 32) write$dsp(r4, &(0x7f0000002000)='`', 0x88020) (rerun: 32) ioprio_set$uid(0x3, 0x0, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000003f0007010000000000000000037c00001800378013000300717472283414d6bba919736d34290000fa541d7e545eb110ab73decf6e47fb3f51010638467cf25926d64f90b7961cd19bd7cc027695eff12b096093e00e927ca64c67d547f1f0cf0496ee6e7ced1763ff6606bd0ad5009b5704ebd436501827972e704aa8a3457a0318d3f4755dbed34f628f560f5396f0ea03f52e63682f70be1c2368f77e"], 0x2c}}, 0x0) (async) r6 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r6, 0xc1105517, &(0x7f0000000240)={{0x0, 0x0, 0x70, 0x8000, 'syz0\x00', 0xffffffff}, 0x3, 0x20000000, 0x7, 0x0, 0x1, 0xfffffffc, 'syz0\x00', &(0x7f0000000180)=['/dev/snd/controlC#\x00'], 0x13}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00000000170000000400", "f4bd000000801900", [0x100000000, 0x8000000000000000]}}) 26.232549575s ago: executing program 32 (id=829): r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x3, &(0x7f0000000200)=[{0x15, 0x0, 0xfc, 0xb7a}, {0x2c, 0xe, 0x0, 0x3}, {0x6, 0x0, 0x8, 0x7ffffcb9}]}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.stat\x00', 0x275a, 0x0) (async) r2 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000200), 0x20a00, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000480)=0x1) ioctl$TCSETSF2(r2, 0x8910, &(0x7f0000000000)={0x10008a, 0x4, 0x8, 0x2, 0xc, "a533b6aaf9f659ff35036bf79d8b4c2a246305", 0x6, 0x8}) (async) ioctl$BTRFS_IOC_DEFRAG(r0, 0x50009402, 0x0) (async, rerun: 32) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (rerun: 32) pwritev(r3, &(0x7f0000002340)=[{&(0x7f00000020c0)='[', 0x1}], 0x1, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) (async) r4 = openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x801, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000080)=0x74000000) (async, rerun: 32) write$dsp(r4, &(0x7f0000002000)='`', 0x88020) (rerun: 32) ioprio_set$uid(0x3, 0x0, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000003f0007010000000000000000037c00001800378013000300717472283414d6bba919736d34290000fa541d7e545eb110ab73decf6e47fb3f51010638467cf25926d64f90b7961cd19bd7cc027695eff12b096093e00e927ca64c67d547f1f0cf0496ee6e7ced1763ff6606bd0ad5009b5704ebd436501827972e704aa8a3457a0318d3f4755dbed34f628f560f5396f0ea03f52e63682f70be1c2368f77e"], 0x2c}}, 0x0) (async) r6 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r6, 0xc1105517, &(0x7f0000000240)={{0x0, 0x0, 0x70, 0x8000, 'syz0\x00', 0xffffffff}, 0x3, 0x20000000, 0x7, 0x0, 0x1, 0xfffffffc, 'syz0\x00', &(0x7f0000000180)=['/dev/snd/controlC#\x00'], 0x13}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00000000170000000400", "f4bd000000801900", [0x100000000, 0x8000000000000000]}}) 7.37299917s ago: executing program 1 (id=1020): bind$tipc(0xffffffffffffffff, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000001c0)={0x3b, &(0x7f0000000140)=[{0x19, '\x00', @st={0x4, [{0x0, @uvalue=0x1}, {0x0, @uvalue=0xfffffffffffffffd}, {0x3, @uvalue=0xc00000000000000}, {0x0, @svalue=0xd83a}]}}]}) 7.355551125s ago: executing program 1 (id=1021): socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_WPAN_PHY(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="08150000000511040000000000000000010000055402010000000000000000080611000000000000f3a9cebc342a903bfbab79968fe9fa43a6"], 0x1508}}, 0x0) r2 = accept$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000000c0)=0x14) writev(r2, &(0x7f0000000900)=[{&(0x7f0000000100)="8e35d85ad46320459751a8921f0fe6212d6fd5d1ef7ed6bffcb286db547b0425aad8defd1cf15a328f4262a4639f1d65970a3871dfb9bbfd248350efdef0333431a07649ac57be58f313faf933dcdc", 0x4f}, {&(0x7f0000000180)="900a8d156206f06c07d5db981ad09ade66a38dd8e2cd9ac3ba880338f0ad6f8d114f5b9156ad11236e959b609e75f7f24b551033ce462f15dc887f12a8f318732adf2d33edcaa2d6c10f203003574d0f06a626f52616e0051cc0538dfcecf57bb508e1d08c4eed7d9e5b972c23a8d840f5371fccfc8a8a4e8c9e622ea00c328584a24870819bab115663e8320aea1a11d910bcdb0031b6f4d32f880d8e8b115f2125158871df581168b48b77e690c15c11cc37", 0xb3}, {&(0x7f0000000240)="f8c7aa65bec9bf160418f72ff0d1c4c82ab745bf52e5bb46e9d0616e66a02cde2227eef7214bc3456d9a427e4c4fcd74cc447155a9b020fc6ba38f0a150445cfa3a21ef889c2ba9c9e9bd78a4a52a62af97c13193e3817c2706b1650f646b2bc26a9cdca968c720234299106c5b37a3166ed8957b71eca096563f3ffd3111011277cdfee3b6d12b6087cac1f7807e434a790b9a02313", 0x96}, {&(0x7f0000000300)="26f70a27f828fb25c7537e0410729c11a906e5096197efa9828b7f876a9fb6be8ca4f982936b1376f24e83cf3fbf92c4733dd848a01d20d886a1ca5cf14d1ab48f469b132042797f93498f3db98fbe8cfca9ce8c4b387092591b", 0x5a}, {&(0x7f0000000380)="dee587f99ab666aeaf80c6f4024375dc1414a7ff01ea34f91f8cf9d14fcd0eef1138cc17348dcb6478c8961761923a090ab15eeaa367be7da36dd157", 0x3c}, {&(0x7f00000003c0)="97867e932f646c68ac065347e913c87f7ad46da4a47be20200e12ef72cedfb865e1149d276f5abee6a973d7ba20e322824594532463d05cfcc06ae6ead8521469ab11cda1327adf81fe60a74c991ecf6d48362139ed5d2b88f0f3495776bbdde6ea143567fc558763660d847a18aed7d0022f40beb3184208aff19682d9d2e171fe00d7b774c94beec2f31b2630b8fb878180e43cfdcff8ad8417d37e488e9e46eb5b78510c84e0b17e64c36b40e21dc04e4668ede6f74ce00ebe54f41a369bf4011dcce93a3cfc4b3621976", 0xcc}, {&(0x7f00000004c0)="909328d3603d017b86f3fc9cfe64509a6f9984ed559d3620b73184aadb8670b2fbaefc43bd50b97cfd4d0023daec7a4ac544f325c338fa5f42beae5961a487b6125a2397deb4557af4d98b5f64af9e9f40660a95c9b571b3891697daf5a191acc445751562caa6e67db333c2f4c162", 0x6f}, {&(0x7f0000000540)="6a431594b5a3a6fbab28d65da5a76d09e01eb71d9174fdc593b34fe61e3b9c17d1ee05a3a8ebd7fe5fb2d7b470f480990b3fde2e090fab1c615a545abbc82594c29360213b27cbd24625c336f833bb892115370c7d1247391d961e3cbbc2ae82827d7236cfaf109aea68f916d3c456f624bd34322f4055f04b8dddf0543235ad5d3e8c85e9976df7fc11aca3bfa77a32dd2286d479ac315ba20b9c022ea1d93049e65f0436840ef107738e4ce81fd92f2c496192757fc1d5525c317c50cda449c8b1d304eccc9d40c780b7237cb703540380226c0686ab7b2f41b37da81ef2f03fab90", 0xe3}, {&(0x7f0000000780)="28a35a515467f2147b557bb195caa0a6ada9a291ac456f9f9cd57d412d9657724af57bcad956549c6a2294c92db8fb732149687c800361713ff388734e1b89f9200318db9d62af9eb5718475938186abecb92d56dfc4aff75392e2deb6d4d9f77a435addfc638de4ec7fd9f5da9d270af4d181b5d349583ece6ca6fc285eba75312e439260b028b29631e4951b4709883f1fcf7fe065d4b133f8397b3cf98aa577b5c8932f67ddd13258a1682abe090a216c11643e4ad2d7c65b40", 0xbb}], 0x9) writev(r0, &(0x7f0000000040), 0x2) syz_usb_connect$uac1(0x2, 0xa5, &(0x7f00000006c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902930003010000070904000000010100000a2401000080020102132406000006000000000000000000000000000924030000000104000924050400f8431cfd0924030007030004070624050400000904010000010200000904010101010200000905010900000000000725018300000009040200000103000009040201"], 0x0) 5.963434924s ago: executing program 1 (id=1024): syz_usb_connect(0x2, 0x3d, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x5f, 0xfc, 0x70, 0x20, 0x711, 0x210, 0xfdd6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x8b, 0x0, 0x2, 0xbe, 0x44, 0x8f, 0xff, [], [{{0x9, 0x5, 0x80, 0x2, 0x3ff, 0x9, 0xf, 0x5, [@generic={0x7, 0x5, "bdf74e3781"}]}}, {{0x9, 0x5, 0x8b, 0x3, 0x40, 0xe, 0x4b, 0x2}}]}}]}}]}}, 0x0) (async) r0 = syz_usb_connect$cdc_ecm(0x3, 0x61, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4f, 0x1, 0x1, 0x3, 0x0, 0x3, [{{0x9, 0x4, 0x0, 0x2, 0x3, 0x2, 0x6, 0x0, 0x8, {{0x8, 0x24, 0x6, 0x0, 0x0, "92c4f8"}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0xd6, 0x3804, 0x401, 0x81}, [@country_functional={0x8, 0x24, 0x7, 0x0, 0x6, [0xa2]}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x20, 0xec, 0x17, 0x1}}], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x2, 0x8, 0x8}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x7f, 0xd, 0xf}}}}}]}}]}}, &(0x7f00000001c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x350, 0x40, 0x5, 0x4, 0x8, 0x40}, 0x1c, &(0x7f0000000100)={0x5, 0xf, 0x1c, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x30, "38510a1a29d4934fb876eb2d2cd9bfa0"}, @ptm_cap={0x3}]}, 0x1, [{0x4a, &(0x7f0000000140)=@string={0x4a, 0x3, "c3243b26900666ebe0e490ab9afd986210d3fed11997e55bae914e326014f8f3dd1a05ac4dcf6aa27f119fe77e5200f4e9de98471baa3a1d9867e753d15e8f7e4786c58625e43bc7"}}]}) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000002c0)={0x14, &(0x7f0000000200)={0x60, 0xf, 0x55, {0x55, 0x3, "0d312a220d5d59ab518b54d547258163aca5f9dc225ab81fc5c6d874353bf10587721b610170d34764eeb2cd659571ffe4aad8608388c6afa95ac990cc5a98096eef7c0c5ee296e1f2930e566619e82df577b8"}}, &(0x7f0000000280)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000440)={0x1c, &(0x7f0000000300)={0x20, 0x0, 0x9a, "17e7089c7e8b8c13ce83de4a537d9e704254d9ccb2a7e2f5f23a21a3588e1b2c5e1110f8d9d6b76a57cbbd367c8292bca8576638324f401c680320d17eef3ca59fd09343593794d0e44bd09601e96efcf666ed5da32e90b08042f80bc169d1dedc390493706253b8d8f917df5d5dd33ac098a8b877a1f5571a633c493cd41523476260abdc887c426ca037e36a5590180b00869c91e16582d28d"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x3a}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0xc}}) 4.673502326s ago: executing program 0 (id=1029): bind$tipc(0xffffffffffffffff, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000001c0)={0x3b, &(0x7f0000000140)=[{0x19, '\x00', @st={0x4, [{0x0, @uvalue=0x1}, {0x0, @uvalue=0xfffffffffffffffd}, {0x3, @uvalue=0x1100000000000000}, {0x0, @svalue=0xd83a}]}}]}) 4.630236433s ago: executing program 0 (id=1030): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000580)=[{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000001c0)="9f1ac09f155c1291fc8baa01adb9b575260400877ef8644bccc1353c6da6123e4e81e2a13e7fcca4b10085ea82589f9511a2f87ee914c9e0894139310b5457cfe7ca3ae3dade5d7a11f014f2bbdec62e2df3daf9875c79c6763fdcb8830f378346bd7c5c71ab8fffc299f6aea8ae05a727e64cbf8c3de5c36604fa3a7f43c2d51832aa29a52a9d0800823bc89a7cc268e91fff7160c2accb039cbf2cfb99a47371db803c3dce71aa0555a2c0fdb6c8e812ac6974d7b3d749bbc7f90a6a79dd2d20ff1637187bf9b58377bd5ae528ea9724f55168710f20afb0040000000000000009255943c5beacc8f0c9140b82f1a835cfd1675c0a83ee32324dd37a901d33d11497fcc9cb46928db1631d0e09b00497628399389129d30e098b5547c985ae9ac28c6cd154fe71cfddd82fb86bf475a11ec27304ff1b1c649cba8392740ba625", 0x141}], 0x1, 0x0, 0x0, 0x44000}], 0x1, 0x0) (async) recvmmsg(r1, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0xffffff0b}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x2, 0x2101, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12012000b0030108021b00010000c0050904c3f801c60738ea06058503080000000000000000000000000000002f1b5c2c1f31dffd00cf921a0920f28ce1b8429610b78b81ed459728330d8f6e"], 0x0) (async) syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x603, 0x600, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x9, 0x40, 0x39, [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x3, 0x1, 0x3, 0x5, {0x9, 0x21, 0xd6f1, 0x3, 0x1, {0x22, 0xd48}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0xae, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0xff, 0xff, 0xe8}}]}}}]}}]}}, &(0x7f00000002c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x200, 0x0, 0xfb, 0x9, 0x20, 0xe}, 0x173, &(0x7f0000000100)={0x5, 0xf, 0x173, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0xc, 0x4, 0x9d2e}, @generic={0xad, 0x10, 0x4, "688c8c00e00d8a4c135a7177f60420c84bc3774817652728754376f91ed6d1c310c8511806f9dc5086a0d05d8218ad65190f28c54381df8432e3f9e3c1568dcc84df07d465996335a9491b10bb854d4bb51962ce3f32c1db5f66c0c361a9ffdc45bee7529802b81b210616d6bc6961beef2ddf1ff80d469114dfbab27a7b4428242d784f2d80b5eacdc0c08c1bcac76203cdc7015547c2c123f0e14908711511d37ed19bb0ea39f25505"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x1, 0xe0, 0x2, 0x7f}, @wireless={0xb, 0x10, 0x1, 0xc, 0x4, 0xec, 0x6, 0xb63a, 0x94}, @wireless={0xb, 0x10, 0x1, 0xc, 0x40, 0x7, 0x4, 0xc865, 0x7}, @generic={0x97, 0x10, 0x1, "e9536c12cddfff62f7ccb27f8db12e82ac3c3b50fe58336ca38cc7e445e719b634d370df04331d7d0c5e617beeb91ea1f293c2480296fcc444c3c374e779446e1b38f3234a2b17b26d7c9516639ed14dcafb51f3a27ca3400f94d040d4982f2aeb29b0756ae67449559ed036329738620a29423fd71c82e833f70906b6884368e7610dda68cd35657537b7e03b50034d0b6dbcf8"}]}, 0x1, [{0x4, &(0x7f0000000280)=@lang_id={0x4}}]}) 4.492336867s ago: executing program 1 (id=1031): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x2, 0x96, 0xd1, 0xca, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0xd, 0x0, 0x6}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r2 = syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000000)={0x2, @pix={0x0, 0x0, 0x59455247}}) ioctl$FE_SET_PROPERTY(r1, 0x40106f52, &(0x7f00000001c0)={0x3b, 0x0}) 3.90491953s ago: executing program 3 (id=1032): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f0000000280)=0x80, 0x4) r1 = accept4$inet6(r0, 0x0, &(0x7f0000000000), 0x1000) connect$inet6(r1, &(0x7f0000000580)={0xa, 0x4e24, 0xa, @dev={0xfe, 0x80, '\x00', 0x28}, 0x4}, 0x1c) 3.831612944s ago: executing program 3 (id=1033): r0 = semget$private(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000000, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xeb9a0000) madvise(&(0x7f000026d000/0x2000)=nil, 0x2000, 0x16) semctl$GETPID(r0, 0x4, 0xb, &(0x7f00000002c0)=""/4096) r1 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r2, 0x26, &(0x7f00000000c0)={0x0, 0x1, 0x1f, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) fremovexattr(r2, &(0x7f0000000040)=@random={'osx.', '/dev/cec#\x00'}) poll(&(0x7f0000000280)=[{r1, 0x2280}], 0x1, 0x2) 3.205306651s ago: executing program 3 (id=1037): r0 = socket$kcm(0x10, 0x2, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80) tee(r1, r1, 0xfffffffdfffffc00, 0x8) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000200)=@multiplanar_overlay={0x9, 0x7, 0x4, 0x0, 0x6, {r2, r3/1000+60000}, {0x5, 0x2, 0xc0, 0xd, 0x1, 0x0, "00107fe1"}, 0x4, 0x3, {&(0x7f0000000180)=[{0x6, 0x4, {0x1}, 0x40}, {0x9, 0x6, {0x1800}, 0x4}]}, 0x475}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x46, 0xfffa}, 0x3a, [0xc001, 0x3, 0xf, 0xb1eb, 0x20080, 0x7, 0x3, 0x2, 0x2000000a, 0x20000000, 0x8, 0x5f, 0x9, 0x5, 0xffff2d37, 0x1002, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x0, 0x7, 0x3c1b, 0x2, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0x8e660, 0x4, 0x7, 0x3, 0x1, 0x4c74, 0x80000000, 0x242, 0x6, 0x10, 0x0, 0x8071, 0x7, 0x6, 0xffffffff, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x3, 0xa8000000, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x10000005, 0x8000012d, 0x8004, 0x5, 0xfffffff3, 0x129432e2, 0xc8, 0xf9, 0xe, 0x2bf, 0x1, 0x9, 0xfffffffc, 0x4, 0x7f6fdd94, 0x0, 0x8, 0x30, 0xe, 0x4, 0x78, 0x5, 0xfff, 0x4, 0x7, 0x7fff, 0x5, 0x1, 0x401, 0x6, 0x1, 0xff, 0x5, 0x7cb, 0x5f31, 0x1000d, 0x4e0, 0x2, 0x4, 0xb, 0x200, 0x9, 0x4, 0x40000d, 0xe1, 0x44, 0x8000, 0x1, 0xfe000000, 0xfffd, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x5, 0xfffffff8, 0x3], [0x5, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x7, 0x5, 0x8, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x2, 0x8, 0x86, 0x3, 0x303c, 0x13e7, 0xb, 0xc, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x3, 0x10800003, 0x200, 0xaf8, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x2000005, 0x6, 0xaca, 0xbe, 0x4002, 0x23, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x9, 0x1c, 0x120000, 0x3, 0x1, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb2f, 0x7, 0x9, 0x5, 0x938, 0x6, 0x6, 0x12, 0xb9, 0xce7, 0x1ff, 0x2, 0xfffffffb, 0x5, 0x3, 0x101, 0x2010000, 0xc, 0x7fff, 0xffff, 0xa620, 0x134, 0x78b, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0x1, 0xfffff000, 0x5, 0x8000003, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x101, 0xa1f, 0xf44, 0x7, 0x1, 0x6c18, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0x1ff, 0xfffffffb]}, 0x45c) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) writev(r4, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x5603d}], 0x1) sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000007140100000032c83a110000050042"], 0x18}}, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000001, 0x10, r0, 0x1af34000) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080010000000e8fe55a1180015000600142603600e120500210000000401a8001600a400014020000300feffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000580)="6700000011008188041f56ecdb4cb9cca7480ef432000000e3bd6efb440009000e000a0010000000ba80010009005a8c3774fa0af3dc59a933c1e7a6d3361d83b20000319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f09cdc2649f", 0x67}], 0x1}, 0x20000000) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) 2.708995204s ago: executing program 3 (id=1038): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x3d) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000200)={@initdev={0xfe, 0x88, '\x00', 0xff, 0x0}, @private2, @mcast1, 0xa, 0x0, 0x6, 0x0, 0x4000000000000009, 0x10200}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, 0x0, 0x29) r3 = socket$unix(0x1, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x54, 0x0, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000000)=0x3) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000000540)={{0x0, 0x0, 0x0, 0x0, '\x00', 0x2}, 0x6, 0x2, 0x2, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) read$proc_mixer(0xffffffffffffffff, &(0x7f0000000680)=""/208, 0xd0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r6, &(0x7f0000002140)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000000440)={0x50, 0xb, r7, {0x7, 0x29, 0xfffffffd, 0xffffffff80000000, 0xfffc, 0x2, 0x86b, 0x2, 0x0, 0x0, 0x0, 0xffffffff}}, 0x50) openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x0, 0x3) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r4, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x7, 0xfffffffffffffffc, 0x0, 0x2, 0x7fffffffffffffff, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x9, 0x4, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200000000, 0x1, 0x0, 0xfffffffffffffffe, 0x0, 0x2, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0xed9b, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x0, 0x4, 0x0, 0x4, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff]}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) 2.521539785s ago: executing program 4 (id=1039): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="f0000000100001000000000000000000fe8000000000000000000000000000aaffffffff00000000000000000000000000000000000000000a00200089000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac140614bb0000000000000000000000000001697500000033000300fc0200000000000000000000000000010080000000000000ffffffff"], 0xf0}}, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b904021d080225000000040000a118000200fcffffff00000e1208000f0100810401a80016ea1f0006", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) (async) r0 = socket$kcm(0x10, 0x2, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) (async) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r5, 0xc058534f, &(0x7f00000000c0)={{}, 0x2}) (async) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="8c020000", @ANYRES16=r3, @ANYBLOB="010027bd7000fcdbdf250300000008000100", @ANYRES32=r4], 0x28c}}, 0x40080) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b9040a", 0x11}], 0x1, 0x0, 0x0, 0x7400}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000580)=ANY=[], 0xfe33) 2.387962034s ago: executing program 4 (id=1040): socket$key(0xf, 0x3, 0x2) r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0xa) fchdir(r1) socket$kcm(0xa, 0x3, 0x87) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) r4 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) getdents64(r4, &(0x7f0000000040)=""/53, 0x2457a0be381e3a04) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) (fail_nth: 1) 1.791929981s ago: executing program 4 (id=1041): socket$key(0xf, 0x3, 0x2) r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0xa) fchdir(r1) socket$kcm(0xa, 0x3, 0x87) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2800003, 0x31, 0xffffffffffffffff, 0x231cd000) madvise(&(0x7f0000d9c000/0x1000)=nil, 0x1000, 0x17) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000300)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f00000001c0)={'ip_vti0\x00', @multicast}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) getdents64(r5, &(0x7f0000000040)=""/53, 0x2457a0be381e3a04) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) syz_open_procfs(r6, &(0x7f0000000140)='syscall\x00') 1.617996146s ago: executing program 4 (id=1042): socket$kcm(0xa, 0x5, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bind$packet(r0, &(0x7f0000000180)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) pipe2(0x0, 0x0) fcntl$addseals(0xffffffffffffffff, 0x409, 0x47e8c3b29599b862) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000700)={0x14, r4, 0x967d0b0e403bb733, 0x70bd2d, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4010}, 0x24044004) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 1.529509289s ago: executing program 0 (id=1043): r0 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1000000000000000100100"], 0x10}, 0xfc00) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0xf1, @empty, 0x19f4929}], 0x1c) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r3, 0x0, 0xcc, &(0x7f0000000280)={@broadcast, @multicast1, 0x0, "7ea97ddb2ac127ffa5b7216fe75ebaa2855a422a8bf8ec7caf003751804500", 0x0, 0xfffffffd, 0x4, 0xfffffffe}, 0x3c) setsockopt$MRT_ADD_MFC(r3, 0x0, 0xcc, &(0x7f0000000200)={@empty, @private, 0x0, "606b177019716ea6ff1f4d7ed79c31e2e0f1da00000000230000002000", 0x1, 0x0, 0x3}, 0x3c) setsockopt$MRT_FLUSH(r3, 0x0, 0xd4, &(0x7f00000003c0)=0xa, 0x4) listen(r2, 0x100) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r4, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x22}}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000140)='z', 0x1}], 0x1, 0x0, 0x0, 0x48d5}, 0x8050) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x9, 0x0, 0x8a, 0x0, 0x0, 0x2000000, 0x0, 0xfffffffe}}) socket$kcm(0x29, 0x5, 0x0) 1.284685927s ago: executing program 3 (id=1044): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x80, 0x0, 0x10, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "228d3097ec3ae24f048ecbb1e50d1fb6"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="e5df6112c244"}, @NL80211_ATTR_PMK={0x14, 0xfe, "b018c0b8a027052efb01812fb6e14c7d"}, @NL80211_ATTR_PMK={0x14, 0xfe, "31ead256dd6a69765e88ea4916eb85ed"}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x7}, @NL80211_ATTR_PMK={0x14, 0xfe, "10c182f2b04aad658576afedb3e99251"}]}, 0x80}, 0x1, 0x0, 0x0, 0x4040}, 0x20000000) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r1, 0x100, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) (async) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f00000002c0), r0) (async) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x64, &(0x7f0000000300), &(0x7f0000000340)=0x4) (async) sendmsg$TIPC_NL_MON_GET(r0, &(0x7f0000000640)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000600)={&(0x7f00000003c0)={0x22c, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0xcc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffff0}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1cf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfe000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd28}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x59b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_NET={0x4}, @TIPC_NLA_NODE={0x90, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3d, 0x4, {'gcm(aes)\x00', 0x15, "b4de9a9fcf7af9859236644eb551ef133b45e1b34c"}}, @TIPC_NLA_NODE_KEY={0x42, 0x4, {'gcm(aes)\x00', 0x1a, "93c0b071e6d2e7c5ee8e2ac8109d40077659e6e63176c06e38b8"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x17a9}]}, @TIPC_NLA_SOCK={0x68, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfe}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1000}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x81}, @TIPC_NLA_SOCK_CON={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xd}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xf97}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0x50, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x22c}, 0x1, 0x0, 0x0, 0x801}, 0x48080) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000680)={{0x1, 0x1, 0x18, r0, {0x9f8}}, './file0\x00'}) getsockopt$inet6_tcp_int(r4, 0x6, 0x18, &(0x7f00000006c0), &(0x7f0000000700)=0x4) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000008, 0x11, r0, 0x73712000) (async) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), r4) sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x54, r5, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}]}, @TIPC_NLA_LINK={0x30, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xca93}]}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8011}, 0x4000004) (async) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r4, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x28, r1, 0x300, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x8001, 0x18}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4) (async) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000009c0)='/sys/kernel/vmcoreinfo', 0x400902, 0xc8) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000a40), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r7, &(0x7f0000000b00)={&(0x7f0000000a00), 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x30, r8, 0x10, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_MAX_FRAME_RETRIES={0x5, 0xf, 0x1}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040050}, 0x4) (async) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r4, 0xc018937c, &(0x7f0000000b40)={{0x1, 0x1, 0x18}, './file0\x00'}) (async) r9 = openat$cgroup_ro(r4, &(0x7f0000000b80)='rdma.current\x00', 0x0, 0x0) bind$phonet(r9, &(0x7f0000000bc0)={0x23, 0x4, 0xd}, 0x10) (async) ioctl$EXT4_IOC_SETFSUUID(r9, 0x4008662c, &(0x7f0000000c00)={0x10, 0x0, "1bd170d5c8f0fe219cecb38afb14f429"}) socket$phonet_pipe(0x23, 0x5, 0x2) sendmsg$SEG6_CMD_SET_TUNSRC(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c80)={0x38, r3, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0xfe}, @SEG6_ATTR_DST={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x2b}}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x40]}]}, 0x38}}, 0x4008090) (async) socket$phonet_pipe(0x23, 0x5, 0x2) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000d40)={'wlan1\x00'}) (async) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f0000000d80)={"c0778d64d98b8056bb5f7a9645da6515f3c3a0cf1be0e53d2f75e357133fcb06", r6, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r9, 0xc01864c2, &(0x7f0000000dc0)={0x0, 0x1, r10}) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000e00), r7) (async) getsockopt$bt_BT_VOICE(r4, 0x112, 0xb, &(0x7f0000000e40)=0x7, &(0x7f0000000e80)=0x2) 1.221362529s ago: executing program 0 (id=1045): r0 = semget$private(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000000, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xeb9a0000) madvise(&(0x7f000026d000/0x2000)=nil, 0x2000, 0x16) semctl$GETPID(r0, 0x4, 0xb, &(0x7f00000002c0)=""/4096) r1 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r2, 0x26, &(0x7f00000000c0)={0x0, 0x1, 0x1f, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) poll(&(0x7f0000000280)=[{r1, 0x2280}], 0x1, 0x2) 1.191029605s ago: executing program 3 (id=1046): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x3, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="120110012b95d908e204121410ca01020301090212000102faa0bf0904000800080662007ba66e9af975b4105f9a2d4b63ff0b365ef37aedd392133d3b339a0ea255f84e991ebee315cfc63c07240282b0cae98030c1ce4cceb3fa1f5a10549877afb02219ef3e618f47e134372b9ced399762086be7659c247bc22c10e618ae9460e54d99ab6351b71e0f2ec28a915f60d0f9ce4c5214a0a1bcf9fe957523aab0d678f89a5e609cf79af35fde5ced48bda4c0fb4fc4d4fd2e4bec42b23cbff50255fd637ffe216df39545e7ba86bcf5fc86f40ed003ce081d7d8010dabcd9"], 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653d303030303030303030303030303030303034303030302c757365725f09643d8e283d6fe2af1560bc4f81e7dd4696ea6e51c0ab66478c8076d9493e4ce659b6f83468bc577bac756cd9de60d03d41e552828fcfa23b37a9b8f7b1839fd00bbb8aa208000000000000003f8a8e7f33cb598064eab61f0f4869b0c837e2dda8", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x82, 0x0) syz_fuse_handle_req(r1, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f0000004280)={0x50}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0xfffffff9, 0x0, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r4 = gettid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x6, 0x7fc00100}]}) cachestat(r3, 0x0, 0x0, 0x0) tkill(r4, 0x7) close_range(r3, 0xffffffffffffffff, 0x0) setitimer(0x1, &(0x7f0000001d80)={{0x77359400}, {0x0, 0x2710}}, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000940)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r6 = accept$alg(r5, 0x0, 0x0) write$binfmt_script(r6, &(0x7f0000000600), 0xfec8) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r6, 0x0, r7, 0x0, 0x7, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="b800000019000100fdffffff00000000e00000020000000000000000000000000000e5ffffff0000000000000000080100000000000000000a0000008700000047380f9543ee492ae7feb13980a97d0d398b75a74e7b3fea8b908807bbc57890c7dd9fd67dac689e0b51b47407531192a347360010b3a23243fd8a4036837d5394e831749785b09ce9a9b0a87933dcf2bcda841371492bcc72", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000003000000000000000000000000000000030000000000000000000000000000000000000000000000fbfffffffffffffffdffffffffffffff00000000000000000000000000000000fdffffffffffffff01000000000000000001000100000000"], 0xb8}, 0x1, 0x0, 0x0, 0x4}, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="b80000001900010027bd700000000000e00000020000000000000000000000000000000000000000000000000000000001fe0000000000000a00000029000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000700000000000000080000000000000000000000000000000200080000000000400000000000000000000000000000000000000000000000000000000000000000ffffffff00"/112], 0xb8}}, 0x4004) syz_fuse_handle_req(r1, &(0x7f0000004300), 0x2000, &(0x7f0000006300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000063c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000006ffff00000a40000000060a0b16000000000000000002000004140004801000018008000100636d7000040002800900891bf6110000000000000900020073797a3200000000140000001100010000000000000000000000000a836624edfaf467e6122ff7446ee4aaa0afdb41677037b3308d692b0b3e27f0f67890284f6d817a8c789c714c9bde7ad2f17fd464c7101f16f760fa8ece95e9acd6320eb55969552bd34c63e6d0536c451b6a000000000000000000"], 0x68}, 0x1, 0x0, 0x0, 0x850}, 0x0) 1.105747327s ago: executing program 4 (id=1047): r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000000406fd020000000000000000050000060500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x8020}, 0x84) 1.038996s ago: executing program 4 (id=1048): pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=@migrate={0xa0, 0x21, 0x5, 0x0, 0x0, {{@in=@private=0xa010102, @in=@local, 0x4e20, 0x0, 0x4e24, 0x0, 0xa, 0x0, 0x80, 0x2c}, 0x6e6bbd}, [@migrate={0x50, 0x11, [{@in6=@local, @in=@local, @in=@empty, @in=@rand_addr=0x64010102, 0xff, 0x4, 0x0, 0x3506, 0xa, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x6a8dd86ef567f079}, 0x24024810) r3 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r3, &(0x7f0000000040)={0x18, 0x2, {0x0, @dev}}, 0x1e) close_range(r0, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = add_key$keyring(&(0x7f0000000240), &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000440)='asymmetric\x00', 0x0, &(0x7f0000000000)="30800201", 0x1001, r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) sendmsg$NL80211_CMD_GET_REG(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="00002dbd7000fbdbdf251f0044a5ecc841000008009a00010000000400cc000500010000000400cc0004"], 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x4044) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) syz_usb_connect(0x5, 0x51, &(0x7f0000002480)=ANY=[@ANYBLOB="120101024cf1c50863070210845f0102030109023f0001000000000904000005ff87e7000905880f000000000009050300000000000009050cfeffff01060209050f000000000000090507"], &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x8012a) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="31070000000000000000380000000e0001006e657464657673696d0000002d0002006e657464657673696d30000008007300000000000e0001006e986cdd3694e98dad0000000f0002006e657464657673696d3000000800030003000000"], 0x64}, 0x1, 0x2, 0x0, 0x1bb5818a0d17d3a}, 0xc890) 608.47107ms ago: executing program 1 (id=1049): socket$key(0xf, 0x3, 0x2) r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0xa) fchdir(r1) socket$kcm(0xa, 0x3, 0x87) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) r4 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) getdents64(r4, &(0x7f0000000040)=""/53, 0x2457a0be381e3a04) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) (fail_nth: 2) 533.179298ms ago: executing program 0 (id=1050): socket$key(0xf, 0x3, 0x2) r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0xa) fchdir(r1) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(r2, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f00000007c0)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c050}, 0x1) r3 = dup(r2) recvfrom$inet6(r3, 0x0, 0x0, 0x20, &(0x7f0000000300)={0xa, 0x4e22, 0x101, @private0={0xfc, 0x0, '\x00', 0x1}, 0x3}, 0x1c) socket$kcm(0xa, 0x3, 0x87) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x2003}) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) r5 = syz_open_dev$sg(&(0x7f0000000280), 0x5dc, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)={0x0, 0xe, 0x55}) r6 = socket$kcm(0x2, 0xa, 0x2) r7 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_QUERYCTRL(r7, 0xc0445624, &(0x7f0000000100)={0x8000004, 0x0, "7eb07d82287af45095b338f9ebf9b45c9041dbac2c227be9b033f71f8edccf09"}) r8 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) getdents64(r8, &(0x7f0000000040)=""/53, 0x2457a0be381e3a04) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 450.577µs ago: executing program 1 (id=1051): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = semget$private(0x0, 0x20000000102, 0x0) semop(r0, &(0x7f0000000240)=[{0x1, 0xe65b}], 0x1) setsockopt$MRT_PIM(0xffffffffffffffff, 0x0, 0xcf, &(0x7f0000000000)=0x4, 0x4) 0s ago: executing program 0 (id=1052): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f00000001c0)={0x39, &(0x7f0000000040)=[{0x14, '\x00', @data=0x48af, 0x6}]}) kernel console output (not intermixed with test programs): 0x2 has an invalid bInterval 0, changing to 7 [ 203.233739][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 203.240637][ T10] usb 2-1: New USB device found, idVendor=1b1c, idProduct=1c09, bcdDevice= 0.00 [ 203.250222][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.261151][ T10] usb 2-1: config 0 descriptor?? [ 203.306182][ T8101] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 203.675335][ T10] corsair-psu 0003:1B1C:1C09.000D: unknown main item tag 0x7 [ 203.689731][ T10] corsair-psu 0003:1B1C:1C09.000D: hidraw0: USB HID v4.08 Device [HID 1b1c:1c09] on usb-dummy_hcd.1-1/input0 [ 203.871671][ T8099] dlm: plock device version mismatch: kernel (1.2.0), user (1.6.16) [ 204.035984][ T1208] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 204.050581][ T1208] asix 4-1:0.188: probe with driver asix failed with error -71 [ 204.064388][ T795] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 204.073709][ T1208] usb 4-1: USB disconnect, device number 46 [ 204.145593][ T10] corsair-psu 0003:1B1C:1C09.000D: unable to initialize device (-110) [ 204.165870][ T10] corsair-psu 0003:1B1C:1C09.000D: probe with driver corsair-psu failed with error -110 [ 204.193089][ T10] usb 2-1: USB disconnect, device number 54 [ 204.234146][ T795] usb 1-1: Using ep0 maxpacket: 32 [ 204.247567][ T795] usb 1-1: unable to get BOS descriptor or descriptor too short [ 204.261581][ T8132] binder: 8131:8132 ioctl 5429 200000000000 returned -22 [ 204.261975][ T795] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 204.284198][ T795] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 204.293758][ T795] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.303175][ T795] usb 1-1: Product: syz [ 204.307673][ T795] usb 1-1: Manufacturer: syz [ 204.312387][ T795] usb 1-1: SerialNumber: syz [ 204.488460][ T8138] netlink: 12 bytes leftover after parsing attributes in process `syz.1.677'. [ 204.531667][ T795] usb 1-1: Limiting number of CPorts to U8_MAX [ 204.542656][ T795] usb 1-1: Not enough endpoints found in device, aborting! [ 204.593984][ T1208] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 204.736391][ T979] usb 1-1: USB disconnect, device number 53 [ 204.755278][ T1208] usb 3-1: Using ep0 maxpacket: 16 [ 204.762154][ T1208] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 204.776408][ T1208] usb 3-1: New USB device found, idVendor=05ac, idProduct=0272, bcdDevice= 0.00 [ 204.785723][ T1208] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 204.805120][ T1208] usb 3-1: config 0 descriptor?? [ 204.825550][ T1208] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input28 [ 204.942427][ T30] audit: type=1326 audit(1770369122.057:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8128 comm="syz.3.673" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7feffd59aeb9 code=0x7fc00000 [ 205.024063][ T5177] bcm5974 3-1:0.0: could not read from device [ 205.025247][ T1208] usb 3-1: USB disconnect, device number 52 [ 205.052547][ T5837] bcm5974 3-1:0.0: could not read from device [ 205.533994][ T1208] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 205.694464][ T1208] usb 4-1: Using ep0 maxpacket: 32 [ 205.701226][ T1208] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 205.709960][ T1208] usb 4-1: config 0 has no interface number 0 [ 205.717294][ T1208] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 205.728769][ T1208] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 205.738757][ T1208] usb 4-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 205.748918][ T1208] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.759261][ T1208] usb 4-1: config 0 descriptor?? [ 205.794028][ T979] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 205.895881][ T24] usb 3-1: new full-speed USB device number 53 using dummy_hcd [ 205.947764][ T979] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 205.957001][ T979] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.965073][ T979] usb 2-1: Product: syz [ 205.969258][ T979] usb 2-1: Manufacturer: syz [ 205.976136][ T979] usb 2-1: SerialNumber: syz [ 205.984342][ T979] usb 2-1: config 0 descriptor?? [ 206.056507][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 206.067992][ T24] usb 3-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 206.077710][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.090284][ T24] usb 3-1: config 0 descriptor?? [ 206.171435][ T8161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 206.180641][ T8161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 206.218525][ T979] usb-storage 2-1:0.0: USB Mass Storage device detected [ 206.236227][ T1208] usbhid 4-1:0.1: can't add hid device: -71 [ 206.242310][ T1208] usbhid 4-1:0.1: probe with driver usbhid failed with error -71 [ 206.257169][ T1208] usb 4-1: USB disconnect, device number 47 [ 206.301658][ T24] usb 3-1: string descriptor 0 read error: -71 [ 206.319282][ T24] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input29 [ 206.336729][ T5177] bcm5974 3-1:0.0: could not read from device [ 206.346411][ T5177] bcm5974 3-1:0.0: could not read from device [ 206.361751][ T5177] bcm5974 3-1:0.0: could not read from device [ 206.370225][ T5177] bcm5974 3-1:0.0: could not read from device [ 206.372785][ T24] usb 3-1: USB disconnect, device number 53 [ 206.384697][ T5177] bcm5974 3-1:0.0: could not read from device [ 206.391718][ T5177] bcm5974 3-1:0.0: could not read from device [ 206.400331][ T5982] bcm5974 3-1:0.0: could not read from device [ 206.414880][ T5982] udevd[5982]: setting mode of /dev/input/event5 to 020660 failed: No such file or directory [ 206.427273][ T5982] udevd[5982]: setting owner of /dev/input/event5 to uid=0, gid=104 failed: No such file or directory [ 206.440406][ T29] usb 2-1: USB disconnect, device number 55 [ 206.803749][ T8181] sit0: entered promiscuous mode [ 206.827071][ T8181] validate_nla: 24 callbacks suppressed [ 206.827094][ T8181] netlink: 'syz.3.691': attribute type 1 has an invalid length. [ 206.863997][ T8181] netlink: 1 bytes leftover after parsing attributes in process `syz.3.691'. [ 207.000858][ T8189] netlink: 14 bytes leftover after parsing attributes in process `syz.1.694'. [ 207.187382][ T5874] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 207.334329][ T5874] usb 4-1: Using ep0 maxpacket: 32 [ 207.344553][ T5874] usb 4-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 207.357269][ T5874] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 207.368755][ T5874] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 207.385564][ T5874] usb 4-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=75.9e [ 207.395201][ T5874] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.404006][ T5874] usb 4-1: Product: syz [ 207.409104][ T5874] usb 4-1: Manufacturer: syz [ 207.413738][ T5874] usb 4-1: SerialNumber: syz [ 207.422855][ T5874] usb 4-1: config 0 descriptor?? [ 207.439069][ T8211] netlink: 'syz.1.700': attribute type 61 has an invalid length. [ 207.447322][ T8211] netlink: 16 bytes leftover after parsing attributes in process `syz.1.700'. [ 207.458271][ T24] usb 3-1: new full-speed USB device number 54 using dummy_hcd [ 207.616637][ T24] usb 3-1: unable to get BOS descriptor or descriptor too short [ 207.625331][ T24] usb 3-1: not running at top speed; connect to a high speed hub [ 207.635920][ T24] usb 3-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 207.641034][ T5874] usb 4-1: USB disconnect, device number 48 [ 207.646736][ T24] usb 3-1: config 129 has 0 interfaces, different from the descriptor's value: 1 [ 207.668342][ T24] usb 3-1: string descriptor 0 read error: -22 [ 207.676976][ T24] usb 3-1: New USB device found, idVendor=19d2, idProduct=0178, bcdDevice=c2.c8 [ 207.687366][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.905750][ T24] usb 3-1: USB disconnect, device number 54 [ 208.194207][ T5874] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 208.347249][ T5874] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 208.360520][ T5874] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 208.370321][ T5874] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.384204][ T5874] usb 1-1: config 0 descriptor?? [ 208.400433][ T8222] loop5: detected capacity change from 0 to 7 [ 208.411367][ T5837] Dev loop5: unable to read RDB block 7 [ 208.417762][ T5837] loop5: unable to read partition table [ 208.424291][ T5837] loop5: partition table beyond EOD, truncated [ 208.433445][ T8222] Dev loop5: unable to read RDB block 7 [ 208.441311][ T8222] loop5: unable to read partition table [ 208.447969][ T8222] loop5: partition table beyond EOD, truncated [ 208.455434][ T8222] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 208.574014][ T24] usb 4-1: new full-speed USB device number 49 using dummy_hcd [ 208.726452][ T24] usb 4-1: config 0 has an invalid interface number: 214 but max is 0 [ 208.734779][ T24] usb 4-1: config 0 has no interface number 0 [ 208.741144][ T24] usb 4-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 208.753536][ T24] usb 4-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 208.763634][ T24] usb 4-1: New USB device strings: Mfr=1, Product=0, SerialNumber=3 [ 208.771853][ T24] usb 4-1: Manufacturer: syz [ 208.774005][ T979] usb 3-1: new full-speed USB device number 55 using dummy_hcd [ 208.776692][ T24] usb 4-1: SerialNumber: syz [ 208.792511][ T24] usb 4-1: config 0 descriptor?? [ 208.844060][ T10] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 208.935687][ T979] usb 3-1: config 1 has an invalid interface number: 32 but max is 1 [ 208.943993][ T979] usb 3-1: config 1 has no interface number 0 [ 208.950916][ T979] usb 3-1: config 1 interface 32 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 208.962278][ T979] usb 3-1: config 1 interface 32 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 208.974838][ T979] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 208.985879][ T979] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 208.996805][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 209.003637][ T8214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 209.014805][ T8214] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 209.023793][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 209.036402][ T979] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 209.038595][ T8214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 209.045726][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 209.045757][ T10] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 209.045810][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 209.059649][ T8214] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 209.064371][ T979] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 209.102565][ T10] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 209.113035][ T10] usb 2-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 209.122432][ T979] usb 3-1: Product: syz [ 209.127122][ T979] usb 3-1: Manufacturer: syz [ 209.131788][ T979] usb 3-1: SerialNumber: syz [ 209.136796][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.155897][ T8225] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 209.165796][ T10] usb 2-1: config 0 descriptor?? [ 209.174550][ T8229] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 209.263561][ T5874] keytouch 0003:0926:3333.000E: fixing up Keytouch IEC report descriptor [ 209.290121][ T5874] input: HID 0926:3333 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0926:3333.000E/input/input31 [ 209.378122][ T8224] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 209.406455][ T8224] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 209.430566][ T5874] keytouch 0003:0926:3333.000E: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.0-1/input0 [ 209.511337][ T24] input: syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.214/input/input30 [ 209.599981][ T10] usb 2-1: USB disconnect, device number 56 [ 209.601034][ T5825] Bluetooth: hci4: Opcode 0x0c03 failed: -71 [ 209.707442][ T5874] usb 4-1: USB disconnect, device number 49 [ 209.734917][ T979] cdc_ncm 3-1:1.32: bind() failure [ 209.786227][ T979] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 209.818300][ T979] cdc_ncm 3-1:1.1: bind() failure [ 209.893141][ T979] usb 3-1: USB disconnect, device number 55 [ 210.146263][ T8244] pim6reg: entered allmulticast mode [ 210.209486][ T8247] netlink: 'syz.1.712': attribute type 2 has an invalid length. [ 210.234694][ T8247] netlink: 'syz.1.712': attribute type 2 has an invalid length. [ 210.270993][ T8247] netlink: 'syz.1.712': attribute type 2 has an invalid length. [ 210.286049][ T8247] netlink: 'syz.1.712': attribute type 2 has an invalid length. [ 210.380385][ T8256] loop5: detected capacity change from 0 to 7 [ 210.389978][ T8256] Dev loop5: unable to read RDB block 7 [ 210.395737][ T8256] loop5: unable to read partition table [ 210.403793][ T8256] loop5: partition table beyond EOD, truncated [ 210.414180][ T8256] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 210.594660][ T795] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 210.763959][ T795] usb 4-1: Using ep0 maxpacket: 32 [ 210.776281][ T795] usb 4-1: config 3 has an invalid interface number: 202 but max is 0 [ 210.784969][ T795] usb 4-1: config 3 has no interface number 0 [ 210.792527][ T795] usb 4-1: config 3 has an invalid interface number: 202 but max is 0 [ 210.794070][ T979] usb 3-1: new low-speed USB device number 56 using dummy_hcd [ 210.800947][ T795] usb 4-1: config 3 has no interface number 0 [ 210.819002][ T795] usb 4-1: New USB device found, idVendor=0b95, idProduct=178a, bcdDevice=b0.61 [ 210.828681][ T795] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.836874][ T795] usb 4-1: Product: syz [ 210.841231][ T795] usb 4-1: Manufacturer: syz [ 210.849877][ T795] usb 4-1: SerialNumber: syz [ 210.987741][ T10] usb 1-1: USB disconnect, device number 54 [ 210.999274][ T979] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 211.018766][ T979] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 211.036684][ T979] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 211.047825][ T979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.068159][ T979] usb 3-1: config 0 descriptor?? [ 211.096315][ T5874] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 211.123174][ T979] usb 4-1: USB disconnect, device number 50 [ 211.280181][ T8262] binder: 8261:8262 ioctl c018620c 200000000080 returned -22 [ 211.288919][ T5874] usb 2-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice=c6.98 [ 211.299080][ T5874] usb 2-1: New USB device strings: Mfr=14, Product=0, SerialNumber=0 [ 211.307457][ T5874] usb 2-1: Manufacturer: syz [ 211.332354][ T5874] usb 2-1: config 0 descriptor?? [ 211.342987][ T5874] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 211.361749][ T5874] ftdi_sio ttyUSB0: unknown device type: 0xc698 [ 211.501646][ T8284] loop5: detected capacity change from 0 to 7 [ 211.509122][ T8284] Dev loop5: unable to read RDB block 7 [ 211.515282][ T8284] loop5: unable to read partition table [ 211.521298][ T8284] loop5: partition table beyond EOD, truncated [ 211.528461][ T8284] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 211.558922][ T795] usb 2-1: USB disconnect, device number 57 [ 211.589385][ T795] ftdi_sio 2-1:0.0: device disconnected [ 211.791315][ T8293] netlink: 8 bytes leftover after parsing attributes in process `syz.3.729'. [ 211.882239][ T979] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 211.927486][ T5836] Bluetooth: hci2: command 0x2016 tx timeout [ 211.927494][ T5142] Bluetooth: hci1: command 0x0406 tx timeout [ 211.927546][ T5825] Bluetooth: hci3: command 0x0406 tx timeout [ 211.993267][ T8296] netlink: 52 bytes leftover after parsing attributes in process `syz.3.730'. [ 212.007173][ T8296] netlink: 52 bytes leftover after parsing attributes in process `syz.3.730'. [ 212.017432][ T8296] netlink: 52 bytes leftover after parsing attributes in process `syz.3.730'. [ 212.045579][ T979] usb 1-1: Using ep0 maxpacket: 8 [ 212.053277][ T979] usb 1-1: config 11 has an invalid interface number: 206 but max is 0 [ 212.063443][ T979] usb 1-1: config 11 has no interface number 0 [ 212.083939][ T979] usb 1-1: config 11 interface 206 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 212.095737][ T979] usb 1-1: config 11 interface 206 altsetting 0 endpoint 0xD has invalid maxpacket 1024, setting to 64 [ 212.107202][ T979] usb 1-1: config 11 interface 206 altsetting 0 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 212.128176][ T979] usb 1-1: New USB device found, idVendor=1038, idProduct=4029, bcdDevice=9a.18 [ 212.137628][ T979] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.166633][ T979] usb 1-1: Product: syz [ 212.170981][ T979] usb 1-1: Manufacturer: syz [ 212.177154][ T979] usb 1-1: SerialNumber: syz [ 212.235497][ T8301] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 212.421120][ T979] usb 1-1: USB disconnect, device number 55 [ 212.579125][ T8315] loop5: detected capacity change from 0 to 7 [ 212.600118][ T5982] Dev loop5: unable to read RDB block 7 [ 212.613986][ T5982] loop5: unable to read partition table [ 212.626563][ T5982] loop5: partition table beyond EOD, truncated [ 212.634935][ T8315] Dev loop5: unable to read RDB block 7 [ 212.643724][ T8315] loop5: unable to read partition table [ 212.654579][ T8315] loop5: partition table beyond EOD, truncated [ 212.683920][ T8315] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 212.786413][ T8326] workqueue: Failed to create a rescuer kthread for wq "xfs-buf/nullb0": -EINTR [ 213.082680][ T8344] netlink: 'syz.0.745': attribute type 1 has an invalid length. [ 213.100568][ T8344] netlink: 'syz.0.745': attribute type 2 has an invalid length. [ 213.108462][ T8344] netlink: 'syz.0.745': attribute type 1 has an invalid length. [ 213.117163][ T8344] netlink: 'syz.0.745': attribute type 3 has an invalid length. [ 213.125571][ T8344] netlink: 4 bytes leftover after parsing attributes in process `syz.0.745'. [ 213.209228][ T8352] loop5: detected capacity change from 0 to 7 [ 213.216417][ T8352] Dev loop5: unable to read RDB block 7 [ 213.222016][ T8352] loop5: unable to read partition table [ 213.229046][ T8352] loop5: partition table beyond EOD, truncated [ 213.235933][ T8352] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 213.266799][ T979] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 213.352984][ T8354] Invalid ELF header magic: != ELF [ 213.405372][ T10] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 213.444121][ T979] usb 4-1: Using ep0 maxpacket: 16 [ 213.455343][ T979] usb 4-1: config 1 has an invalid descriptor of length 193, skipping remainder of the config [ 213.468361][ T979] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 213.490702][ T979] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 213.510251][ T979] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.518656][ T979] usb 4-1: Product: syz [ 213.524103][ T979] usb 4-1: Manufacturer: syz [ 213.533078][ T979] usb 4-1: SerialNumber: syz [ 213.569432][ T10] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 213.586046][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 213.598767][ T10] usb 2-1: Product: syz [ 213.603220][ T10] usb 2-1: Manufacturer: syz [ 213.613166][ T10] usb 2-1: SerialNumber: syz [ 213.629813][ T10] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 213.646250][ T795] usb 3-1: USB disconnect, device number 56 [ 213.650768][ T5874] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 213.757078][ T8342] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 213.780854][ T8342] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 213.793647][ T979] usb 4-1: 0:2 : does not exist [ 213.832334][ T979] usb 4-1: unit 219 not found! [ 213.868818][ T8370] netlink: 80 bytes leftover after parsing attributes in process `syz.0.752'. [ 213.938547][ T979] usb 4-1: USB disconnect, device number 51 [ 214.032685][ T5982] udevd[5982]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 214.548559][ T979] usb 2-1: USB disconnect, device number 58 [ 214.572895][ T8399] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 214.582046][ T795] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 214.592601][ T8399] overlayfs: failed to set xattr on upper [ 214.602332][ T8399] overlayfs: ...falling back to redirect_dir=nofollow. [ 214.624303][ T8399] overlayfs: ...falling back to index=off. [ 214.630269][ T8399] overlayfs: ...falling back to uuid=null. [ 214.651244][ T8400] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 214.744582][ T795] usb 1-1: Using ep0 maxpacket: 16 [ 214.776929][ T795] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 214.807845][ T795] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 214.820238][ T795] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 214.846808][ T795] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 214.867848][ T795] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 214.883344][ T795] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 214.895310][ T795] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 214.903577][ T795] usb 1-1: Manufacturer: syz [ 214.925194][ T795] usb 1-1: config 0 descriptor?? [ 215.046408][ T5874] usb 2-1: Service connection timeout for: 256 [ 215.068500][ T5874] ath9k_htc 2-1:1.0: ath9k_htc: Unable to initialize HTC services [ 215.083039][ T5874] ath9k_htc: Failed to initialize the device [ 215.096249][ T979] usb 2-1: ath9k_htc: USB layer deinitialized [ 215.140140][ T8391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 215.170984][ T8391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 215.182652][ T8427] loop5: detected capacity change from 0 to 7 [ 215.193829][ T5982] Dev loop5: unable to read RDB block 7 [ 215.202103][ T5982] loop5: unable to read partition table [ 215.221547][ T5982] loop5: partition table beyond EOD, truncated [ 215.237167][ T8427] Dev loop5: unable to read RDB block 7 [ 215.265863][ T8427] loop5: unable to read partition table [ 215.271952][ T8427] loop5: partition table beyond EOD, truncated [ 215.288389][ T8427] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 215.320411][ T795] rc_core: IR keymap rc-hauppauge not found [ 215.342530][ T795] Registered IR keymap rc-empty [ 215.348416][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.385893][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.393380][ T8435] tipc: Can't bind to reserved service type 0 [ 215.403596][ T30] audit: type=1326 audit(215.348:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8434 comm="syz.3.774" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7feffd59aeb9 code=0x0 [ 215.431109][ T795] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 215.464067][ T795] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input32 [ 215.484189][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.504234][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.524041][ T1208] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 215.534693][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.539402][ T8444] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 215.554322][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.584346][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.606236][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.632023][ T8447] netlink: 12 bytes leftover after parsing attributes in process `syz.1.777'. [ 215.644496][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.676148][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.703985][ T1208] usb 3-1: Using ep0 maxpacket: 8 [ 215.710002][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.721759][ T1208] usb 3-1: unable to get BOS descriptor or descriptor too short [ 215.732157][ T1208] usb 3-1: config 106 has an invalid interface number: 76 but max is 0 [ 215.741163][ T795] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 215.749106][ T1208] usb 3-1: config 106 has no interface number 0 [ 215.755884][ T8450] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 215.757101][ T1208] usb 3-1: config 106 interface 76 altsetting 121 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 215.769939][ T8450] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 215.777110][ T1208] usb 3-1: config 106 interface 76 altsetting 121 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 215.798929][ T795] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 215.807399][ T795] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 215.822184][ T1208] usb 3-1: config 106 interface 76 has no altsetting 0 [ 215.832661][ T1208] usb 3-1: New USB device found, idVendor=0424, idProduct=7800, bcdDevice=f9.71 [ 215.845094][ T795] usb 1-1: USB disconnect, device number 56 [ 215.854914][ T1208] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.864903][ T1208] usb 3-1: Product: syz [ 215.869451][ T1208] usb 3-1: Manufacturer: syz [ 215.874570][ T1208] usb 3-1: SerialNumber: syz [ 215.947485][ T5874] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 216.103953][ T5874] usb 2-1: Using ep0 maxpacket: 16 [ 216.108410][ T1208] usb 3-1: USB disconnect, device number 57 [ 216.117640][ T5874] usb 2-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 216.127875][ T5874] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.139224][ T5874] usb 2-1: Product: syz [ 216.143459][ T5874] usb 2-1: Manufacturer: syz [ 216.149118][ T5874] usb 2-1: SerialNumber: syz [ 216.156714][ T5874] usb 2-1: config 0 descriptor?? [ 216.165230][ T5874] visor 2-1:0.0: Sony Clie 3.5 converter detected [ 216.345766][ T8454] netlink: 8 bytes leftover after parsing attributes in process `syz.0.780'. [ 216.366879][ T5874] usb 2-1: clie_3_5_startup: get config number failed: -71 [ 216.387078][ T5874] visor 2-1:0.0: probe with driver visor failed with error -71 [ 216.398728][ T5874] usb 2-1: USB disconnect, device number 59 [ 216.494082][ T979] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 216.528974][ T8459] loop5: detected capacity change from 0 to 7 [ 216.536556][ T8459] Dev loop5: unable to read RDB block 7 [ 216.542169][ T8459] loop5: unable to read partition table [ 216.550591][ T8459] loop5: partition table beyond EOD, truncated [ 216.557402][ T8459] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 216.654110][ T979] usb 4-1: Using ep0 maxpacket: 16 [ 216.661910][ T979] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 216.673172][ T979] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 216.686310][ T979] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 216.697625][ T979] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 216.710450][ T979] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 216.728708][ T979] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 216.739228][ T979] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 216.747521][ T979] usb 4-1: Manufacturer: syz [ 216.758666][ T979] usb 4-1: config 0 descriptor?? [ 216.986400][ T8473] binder: 8472:8473 ioctl c0306201 200000000080 returned -14 [ 216.997712][ T8473] binder: 8472:8473 ioctl 3ba0 200000000200 returned -22 [ 217.006217][ T8473] binder: 8472:8473 ioctl 3b8b 200000000280 returned -22 [ 217.015875][ T8473] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 217.078436][ T51] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 217.088209][ T8478] team_slave_0: entered allmulticast mode [ 217.099912][ T8478] team_slave_0: entered promiscuous mode [ 217.104043][ T979] rc_core: IR keymap rc-hauppauge not found [ 217.111172][ T8478] netlink: 24 bytes leftover after parsing attributes in process `syz.1.788'. [ 217.113391][ T979] Registered IR keymap rc-empty [ 217.134823][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.166941][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.195361][ T979] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 217.211190][ T979] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input33 [ 217.238403][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.274540][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.294420][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.324161][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.344105][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.364258][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.402420][ T8486] tipc: Enabling of bearer rejected, failed to enable media [ 217.414125][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.444647][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.474965][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.497229][ T8452] vivid-002: ================= START STATUS ================= [ 217.514095][ T979] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 217.514624][ T8452] vivid-002: RDS Tx I/O Mode: Controls [ 217.550375][ T8452] vivid-002: RDS Program ID: 32904 [ 217.564914][ T979] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 217.570541][ T8452] vivid-002: RDS Program Type: 3 [ 217.577825][ T979] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 217.581424][ T8452] vivid-002: RDS PS Name: VIVID-TX [ 217.598639][ T8452] vivid-002: RDS Radio Text: This is a VIVID default Radio Text template text, change at will [ 217.630407][ T8452] vivid-002: RDS Stereo: true [ 217.645600][ T8452] vivid-002: RDS Artificial Head: false [ 217.654814][ T8452] vivid-002: RDS Compressed: false [ 217.660785][ T8452] vivid-002: RDS Dynamic PTY: false [ 217.672224][ T8452] vivid-002: RDS Traffic Announcement: false [ 217.680035][ T8452] vivid-002: RDS Traffic Program: true [ 217.686442][ T8452] vivid-002: RDS Music: true [ 217.691643][ T8452] vivid-002: ================== END STATUS ================== [ 217.720616][ T795] usb 4-1: USB disconnect, device number 52 [ 217.772135][ T8500] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 217.874128][ T979] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 217.913979][ T1208] usb 1-1: new full-speed USB device number 57 using dummy_hcd [ 218.034056][ T979] usb 3-1: Using ep0 maxpacket: 16 [ 218.042351][ T979] usb 3-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 218.051684][ T979] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.059819][ T979] usb 3-1: Product: syz [ 218.064186][ T979] usb 3-1: Manufacturer: syz [ 218.068897][ T979] usb 3-1: SerialNumber: syz [ 218.076123][ T1208] usb 1-1: config 0 has an invalid descriptor of length 102, skipping remainder of the config [ 218.089177][ T979] usb 3-1: config 0 descriptor?? [ 218.089517][ T1208] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 218.102459][ T979] visor 3-1:0.0: Sony Clie 3.5 converter detected [ 218.106408][ T1208] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 30768, setting to 64 [ 218.106440][ T1208] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 218.108759][ T1208] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 218.148401][ T795] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 218.156574][ T1208] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 218.166043][ T1208] usb 1-1: Product: syz [ 218.170363][ T1208] usb 1-1: Manufacturer: syz [ 218.176954][ T1208] usb 1-1: SerialNumber: syz [ 218.190397][ T1208] usb 1-1: config 0 descriptor?? [ 218.303363][ T979] usb 3-1: clie_3_5_startup: get config number failed: -71 [ 218.313979][ T795] usb 4-1: Using ep0 maxpacket: 16 [ 218.315818][ T979] visor 3-1:0.0: probe with driver visor failed with error -71 [ 218.327476][ T795] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 218.334200][ T979] usb 3-1: USB disconnect, device number 58 [ 218.341264][ T795] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 218.356395][ T795] usb 4-1: config 1 interface 2 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 218.371603][ T795] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 218.382301][ T795] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.391880][ T795] usb 4-1: Product: syz [ 218.396227][ T795] usb 4-1: Manufacturer: syz [ 218.405053][ T1208] radio-si470x 1-1:0.0: DeviceID=0x0b9c ChipID=0x10cc [ 218.408654][ T8498] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.412066][ T795] usb 4-1: SerialNumber: syz [ 218.423544][ T8498] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.430986][ T1208] radio-si470x 1-1:0.0: software version 11, hardware version 156 [ 218.626975][ T1208] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 218.638243][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.645038][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.651638][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.653029][ T8504] netlink: 'syz.3.798': attribute type 10 has an invalid length. [ 218.658362][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.667173][ T8504] bridge0: port 2(bridge_slave_1) entered disabled state [ 218.673586][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.687150][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.693931][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.697495][ T8504] bridge0: port 2(bridge_slave_1) entered blocking state [ 218.701294][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.707666][ T8504] bridge0: port 2(bridge_slave_1) entered forwarding state [ 218.714251][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.728264][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.734893][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.741534][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.748273][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.755874][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.762502][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.767632][ T8504] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 218.769655][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.784794][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.791415][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.799182][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.806489][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.813319][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.820151][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.826997][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.833662][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.840330][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.847142][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.854139][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.860860][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.868340][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.875056][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.881714][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.888387][ T1208] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 218.888507][ C1] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 218.904571][ T1208] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -22 [ 218.932304][ T1208] usb 1-1: USB disconnect, device number 57 [ 219.025740][ T795] usb 4-1: USB disconnect, device number 53 [ 219.045065][ T8517] IPVS: set_ctl: invalid protocol: 218 127.0.0.1:20000 [ 219.067685][ T5982] udevd[5982]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 219.222416][ T8522] TCP: TCP_TX_DELAY enabled [ 219.414991][ T8530] pimreg: entered allmulticast mode [ 219.426778][ T8530] netlink: 8 bytes leftover after parsing attributes in process `syz.0.807'. [ 219.436627][ T8530] netlink: 8 bytes leftover after parsing attributes in process `syz.0.807'. [ 219.450529][ T8530] netlink: 104 bytes leftover after parsing attributes in process `syz.0.807'. [ 219.664092][ T24] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 219.744064][ T979] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 219.754136][ T5873] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 219.824672][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 219.834576][ T24] usb 4-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 219.844235][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.852492][ T24] usb 4-1: Product: syz [ 219.857856][ T24] usb 4-1: Manufacturer: syz [ 219.862641][ T24] usb 4-1: SerialNumber: syz [ 219.869575][ T24] usb 4-1: config 0 descriptor?? [ 219.877533][ T24] visor 4-1:0.0: Sony Clie 3.5 converter detected [ 219.913975][ T979] usb 3-1: Using ep0 maxpacket: 8 [ 219.919347][ T5873] usb 1-1: Using ep0 maxpacket: 16 [ 219.929143][ T979] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 219.941279][ T979] usb 3-1: New USB device found, idVendor=056a, idProduct=0059, bcdDevice= 0.00 [ 219.950830][ T979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.959275][ T5873] usb 1-1: config 0 has an invalid interface number: 137 but max is 0 [ 219.969868][ T5873] usb 1-1: config 0 has no interface number 0 [ 219.977575][ T979] usb 3-1: config 0 descriptor?? [ 219.990288][ T5873] usb 1-1: New USB device found, idVendor=05ac, idProduct=921d, bcdDevice=ac.48 [ 219.999862][ T5873] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.008312][ T5873] usb 1-1: Product: syz [ 220.012653][ T5873] usb 1-1: Manufacturer: syz [ 220.017397][ T5873] usb 1-1: SerialNumber: syz [ 220.027362][ T5873] usb 1-1: config 0 descriptor?? [ 220.036007][ T5873] appledisplay 1-1:0.137: Could not find int-in endpoint [ 220.045650][ T5873] usbhid 1-1:0.137: couldn't find an input interrupt endpoint [ 220.077724][ T24] usb 4-1: clie_3_5_startup: get config number failed: -71 [ 220.103677][ T24] visor 4-1:0.0: probe with driver visor failed with error -71 [ 220.118471][ T24] usb 4-1: USB disconnect, device number 54 [ 220.235004][ T1208] usb 1-1: USB disconnect, device number 58 [ 220.401514][ T979] usbhid 3-1:0.0: can't add hid device: -71 [ 220.414063][ T979] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 220.426409][ T979] usb 3-1: USB disconnect, device number 59 [ 220.662694][ T8559] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 220.695600][ T8562] netlink: 8 bytes leftover after parsing attributes in process `syz.3.815'. [ 220.725888][ T8559] faux_driver vgem: [drm] Unknown color mode 3; guessing buffer size. [ 220.788132][ T8565] openvswitch: netlink: IP tunnel TTL not specified. [ 221.047741][ T8582] i2c i2c-0: dtv_property_process_set: SET cmd 0x7d7e1e82 undefined [ 221.229993][ T1208] Process accounting resumed [ 221.297388][ T5874] usb 2-1: new full-speed USB device number 60 using dummy_hcd [ 221.376696][ T8600] FAULT_INJECTION: forcing a failure. [ 221.376696][ T8600] name failslab, interval 1, probability 0, space 0, times 0 [ 221.389685][ T979] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 221.394026][ T8600] CPU: 1 UID: 0 PID: 8600 Comm: syz.2.827 Tainted: G L syzkaller #0 PREEMPT(full) [ 221.394052][ T8600] Tainted: [L]=SOFTLOCKUP [ 221.394060][ T8600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 221.394069][ T8600] Call Trace: [ 221.394078][ T8600] [ 221.394086][ T8600] dump_stack_lvl+0xe8/0x150 [ 221.394116][ T8600] should_fail_ex+0x412/0x560 [ 221.394145][ T8600] should_failslab+0xa8/0x100 [ 221.394167][ T8600] __kmalloc_noprof+0xe8/0x760 [ 221.394186][ T8600] ? tomoyo_encode+0x28b/0x550 [ 221.394217][ T8600] tomoyo_encode+0x28b/0x550 [ 221.394247][ T8600] tomoyo_realpath_from_path+0x58d/0x5d0 [ 221.394283][ T8600] ? tomoyo_path_number_perm+0x219/0x630 [ 221.394304][ T8600] tomoyo_path_number_perm+0x246/0x630 [ 221.394328][ T8600] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 221.394351][ T8600] ? __lock_acquire+0x6b5/0x2cf0 [ 221.394384][ T8600] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 221.394427][ T8600] ? __fget_files+0x2a/0x420 [ 221.394452][ T8600] ? __fget_files+0x2a/0x420 [ 221.394473][ T8600] ? __fget_files+0x3a0/0x420 [ 221.394494][ T8600] ? __fget_files+0x2a/0x420 [ 221.394521][ T8600] security_file_ioctl+0xc3/0x2a0 [ 221.394543][ T8600] __se_sys_ioctl+0x47/0x170 [ 221.394565][ T8600] do_syscall_64+0x14d/0xf80 [ 221.394587][ T8600] ? trace_irq_disable+0x3b/0x150 [ 221.394609][ T8600] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.394627][ T8600] ? clear_bhb_loop+0x40/0x90 [ 221.394648][ T8600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.394666][ T8600] RIP: 0033:0x7f7d3d99aeb9 [ 221.394683][ T8600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 221.394698][ T8600] RSP: 002b:00007f7d3bbee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 221.394718][ T8600] RAX: ffffffffffffffda RBX: 00007f7d3dc15fa0 RCX: 00007f7d3d99aeb9 [ 221.394730][ T8600] RDX: 00002000000001c0 RSI: 0000000040106f52 RDI: 0000000000000003 [ 221.394740][ T8600] RBP: 00007f7d3bbee090 R08: 0000000000000000 R09: 0000000000000000 [ 221.394750][ T8600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 221.394770][ T8600] R13: 00007f7d3dc16038 R14: 00007f7d3dc15fa0 R15: 00007ffd6aedf028 [ 221.394799][ T8600] [ 221.394823][ T8600] ERROR: Out of memory at tomoyo_realpath_from_path. [ 221.456261][ T5874] usb 2-1: config 0 has an invalid descriptor of length 54, skipping remainder of the config [ 221.557002][ T8603] misc userio: Begin command sent, but we're already running [ 221.562880][ T5874] usb 2-1: New USB device found, idVendor=0eef, idProduct=72c4, bcdDevice= 0.00 [ 221.667909][ T5874] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=221 [ 221.676373][ T5874] usb 2-1: SerialNumber: syz [ 221.683391][ T5874] usb 2-1: config 0 descriptor?? [ 221.692701][ T5874] hub 2-1:0.0: bad descriptor, ignoring hub [ 221.699047][ T979] usb 1-1: Using ep0 maxpacket: 16 [ 221.704456][ T5874] hub 2-1:0.0: probe with driver hub failed with error -5 [ 221.716235][ T979] usb 1-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 221.726913][ T979] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.735235][ T979] usb 1-1: Product: syz [ 221.739698][ T979] usb 1-1: Manufacturer: syz [ 221.746152][ T979] usb 1-1: SerialNumber: syz [ 221.752957][ T979] usb 1-1: config 0 descriptor?? [ 221.760869][ T979] visor 1-1:0.0: Sony Clie 3.5 converter detected [ 221.961766][ T979] usb 1-1: clie_3_5_startup: get config number failed: -71 [ 221.962419][ T979] visor 1-1:0.0: probe with driver visor failed with error -71 [ 221.972067][ T979] usb 1-1: USB disconnect, device number 59 [ 222.028111][ T8619] overlayfs: conflicting options: userxattr,redirect_dir=on [ 222.054678][ T5874] usb 2-1: USB disconnect, device number 60 [ 222.374333][ T979] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 222.514048][ T979] usb 2-1: device descriptor read/64, error -71 [ 222.574995][ T8646] FAULT_INJECTION: forcing a failure. [ 222.574995][ T8646] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 222.591534][ T8646] CPU: 1 UID: 0 PID: 8646 Comm: syz.0.836 Tainted: G L syzkaller #0 PREEMPT(full) [ 222.591565][ T8646] Tainted: [L]=SOFTLOCKUP [ 222.591572][ T8646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 222.591584][ T8646] Call Trace: [ 222.591592][ T8646] [ 222.591600][ T8646] dump_stack_lvl+0xe8/0x150 [ 222.591630][ T8646] should_fail_ex+0x412/0x560 [ 222.591659][ T8646] _copy_from_user+0x2d/0xb0 [ 222.591679][ T8646] dvb_usercopy+0x15c/0x2e0 [ 222.591706][ T8646] ? __pfx_dvb_frontend_do_ioctl+0x10/0x10 [ 222.591729][ T8646] ? __pfx_dvb_usercopy+0x10/0x10 [ 222.591774][ T8646] ? __fget_files+0x2a/0x420 [ 222.591798][ T8646] ? __fget_files+0x3a0/0x420 [ 222.591821][ T8646] ? __fget_files+0x2a/0x420 [ 222.591848][ T8646] ? __pfx_dvb_frontend_ioctl+0x10/0x10 [ 222.591873][ T8646] dvb_frontend_ioctl+0x59/0x80 [ 222.591899][ T8646] __se_sys_ioctl+0xfc/0x170 [ 222.591924][ T8646] do_syscall_64+0x14d/0xf80 [ 222.591949][ T8646] ? trace_irq_disable+0x3b/0x150 [ 222.591977][ T8646] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.591997][ T8646] ? clear_bhb_loop+0x40/0x90 [ 222.592020][ T8646] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 222.592039][ T8646] RIP: 0033:0x7f91b619aeb9 [ 222.592058][ T8646] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 222.592074][ T8646] RSP: 002b:00007f91b6fcd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 222.592096][ T8646] RAX: ffffffffffffffda RBX: 00007f91b6415fa0 RCX: 00007f91b619aeb9 [ 222.592109][ T8646] RDX: 00002000000001c0 RSI: 0000000040106f52 RDI: 0000000000000003 [ 222.592122][ T8646] RBP: 00007f91b6fcd090 R08: 0000000000000000 R09: 0000000000000000 [ 222.592134][ T8646] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 222.592145][ T8646] R13: 00007f91b6416038 R14: 00007f91b6415fa0 R15: 00007ffc7ae330d8 [ 222.592177][ T8646] [ 222.789353][ T979] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 222.915891][ T8660] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 222.924417][ T979] usb 2-1: device descriptor read/64, error -71 [ 223.036387][ T979] usb usb2-port1: attempt power cycle [ 223.104320][ T10] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 223.256563][ T10] usb 4-1: config 0 has an invalid interface number: 252 but max is 0 [ 223.265115][ T10] usb 4-1: config 0 has no interface number 0 [ 223.271383][ T10] usb 4-1: too many endpoints for config 0 interface 252 altsetting 3: 144, using maximum allowed: 30 [ 223.283650][ T10] usb 4-1: config 0 interface 252 altsetting 3 has 0 endpoint descriptors, different from the interface descriptor's value: 144 [ 223.298252][ T10] usb 4-1: config 0 interface 252 has no altsetting 0 [ 223.312642][ T10] usb 4-1: New USB device found, idVendor=1de1, idProduct=c102, bcdDevice=7d.08 [ 223.322331][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 223.333483][ T10] usb 4-1: Product: syz [ 223.339762][ T10] usb 4-1: Manufacturer: syz [ 223.345867][ T10] usb 4-1: SerialNumber: syz [ 223.356728][ T10] usb 4-1: config 0 descriptor?? [ 223.384086][ T979] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 223.406097][ T979] usb 2-1: device descriptor read/8, error -71 [ 223.574623][ T8656] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 223.583678][ T8656] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 223.598185][ T10] usb-storage 4-1:0.252: USB Mass Storage device detected [ 223.607900][ T10] usb-storage 4-1:0.252: device ignored [ 223.653976][ T979] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 223.667514][ T10] usb 4-1: USB disconnect, device number 55 [ 223.696831][ T979] usb 2-1: device descriptor read/8, error -71 [ 223.804456][ T979] usb usb2-port1: unable to enumerate USB device [ 224.059279][ T8676] tipc: Enabled bearer , priority 10 [ 224.151329][ T8684] i2c i2c-0: dtv_property_process_set: SET cmd 0x00800004 undefined [ 224.454163][ T1208] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 224.479614][ T8709] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 224.582664][ T8715] can0: slcan on ttyS3. [ 224.595617][ T8715] netlink: 12 bytes leftover after parsing attributes in process `syz.3.852'. [ 224.626362][ T1208] usb 2-1: Using ep0 maxpacket: 16 [ 224.638149][ T1208] usb 2-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 224.648468][ T1208] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.658904][ T1208] usb 2-1: Product: syz [ 224.663281][ T1208] usb 2-1: Manufacturer: syz [ 224.667977][ T1208] usb 2-1: SerialNumber: syz [ 224.676051][ T1208] usb 2-1: config 0 descriptor?? [ 224.688595][ T795] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 224.708975][ T1208] visor 2-1:0.0: Sony Clie 3.5 converter detected [ 224.866962][ T24] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 224.886583][ T795] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 224.897809][ T795] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 224.907876][ T795] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.916299][ T1208] usb 2-1: clie_3_5_startup: get config number failed: -71 [ 224.927212][ T1208] visor 2-1:0.0: probe with driver visor failed with error -71 [ 224.937577][ T795] usb 1-1: config 0 descriptor?? [ 224.954241][ T795] pwc: Askey VC010 type 2 USB webcam detected. [ 224.968448][ T1208] usb 2-1: USB disconnect, device number 65 [ 225.036878][ T24] usb 4-1: config 0 has an invalid interface number: 255 but max is 1 [ 225.047291][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 225.059407][ T24] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 225.069691][ T24] usb 4-1: config 0 has no interface number 0 [ 225.076567][ T24] usb 4-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 225.088470][ T24] usb 4-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 225.102427][ T24] usb 4-1: config 0 interface 255 has no altsetting 0 [ 225.113210][ T24] usb 4-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=20.a3 [ 225.123590][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.133048][ T24] usb 4-1: Product: syz [ 225.137991][ T24] usb 4-1: Manufacturer: syz [ 225.142685][ T24] usb 4-1: SerialNumber: syz [ 225.165332][ T24] usb 4-1: config 0 descriptor?? [ 225.357103][ T795] pwc: recv_control_msg error -32 req 02 val 2b00 [ 225.368536][ T795] pwc: recv_control_msg error -32 req 02 val 2700 [ 225.376101][ T795] pwc: recv_control_msg error -32 req 02 val 2c00 [ 225.379558][ T8715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 225.384676][ T795] pwc: recv_control_msg error -32 req 04 val 1000 [ 225.394413][ T8715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 225.399444][ T8707] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 225.418179][ T8707] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 225.431817][ T795] pwc: recv_control_msg error -32 req 04 val 1300 [ 225.445663][ T795] pwc: recv_control_msg error -32 req 04 val 1400 [ 225.512514][ T979] usb 4-1: USB disconnect, device number 56 [ 225.615944][ T8714] can0 (unregistered): slcan off ttyS3. [ 225.655195][ T795] pwc: recv_control_msg error -71 req 02 val 2100 [ 225.665110][ T795] pwc: recv_control_msg error -71 req 04 val 1500 [ 225.686750][ T795] pwc: recv_control_msg error -71 req 02 val 2500 [ 225.693794][ T795] pwc: recv_control_msg error -71 req 02 val 2400 [ 225.714507][ T795] pwc: recv_control_msg error -71 req 02 val 2600 [ 225.724400][ T795] pwc: recv_control_msg error -71 req 02 val 2900 [ 225.735475][ T795] pwc: recv_control_msg error -71 req 02 val 2800 [ 225.745527][ T795] pwc: recv_control_msg error -71 req 04 val 1100 [ 225.761861][ T795] pwc: recv_control_msg error -71 req 04 val 1200 [ 225.783649][ T795] pwc: Registered as video103. [ 225.802517][ T795] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input36 [ 225.856541][ T795] usb 1-1: USB disconnect, device number 60 [ 226.283971][ T979] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 226.382811][ T8776] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 226.431733][ T8781] netlink: 'syz.0.861': attribute type 10 has an invalid length. [ 226.451134][ T8781] batman_adv: batadv0: Adding interface: netdevsim0 [ 226.473949][ T8781] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 226.502402][ T8781] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 226.514459][ T979] usb 2-1: config index 0 descriptor too short (expected 1051, got 27) [ 226.524080][ T979] usb 2-1: config 0 has an invalid interface number: 0 but max is -1 [ 226.532666][ T979] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 226.554160][ T979] usb 2-1: config 0 interface 0 altsetting 12 has an endpoint descriptor with address 0x95, changing to 0x85 [ 226.580695][ T979] usb 2-1: config 0 interface 0 altsetting 12 endpoint 0x85 has an invalid bInterval 101, changing to 10 [ 226.604831][ T979] usb 2-1: config 0 interface 0 altsetting 12 endpoint 0x85 has invalid maxpacket 18086, setting to 1024 [ 226.630591][ T979] usb 2-1: config 0 interface 0 has no altsetting 0 [ 226.647348][ T979] usb 2-1: New USB device found, idVendor=06cd, idProduct=010a, bcdDevice=d9.c3 [ 226.664422][ T979] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.672649][ T979] usb 2-1: Product: syz [ 226.683906][ T979] usb 2-1: Manufacturer: syz [ 226.688612][ T979] usb 2-1: SerialNumber: syz [ 226.707130][ T979] usb 2-1: config 0 descriptor?? [ 226.714581][ T8757] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 226.734025][ T10] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 226.884126][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 226.899672][ T10] usb 4-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 226.919619][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.935859][ T979] keyspan 2-1:0.0: Keyspan 4 port adapter converter detected [ 226.953549][ T10] usb 4-1: Product: syz [ 226.959403][ T10] usb 4-1: Manufacturer: syz [ 226.968286][ T979] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 87 [ 226.977027][ T10] usb 4-1: SerialNumber: syz [ 226.984262][ T979] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 7 [ 226.995373][ T10] usb 4-1: config 0 descriptor?? [ 227.003662][ T10] visor 4-1:0.0: Sony Clie 3.5 converter detected [ 227.012344][ T979] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 81 [ 227.022065][ T979] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 1 [ 227.041969][ T979] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 227.056172][ T979] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 82 [ 227.064799][ T979] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 2 [ 227.075203][ T979] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 227.088585][ T979] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 83 [ 227.098771][ T979] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 3 [ 227.114700][ T979] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 227.129472][ T979] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 84 [ 227.137519][ T979] keyspan 2-1:0.0: found no endpoint descriptor for endpoint 4 [ 227.150631][ T979] usb 2-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 227.169659][ T979] usb 2-1: USB disconnect, device number 66 [ 227.205707][ T10] usb 4-1: clie_3_5_startup: get config number failed: -71 [ 227.232860][ T10] visor 4-1:0.0: probe with driver visor failed with error -71 [ 227.242997][ T979] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 227.269159][ T10] usb 4-1: USB disconnect, device number 57 [ 227.283007][ T979] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 227.300266][ T979] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 227.320796][ T979] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 227.336022][ T979] keyspan 2-1:0.0: device disconnected [ 227.464172][ T5904] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 227.614060][ T5904] usb 1-1: Using ep0 maxpacket: 16 [ 227.620864][ T5904] usb 1-1: config 0 has an invalid interface number: 230 but max is 0 [ 227.629816][ T5904] usb 1-1: config 0 has no interface number 0 [ 227.636708][ T5904] usb 1-1: New USB device found, idVendor=0923, idProduct=010f, bcdDevice=a9.c1 [ 227.646481][ T5904] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.657367][ T5904] usb 1-1: config 0 descriptor?? [ 227.667320][ T5904] gspca_main: tv8532-2.14.0 probing 0923:010f [ 227.772534][ T8814] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 227.804025][ T979] usb 2-1: new low-speed USB device number 67 using dummy_hcd [ 227.920238][ T5904] usb 1-1: USB disconnect, device number 61 [ 227.943977][ T979] usb 2-1: device descriptor read/64, error -71 [ 228.151620][ T8827] loop5: detected capacity change from 0 to 7 [ 228.159460][ T8827] Dev loop5: unable to read RDB block 7 [ 228.167111][ T8827] loop5: AHDI p1 p3 p4 [ 228.171584][ T8827] loop5: partition table partially beyond EOD, truncated [ 228.179297][ T8827] loop5: p1 size 100663296 extends beyond EOD, truncated [ 228.188819][ T8827] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 228.204024][ T979] usb 2-1: new low-speed USB device number 68 using dummy_hcd [ 228.356903][ T979] usb 2-1: device descriptor read/64, error -71 [ 228.465502][ T979] usb usb2-port1: attempt power cycle [ 228.483656][ T8841] netlink: 'syz.0.879': attribute type 23 has an invalid length. [ 228.540482][ T8844] trusted_key: syz.0.880 sent an empty control message without MSG_MORE. [ 228.614135][ T5904] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 228.753969][ T5904] usb 4-1: device descriptor read/64, error -71 [ 228.804726][ T979] usb 2-1: new low-speed USB device number 69 using dummy_hcd [ 228.834757][ T979] usb 2-1: device descriptor read/8, error -71 [ 228.841978][ T8864] option changes via remount are deprecated (pid=8863 comm=syz.0.887) [ 228.912126][ T8867] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 228.924421][ T8867] netlink: 8 bytes leftover after parsing attributes in process `syz.0.888'. [ 228.933387][ T8867] netlink: 8 bytes leftover after parsing attributes in process `syz.0.888'. [ 228.994046][ T5904] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 229.079199][ T979] usb 2-1: new low-speed USB device number 70 using dummy_hcd [ 229.105002][ T979] usb 2-1: device descriptor read/8, error -71 [ 229.124189][ T5904] usb 4-1: device descriptor read/64, error -71 [ 229.214370][ T979] usb usb2-port1: unable to enumerate USB device [ 229.235668][ T5904] usb usb4-port1: attempt power cycle [ 229.354170][ T1208] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 229.528122][ T1208] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 229.537565][ T1208] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.545874][ T1208] usb 1-1: Product: syz [ 229.550862][ T1208] usb 1-1: Manufacturer: syz [ 229.555740][ T1208] usb 1-1: SerialNumber: syz [ 229.566158][ T1208] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 229.584332][ T5904] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 229.594006][ T795] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 229.614753][ T5904] usb 4-1: device descriptor read/8, error -71 [ 229.854061][ T5904] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 229.884891][ T5904] usb 4-1: device descriptor read/8, error -71 [ 229.994934][ T5904] usb usb4-port1: unable to enumerate USB device [ 230.011129][ T8880] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.020379][ T8880] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.236888][ T1208] usb 1-1: USB disconnect, device number 62 [ 230.653951][ T795] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 230.661623][ T795] ath9k_htc: Failed to initialize the device [ 230.668747][ T1208] usb 1-1: ath9k_htc: USB layer deinitialized [ 231.054048][ T1208] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 231.205922][ T1208] usb 1-1: config 177 has too many interfaces: 162, using maximum allowed: 32 [ 231.215217][ T1208] usb 1-1: config 177 has an invalid descriptor of length 0, skipping remainder of the config [ 231.226186][ T1208] usb 1-1: config 177 has 0 interfaces, different from the descriptor's value: 162 [ 231.237315][ T1208] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 231.246451][ T1208] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 231.254734][ T1208] usb 1-1: Product: syz [ 231.259176][ T1208] usb 1-1: Manufacturer: syz [ 231.264281][ T1208] usb 1-1: SerialNumber: syz [ 231.473647][ T8898] misc userio: Begin command sent, but we're already running [ 231.490284][ T1208] usb 1-1: USB disconnect, device number 63 [ 231.784084][ T24] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 231.932488][ T8902] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 231.940938][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 231.943679][ T8902] overlayfs: failed to set xattr on upper [ 231.948365][ T24] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 231.952091][ T8902] overlayfs: ...falling back to redirect_dir=nofollow. [ 231.960822][ T24] usb 2-1: config 0 has no interface number 0 [ 231.967535][ T8902] overlayfs: ...falling back to index=off. [ 231.974425][ T24] usb 2-1: config 0 interface 67 altsetting 0 has a duplicate endpoint with address 0x82, skipping [ 231.979784][ T8902] overlayfs: ...falling back to uuid=null. [ 231.992760][ T24] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 231.996368][ T8902] overlayfs: ...falling back to xino=off. [ 232.005908][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.021226][ T24] usb 2-1: Product: syz [ 232.025889][ T24] usb 2-1: Manufacturer: syz [ 232.042676][ T24] usb 2-1: SerialNumber: syz [ 232.050761][ T24] usb 2-1: config 0 descriptor?? [ 232.065582][ T24] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 232.082014][ T24] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -22 [ 232.266358][ T8912] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.276989][ T8912] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 232.287524][ T24] usb 2-1: USB disconnect, device number 71 [ 232.374085][ T979] usb 4-1: new full-speed USB device number 62 using dummy_hcd [ 232.473974][ T5874] usb 1-1: new full-speed USB device number 64 using dummy_hcd [ 232.526246][ T979] usb 4-1: unable to get BOS descriptor or descriptor too short [ 232.534827][ T979] usb 4-1: not running at top speed; connect to a high speed hub [ 232.544486][ T979] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 232.555597][ T979] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 232.567982][ T979] usb 4-1: string descriptor 0 read error: -22 [ 232.574360][ T979] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 232.583584][ T979] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.599878][ T979] usb 4-1: 0:2 : does not exist [ 232.636239][ T5874] usb 1-1: unable to get BOS descriptor or descriptor too short [ 232.644865][ T5874] usb 1-1: not running at top speed; connect to a high speed hub [ 232.654292][ T5874] usb 1-1: config 2 has an invalid interface number: 51 but max is 0 [ 232.662624][ T5874] usb 1-1: config 2 has no interface number 0 [ 232.669643][ T5874] usb 1-1: config 2 interface 51 has no altsetting 0 [ 232.678782][ T5874] usb 1-1: New USB device found, idVendor=06cd, idProduct=0102, bcdDevice=10.57 [ 232.687940][ T5874] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.696210][ T5874] usb 1-1: Product: syz [ 232.700578][ T5874] usb 1-1: Manufacturer: syz [ 232.705430][ T5874] usb 1-1: SerialNumber: syz [ 232.800920][ T8907] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.812077][ T8907] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 232.930114][ T8919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.941696][ T8919] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 232.962199][ T5874] keyspan 1-1:2.51: Keyspan - (without firmware) converter detected [ 232.985295][ T5874] usb 1-1: USB disconnect, device number 64 [ 232.992580][ T5874] keyspan 1-1:2.51: device disconnected [ 233.083111][ T5192] Dev loop5: unable to read RDB block 7 [ 233.089440][ T5192] loop5: AHDI p1 p3 p4 [ 233.093790][ T5192] loop5: partition table partially beyond EOD, truncated [ 233.101664][ T5192] loop5: p1 size 100663296 extends beyond EOD, truncated [ 233.111906][ T5192] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 233.576564][ T8943] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 233.595769][ T8946] 9p: Bad value for 'rfdno' [ 233.655664][ T979] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 233.676849][ T979] usb 4-1: 5:0: cannot get min/max values for control 3 (id 5) [ 233.696867][ T979] usb 4-1: 5:0: failed to get current value for ch 1 (-22) [ 233.706151][ T30] audit: type=1326 audit(233.658:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8953 comm="syz.1.917" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f887c39aeb9 code=0x0 [ 233.740979][ T979] usb 4-1: 5:0: cannot get min/max values for control 3 (id 5) [ 233.809618][ T979] usb 4-1: USB disconnect, device number 62 [ 233.996607][ T5881] usb 2-1: new full-speed USB device number 72 using dummy_hcd [ 234.022147][ T8966] team_slave_0: entered promiscuous mode [ 234.028248][ T8966] team_slave_1: entered promiscuous mode [ 234.116930][ T8965] team_slave_0: left promiscuous mode [ 234.122695][ T8965] team_slave_1: left promiscuous mode [ 234.166071][ T5881] usb 2-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0x56, changing to 0x6 [ 234.178529][ T5881] usb 2-1: config 36 interface 0 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 10 [ 234.195519][ T5881] usb 2-1: config 36 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 64299, setting to 64 [ 234.212090][ T5881] usb 2-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 234.222458][ T5881] usb 2-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 234.231405][ T5881] usb 2-1: Manufacturer: syz [ 234.236512][ T5881] usb 2-1: SerialNumber: syz [ 234.248234][ T8955] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 234.503950][ T24] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 234.684058][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 234.691345][ T24] usb 4-1: config 0 interface 0 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 234.703197][ T24] usb 4-1: config 0 interface 0 has no altsetting 0 [ 234.710207][ T24] usb 4-1: New USB device found, idVendor=0757, idProduct=0a00, bcdDevice= 0.00 [ 234.719603][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.731416][ T24] usb 4-1: config 0 descriptor?? [ 235.157606][ T8973] netlink: 24 bytes leftover after parsing attributes in process `syz.0.926'. [ 235.159658][ T24] nti 0003:0757:0A00.000F: hidraw0: USB HID vff.fc Device [HID 0757:0a00] on usb-dummy_hcd.3-1/input0 [ 235.352324][ T10] usb 4-1: USB disconnect, device number 63 [ 236.133973][ T10] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 236.284149][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 236.292485][ T10] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 236.304439][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 236.319099][ T10] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 236.329080][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.337544][ T10] usb 4-1: Product: syz [ 236.341862][ T10] usb 4-1: Manufacturer: syz [ 236.346698][ T10] usb 4-1: SerialNumber: syz [ 236.355460][ T10] usb 4-1: config 0 descriptor?? [ 236.365010][ T10] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 236.374338][ T10] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 236.712587][ T5881] usbhid 2-1:36.0: couldn't find an input interrupt endpoint [ 236.737487][ T5881] usb 2-1: USB disconnect, device number 72 [ 236.968619][ T10] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 236.990172][ T10] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 236.997431][ T8986] sctp: [Deprecated]: syz.1.931 (pid 8986) Use of int in max_burst socket option deprecated. [ 236.997431][ T8986] Use struct sctp_assoc_value instead [ 237.074071][ T5831] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 237.095538][ T5831] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 237.106350][ T5831] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 237.115084][ T5831] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 237.123081][ T5831] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 237.215814][ T10] em28xx 4-1:0.0: AC97 chip type couldn't be determined [ 237.223944][ T10] em28xx 4-1:0.0: No AC97 audio processor [ 237.636073][ T5881] usb 4-1: USB disconnect, device number 64 [ 237.665131][ T5881] em28xx 4-1:0.0: Disconnecting em28xx [ 237.684201][ T5881] em28xx 4-1:0.0: Freeing device [ 237.860940][ T9010] netlink: 60 bytes leftover after parsing attributes in process `syz.3.935'. [ 237.873561][ T9010] unsupported nlmsg_type 40 [ 237.976278][ T8987] chnl_net:caif_netlink_parms(): no params data found [ 238.035416][ T63] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.084469][ T9017] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 238.105872][ T30] audit: type=1326 audit(238.048:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9019 comm="syz.3.938" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7feffd59aeb9 code=0x0 [ 238.177025][ T63] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.251903][ T63] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.302587][ T63] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.372471][ T8987] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.380081][ T8987] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.387727][ T8987] bridge_slave_0: entered allmulticast mode [ 238.396627][ T8987] bridge_slave_0: entered promiscuous mode [ 238.412746][ T8987] bridge0: port 2(bridge_slave_1) entered blocking state [ 238.420873][ T8987] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.428568][ T8987] bridge_slave_1: entered allmulticast mode [ 238.430667][ T9030] netlink: 'syz.0.940': attribute type 21 has an invalid length. [ 238.437325][ T8987] bridge_slave_1: entered promiscuous mode [ 238.443458][ T5874] usb 4-1: new full-speed USB device number 65 using dummy_hcd [ 238.459849][ T9030] netlink: 128 bytes leftover after parsing attributes in process `syz.0.940'. [ 238.469729][ T10] usb 2-1: new full-speed USB device number 73 using dummy_hcd [ 238.482470][ T9030] fuse: Unknown parameter '000000000000000000030x0000000000000003' [ 238.510595][ T8987] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 238.540279][ T8987] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 238.604305][ T10] usb 2-1: device descriptor read/64, error -71 [ 238.625804][ T5874] usb 4-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0x56, changing to 0x6 [ 238.639384][ T8987] team0: Port device team_slave_0 added [ 238.645317][ T5874] usb 4-1: config 36 interface 0 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 10 [ 238.660287][ T5874] usb 4-1: config 36 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 64299, setting to 64 [ 238.677654][ T63] bridge_slave_1: left allmulticast mode [ 238.683455][ T63] bridge_slave_1: left promiscuous mode [ 238.691787][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.702723][ T5874] usb 4-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 238.712835][ T5874] usb 4-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 238.722809][ T63] bridge_slave_0: left promiscuous mode [ 238.729256][ T5874] usb 4-1: Manufacturer: syz [ 238.734423][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.741912][ T5874] usb 4-1: SerialNumber: syz [ 238.752152][ T9022] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 238.856978][ T10] usb 2-1: new full-speed USB device number 74 using dummy_hcd [ 239.005094][ T10] usb 2-1: device descriptor read/64, error -71 [ 239.086658][ T63] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 239.099121][ T63] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 239.110801][ T63] bond0 (unregistering): Released all slaves [ 239.114323][ T10] usb usb2-port1: attempt power cycle [ 239.128060][ T8987] team0: Port device team_slave_1 added [ 239.213426][ T5831] Bluetooth: hci4: command tx timeout [ 239.222430][ T8987] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 239.233123][ T8987] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 239.261585][ T8987] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 239.317578][ T8987] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 239.334185][ T8987] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 239.397536][ T8987] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 239.466305][ T10] usb 2-1: new full-speed USB device number 75 using dummy_hcd [ 239.497193][ T10] usb 2-1: device descriptor read/8, error -71 [ 239.753993][ T10] usb 2-1: new full-speed USB device number 76 using dummy_hcd [ 239.770150][ T8987] hsr_slave_0: entered promiscuous mode [ 239.783568][ T8987] hsr_slave_1: entered promiscuous mode [ 239.792394][ T8987] debugfs: 'hsr0' already exists in 'hsr' [ 239.798531][ T8987] Cannot create hsr debugfs directory [ 239.804770][ T10] usb 2-1: device descriptor read/8, error -71 [ 239.819374][ T5881] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 239.857736][ T63] hsr_slave_0: left promiscuous mode [ 239.865105][ T63] hsr_slave_1: left promiscuous mode [ 239.871511][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 239.880382][ T63] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 239.889025][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 239.899541][ T63] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 239.914481][ T10] usb usb2-port1: unable to enumerate USB device [ 239.931201][ T63] veth1_macvtap: left promiscuous mode [ 239.937236][ T63] veth0_macvtap: left promiscuous mode [ 239.943204][ T63] veth1_vlan: left promiscuous mode [ 239.950736][ T63] veth0_vlan: left promiscuous mode [ 239.994092][ T5881] usb 1-1: Using ep0 maxpacket: 16 [ 240.002860][ T5881] usb 1-1: config 128 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 240.040751][ T5881] usb 1-1: config 128 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 240.067190][ T5881] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 240.088449][ T5881] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 240.152481][ T63] pim6reg (unregistering): left allmulticast mode [ 240.551244][ T9051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 240.567974][ T9051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 240.582401][ T5881] mcp2221 0003:04D8:00DD.0010: collection stack underflow [ 240.590669][ T5881] mcp2221 0003:04D8:00DD.0010: item 0 0 0 12 parsing failed [ 240.600315][ T5881] mcp2221 0003:04D8:00DD.0010: can't parse reports [ 240.607699][ T5881] mcp2221 0003:04D8:00DD.0010: probe with driver mcp2221 failed with error -22 [ 240.741283][ T63] team0 (unregistering): Port device team_slave_1 removed [ 240.771394][ T979] usb 1-1: USB disconnect, device number 65 [ 240.817770][ T63] team0 (unregistering): Port device team_slave_0 removed [ 241.138301][ T5874] usbhid 4-1:36.0: couldn't find an input interrupt endpoint [ 241.160148][ T5874] usb 4-1: USB disconnect, device number 65 [ 241.285313][ T5831] Bluetooth: hci4: command tx timeout [ 241.374009][ T9059] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 241.510465][ T9062] netlink: 156 bytes leftover after parsing attributes in process `syz.0.948'. [ 241.654292][ T5874] usb 4-1: new full-speed USB device number 66 using dummy_hcd [ 241.703941][ T24] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 241.827814][ T5874] usb 4-1: config 16 has an invalid interface number: 168 but max is 0 [ 241.844029][ T5874] usb 4-1: config 16 has no interface number 0 [ 241.851181][ T5874] usb 4-1: config 16 interface 168 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 241.873229][ T24] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 241.880829][ T5874] usb 4-1: config 16 interface 168 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 241.900159][ T5881] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 241.904857][ T5874] usb 4-1: New USB device found, idVendor=0586, idProduct=0102, bcdDevice=14.0a [ 241.917782][ T5874] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.937195][ T24] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 241.964684][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.973098][ T24] usb 2-1: Product: syz [ 241.977301][ T5874] HFC-S_USB 4-1:16.168: probe with driver HFC-S_USB failed with error -5 [ 241.992406][ T8987] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 242.002263][ T24] usb 2-1: Manufacturer: syz [ 242.007423][ T24] usb 2-1: SerialNumber: syz [ 242.033094][ T8987] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 242.051797][ T8987] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 242.070305][ T8987] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 242.077970][ T5881] usb 1-1: Using ep0 maxpacket: 32 [ 242.089489][ T5881] usb 1-1: too many endpoints for config 0 interface 0 altsetting 3: 62, using maximum allowed: 30 [ 242.112068][ T5881] usb 1-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 62 [ 242.129994][ T5881] usb 1-1: config 0 interface 0 has no altsetting 0 [ 242.143210][ T5881] usb 1-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 242.157197][ T5881] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 242.191141][ T795] usb 4-1: USB disconnect, device number 66 [ 242.242564][ T5881] usb 1-1: config 0 descriptor?? [ 242.432605][ T8987] 8021q: adding VLAN 0 to HW filter on device bond0 [ 242.461900][ T24] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 242.472209][ T8987] 8021q: adding VLAN 0 to HW filter on device team0 [ 242.482321][ T24] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 242.508777][ T77] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.516314][ T77] bridge0: port 1(bridge_slave_0) entered forwarding state [ 242.542139][ T77] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.549931][ T77] bridge0: port 2(bridge_slave_1) entered forwarding state [ 242.704623][ T9064] netlink: 10 bytes leftover after parsing attributes in process `syz.1.949'. [ 242.732275][ T5881] hid-thrustmaster 0003:044F:B65D.0011: hidraw0: USB HID v0.04 Device [HID 044f:b65d] on usb-dummy_hcd.0-1/input0 [ 242.786331][ T5881] hid-thrustmaster 0003:044F:B65D.0011: Wrong number of endpoints? [ 242.887497][ T9097] binder: Unknown parameter 'statÿ' [ 242.893244][ T9097] binder: Unknown parameter 'statÿ' [ 242.919835][ C1] hid-thrustmaster 0003:044F:B65D.0011: Unknown packet type 0x0, unable to proceed further with wheel init [ 243.099933][ T8987] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 243.135910][ T5881] usb 1-1: USB disconnect, device number 66 [ 243.364717][ T5831] Bluetooth: hci4: command tx timeout [ 243.468335][ T9119] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 243.480468][ T9119] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 243.776429][ T8987] veth0_vlan: entered promiscuous mode [ 243.802055][ T8987] veth1_vlan: entered promiscuous mode [ 243.898053][ T8987] veth0_macvtap: entered promiscuous mode [ 243.917437][ T8987] veth1_macvtap: entered promiscuous mode [ 243.995861][ T24] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000404. ret = -EPROTO [ 244.012021][ T8987] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 244.022659][ T24] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 244.036013][ T24] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 244.049066][ T24] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 244.061939][ T8987] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 244.081076][ T24] usb 2-1: USB disconnect, device number 77 [ 244.107370][ T42] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.124914][ T979] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 244.143998][ T42] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.161684][ T42] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.183028][ T42] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 244.283988][ T979] usb 1-1: device descriptor read/64, error -71 [ 244.326007][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 244.334504][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 244.403507][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 244.416809][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 244.525075][ T979] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 244.581811][ T9145] loop5: detected capacity change from 0 to 7 [ 244.603568][ T9145] Dev loop5: unable to read RDB block 7 [ 244.619029][ T9145] loop5: AHDI p1 p3 p4 [ 244.623441][ T9145] loop5: partition table partially beyond EOD, truncated [ 244.633113][ T9145] loop5: p1 size 100663296 extends beyond EOD, truncated [ 244.646562][ T9148] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 244.656834][ T9145] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 244.684076][ T29] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 244.684206][ T979] usb 1-1: device descriptor read/64, error -71 [ 244.750823][ T5982] udevd[5982]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 244.787049][ T5837] udevd[5837]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 244.824044][ T29] usb 4-1: device descriptor read/64, error -71 [ 244.830403][ T979] usb usb1-port1: attempt power cycle [ 245.066835][ T29] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 245.196757][ T979] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 245.214293][ T29] usb 4-1: device descriptor read/64, error -71 [ 245.225566][ T979] usb 1-1: device descriptor read/8, error -71 [ 245.355099][ T29] usb usb4-port1: attempt power cycle [ 245.390568][ T9185] loop5: detected capacity change from 0 to 7 [ 245.400822][ T9185] Dev loop5: unable to read RDB block 7 [ 245.410285][ T9185] loop5: unable to read partition table [ 245.416584][ T9185] loop5: partition table beyond EOD, truncated [ 245.425421][ T9185] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 245.444035][ T5831] Bluetooth: hci4: command tx timeout [ 245.486810][ T979] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 245.524038][ T1208] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 245.524698][ T979] usb 1-1: device descriptor read/8, error -71 [ 245.656357][ T979] usb usb1-port1: unable to enumerate USB device [ 245.686778][ T1208] usb 5-1: config index 0 descriptor too short (expected 539, got 27) [ 245.698459][ T1208] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 4 [ 245.713793][ T1208] usb 5-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 245.723320][ T29] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 245.733612][ T1208] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.746301][ T29] usb 4-1: device descriptor read/8, error -71 [ 245.752801][ T1208] usb 5-1: Product: syz [ 245.757949][ T1208] usb 5-1: Manufacturer: syz [ 245.762675][ T1208] usb 5-1: SerialNumber: syz [ 245.778775][ T1208] usb 5-1: config 0 descriptor?? [ 245.787797][ T1208] hub 5-1:0.0: bad descriptor, ignoring hub [ 245.795098][ T1208] hub 5-1:0.0: probe with driver hub failed with error -5 [ 245.807827][ T1208] input: syz syz as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input38 [ 245.826972][ T1208] usbtouchscreen 5-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -22 [ 245.850603][ T1208] usbtouchscreen 5-1:0.0: probe with driver usbtouchscreen failed with error -22 [ 245.874818][ T24] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 245.984654][ T29] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 246.014751][ T29] usb 4-1: device descriptor read/8, error -71 [ 246.044653][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 246.052058][ T24] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 246.061424][ T24] usb 2-1: config 0 has no interface number 0 [ 246.073607][ T24] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 246.084188][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.092798][ T24] usb 2-1: Product: syz [ 246.097592][ T24] usb 2-1: Manufacturer: syz [ 246.102308][ T24] usb 2-1: SerialNumber: syz [ 246.112640][ T24] usb 2-1: config 0 descriptor?? [ 246.124454][ T29] usb usb4-port1: unable to enumerate USB device [ 246.131579][ T979] usb 5-1: USB disconnect, device number 2 [ 246.530924][ T24] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 246.546309][ T24] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 246.563652][ T9211] loop5: detected capacity change from 0 to 7 [ 246.572509][ T9211] Dev loop5: unable to read RDB block 7 [ 246.578438][ T9211] loop5: AHDI p1 p3 p4 [ 246.583022][ T9211] loop5: partition table partially beyond EOD, truncated [ 246.591613][ T9211] loop5: p1 size 100663296 extends beyond EOD, truncated [ 246.600871][ T9211] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 246.664441][ T7431] udevd[7431]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 246.679497][ T5837] udevd[5837]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 247.021489][ T9233] FAULT_INJECTION: forcing a failure. [ 247.021489][ T9233] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 247.036590][ T9233] CPU: 0 UID: 0 PID: 9233 Comm: syz.0.973 Tainted: G L syzkaller #0 PREEMPT(full) [ 247.036620][ T9233] Tainted: [L]=SOFTLOCKUP [ 247.036627][ T9233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 247.036637][ T9233] Call Trace: [ 247.036645][ T9233] [ 247.036654][ T9233] dump_stack_lvl+0xe8/0x150 [ 247.036686][ T9233] should_fail_ex+0x412/0x560 [ 247.036714][ T9233] _copy_from_user+0x2d/0xb0 [ 247.036735][ T9233] kstrtouint_from_user+0xd6/0x180 [ 247.036761][ T9233] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 247.036814][ T9233] proc_fail_nth_write+0x8e/0x210 [ 247.036837][ T9233] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 247.036863][ T9233] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 247.036884][ T9233] vfs_write+0x29a/0xb90 [ 247.036902][ T9233] ? __pfx_vfs_write+0x10/0x10 [ 247.036914][ T9233] ? __fget_files+0x2a/0x420 [ 247.036933][ T9233] ? __fget_files+0x3a0/0x420 [ 247.036955][ T9233] ? __fget_files+0x2a/0x420 [ 247.036987][ T9233] ksys_write+0x150/0x270 [ 247.037009][ T9233] ? __pfx_ksys_write+0x10/0x10 [ 247.037040][ T9233] do_syscall_64+0x14d/0xf80 [ 247.037062][ T9233] ? trace_irq_disable+0x3b/0x150 [ 247.037078][ T9233] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.037089][ T9233] ? clear_bhb_loop+0x40/0x90 [ 247.037103][ T9233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 247.037116][ T9233] RIP: 0033:0x7f91b615b78e [ 247.037141][ T9233] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 247.037157][ T9233] RSP: 002b:00007f91b6fccfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 247.037177][ T9233] RAX: ffffffffffffffda RBX: 00007f91b6fcd6c0 RCX: 00007f91b615b78e [ 247.037190][ T9233] RDX: 0000000000000001 RSI: 00007f91b6fcd0a0 RDI: 0000000000000003 [ 247.037201][ T9233] RBP: 00007f91b6fcd090 R08: 0000000000000000 R09: 0000000000000000 [ 247.037212][ T9233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 247.037220][ T9233] R13: 00007f91b6416038 R14: 00007f91b6415fa0 R15: 00007ffc7ae330d8 [ 247.037239][ T9233] [ 247.266100][ T979] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 247.403968][ T979] usb 5-1: device descriptor read/64, error -71 [ 247.465265][ T9237] netlink: 1042 bytes leftover after parsing attributes in process `syz.0.975'. [ 247.644009][ T979] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 247.774002][ T979] usb 5-1: device descriptor read/64, error -71 [ 247.804065][ T29] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 247.886776][ T979] usb usb5-port1: attempt power cycle [ 247.955595][ T29] usb 1-1: Using ep0 maxpacket: 32 [ 247.966091][ T29] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 247.975203][ T29] usb 1-1: config 0 has no interface number 0 [ 247.982330][ T29] usb 1-1: config 0 interface 184 has no altsetting 0 [ 247.992986][ T29] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 248.003419][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.012006][ T29] usb 1-1: Product: syz [ 248.016745][ T29] usb 1-1: Manufacturer: syz [ 248.021501][ T29] usb 1-1: SerialNumber: syz [ 248.030010][ T29] usb 1-1: config 0 descriptor?? [ 248.223996][ T979] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 248.248671][ T979] usb 5-1: device descriptor read/8, error -71 [ 248.310269][ T24] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000038: -71 [ 248.328544][ T24] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 248.342337][ T24] usb 2-1: USB disconnect, device number 78 [ 248.494012][ T979] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 248.514895][ T979] usb 5-1: device descriptor read/8, error -71 [ 248.625060][ T979] usb usb5-port1: unable to enumerate USB device [ 248.652122][ T29] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 248.663470][ T29] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 248.925884][ T9259] loop5: detected capacity change from 0 to 7 [ 248.941507][ T9259] Dev loop5: unable to read RDB block 7 [ 248.947860][ T9259] loop5: unable to read partition table [ 248.954330][ T9259] loop5: partition table beyond EOD, truncated [ 248.964081][ T9259] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 249.274054][ T979] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 249.424012][ T979] usb 2-1: Using ep0 maxpacket: 32 [ 249.430882][ T979] usb 2-1: no configurations [ 249.436142][ T979] usb 2-1: can't read configurations, error -22 [ 249.484019][ T9244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.495944][ T9244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.509000][ T29] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 249.520662][ T29] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 249.532055][ T29] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 249.542852][ T29] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 249.554621][ T29] usb 1-1: USB disconnect, device number 71 [ 249.564005][ T979] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 249.724238][ T979] usb 2-1: Using ep0 maxpacket: 32 [ 249.733005][ T979] usb 2-1: no configurations [ 249.738006][ T979] usb 2-1: can't read configurations, error -22 [ 249.745061][ T979] usb usb2-port1: attempt power cycle [ 249.960497][ T9266] netlink: 'syz.4.985': attribute type 2 has an invalid length. [ 250.104432][ T979] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 250.135717][ T979] usb 2-1: Using ep0 maxpacket: 32 [ 250.153700][ T979] usb 2-1: no configurations [ 250.166264][ T979] usb 2-1: can't read configurations, error -22 [ 250.314047][ T979] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 250.334778][ T979] usb 2-1: Using ep0 maxpacket: 32 [ 250.341167][ T979] usb 2-1: no configurations [ 250.346953][ T979] usb 2-1: can't read configurations, error -22 [ 250.355777][ T979] usb usb2-port1: unable to enumerate USB device [ 250.384068][ T5904] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 250.538171][ T5904] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 250.547943][ T5904] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.556315][ T5904] usb 5-1: Product: syz [ 250.560499][ T5904] usb 5-1: Manufacturer: syz [ 250.565458][ T5904] usb 5-1: SerialNumber: syz [ 250.576096][ T5904] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 250.592648][ T979] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 250.594003][ T795] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 250.679615][ T9279] i2c i2c-0: dtv_property_process_set: SET cmd 0x6c63615f undefined [ 250.764043][ T795] usb 1-1: Using ep0 maxpacket: 32 [ 250.774748][ T795] usb 1-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 250.784031][ T795] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.792531][ T795] usb 1-1: Product: syz [ 250.796866][ T795] usb 1-1: Manufacturer: syz [ 250.801661][ T795] usb 1-1: SerialNumber: syz [ 250.809938][ T795] usb 1-1: config 0 descriptor?? [ 250.819372][ T795] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 250.974158][ T29] usb 4-1: new full-speed USB device number 71 using dummy_hcd [ 251.061607][ T5904] usb 5-1: USB disconnect, device number 7 [ 251.136056][ T29] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 251.144267][ T29] usb 4-1: can't read configurations, error -22 [ 251.221339][ T9276] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.230383][ T9276] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 251.265196][ T795] gspca_topro: reg_w err -71 [ 251.293994][ T29] usb 4-1: new full-speed USB device number 72 using dummy_hcd [ 251.302721][ T795] gspca_topro: Sensor soi763a [ 251.320036][ T795] usb 1-1: USB disconnect, device number 72 [ 251.406353][ T9289] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 251.479435][ T29] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 251.488427][ T29] usb 4-1: can't read configurations, error -22 [ 251.495974][ T29] usb usb4-port1: attempt power cycle [ 251.684136][ T979] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 251.691486][ T979] ath9k_htc: Failed to initialize the device [ 251.698998][ T5904] usb 5-1: ath9k_htc: USB layer deinitialized [ 251.774317][ T795] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 251.834058][ T29] usb 4-1: new full-speed USB device number 73 using dummy_hcd [ 251.857238][ T29] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 251.865344][ T29] usb 4-1: can't read configurations, error -22 [ 251.934174][ T795] usb 1-1: Using ep0 maxpacket: 16 [ 251.946806][ T795] usb 1-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 251.956110][ T795] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.964357][ T795] usb 1-1: Product: syz [ 251.968706][ T795] usb 1-1: Manufacturer: syz [ 251.973609][ T795] usb 1-1: SerialNumber: syz [ 251.981031][ T795] usb 1-1: config 0 descriptor?? [ 251.988290][ T795] visor 1-1:0.0: Sony Clie 3.5 converter detected [ 251.995471][ T29] usb 4-1: new full-speed USB device number 74 using dummy_hcd [ 252.004021][ T5904] usb 5-1: new low-speed USB device number 8 using dummy_hcd [ 252.026603][ T29] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 252.035017][ T29] usb 4-1: can't read configurations, error -22 [ 252.041799][ T29] usb usb4-port1: unable to enumerate USB device [ 252.134113][ T5904] usb 5-1: device descriptor read/64, error -71 [ 252.188314][ T795] usb 1-1: clie_3_5_startup: get config number failed: -71 [ 252.196199][ T795] visor 1-1:0.0: probe with driver visor failed with error -71 [ 252.211214][ T795] usb 1-1: USB disconnect, device number 73 [ 252.267219][ T9306] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 252.282240][ T9306] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 252.374100][ T5904] usb 5-1: new low-speed USB device number 9 using dummy_hcd [ 252.494439][ T5874] usb 2-1: new full-speed USB device number 83 using dummy_hcd [ 252.514169][ T5904] usb 5-1: device descriptor read/64, error -71 [ 252.625068][ T5904] usb usb5-port1: attempt power cycle [ 252.646115][ T5874] usb 2-1: config 7 has an invalid interface number: 101 but max is 0 [ 252.654815][ T5874] usb 2-1: config 7 has no interface number 0 [ 252.664009][ T5874] usb 2-1: New USB device found, idVendor=0fd9, idProduct=002c, bcdDevice= 6.6b [ 252.673676][ T5874] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.683743][ T5874] usb 2-1: Product: syz [ 252.692061][ T5874] usb 2-1: Manufacturer: syz [ 252.698688][ T5874] usb 2-1: SerialNumber: syz [ 252.762736][ T9311] loop5: detected capacity change from 0 to 7 [ 252.771880][ T5837] Dev loop5: unable to read RDB block 7 [ 252.777939][ T5837] loop5: unable to read partition table [ 252.784241][ T5837] loop5: partition table beyond EOD, truncated [ 252.792089][ T9311] Dev loop5: unable to read RDB block 7 [ 252.799563][ T9311] loop5: unable to read partition table [ 252.805931][ T9311] loop5: partition table beyond EOD, truncated [ 252.812908][ T9311] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 252.964061][ T5904] usb 5-1: new low-speed USB device number 10 using dummy_hcd [ 252.995294][ T5904] usb 5-1: device descriptor read/8, error -71 [ 253.244111][ T5904] usb 5-1: new low-speed USB device number 11 using dummy_hcd [ 253.270108][ T5904] usb 5-1: device descriptor read/8, error -71 [ 253.390166][ T5904] usb usb5-port1: unable to enumerate USB device [ 253.774267][ T9321] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 253.807565][ T9324] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 253.940717][ T9332] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 253.994977][ T9335] loop5: detected capacity change from 0 to 7 [ 254.005284][ T9335] Dev loop5: unable to read RDB block 7 [ 254.010960][ T9335] loop5: AHDI p1 p3 p4 [ 254.018577][ T9335] loop5: partition table partially beyond EOD, truncated [ 254.026759][ T9335] loop5: p1 size 100663296 extends beyond EOD, truncated [ 254.036884][ T9335] loop5: p3 size 4261412863 extends beyond EOD, truncated [ 254.110525][ T5837] udevd[5837]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 254.111774][ T7431] udevd[7431]: inotify_add_watch(7, /dev/loop5p3, 10) failed: No such file or directory [ 254.244071][ T795] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 254.393996][ T795] usb 1-1: Using ep0 maxpacket: 32 [ 254.400922][ T795] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 254.409869][ T795] usb 1-1: config 0 has no interface number 0 [ 254.416504][ T795] usb 1-1: config 0 interface 184 has no altsetting 0 [ 254.425838][ T795] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 254.436172][ T795] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.444618][ T795] usb 1-1: Product: syz [ 254.448890][ T795] usb 1-1: Manufacturer: syz [ 254.453702][ T795] usb 1-1: SerialNumber: syz [ 254.461276][ T795] usb 1-1: config 0 descriptor?? [ 254.883753][ T9347] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 254.988025][ T795] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 255.020965][ T795] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 255.040837][ T795] usb 1-1: USB disconnect, device number 74 [ 255.047178][ T979] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 255.163151][ T9353] overlayfs: invalid origin (000000ca387fe0fb3738702bed8ab4416592a5356da96db48150eae0040000006fe65c239a40022f0000000000000000) [ 255.196767][ T979] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 255.210497][ T979] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 255.223089][ T979] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 255.236065][ T979] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 255.253574][ T979] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 255.278486][ T979] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 255.313196][ T979] usb 4-1: Manufacturer: syz [ 255.325847][ T5874] as10x_usb: device has been detected [ 255.334443][ T5874] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT Deluxe) [ 255.350853][ T979] usb 4-1: config 0 descriptor?? [ 255.366983][ T5874] usb 2-1: DVB: registering adapter 1 frontend 0 (Elgato EyeTV DTT Deluxe)... [ 255.413224][ T5874] as10x_usb: error during firmware upload part1 [ 255.420997][ T5874] Registered device Elgato EyeTV DTT Deluxe [ 255.431408][ T5874] usb 2-1: USB disconnect, device number 83 [ 255.504168][ T795] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 255.516497][ T5874] Unregistered device Elgato EyeTV DTT Deluxe [ 255.519057][ T5874] as10x_usb: device has been disconnected [ 255.557332][ T29] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 255.644745][ T9368] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 255.658268][ T795] usb 1-1: device descriptor read/64, error -71 [ 255.712189][ T9371] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.1021'. [ 255.722179][ T29] usb 5-1: Using ep0 maxpacket: 16 [ 255.729436][ T29] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 255.736179][ T9371] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.1021'. [ 255.741550][ T29] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 255.771415][ T29] usb 5-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.00 [ 255.781860][ T29] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 255.801673][ T29] usb 5-1: config 0 descriptor?? [ 255.804799][ T979] appleir 0003:05AC:8243.0012: unknown main item tag 0x0 [ 255.823267][ T979] appleir 0003:05AC:8243.0012: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 255.904083][ T795] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 255.931139][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.938368][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.994104][ T979] usb 2-1: new full-speed USB device number 84 using dummy_hcd [ 256.034065][ T795] usb 1-1: device descriptor read/64, error -71 [ 256.144285][ T795] usb usb1-port1: attempt power cycle [ 256.156975][ T979] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 256.167413][ T979] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 256.179527][ T979] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 256.192448][ T979] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 256.201852][ T979] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.210031][ T979] usb 2-1: Product: syz [ 256.214527][ T979] usb 2-1: Manufacturer: syz [ 256.219237][ T979] usb 2-1: SerialNumber: syz [ 256.221813][ T29] apple 0003:05AC:0247.0013: unexpected long global item [ 256.236399][ T29] apple 0003:05AC:0247.0013: parse failed [ 256.242508][ T29] apple 0003:05AC:0247.0013: probe with driver apple failed with error -22 [ 256.443278][ T979] usb 2-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 256.446962][ T29] usb 5-1: USB disconnect, device number 12 [ 256.467609][ T979] usb 2-1: MIDIStreaming interface descriptor not found [ 256.514256][ T795] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 256.554185][ T5874] usb 4-1: USB disconnect, device number 75 [ 256.556366][ T795] usb 1-1: device descriptor read/8, error -71 [ 256.669256][ T979] usb 2-1: USB disconnect, device number 84 [ 256.814687][ T795] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 256.856132][ T795] usb 1-1: device descriptor read/8, error -71 [ 257.004358][ T795] usb usb1-port1: unable to enumerate USB device [ 257.141410][ T9397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 257.168566][ T9397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 257.363939][ T5873] usb 2-1: new full-speed USB device number 85 using dummy_hcd [ 257.527468][ T5873] usb 2-1: config 0 has an invalid interface number: 139 but max is 0 [ 257.569246][ T5873] usb 2-1: config 0 has no interface number 0 [ 257.593490][ T5873] usb 2-1: config 0 interface 139 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 257.639906][ T5873] usb 2-1: config 0 interface 139 altsetting 0 has an endpoint descriptor with address 0xBD, changing to 0x8D [ 257.667877][ T5873] usb 2-1: config 0 interface 139 altsetting 0 endpoint 0x8D has invalid maxpacket 14158, setting to 64 [ 257.696864][ T5873] usb 2-1: config 0 interface 139 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 257.728093][ T5873] usb 2-1: New USB device found, idVendor=0711, idProduct=0210, bcdDevice=fd.d6 [ 257.745176][ T5873] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.753578][ T5873] usb 2-1: Product: syz [ 257.758543][ T5873] usb 2-1: Manufacturer: syz [ 257.763178][ T5873] usb 2-1: SerialNumber: syz [ 257.781780][ T5873] usb 2-1: config 0 descriptor?? [ 257.789464][ T9396] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 257.797459][ T9396] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 257.936843][ T5881] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 257.953973][ T5874] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 258.009301][ T5873] mct_u232 2-1:0.139: MCT U232 converter detected [ 258.030094][ T5873] usb 2-1: MCT U232 converter now attached to ttyUSB0 [ 258.044778][ T5873] usb 2-1: USB disconnect, device number 85 [ 258.061833][ T5873] mct_u232 ttyUSB0: MCT U232 converter now disconnected from ttyUSB0 [ 258.081449][ T5873] mct_u232 2-1:0.139: device disconnected [ 258.114734][ T5881] usb 5-1: Using ep0 maxpacket: 8 [ 258.126051][ T5874] usb 4-1: config index 0 descriptor too short (expected 39, got 27) [ 258.139697][ T5881] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 258.147465][ T5874] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 258.161599][ T5881] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.175577][ T5874] usb 4-1: config 0 interface 0 has no altsetting 0 [ 258.179428][ T5881] usb 5-1: Product: syz [ 258.198194][ T5874] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 258.204250][ T5881] usb 5-1: Manufacturer: syz [ 258.212273][ T5874] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 258.216023][ T5881] usb 5-1: SerialNumber: syz [ 258.232291][ T5874] usb 4-1: Product: syz [ 258.252125][ T5881] usb 5-1: config 0 descriptor?? [ 258.253326][ T5874] usb 4-1: Manufacturer: syz [ 258.267034][ T5874] usb 4-1: SerialNumber: syz [ 258.273563][ T9432] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1028'. [ 258.285259][ T5874] usb 4-1: config 0 descriptor?? [ 258.305255][ T5874] hub 4-1:0.0: bad descriptor, ignoring hub [ 258.311478][ T5874] hub 4-1:0.0: probe with driver hub failed with error -5 [ 258.342827][ T5874] usb 4-1: selecting invalid altsetting 0 [ 258.369730][ T9437] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 258.461603][ T9443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.472224][ T5881] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 258.481961][ T9443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.506319][ T9417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.516270][ T9417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.586023][ T5874] usb 4-1: USB disconnect, device number 76 [ 258.659093][ T5826] udevd[5826]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 258.682475][ T5881] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 258.694297][ T29] usb 1-1: new full-speed USB device number 79 using dummy_hcd [ 258.873972][ T5881] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 258.901899][ T29] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 258.910753][ T29] usb 1-1: can't read configurations, error -61 [ 259.045078][ T29] usb 1-1: new full-speed USB device number 80 using dummy_hcd [ 259.064559][ T5881] usb 2-1: Using ep0 maxpacket: 32 [ 259.072758][ T5881] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 259.097833][ T5881] usb 2-1: config 0 has no interface number 0 [ 259.108028][ T5881] usb 2-1: config 0 interface 184 has no altsetting 0 [ 259.120221][ T5881] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 259.136567][ T5881] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.151716][ T5881] usb 2-1: Product: syz [ 259.161337][ T5881] usb 2-1: Manufacturer: syz [ 259.166638][ T5881] usb 2-1: SerialNumber: syz [ 259.176052][ T5881] usb 2-1: config 0 descriptor?? [ 259.233086][ T29] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 259.241243][ T29] usb 1-1: can't read configurations, error -61 [ 259.251997][ T29] usb usb1-port1: attempt power cycle [ 259.464236][ T5874] usb 5-1: USB disconnect, device number 13 [ 259.604053][ T29] usb 1-1: new full-speed USB device number 81 using dummy_hcd [ 259.657904][ T29] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 259.673957][ T29] usb 1-1: can't read configurations, error -61 [ 259.822206][ T29] usb 1-1: new full-speed USB device number 82 using dummy_hcd [ 259.862218][ T29] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 259.876571][ T29] usb 1-1: can't read configurations, error -61 [ 259.898461][ T29] usb usb1-port1: unable to enumerate USB device [ 259.927432][ T9477] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1037'. [ 259.941221][ T9477] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 259.966530][ T9477] netlink: 'syz.3.1037': attribute type 10 has an invalid length. [ 259.976736][ T9477] netlink: 55 bytes leftover after parsing attributes in process `syz.3.1037'. [ 260.598134][ T9485] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1039'. [ 260.608438][ T9484] netlink: 624 bytes leftover after parsing attributes in process `syz.4.1039'. [ 260.740911][ T9487] FAULT_INJECTION: forcing a failure. [ 260.740911][ T9487] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 260.756805][ T9487] CPU: 1 UID: 0 PID: 9487 Comm: syz.4.1040 Tainted: G L syzkaller #0 PREEMPT(full) [ 260.756836][ T9487] Tainted: [L]=SOFTLOCKUP [ 260.756843][ T9487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 260.756854][ T9487] Call Trace: [ 260.756862][ T9487] [ 260.756875][ T9487] dump_stack_lvl+0xe8/0x150 [ 260.756906][ T9487] should_fail_ex+0x412/0x560 [ 260.756936][ T9487] _copy_from_iter+0x1d3/0x1670 [ 260.756974][ T9487] ? __pfx__copy_from_iter+0x10/0x10 [ 260.757003][ T9487] ? __lock_acquire+0x6b5/0x2cf0 [ 260.757036][ T9487] tun_get_user+0x275/0x3dd0 [ 260.757077][ T9487] ? __pfx_tun_get_user+0x10/0x10 [ 260.757098][ T9487] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 260.757123][ T9487] ? lockdep_hardirqs_on+0x7a/0x110 [ 260.757147][ T9487] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 260.757169][ T9487] ? save_netdev_trace_buffer+0x4e2/0x610 [ 260.757206][ T9487] ? ref_tracker_alloc+0x363/0x4d0 [ 260.757231][ T9487] ? tun_chr_write_iter+0x60/0x210 [ 260.757249][ T9487] ? vfs_write+0x61d/0xb90 [ 260.757265][ T9487] ? ksys_write+0x150/0x270 [ 260.757283][ T9487] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 260.757314][ T9487] ? tun_get+0x1c/0x2f0 [ 260.757339][ T9487] ? tun_get+0x1c/0x2f0 [ 260.757358][ T9487] ? tun_get+0x1c/0x2f0 [ 260.757380][ T9487] tun_chr_write_iter+0x113/0x210 [ 260.757402][ T9487] vfs_write+0x61d/0xb90 [ 260.757429][ T9487] ? __pfx_vfs_write+0x10/0x10 [ 260.757458][ T9487] ? __fget_files+0x2a/0x420 [ 260.757492][ T9487] ksys_write+0x150/0x270 [ 260.757514][ T9487] ? __pfx_ksys_write+0x10/0x10 [ 260.757544][ T9487] do_syscall_64+0x14d/0xf80 [ 260.757568][ T9487] ? trace_irq_disable+0x3b/0x150 [ 260.757593][ T9487] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.757620][ T9487] ? clear_bhb_loop+0x40/0x90 [ 260.757644][ T9487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.757662][ T9487] RIP: 0033:0x7faa3619aeb9 [ 260.757681][ T9487] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 260.757696][ T9487] RSP: 002b:00007faa3703f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 260.757717][ T9487] RAX: ffffffffffffffda RBX: 00007faa36415fa0 RCX: 00007faa3619aeb9 [ 260.757731][ T9487] RDX: 000000000000fdef RSI: 0000200000000040 RDI: 0000000000000007 [ 260.757743][ T9487] RBP: 00007faa3703f090 R08: 0000000000000000 R09: 0000000000000000 [ 260.757755][ T9487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 260.757766][ T9487] R13: 00007faa36416038 R14: 00007faa36415fa0 R15: 00007ffca8a47fb8 [ 260.757796][ T9487] [ 261.349383][ T5881] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 261.360114][ T5881] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 261.374434][ T5881] usb 2-1: USB disconnect, device number 86 [ 261.532133][ T9492] netlink: 'syz.4.1042': attribute type 10 has an invalid length. [ 261.557554][ T9494] pimreg: left allmulticast mode [ 261.593752][ T9492] bridge0: port 2(bridge_slave_1) entered disabled state [ 261.601391][ T9492] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.653027][ T9492] bridge0: port 2(bridge_slave_1) entered blocking state [ 261.660734][ T9492] bridge0: port 2(bridge_slave_1) entered forwarding state [ 261.668586][ T9492] bridge0: port 1(bridge_slave_0) entered blocking state [ 261.676265][ T9492] bridge0: port 1(bridge_slave_0) entered forwarding state [ 261.746088][ T9492] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 262.203939][ T1208] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 262.364046][ T979] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 262.373936][ T1208] usb 4-1: Using ep0 maxpacket: 8 [ 262.388050][ T1208] usb 4-1: config 2 interface 0 has no altsetting 0 [ 262.406965][ T1208] usb 4-1: New USB device found, idVendor=04e2, idProduct=1412, bcdDevice=ca.10 [ 262.423945][ T1208] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.442815][ T1208] usb 4-1: Product: syz [ 262.447565][ T1208] usb 4-1: Manufacturer: syz [ 262.452284][ T1208] usb 4-1: SerialNumber: syz [ 262.483537][ T9514] FAULT_INJECTION: forcing a failure. [ 262.483537][ T9514] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.499818][ T9514] CPU: 1 UID: 0 PID: 9514 Comm: syz.1.1049 Tainted: G L syzkaller #0 PREEMPT(full) [ 262.499851][ T9514] Tainted: [L]=SOFTLOCKUP [ 262.499863][ T9514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 262.499874][ T9514] Call Trace: [ 262.499882][ T9514] [ 262.499890][ T9514] dump_stack_lvl+0xe8/0x150 [ 262.499921][ T9514] should_fail_ex+0x412/0x560 [ 262.499950][ T9514] _copy_from_iter+0x1d3/0x1670 [ 262.499989][ T9514] ? __pfx__copy_from_iter+0x10/0x10 [ 262.500020][ T9514] ? __lock_acquire+0x6b5/0x2cf0 [ 262.500054][ T9514] tun_get_user+0x516/0x3dd0 [ 262.500097][ T9514] ? __pfx_tun_get_user+0x10/0x10 [ 262.500118][ T9514] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 262.500142][ T9514] ? lockdep_hardirqs_on+0x7a/0x110 [ 262.500165][ T9514] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 262.500186][ T9514] ? save_netdev_trace_buffer+0x4e2/0x610 [ 262.500221][ T9514] ? ref_tracker_alloc+0x363/0x4d0 [ 262.500245][ T9514] ? tun_chr_write_iter+0x60/0x210 [ 262.500262][ T9514] ? vfs_write+0x61d/0xb90 [ 262.500278][ T9514] ? ksys_write+0x150/0x270 [ 262.500296][ T9514] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 262.500326][ T9514] ? tun_get+0x1c/0x2f0 [ 262.500352][ T9514] ? tun_get+0x1c/0x2f0 [ 262.500369][ T9514] ? tun_get+0x1c/0x2f0 [ 262.500393][ T9514] tun_chr_write_iter+0x113/0x210 [ 262.500425][ T9514] vfs_write+0x61d/0xb90 [ 262.500451][ T9514] ? __pfx_vfs_write+0x10/0x10 [ 262.500480][ T9514] ? __fget_files+0x2a/0x420 [ 262.500514][ T9514] ksys_write+0x150/0x270 [ 262.500535][ T9514] ? __pfx_ksys_write+0x10/0x10 [ 262.500564][ T9514] do_syscall_64+0x14d/0xf80 [ 262.500587][ T9514] ? trace_irq_disable+0x3b/0x150 [ 262.500611][ T9514] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.500630][ T9514] ? clear_bhb_loop+0x40/0x90 [ 262.500653][ T9514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.500671][ T9514] RIP: 0033:0x7f887c39aeb9 [ 262.500691][ T9514] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 262.500708][ T9514] RSP: 002b:00007f887d216028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 262.500731][ T9514] RAX: ffffffffffffffda RBX: 00007f887c615fa0 RCX: 00007f887c39aeb9 [ 262.500744][ T9514] RDX: 000000000000fdef RSI: 0000200000000040 RDI: 0000000000000007 [ 262.500757][ T9514] RBP: 00007f887d216090 R08: 0000000000000000 R09: 0000000000000000 [ 262.500768][ T9514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 262.500779][ T9514] R13: 00007f887c616038 R14: 00007f887c615fa0 R15: 00007ffe375d4578 [ 262.500808][ T9514] [ 262.514013][ T979] usb 5-1: Using ep0 maxpacket: 8 [ 262.574879][ T9516] program syz.0.1050 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 262.587242][ T979] usb 5-1: unable to get BOS descriptor or descriptor too short [ 262.685413][ T9507] fuse: Unknown parameter 'user_ d' [ 262.687925][ T979] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 262.813702][ T979] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 262.823933][ T979] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 262.854067][ T979] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 65535, setting to 1024 [ 262.867672][ T979] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1024 [ 262.878332][ T979] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 262.892496][ T979] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 262.906999][ T979] usb 5-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 262.917255][ T979] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.927838][ T979] usb 5-1: Product: syz [ 262.932858][ T979] usb 5-1: Manufacturer: syz [ 262.940707][ T979] usb 5-1: SerialNumber: syz [ 262.954595][ T979] usb 5-1: config 0 descriptor?? [ 262.962587][ T9511] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 262.976119][ T979] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 263.087346][ T9521] ================================================================== [ 263.095476][ T9521] BUG: KASAN: slab-use-after-free in dvb_device_open+0xc4/0x350 [ 263.103166][ T9521] Read of size 8 at addr ffff88802c06a018 by task syz.0.1052/9521 [ 263.111091][ T9521] [ 263.113625][ T9521] CPU: 1 UID: 0 PID: 9521 Comm: syz.0.1052 Tainted: G L syzkaller #0 PREEMPT(full) [ 263.113672][ T9521] Tainted: [L]=SOFTLOCKUP [ 263.113680][ T9521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 263.113694][ T9521] Call Trace: [ 263.113702][ T9521] [ 263.113713][ T9521] dump_stack_lvl+0xe8/0x150 [ 263.113745][ T9521] print_report+0xba/0x230 [ 263.113772][ T9521] ? dvb_device_open+0xc4/0x350 [ 263.113801][ T9521] kasan_report+0x117/0x150 [ 263.113826][ T9521] ? dvb_device_open+0xc4/0x350 [ 263.113854][ T9521] dvb_device_open+0xc4/0x350 [ 263.113878][ T9521] ? do_raw_spin_unlock+0xf5/0x210 [ 263.113900][ T9521] chrdev_open+0x4cd/0x5e0 [ 263.113924][ T9521] ? __pfx_chrdev_open+0x10/0x10 [ 263.113946][ T9521] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 263.113979][ T9521] ? __pfx_chrdev_open+0x10/0x10 [ 263.114002][ T9521] do_dentry_open+0x785/0x14e0 [ 263.114035][ T9521] vfs_open+0x3b/0x340 [ 263.114059][ T9521] ? path_openat+0x2df0/0x3860 [ 263.114082][ T9521] path_openat+0x2e08/0x3860 [ 263.114110][ T9521] ? __pfx_stack_trace_save+0x10/0x10 [ 263.114132][ T9521] ? stack_depot_save_flags+0x33/0x810 [ 263.114165][ T9521] ? __pfx_path_openat+0x10/0x10 [ 263.114184][ T9521] ? __x64_sys_openat+0x138/0x170 [ 263.114211][ T9521] ? do_syscall_64+0x14d/0xf80 [ 263.114240][ T9521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.114268][ T9521] ? __lock_acquire+0x6b5/0x2cf0 [ 263.114298][ T9521] do_file_open+0x23e/0x4a0 [ 263.114322][ T9521] ? __pfx_do_file_open+0x10/0x10 [ 263.114352][ T9521] ? _raw_spin_unlock+0x28/0x50 [ 263.114377][ T9521] ? alloc_fd+0x64b/0x6c0 [ 263.114407][ T9521] do_sys_openat2+0x113/0x200 [ 263.114437][ T9521] ? __pfx_do_sys_openat2+0x10/0x10 [ 263.114463][ T9521] ? exc_page_fault+0x6a/0xc0 [ 263.114490][ T9521] ? do_user_addr_fault+0xc6f/0x1340 [ 263.114517][ T9521] __x64_sys_openat+0x138/0x170 [ 263.114546][ T9521] do_syscall_64+0x14d/0xf80 [ 263.114573][ T9521] ? trace_irq_disable+0x3b/0x150 [ 263.114603][ T9521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.114625][ T9521] ? clear_bhb_loop+0x40/0x90 [ 263.114662][ T9521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.114687][ T9521] RIP: 0033:0x7f91b615b78e [ 263.114710][ T9521] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 263.114729][ T9521] RSP: 002b:00007f91b6fccb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 263.114754][ T9521] RAX: ffffffffffffffda RBX: 00007f91b6fcd6c0 RCX: 00007f91b615b78e [ 263.114771][ T9521] RDX: 0000000000040002 RSI: 00007f91b6fccc00 RDI: ffffffffffffff9c [ 263.114786][ T9521] RBP: 00007f91b6fccc00 R08: 0000000000000000 R09: 0000000000000000 [ 263.114800][ T9521] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 263.114814][ T9521] R13: 00007f91b6416038 R14: 00007f91b6415fa0 R15: 00007ffc7ae330d8 [ 263.114837][ T9521] [ 263.114845][ T9521] [ 263.414125][ T9521] Allocated by task 1: [ 263.418455][ T9521] kasan_save_track+0x3e/0x80 [ 263.423157][ T9521] __kasan_kmalloc+0x93/0xb0 [ 263.428007][ T9521] __kmalloc_cache_noprof+0x31c/0x660 [ 263.433650][ T9521] dvb_register_device+0x2fd/0x2210 [ 263.438938][ T9521] dvb_register_frontend+0x649/0x950 [ 263.444431][ T9521] vidtv_bridge_probe+0x9aa/0xf80 [ 263.449612][ T9521] platform_probe+0xf9/0x190 [ 263.454291][ T9521] really_probe+0x267/0xaf0 [ 263.458792][ T9521] __driver_probe_device+0x18c/0x320 [ 263.464078][ T9521] driver_probe_device+0x4f/0x240 [ 263.469110][ T9521] __driver_attach+0x3e7/0x710 [ 263.473903][ T9521] bus_for_each_dev+0x23b/0x2c0 [ 263.478760][ T9521] bus_add_driver+0x345/0x670 [ 263.483627][ T9521] driver_register+0x23a/0x320 [ 263.488420][ T9521] vidtv_bridge_init+0x28/0x50 [ 263.493195][ T9521] do_one_initcall+0x250/0x8d0 [ 263.497968][ T9521] do_initcall_level+0x104/0x190 [ 263.502909][ T9521] do_initcalls+0x59/0xa0 [ 263.507235][ T9521] kernel_init_freeable+0x2a6/0x3e0 [ 263.512433][ T9521] kernel_init+0x1d/0x1d0 [ 263.516773][ T9521] ret_from_fork+0x51e/0xb90 [ 263.521394][ T9521] ret_from_fork_asm+0x1a/0x30 [ 263.526186][ T9521] [ 263.528601][ T9521] Freed by task 9446: [ 263.532748][ T9521] kasan_save_track+0x3e/0x80 [ 263.537515][ T9521] kasan_save_free_info+0x46/0x50 [ 263.542717][ T9521] __kasan_slab_free+0x5c/0x80 [ 263.547587][ T9521] kfree+0x1c1/0x630 [ 263.551580][ T9521] dvb_device_open+0x2cd/0x350 [ 263.556532][ T9521] chrdev_open+0x4cd/0x5e0 [ 263.561067][ T9521] do_dentry_open+0x785/0x14e0 [ 263.565971][ T9521] vfs_open+0x3b/0x340 [ 263.570060][ T9521] path_openat+0x2e08/0x3860 [ 263.574654][ T9521] do_file_open+0x23e/0x4a0 [ 263.579158][ T9521] do_sys_openat2+0x113/0x200 [ 263.583933][ T9521] __x64_sys_openat+0x138/0x170 [ 263.588825][ T9521] do_syscall_64+0x14d/0xf80 [ 263.593419][ T9521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.599833][ T9521] [ 263.602573][ T9521] The buggy address belongs to the object at ffff88802c06a000 [ 263.602573][ T9521] which belongs to the cache kmalloc-256 of size 256 [ 263.616829][ T9521] The buggy address is located 24 bytes inside of [ 263.616829][ T9521] freed 256-byte region [ffff88802c06a000, ffff88802c06a100) [ 263.630910][ T9521] [ 263.633323][ T9521] The buggy address belongs to the physical page: [ 263.640005][ T9521] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c06a [ 263.649306][ T9521] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 263.657823][ T9521] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 263.665561][ T9521] page_type: f5(slab) [ 263.670160][ T9521] raw: 00fff00000000040 ffff88813ff1bb40 dead000000000122 0000000000000000 [ 263.678935][ T9521] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 263.687638][ T9521] head: 00fff00000000040 ffff88813ff1bb40 dead000000000122 0000000000000000 [ 263.696842][ T9521] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 263.705603][ T9521] head: 00fff00000000001 ffffea0000b01a81 00000000ffffffff 00000000ffffffff [ 263.714448][ T9521] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 263.723113][ T9521] page dumped because: kasan: bad access detected [ 263.729790][ T9521] page_owner tracks the page as allocated [ 263.735512][ T9521] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 19547035007, free_ts 0 [ 263.756094][ T9521] post_alloc_hook+0x231/0x280 [ 263.760975][ T9521] get_page_from_freelist+0x24dc/0x2580 [ 263.766530][ T9521] __alloc_frozen_pages_noprof+0x18d/0x380 [ 263.772855][ T9521] allocate_slab+0x7b/0x660 [ 263.777358][ T9521] refill_objects+0x331/0x3c0 [ 263.782043][ T9521] __pcs_replace_empty_main+0x2b9/0x620 [ 263.787688][ T9521] __kmalloc_cache_noprof+0x392/0x660 [ 263.793058][ T9521] bus_add_driver+0x162/0x670 [ 263.797930][ T9521] driver_register+0x23a/0x320 [ 263.802870][ T9521] usb_register_driver+0x1e4/0x390 [ 263.808170][ T9521] do_one_initcall+0x250/0x8d0 [ 263.813129][ T9521] do_initcall_level+0x104/0x190 [ 263.818240][ T9521] do_initcalls+0x59/0xa0 [ 263.822902][ T9521] kernel_init_freeable+0x2a6/0x3e0 [ 263.828097][ T9521] kernel_init+0x1d/0x1d0 [ 263.832436][ T9521] ret_from_fork+0x51e/0xb90 [ 263.837204][ T9521] page_owner free stack trace missing [ 263.842655][ T9521] [ 263.845323][ T9521] Memory state around the buggy address: [ 263.851392][ T9521] ffff88802c069f00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 263.859540][ T9521] ffff88802c069f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 263.867600][ T9521] >ffff88802c06a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 263.875835][ T9521] ^ [ 263.880939][ T9521] ffff88802c06a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 263.888999][ T9521] ffff88802c06a100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 263.897230][ T9521] ================================================================== [ 263.937280][ T6520] udevd[6520]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 263.974362][ T9521] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 263.982319][ T9521] CPU: 0 UID: 0 PID: 9521 Comm: syz.0.1052 Tainted: G L syzkaller #0 PREEMPT(full) [ 263.993464][ T9521] Tainted: [L]=SOFTLOCKUP [ 263.997823][ T9521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 264.008158][ T9521] Call Trace: [ 264.011930][ T9521] [ 264.015231][ T9521] vpanic+0x56c/0xa60 [ 264.019453][ T9521] ? __pfx_vpanic+0x10/0x10 [ 264.024127][ T9521] ? __pfx___schedule+0x10/0x10 [ 264.029032][ T9521] panic+0xc5/0xd0 [ 264.032934][ T9521] ? __pfx_panic+0x10/0x10 [ 264.037570][ T9521] ? preempt_schedule_thunk+0x16/0x30 [ 264.043066][ T9521] ? dvb_device_open+0xc4/0x350 [ 264.047950][ T9521] check_panic_on_warn+0x89/0xb0 [ 264.053089][ T9521] ? dvb_device_open+0xc4/0x350 [ 264.058233][ T9521] end_report+0x73/0x180 [ 264.062624][ T9521] ? dvb_device_open+0xc4/0x350 [ 264.067586][ T9521] kasan_report+0x128/0x150 [ 264.072460][ T9521] ? dvb_device_open+0xc4/0x350 [ 264.077606][ T9521] dvb_device_open+0xc4/0x350 [ 264.082491][ T9521] ? do_raw_spin_unlock+0xf5/0x210 [ 264.087831][ T9521] chrdev_open+0x4cd/0x5e0 [ 264.092466][ T9521] ? __pfx_chrdev_open+0x10/0x10 [ 264.097440][ T9521] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 264.104174][ T9521] ? __pfx_chrdev_open+0x10/0x10 [ 264.109376][ T9521] do_dentry_open+0x785/0x14e0 [ 264.114196][ T9521] vfs_open+0x3b/0x340 [ 264.118508][ T9521] ? path_openat+0x2df0/0x3860 [ 264.123306][ T9521] path_openat+0x2e08/0x3860 [ 264.128047][ T9521] ? __pfx_stack_trace_save+0x10/0x10 [ 264.133622][ T9521] ? stack_depot_save_flags+0x33/0x810 [ 264.139137][ T9521] ? __pfx_path_openat+0x10/0x10 [ 264.144440][ T9521] ? __x64_sys_openat+0x138/0x170 [ 264.149575][ T9521] ? do_syscall_64+0x14d/0xf80 [ 264.154453][ T9521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.160550][ T9521] ? __lock_acquire+0x6b5/0x2cf0 [ 264.165601][ T9521] do_file_open+0x23e/0x4a0 [ 264.170921][ T9521] ? __pfx_do_file_open+0x10/0x10 [ 264.176163][ T9521] ? _raw_spin_unlock+0x28/0x50 [ 264.181226][ T9521] ? alloc_fd+0x64b/0x6c0 [ 264.185944][ T9521] do_sys_openat2+0x113/0x200 [ 264.190923][ T9521] ? __pfx_do_sys_openat2+0x10/0x10 [ 264.196161][ T9521] ? exc_page_fault+0x6a/0xc0 [ 264.200881][ T9521] ? do_user_addr_fault+0xc6f/0x1340 [ 264.206545][ T9521] __x64_sys_openat+0x138/0x170 [ 264.211684][ T9521] do_syscall_64+0x14d/0xf80 [ 264.216557][ T9521] ? trace_irq_disable+0x3b/0x150 [ 264.221873][ T9521] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.228050][ T9521] ? clear_bhb_loop+0x40/0x90 [ 264.232751][ T9521] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 264.239189][ T9521] RIP: 0033:0x7f91b615b78e [ 264.244109][ T9521] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 264.265481][ T9521] RSP: 002b:00007f91b6fccb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 264.274375][ T9521] RAX: ffffffffffffffda RBX: 00007f91b6fcd6c0 RCX: 00007f91b615b78e [ 264.282715][ T9521] RDX: 0000000000040002 RSI: 00007f91b6fccc00 RDI: ffffffffffffff9c [ 264.290893][ T9521] RBP: 00007f91b6fccc00 R08: 0000000000000000 R09: 0000000000000000 [ 264.299228][ T9521] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 264.307476][ T9521] R13: 00007f91b6416038 R14: 00007f91b6415fa0 R15: 00007ffc7ae330d8 [ 264.315636][ T9521] [ 264.319258][ T9521] Kernel Offset: disabled [ 264.323665][ T9521] Rebooting in 86400 seconds..