last executing test programs: 10.602187153s ago: executing program 4 (id=1239): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000001480)=[{{&(0x7f0000000000)={0xa, 0x4e1e, 0x0, @remote, 0x6}, 0x1c, &(0x7f00000011c0)=[{&(0x7f00000010c0)="7957d404736da65f9d132319c6a502980bd70906e911", 0x16}, {&(0x7f00000000c0)="4fb9dd96d8c3", 0x6}, {&(0x7f0000001100)="dd0042f00d2a35af4569f98e31cd5cfed50a5a561f724554853737735e54d474d6dfd389e0f4f50e4a724f5bd01c9cbf5d0dcc0e21014aa7bec135dbe6134bdd45c037a7f6f11cc5407e15bdb59b18417c013e09d7acb712f32664427e942863892c4e5c14da4e381521d188b810525e7f4bb240fd", 0x75}], 0x3, &(0x7f00000020c0)=ANY=[@ANYBLOB="38020000000000032900000036000000004300000000000004013f040100c910ff010000000000000000000000000001c910fc0000000000000000000000000000000001000740000000000e07010101000000010000000200000000000000000000000000000001000000010000002000000000000000ffffffff00000000ffffffffffffff7f06aeb07c1c192077cc9e7c45705803ad5588ca8b194d23f748fe792cfa3d32221f25d73b8ffe64a4ddda6efcfb7483b588194d29c7a04395d8500965a9a1d07879040c44db1d5d6f618d2ab920f0bf168ddc9acc6a51edd1230760d4ae8bf30f5f82a78e8114849ee8e37364560400000035bfa8197ef2ba99103ee5f5aae28ec5c8e2675db11530f5c466d55f2244d479dc653c854406155eada3eaeb90d39149b8d13bab75a9bd1452c8c76284b9ddfbeff41344e64f1771d78a706e1c5a6d63f1c954e24a1e73f75c26e9f09ec9b606cc3470f11c4842db651926bd2263a4a0a8fe80de8b2f9cb176e51819d5f4d10a5d1f0488d5e46953fbfd750f6137fbebe89a8d462158a87f9622355104b4f68d7a6d3ad85c373ea52a25afad37ffb743a5c361158087904b09fcc806d032bac00ee0e0251fc032446e45a3e12417ff4703526ffc45f71567857777927903799e0ba453334186009d22e38099c67b5350c7e82136bba947a18fb61d36fcba1f9efe3d79485d06252702833dc8ee417f40bb9064878fb89dd75a49135e5df148c4ad1e1d5626b44c8112d822f4c9a05e693fd5ae5595627f8684016b37a2bf6d0040030000000000002900000037000000006500000000000000fb1a63687c244e6df3aecb13d6eb957495b669cc032f6d0a11a5e16eed9937b046c9dc1a61dcf9754b767df4735c3f8c37b4d5cd15a99c5a19cc62c921ad4e90d6e3695ec1891223a53600d5031b5735acafb556e22279975f958ad437c76573e544506e58455772eb11493af933099a5dc7e9e0c8b907e68e23e59d7b94bc774309e2047132758b60955301f277a9032b0bc47e660b243e9e2126733f13ab99055a0999068ada35a38d105a5efe6c7115774effe28695ecae3944413b7764eefde26ed571d857b2cb2dd1b2a4a84c1fec0799cf90f57f7a6d35e2b60cd425b9372ae4a27f453e5d7da2eacd3b98cdb10cec9152d5829c2511eb0f9600a0cd280f3d08849b6cd43d25e3dcd62f7c7dee6123a2682daf4aa9a856b31e9204c5c2b80b84dbeec05d93a64a550f1ebc326488cd620c6fe1aa266a0ce5b24be03b5037786e037cc85ed61f362e081fb694e12e54fcb9eb0f86d6d91fd159023a073278f84d6ada8f9aa25ec223d268f3291b25392c941740932bd1a82f40a8fc586db23d2f6240ce883e3c1dc1e0d07fc3aa73a9ac82a1538d129c9e66cb6a8100abe95bc4064581e8c01ce65ba3ea751db5d8c0a1173fe62b2fd2d415042a97ade4d274a466b6d997eed6bf5d7a305ead804c36b9e1c314b26676ed83412417610d3cf4d07e5b24cf3de9c790ae93850e0f8bba047b710cf340c78a80cef5f6665a647681ff5f7b6ecce8ab65e26406b6a6e0e72ff8501c545bffc00f034dc3a5b251390ae68bb61d936dc9a24e6f66c72e7911c51c716dfd4304566fb32e6c2745d232f990d0bbe0ddf9dc58398dda292c07b16da766a37c60bd9993b4f21e641036a8afa2ccdb47d7990d5a007faccb2f86664179f2e229723bce870aec3f7f4e529c92add713590ce6c0ea1a0499fb76d32636cfd18b6b39fb48f1a6d46f6ae8f45c47ee8260f9531070d170ab92739be0bdf5b76f8a9b93a5e550dfecab79d2e46085a67024b6be883c79ade2873458fda5a7f4eb62b05634356ee3b45723f4cff19c654ad441ff5b8792df7f18d841c351e195151b1b3532e742a6525c86efdb29653f35ce8e0a41c8c6d39f39531e13aeb1172893eeedd83b6afb939f8e6abc5482696aa48918000000000000002900000037"], 0x590}}], 0x1, 0x8008801) 10.212281387s ago: executing program 3 (id=1241): openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="f0000000100013070000000000000000ffffffff000000000000000000000000ac1e00010000000000000000000000000000000000000000000000005ab2f76f060000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414aa000000000000000000000000000000003c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b614403cffbf0fdc415a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fdffffff000000000000000000000000020000000000000000000000784dbabeedf6d71b03a161a2eebe839930b8801cba5ff283d181c67e3b45aedad645f970c33edca6a777b018c61909607b0bc8829ffcec66b3"], 0xf0}}, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r0, &(0x7f0000000480), 0x0, 0x0, 0x0) 10.086571505s ago: executing program 4 (id=1242): userfaultfd(0x801) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socket(0x22, 0x2, 0x24) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044000000a80016000a0003400220000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, 0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x46, &(0x7f0000000040)=ANY=[@ANYRES64, @ANYRES16], 0x0) 9.923492614s ago: executing program 3 (id=1243): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000000)=@x86={0x5, 0x5, 0x17, 0x0, 0x3, 0xf9, 0x2, 0x79, 0xff, 0x8, 0x1, 0x1, 0x0, 0x8, 0x5, 0x4, 0x72, 0x7, 0xfa, '\x00', 0x3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2d58}}, './file0\x00'}) r4 = eventfd2(0x107, 0x80800) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000200)={0x3, 0xffff1000, 0x8, r4, 0x2}) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r5, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) unshare(0x6020400) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x9, &(0x7f0000000040)=0x1, 0x4) r7 = socket$inet(0x2, 0x3, 0x1) setsockopt$inet_group_source_req(r3, 0x0, 0x2b, &(0x7f0000000240)={0x9, {{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, {{0x2, 0x4e21, @broadcast}}}, 0x108) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000040)={{0x1, 0x1, 0x18, r7, {0x9}}, './file0\x00'}) ioctl$PIO_CMAP(r8, 0x4b71, &(0x7f0000000080)={0xffffffffffffffff, 0x8, 0x0, 0x3a64a113, 0x1000, 0x7fff}) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f0000000140)={0x2, 0x1, [{0xf92, 0x0, 0x2}, {0x6, 0x0, 0x7}]}) setsockopt$inet6_IPV6_ADDRFORM(r9, 0x29, 0x1, &(0x7f0000000100), 0x4) setsockopt$inet_opts(r7, 0x0, 0xb, &(0x7f0000000000)="89", 0x1) nanosleep(&(0x7f0000000380), &(0x7f00000003c0)) syz_emit_ethernet(0xaa, &(0x7f0000000400)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb08004500009c00680000000190786444ccceca9ebbe8cb1ed880bbac1e0001ac1414aa0b039078006f000640000001010607130000000000000000000000000000000000440c00030000000000000000891bb600000000ffffffffffffffffac141415e0000001ac1e0101442c03010a0101010000000d64010100000000040a01010100000001e0000001000000026401010a01acdcf21df90af201e104c9aa0100000008440400"/197], 0x0) 9.436054055s ago: executing program 3 (id=1244): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000600)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000000c0), 0x0) r4 = accept4(r3, 0x0, 0x0, 0x80000) recvmsg$can_raw(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000140)=""/103, 0x67}], 0x1}, 0x40010022) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r5, 0x0, 0x20004804) r6 = syz_open_dev$loop(&(0x7f00000000c0), 0x8, 0x80880) ioctl$BLKRRPART(r6, 0x125f, 0x0) ioctl$INCFS_IOC_FILL_BLOCKS(0xffffffffffffffff, 0x80106720, &(0x7f00000001c0)={0x3, &(0x7f0000000140)=[{0x0, 0x5d, &(0x7f0000000000)="3ace8a7e162a57a415afc9ba58a0d4b4547f50f92dbae55648af704d3d28372c2cc8cbf0b205e45a0ebb68ffc1b6be37794d27f27baf0cf153a49cfee2d65ba8fa4beebc7c3f624f45ff6ad418ecf48396cab7e823d2417b2c1af76bfe", 0x0, 0x1}, {0x5, 0xfb, &(0x7f0000000280)="df70d80b7930fa02bac03f03b0ceb216f419af16192ea1bd6e1d888f0164579dba5f316fe13821b98cfd508547c47f82f2bb7cced5dc74a2c5bc64dbcd190926ca64a6da5c77484f52798058d8a521d206d260bdea3117af6cc9f88b8e025954315c5934e6f0fda3a48e080993fcdc4981365a81512d39d1a397feb83c8fa94406f16b3627e2d0afab0b9d7718a2ddc1be94a73a7d18f45f238fd29b5a2f91721b5c15c920eaca2508aa4b6bea419e83bb41d4399e8c43d4403a666edddfff76115ae09527245a70d9e1bed0931c4ffa11777a46cdbd1a07e44e998f8fba83e4f3913a42bc07a6b4711de9014f4484a3ff037a45920b2680dc507d"}, {0x9, 0x2e, &(0x7f0000000080)="8d0bb7bf04f71da07d40818795def17404b36a197645b4b1e625f55d305f499169e6480400818b18245d50af2bf5", 0x1, 0x1}]}) syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793b10d10501200010010203010902120001000000000904"], 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000fe07124081173809499b0102030109022400010010000009040000028b86470009040000000000000009"], 0x0) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug', 0x0, 0x0) fcntl$notify(r7, 0x402, 0x8) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000000040)={@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0xff, 0x3, 0x6}, 0x20) socket(0x40000000015, 0x5, 0x0) r9 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r9, &(0x7f00000000c0), 0x10) 7.015794486s ago: executing program 1 (id=1251): ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f00001196c0)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000119940)={0x7, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r0}, {}, {}, {}, {}, {}, {}, {}, {0x0, r2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r2}, {}, {}, {0x0, r2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r1}], 0x7d, "e9f85915cabb3f"}) r3 = socket$nl_route(0x10, 0x3, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) ioctl$UFFDIO_COPY(r4, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6}]}) open_tree(0xffffffffffffff9c, 0x0, 0x89901) close_range(r6, 0xffffffffffffffff, 0x0) r7 = socket$inet_smc(0x2b, 0x1, 0x0) r8 = socket(0x1d, 0x2, 0x6) r9 = epoll_create(0x1) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f0000000080)={0x30000001}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f00000000c0)={0x0, 0x2}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000000200)={r10, 0x5b, "70bd3ef2717adc7290dd9f3e96ac0bfd673cdc3dfec5c671cb6d167afe2a2074b2b4faa92534a25e186d62254174b49e5ab6c41c16de7472748d24e4af486b0406f2ccde8cf5d510a29709fab726098af77979de01e98590555889"}, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r7, 0x0, 0x42, &(0x7f0000000040)={'HL\x00'}, &(0x7f0000000080)=0x1e) r11 = mq_open(&(0x7f00000019c0)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\xe0\x9d\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xdf\x15\f]\x15\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb', 0x42, 0x0, 0x0) mq_getsetattr(r11, 0x0, &(0x7f0000000180)) accept(r7, &(0x7f0000000280)=@in6={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000300)=0x80) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x4000000) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f000011a940)) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f000011ac00)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r9, 0xd000943e, 0x0) 6.727342351s ago: executing program 0 (id=1254): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$packet(0x11, 0x2, 0x300) fadvise64(r2, 0x8, 0x8000000000000001, 0x2) r3 = socket$inet(0x2, 0x5, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x3c, 0x2, {{0x6, 0x2, 0x0, 0x2, 0xffffffff}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xfffffffd}}, @TCA_NETEM_RATE={0x14, 0x6, {0x1, 0x80, 0x7, 0x7a7}}]}}}]}, 0x6c}}, 0x20000000) sendmsg$inet(0xffffffffffffffff, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x40, 0x4, r3, 0x0, 0x0, 0x0, 0x80000, 0x1}) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000001780)=@nat={'nat\x00', 0x62, 0x5, 0x1540, 0x0, 0x0, 0xffffffff, 0x10d8, 0x11e0, 0x14a8, 0x14a8, 0xffffffff, 0x14a8, 0x14a8, 0x5, 0x0, {[{{@ip={@multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 'veth0_to_bond\x00', 'wg1\x00', {0xff}}, 0x0, 0x10a0, 0x10d8, 0x0, {0x22e}, [@common=@unspec=@cgroup1={{0x1030}, {0x8, 0x0, 0x0, 0x0, './cgroup.net/syz0\x00', 0x9, {0x100000001}}}]}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x4f00, {0x1, @multicast1, @remote, @icmp_id, @port=0x4e21}}}}, {{@uncond, 0x0, 0xd0, 0x108, 0x0, {}, [@common=@icmp={{0x28}, {0x12, "3fb0", 0x1}}, @common=@unspec=@owner={{0x38}, {0x0, 0x0, 0x0, 0x0, 0x4, 0x2}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x20, @rand_addr=0x64010101, @remote, @gre_key, @port=0x4e22}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x640100fd, 0x0, 0x0, 'veth1_to_team\x00', 'ipvlan0\x00'}, 0x0, 0xa0, 0xd8, 0x0, {}, [@common=@addrtype={{0x30}, {0x844, 0x19, 0x0, 0x1}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @private=0x2, @multicast2, @gre_key, @icmp_id=0xfffd}}}}, {{@uncond, 0x0, 0x1b8, 0x1f0, 0x0, {}, [@common=@unspec=@comment={{0x120}}, @common=@icmp={{0x28}, {0x0, "6e82"}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x2, @remote, @broadcast, @icmp_id, @gre_key=0x58f7}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x15a0) io_uring_enter(0xffffffffffffffff, 0x3516, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) 6.657382453s ago: executing program 4 (id=1255): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_misc(r0, 0x0, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r3, &(0x7f0000000240)=@other={'trylock', ' ', 'mem'}, 0xc) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) ptrace(0x10, 0x1) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4000) socket$kcm(0xa, 0x2, 0x3a) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000c18000), 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000001880)={'bond_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=@newqdisc={0x9c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0x6}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x17, 0x2, {{0x3, 0x1, 0x0, 0x2, 0x4}, 0xa4ca, 0x0, 0x0, 0x6, 0x0, 0x18, 0xb, 0xe, 0x3, 0x9, {0x10001, 0x7, 0x2, 0x7, 0x2, 0x7fffffff}}}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x4, 0x7, 0x6, 0x0, 0x1}}, {0x4}}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4c840}, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000400a8000600200003400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001f", 0x6c}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0xc000) 6.19201596s ago: executing program 1 (id=1256): syz_emit_ethernet(0x82, &(0x7f0000000400)={@broadcast, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0x4, 0x0, 0x0, 0x0, 0x0, {0x16, 0x4, 0x0, 0x3c, 0x0, 0x0, 0x4de, 0x0, 0x1, 0x0, @dev, @local, {[@timestamp_addr={0x44, 0x34, 0x0, 0x1, 0x0, [{@private}, {@rand_addr=0xb000000}, {@private}, {@multicast2}, {@broadcast, 0x3}, {@broadcast}]}, @timestamp={0x44, 0x10, 0x0, 0x0, 0x0, [0x9, 0x7f, 0x7ff]}]}}}}}}}, 0x0) 6.090891923s ago: executing program 0 (id=1257): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000000)) ptrace$cont(0x9, r0, 0x33e, 0x3) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r2 = syz_open_dev$video4linux(&(0x7f00000006c0), 0x2, 0x20800) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000000780)={0x9d0000, 0x4, 0x3, 0xffffffffffffffff, 0x0, &(0x7f0000000740)={0x9f0903, 0x7, '\x00', @p_u16=0x0}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r1, 0x20, 0x70bd29, 0x2, {{}, {@void, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x12}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x2f}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x15}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x3a}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x38}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x8040}, 0x20000) sendmsg$NL80211_CMD_VENDOR(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001740)={0x1c, r1, 0x701, 0x0, 0x10000, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8}]}, 0x1c}}, 0x0) ptrace$cont(0x7, r0, 0x0, 0x0) 6.043246374s ago: executing program 1 (id=1258): openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x6080, 0x0) io_submit(0x0, 0x2, &(0x7f00000001c0)=[&(0x7f0000000200)={0x0, 0x0, 0x2, 0x0, 0x0, r2, &(0x7f0000000000)='%', 0x1}, 0x0]) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x2a0, 0x160, 0x4c, 0x2500, 0x290, 0x73, 0x290, 0x258, 0x258, 0x290, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @local, [], [], 'wg2\x00', 'macvlan1\x00', {}, {}, 0x73}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}}, {{@ipv6={@local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'vxcan1\x00', 'team0\x00'}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x300) r3 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, &(0x7f0000000300)=0x7) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f0000000080)={0x3, 0x8ba, 0x4, {0x4, @win={{0x6417, 0x69f20258, 0x8, 0x8003}, 0x6, 0x1, &(0x7f0000000440)={{0x0, 0x8001, 0x859, 0x1}}, 0x8, 0x0, 0xc4}}, 0x9592}) shmat(0x0, &(0x7f0000ff7000/0x3000)=nil, 0x400c) r4 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000002440), 0x2, 0x0) r5 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000340)=@generic={0x0, 0x0, 0x18}, 0x18) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000008, 0x110, r5, 0x75bd3000) ioctl$VIDIOC_G_FMT(r4, 0x40045612, &(0x7f00000016c0)={0xc, @sliced={0x6, [0x9, 0x0, 0x9, 0x1, 0x8000, 0x9, 0xdb, 0xffff, 0xa8de, 0xb, 0x1f, 0x5, 0x3aa, 0x6, 0x3, 0x7d, 0xaf, 0xfffb, 0x3, 0x109, 0x4, 0x4, 0x1, 0x7, 0xfffe, 0x9, 0x8000, 0x35, 0x4, 0x9, 0x5, 0xb8ec, 0x5, 0xfffb, 0x8, 0x1, 0x100, 0x6, 0x88, 0x6, 0x611, 0x10, 0x80, 0x3, 0x8, 0x26, 0x6, 0x3], 0x9}}) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff6000/0x4000)=nil, 0x4000, &(0x7f0000000080)='\x00') r6 = syz_clone(0x4200000, 0x0, 0x0, 0x0, 0x0, 0x0) wait4(r6, 0x0, 0x40000000, 0x0) r7 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r7, &(0x7f0000003980)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_ATTR(r7, &(0x7f0000000240)={0x78, 0xfffffffffffffffe, r8, {0x2000000007, 0x0, 0x0, {0x0, 0x0, 0x55, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xa000, 0x0, 0x0, 0x0, 0x0, 0x200000}}}, 0x78) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@ipv4_newrule={0x1c, 0x1e, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7}}, 0x1c}}, 0x4000000) 5.695813486s ago: executing program 3 (id=1260): r0 = socket(0x840000000002, 0x3, 0xfa) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000001300)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0xebff, &(0x7f0000000c00)=ANY=[], 0x40}}], 0x2, 0x0) 5.494491731s ago: executing program 0 (id=1261): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_usb_connect(0x0, 0x25c, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000e9b7e3405e04bf02069e0000000109024a"], 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) connect$l2tp6(r2, &(0x7f0000000f40)={0xa, 0x0, 0x7, @private0={0xfc, 0x0, '\x00', 0x1}}, 0x20) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000080)={0x0, 0x54fbb31de3a94a90, 0x800, 0x0, 0x1}, 0x20) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[], 0x118) r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[], 0x0) r5 = syz_io_uring_setup(0x22f, 0x0, &(0x7f0000000300)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r6, r7, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r5, 0x7a98, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYRES64=r1], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, &(0x7f0000000cc0)={0x44, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="54000000070601030000000000000000020000090900020073797a30000d000005000100070000000900020073797a3200000000080006400000767c05000100070000000800064000000002050001"], 0xfffffffffffffee9}, 0x1, 0x0, 0x0, 0x4000010}, 0x34004000) syz_usb_control_io(r4, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=ANY=[@ANYBLOB="040000000400000004000000050001", @ANYRES32, @ANYBLOB="ffe900eb5f"], 0x48) syz_usb_control_io$cdc_ncm(r4, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000680)={0x44, &(0x7f0000000380)={0x0, 0x12, 0x82, "c8b8bc37e4fdc6bf0d0e546d0a4c3932ffcfa59c3ab9cd9e996760cdb835bef8a2f244872ce584e0658190e9610cd1a8e1284f7c4cd2d8d97d84e5a8aa5ea0fce44fc6c02fc14a189678121132e1b7c4284488a62cecfa4b6da6c1407c1d578faa08bd1bc1dd8bb143d76c370f72ac846107103ab979cc3a051dcd44428636001d0b"}, 0x0, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xc}, &(0x7f0000000540)={0x20, 0x80, 0x1c, {0x9, 0x8, 0xfffffffb, 0x180, 0x1, 0x5, 0x3, 0x0, 0x81, 0x4, 0x8, 0x3}}, &(0x7f0000000580)={0x20, 0x85, 0x4, 0x2}, &(0x7f00000005c0)={0x20, 0x83, 0x2}, &(0x7f0000000600)={0x20, 0x87, 0x2, 0x7}, &(0x7f0000000640)={0x20, 0x89, 0x2, 0x1}}) syz_usb_control_io$uac1(r4, 0x0, &(0x7f0000000480)={0x44, &(0x7f00000008c0)=ANY=[@ANYBLOB="00000065000000e9608dd76c429f3865fca2b903e286e3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) fanotify_init(0x200, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r9, 0x1, &(0x7f0000004540)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0x0, r8, 0x0}]) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet(0x2, 0x3, 0x6) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, 0x0, &(0x7f00000000c0)) 5.259847068s ago: executing program 3 (id=1262): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905"], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB="40010400000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, &(0x7f0000000800)={0x14, &(0x7f0000001b40)={0x40, 0xc, 0xc6, {0xc6, 0x5, "279daadc0d697143e2daf0c4af0d8d466c929c8fd20c3ba8ca0328fe8ac0ce82535b483fd908fb8ba5d59c05ba45dd1788bbe5d7019315cdd19e38300aa045cd1ff93974e2014fdcc8f4916071df85770fa40d2771845177fdfc546d33e4532c98eb04b23038c973eb97998ac55f70bb04ea4abfbf798f0555b786fa2cb251bdaa8f91ca9f82f65f4df3662724f7a72b1e13ea9451950edb5312c140f02dbd89fa202f9c4483b3ec6b6bd8ce36bc952f07b6ba832c246dd53aff22a1c318169452757e0c"}}, &(0x7f0000001c40)={0x0, 0x3, 0xc2, @string={0xc2, 0x3, "ed596866f2725a75817a3b537082e2cf3266843c44816471eb7fc71f10e7a0178f5e53516c9069bfc58e147c713538650042680c92df5de6154120ec786e7a1e6a715172939b78e9567423d1b161fd56aaf71c16f13cb8f7df2596d39d22642b338190922da7ea770bcb303be92298d7cc71b77365512e4d20cba3b389d8356240982012597617de6d2c8e0a28b18c090d5b9dc7dbe0ccffc93df83d7538c449c9710eecbef564ee9b8e1f7f1ee968f889377bd5a64e15c4cd60d92803c4c9d7"}}}, &(0x7f0000001f80)={0x34, &(0x7f0000001d40)={0x20, 0x7, 0xa5, "6acdd6c40615b6a2479dd6f753520248d686611b92d8c9f15e6e99a678f4f869cbc075e135cb729159c95d5fef1f0d9f8581965049c7e342070c381e6f5d1979d46b4df116647f3971bf5a7212ef34b2a713ed5e9054c646ef68cd2155b25b1af54019e75c31f6863570b244979f04778fbf30a2daef648656b7bda5f9720c67496376f40f0a86b36d64678c1cf0dce12aea73636f9e81e67016d8b9be091d16be71833728"}, &(0x7f0000001980)={0x0, 0xa, 0x1}, &(0x7f00000019c0)={0x0, 0x8, 0x1, 0xf}, &(0x7f0000001e00)={0x20, 0x0, 0xd0, {0xce, "9ec98b9db5894a39f77b6c9467f9d20aab54224c5f9c591004781e03c772c8fccfba4149bf37db68277aa98f3e948ef2c1b3bed7d1aaa4626d3dd095670fadfaee307d209c293e22ceed6968d5ba49b9fb0a4b7682b597e47ee3bcdf662243f8eb69e23a33a189278b1b76336d20ece0f24985f649b85865f183fdbe8246700de81d303be85b27fe72166cec79e7be74416e0f611af6cd6f056cf4cde72c8ee14422083491eef7b695a2201d13ecbc944ce9f54da623514d7a1f3054f462baab74488ad9abefbfeb02f797a87c19"}}, &(0x7f0000001f00)={0x20, 0x1, 0x1, 0x6}, &(0x7f0000001f40)={0x20, 0x0, 0x1, 0x5}}) r2 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f0000000100)=r3, 0x4) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000280)={0x1c, &(0x7f00000001c0), 0x0, 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}}, 0x4000) r5 = socket$pptp(0x18, 0x1, 0x2) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) write$UHID_INPUT(r7, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3591bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22ebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed499cfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r7, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000002c0)={0x14, &(0x7f0000000340)={0x0, 0x0, 0x6d, {0x6d, 0x7, "14f706ee34972ab340ae9f589c49f27458bc1d509267cea86df67aa017c61e4ef85f8cf1004f509ad12aaf4c8e554b757a38c8c977fb72cdd4e599f50eb36b90e1115459fe4e95add2354dd4d8b6325a7f54dc3b322cc9a829b211894a9e408808e11e9009068c0bdf0acf"}}, &(0x7f0000000240)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000780)={0x44, &(0x7f0000000580)={0x20, 0xd, 0x43, "2533bc9cc88ea0b1df4cd182489548797b800faf7ea0f1211eea4c453fb04dc9e2f0bba707eca6c4488872a624a208c7e3f2adfd3c2338e521f245732e017de23930cf"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000600)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000640)={0x20, 0x80, 0x1c, {0xfde, 0x9, 0x4, 0xf, 0x9, 0x9, 0x8001, 0x80000000, 0x0, 0x5, 0x4, 0xfff}}, &(0x7f0000000680)={0x20, 0x85, 0x4, 0x1ff}, &(0x7f00000006c0)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000700)={0x20, 0x87, 0x2, 0x100}, &(0x7f0000000740)={0x20, 0x89, 0x2, 0x1}}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) getpeername(r5, 0x0, &(0x7f0000000080)) recvmmsg(r4, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x8101}, {{0x0, 0x3c, 0x0}, 0x10020}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f0000000840)=""/235, 0xeb}, {&(0x7f0000000440)=""/84, 0x54}, {&(0x7f0000002b80)=""/4104, 0x1008}, {&(0x7f0000000000)=""/103, 0x67}, {&(0x7f0000001a80)=""/188, 0xbc}], 0x5}, 0x80000000}], 0x4, 0x20, 0x0) sendmsg$IPSET_CMD_DEL(r7, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1fc66ed2335d67ef}, 0xc, &(0x7f0000000100)={&(0x7f00000004c0)={0xa8, 0xa, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x2}, [@IPSET_ATTR_ADT={0x5c, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @local}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e20}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_ETHER={0xa, 0x11, @remote}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x236}}]}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_SKBMARK={0xc, 0x1b, 0x1, 0x0, 0x1ff}, @IPSET_ATTR_COMMENT={0x5, 0x1a, '\x00'}, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x7}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x811}, 0x20000800) 4.953701871s ago: executing program 2 (id=1263): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)) unshare(0x26020480) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xd, 0x3, 0x4, 0x7, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r0, 0x0) ftruncate(r0, 0xc17a) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x7ff, 0x8bb, 0xb5, 0x8, 0x0, 0x8000000000000000, 0x500, 0x3b2, 0x3, 0x5, 0x7, 0x7, 0x7, 0x3, 0x7, 0x200], 0xf000, 0x66000}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) r4 = syz_open_dev$sg(&(0x7f0000000100), 0xca84, 0x102) ioctl$SG_BLKTRACETEARDOWN(r4, 0x1276, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x78) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGPROP(r5, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSFLAGS1(r5, 0x4004743a, &(0x7f0000000300)) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000001f00)) ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f00000002c0)=0x2000800) sendmmsg(r3, &(0x7f0000007180)=[{{0x0, 0x0, &(0x7f00000027c0)=[{&(0x7f0000000440)="3dbd955b", 0x4}], 0x1}}], 0x1, 0x10014) r6 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_io_uring_setup(0x117, &(0x7f0000000300), 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x12, &(0x7f0000000380)=[{0x5, 0x4, 0x3, 0xfffff877}, {0x1000, 0x44, 0xe, 0x80}, {0x5d8, 0x10, 0x1, 0x3c}, {0x3b6e, 0x6, 0x2, 0x847}, {0x5, 0x5, 0x6, 0x52f}, {0x6, 0x7, 0x5, 0xb}, {0x8, 0x3, 0xa7, 0x5}, {0x80, 0x49, 0x0, 0x8}, {0x81, 0x3, 0xc, 0x80000001}]}) linkat(r7, &(0x7f0000000040)='\x00', 0xffffffffffffff9c, 0x0, 0x1000) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000002c0)={[0x8aba, 0x4, 0x4, 0x804, 0x7, 0xf, 0x120000, 0xff, 0xffffffffffffbfff, 0x9, 0x8000000000000005, 0x4, 0x0, 0x9, 0x400000000000006, 0x9], 0x8000000, 0x141200}) 4.688266996s ago: executing program 2 (id=1264): openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="f0000000100013070000000000000000ffffffff000000000000000000000000ac1e00010000000000000000000000000000000000000000000000005ab2f76f060000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414aa000000000000000000000000000000003c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b614403cffbf0fdc415a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fdffffff000000000000000000000000020000000000000000000000784dbabeedf6d71b03a161a2eebe839930b8801cba5ff283d181c67e3b45aedad645f970c33edca6a777b018c61909607b0bc8829ffcec66b3"], 0xf0}}, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r0, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 3.724669167s ago: executing program 0 (id=1265): userfaultfd(0x801) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socket(0x22, 0x2, 0x24) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044000000a80016000a0003400220000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, 0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect(0x0, 0x46, &(0x7f0000000040)=ANY=[@ANYRES64, @ANYRES16], 0x0) 3.724311268s ago: executing program 2 (id=1266): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000000), 0x4) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f0000000080)={@broadcast, @multicast2, 0x1, "2e982c09ab15eb7cc2bb0a1eec919049d880907f99a9f17c7e9bd9a81fa77d7e", 0x7, 0x10001, 0x572, 0xfffffffb}, 0x3c) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x54, r2, 0x1, 0x0, 0x10000000, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @loopback}}, {0x14, 0x2, @in={0x2, 0x0, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) 3.498148742s ago: executing program 2 (id=1267): r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000a, 0x28011, r1, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f00000003c0)=0x1, 0x4) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x458, 0x0, 0x2b8, 0xb0000010, 0x2, 0x5c8f0200, 0x388, 0x3a8, 0x3a8, 0x388, 0x3a8, 0x3, 0x0, {[{{@ipv6={@private1, @local, [], [], 'vlan1\x00', 'veth0_to_team\x00'}, 0x0, 0x248, 0x290, 0x700, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve1\x00', {0xf1, 0x0, 0x33, 0x1000000, 0x10000000, 0x1, 0x7fffffff}}}, @common=@unspec=@limit={{0x48}, {0x0, 0x3}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x206, 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@CONNSECMARK={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) connect$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000100)={@broadcast, @random="060074777f03", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x68, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0xb, 0x3, 0x0, 0x0, 0x0, 0x8, {0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @rand_addr=0x64010106, {[@rr={0x7, 0x13, 0x0, [@private, @empty, @empty, @private]}, @timestamp_prespec={0x44, 0xc, 0x0, 0x3, 0x0, [{@loopback}]}, @ssrr={0x89, 0xf, 0x0, [@private, @broadcast, @broadcast]}, @timestamp_addr={0x44, 0x4c, 0x3, 0x1, 0x0, [{@initdev={0xac, 0x1e, 0x0, 0x0}}, {@private}, {@loopback}, {@broadcast}, {@rand_addr, 0x3}, {@broadcast}, {@rand_addr=0x64010100}, {@local}, {@multicast2}]}, @timestamp={0x44, 0x4}]}}}}}}}, 0x0) 3.235957639s ago: executing program 2 (id=1268): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000380)={@mcast1, @mcast2, @loopback, 0x2, 0x2, 0x0, 0x480, 0x7, 0xca0167, r1}) (fail_nth: 2) 3.235429246s ago: executing program 4 (id=1269): mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) r0 = socket(0x1d, 0x2, 0x6) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x6a, 0x10, 0x0, &(0x7f0000000080)) (async) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) (async) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) 2.852094143s ago: executing program 4 (id=1270): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) fsopen(&(0x7f00000000c0)='nilfs2\x00', 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2.851834832s ago: executing program 2 (id=1271): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000b80)={0x44, &(0x7f0000000140)=ANY=[@ANYBLOB="7a401503000000f61b6e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000cc0)=""/144, 0x90) 2.767807247s ago: executing program 4 (id=1272): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f00000001c0)) socket$inet6(0xa, 0x3, 0x8000000003c) creat(&(0x7f0000000300)='./bus\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) gettid() r3 = syz_io_uring_setup(0x497, &(0x7f0000000200)={0x0, 0x7279, 0x0, 0x2, 0x316}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_dev$sg(&(0x7f0000000200), 0x0, 0x0) prctl$PR_GET_FPEXC(0xb, 0x0) r7 = fsmount(0xffffffffffffffff, 0x1, 0x81) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r7, 0xc018937e, &(0x7f0000000000)={{0x1, 0x1, 0x18, r6}, './file0\x00'}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x80800, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) r10 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r11 = dup(r10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r11, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f00000f2000/0x1000)=nil, 0x1000, 0x2) 2.086926422s ago: executing program 1 (id=1273): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000380)={@mcast1, @mcast2, @loopback, 0x2, 0x2, 0x0, 0x480, 0x7, 0xca0167, r1}) 1.926980892s ago: executing program 1 (id=1274): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'batadv_slave_1\x00', {0x2, 0x0, @loopback=0x7f000000}}) (async) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r1, 0x40000000af01, 0x0) (async) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000500)={0x2, 0x0, [{0x6000, 0x13, &(0x7f0000000280)=""/19}, {0xdddd0000, 0x10, &(0x7f0000000300)=""/16}]}) (async) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000000)={0x1}) capset(&(0x7f0000000100)={0x19980330}, &(0x7f0000000140)={0x4, 0xe, 0x4, 0x7fff, 0xf, 0xe}) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000003c0)={'ip6tnl0\x00', 0x0}) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'caif0\x00', 0x1}) (async) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x88000) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'ipvlan0\x00', 0x1000}) 1.56824799s ago: executing program 3 (id=1275): dup(0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs={0x1}, 0x6e) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='net_prio.prioidx\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r3, &(0x7f0000847fff)='X', 0xffe4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r4 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000b40)={'\x00', 0x8, 0x530, 0xc, 0xfffffffffffffffd, 0x59c}) ioctl$SG_BLKTRACETEARDOWN(r4, 0x1276, 0x20000000) r5 = socket$kcm(0x10, 0x2, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000000c0)={0x0, 0x2, {0xffffffffffffffff}, {0xee00}, 0x2, 0xcb85}) sched_setaffinity(r6, 0x0, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2663}, 0x0) r7 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r7, 0x0) ftruncate(r7, 0x51a9497) clock_gettime(0x0, &(0x7f0000000040)) 1.527204484s ago: executing program 1 (id=1276): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x600, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000600)={0x20, r6, 0x65283e1aaa2ddbb1, 0x0, 0x0, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}]}]}, 0x20}}, 0xffffffa1) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r7, 0x0, 0xcc, &(0x7f0000000100)={@rand_addr=0x64010102, @local, 0x1, "6ad9ab92d677d260db0361fa18c86786414663d7ea0113c3c6c4eecde57a54d2", 0x6, 0x80000000, 0x800, 0x4}, 0x3c) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_usb_connect(0x0, 0x3f, 0x0, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='stat\x00') lseek(r8, 0x9, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) listen(0xffffffffffffffff, 0x0) r9 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1e7d, 0x2e22, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r9, &(0x7f0000000340)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x1fe, 0x7, 0x6000, 0x2000, &(0x7f0000090000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(r2, 0xc018aec0, &(0x7f0000000040)={0x1}) ioctl$KVM_SET_MSRS(r0, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000cf0800008f04"]) 476.613291ms ago: executing program 0 (id=1277): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f00000001c0)=0x3) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r2 = getpgid(0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f00000009c0)=[@in={0x2, 0x4e21, @remote}, @in6={0xa, 0x4e20, 0xdd6e, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xffff}], 0x2c) getsockname$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) syz_extract_tcp_res$synack(&(0x7f0000000100)={0x41424344, 0x41424344}, 0x1, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000940)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000008004500d35900000000000690787f000001ac1414aa8600e2959428e8736e99945656841e592600000003010086d1e25c54004e224e2600"/77, @ANYRES32=r4, @ANYRES32=0x41424344, @ANYBLOB="ac01000090780000"], 0x0) syz_extract_tcp_res(&(0x7f0000000100)={0x41424344, 0x41424344}, 0x5, 0x61f) r6 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCETHTOOL(r6, 0x8993, &(0x7f0000001440)={'bond0\x00', 0x0}) syz_emit_ethernet(0x1e2, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6108f26801ac0601fe8000000000000000000000000000bbfc0200000000000000000000000000003b08040405180300fe8000000000000000000000000000bbfc020000000000000000000000000000ff010000000000000000000000000001fe8000000000000000000000000000aa3c000d39640000003a200000000000000401d101080000000000000000c91000000000000000000000000000000001c2040000000800d5562bd8a39f6090066096f1c8aa36322e43612aa579d2d7e42cd6e032c34320d2c58370f17840fb313f77d93ffe5d8ccaf56bbf10f7f611ef4f14170de981f60decf3df841c64abba264f588d082c04de00c32241b308c50051c05b92879e3155b1493d0d23f9924895122d469de5aa35195d404c82d16a289ec6f32a6fa67eb2761a61b5031ed57135a1ece74a27a853344cefd02ddddd874a7692bb0148728df2a0fbe91744b804ff9a10f917cf13482ac7e67bc4de9a8657646722b7bf5a6da1fedeb988f4c65492d74ccb924c19a75f75f1f0030001000100000000000000004e214e23", @ANYRES32=r4, @ANYRES32=r5, @ANYBLOB="30c2000390780006051e0000000300000003000039790000cfec0000000000000004000000000303071e0c860500000000000000040402fe06e2d4c3d9030302"], 0x0) syz_emit_ethernet(0x1e2, &(0x7f0000000740)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x1ac, 0x6, 0x0, @local, @local, {[@srh={0x2c, 0xa, 0x4, 0x5, 0x8, 0x18, 0x7, [@empty, @rand_addr=' \x01\x00', @local, @dev={0xfe, 0x80, '\x00', 0x37}, @local]}, @fragment={0x2c, 0x0, 0x5, 0x1, 0x0, 0x0, 0x67}, @hopopts={0x2, 0x14, '\x00', [@padn={0x1, 0x1, [0x0]}, @enc_lim, @ra={0x5, 0x2, 0x9a}, @enc_lim={0x4, 0x1, 0x2}, @calipso={0x7, 0x18, {0x1, 0x4, 0x5, 0x3, [0x400, 0x5]}}, @enc_lim={0x4, 0x1, 0x4}, @generic={0x7, 0x3a, "c08ef59173223f97d7c0b3a6dc5307afb061d02b38c0bd30cfd8b9b7b284ef8987f8126ecc5d36b51eb8b01637954bf26d41e1efe7648e3a522f"}, @ra={0x5, 0x2, 0xfd6}, @calipso={0x7, 0x38, {0x0, 0xc, 0x6, 0xe, [0x6, 0x9, 0x5, 0x2, 0xffffffffffffffff, 0x26b9]}}]}, @srh={0x4, 0xe, 0x4, 0x7, 0x4, 0x40, 0x8, [@mcast2, @empty, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2={0xfc, 0x2, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @local}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}], {{0x0, 0x4001, 0x41424344, r4, 0x0, 0x0, 0x9, 0x2, 0x100, 0x0, 0x6, {[@timestamp={0x8, 0xa, 0x0, 0xfff}, @exp_smc={0xfe, 0x6}]}}}}}}}}, 0x0) r7 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000bfd000/0x400000)=nil) syz_kvm_add_vcpu$x86(r7, &(0x7f0000000480)={0x0, &(0x7f00000002c0)=[@code={0x1, 0x71, {"66ba2000ed448b5d0b0f20d835080000000f22d8f3420f01f8470f2344c74424000a000000c744240202000000c7442406000000000f011c24c4a17c2b3af30f090fc71bc74424000c000000c744240205000000c7442406000000000f011c24"}}, @code={0x1, 0x67, {"670f073e0f870a000000c401fd290d07000000440fc732f2adc4012968420dc744240080000000c744240280470000ff1c24c7442400be000000c744240200000000c7442406000000000f011c240f35c4027d135fd4"}}, @code={0x1, 0x57, {"660f73d706460f796e8dc42235073d28000000470f4e9407b1ee00000f20c035010000000f22c03e450f01c9b9800000c00f3235000400000f3066b88c008ec0460f2087f2a7"}}, @code={0x1, 0x5a, {"b9800000c00f3235001000000f30450f3266440f38801b48b807000000000000000f23d00f21f835200000090f23f810e30fc140030f07c422e8f315ad1000003e43d3582c640f2091"}}, @uexit={0x0, 0x18, 0x6}], 0x1a1}) process_vm_writev(r2, &(0x7f0000000100)=[{&(0x7f0000000040)=""/40, 0x28}], 0x1, &(0x7f0000000180)=[{&(0x7f0000000200)=""/162, 0xa2}], 0x1, 0x0) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0) ioctl$SNDRV_PCM_IOCTL_FORWARD(r1, 0x40084149, &(0x7f0000000000)=0x32ee) 0s ago: executing program 0 (id=1278): r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x8001, 0x0) ioctl$SYNC_IOC_MERGE(r0, 0xc0303e03, &(0x7f0000000240)={"6c2e3176375b3152b30000c4bee1263b8ddbca81d29cabc4971359d64581f886", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000400)={0x0, 0x1, r1}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000040)=0x2b38, 0x4) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000800)=@filter={'filter\x00', 0xe, 0x4, 0x4e8, 0xffffffff, 0x128, 0x128, 0x330, 0xffffffff, 0xffffffff, 0x418, 0x418, 0x418, 0xffffffff, 0x4, &(0x7f0000000100), {[{{@ipv6={@private1, @loopback, [0x0, 0xff, 0xff000000, 0xffffff00], [0xffffff00, 0xffffffff, 0xff000000], 'rose0\x00', 'pim6reg1\x00', {}, {}, 0x62, 0x40, 0x2}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@mh={{0x28}, {"bf00"}}, @common=@srh={{0x30}, {0x3b, 0x1, 0x0, 0x4, 0x81, 0x1200, 0x1024}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x7, 0x9f1e}}}, {{@ipv6={@loopback, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}, [0xffffffff, 0x0, 0xff, 0xffffff00], [0x0, 0x0, 0xff, 0xffffffff], 'macvlan1\x00', 'tunl0\x00', {}, {}, 0x2f, 0x6, 0x2, 0x32}, 0x0, 0x1e0, 0x208, 0x0, {}, [@common=@rt={{0x138}, {0x9, [0x5dd, 0xedae], 0x8, 0x30, 0x3, [@local, @private1, @private2={0xfc, 0x2, '\x00', 0x1}, @private1, @private0, @remote, @local, @private0, @loopback, @mcast2, @private2, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, @mcast1, @private0], 0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xff, 0x0, 0xc40, 0x3, 0x8, 0x7f, 0x2, 0x3]}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x548) sendmmsg$inet(r2, &(0x7f00000007c0)=[{{&(0x7f0000000280)={0x2, 0x4e22, @local}, 0x10, 0x0}}], 0x1, 0x2400c8a0) r3 = syz_open_procfs(0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) shutdown(0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = open_tree(r3, &(0x7f0000000140)='./file0\x00', 0x9900) r7 = landlock_create_ruleset(&(0x7f0000000040)={0x3342, 0x3, 0x2}, 0x18, 0x0) landlock_restrict_self(r7, 0x0) fspick(r6, &(0x7f0000000000)='.\x00', 0x0) dup3(r4, r2, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256\x00'}, 0x58) r9 = accept4(r8, 0x0, 0x0, 0x800) recvmmsg$unix(r9, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r6, 0xc0286405, &(0x7f00000003c0)={0xd, 0x3, {0xffffffffffffffff}, {0xee01}, 0x1, 0x3}) lsetxattr$security_capability(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000440)=@v3={0x3000000, [{0x7ff, 0x4}, {0x800, 0x411}], r11}, 0x18, 0x0) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32, @ANYBLOB="0c00990000000000000000000800a000c215000008009f0005000000080026000816"], 0x40}}, 0x2004c0f4) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) kernel console output (not intermixed with test programs): [ 356.075793][ T10] usb 4-1: config index 0 descriptor too short (expected 12336, got 77) [ 356.089959][ T10] usb 4-1: config 48 has too many interfaces: 48, using maximum allowed: 32 [ 356.322023][ T10] usb 4-1: config 48 has an invalid descriptor of length 53, skipping remainder of the config [ 356.388701][ T10] usb 4-1: config 48 has 0 interfaces, different from the descriptor's value: 48 [ 356.432989][ T49] usb 5-1: USB disconnect, device number 40 [ 356.553635][ T10] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 356.580614][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.605124][ T10] usb 4-1: Product: syz [ 356.616981][ T10] usb 4-1: Manufacturer: syz [ 356.899725][ T10] usb 4-1: SerialNumber: syz [ 358.284106][ T9072] program syz.4.895 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 358.599826][ T49] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 358.752017][ T49] usb 1-1: Using ep0 maxpacket: 32 [ 358.791753][ T49] usb 1-1: config 0 interface 0 has no altsetting 0 [ 358.885879][ T49] usb 1-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 358.923779][ T49] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.932508][ T49] usb 1-1: Product: syz [ 358.943509][ T49] usb 1-1: Manufacturer: syz [ 358.949793][ T49] usb 1-1: SerialNumber: syz [ 358.975897][ T49] usb 1-1: config 0 descriptor?? [ 359.039521][ T10] usb 4-1: USB disconnect, device number 53 [ 359.079829][ T5899] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 359.268245][ T5899] usb 5-1: Using ep0 maxpacket: 16 [ 359.281991][ T5899] usb 5-1: config 0 interface 0 has no altsetting 0 [ 359.292539][ T5899] usb 5-1: New USB device found, idVendor=05ac, idProduct=abdf, bcdDevice=3d.49 [ 359.344470][ T5899] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.356871][ T5899] usb 5-1: Product: syz [ 359.375382][ T9085] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 359.383764][ T5899] usb 5-1: Manufacturer: syz [ 359.390685][ T5899] usb 5-1: SerialNumber: syz [ 359.414734][ T5899] usb 5-1: config 0 descriptor?? [ 359.444096][ T5899] ipheth 5-1:0.0: Unable to find endpoints [ 359.451013][ T49] gs_usb 1-1:0.0: Configuring for 3 interfaces [ 359.682326][ T5899] usb 5-1: USB disconnect, device number 41 [ 359.739886][ T49] gs_usb 1-1:0.0: Couldn't register candev for channel 0 (-EINVAL) [ 359.885658][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 359.885682][ T30] audit: type=1800 audit(1747131205.817:409): pid=9091 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.901" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=8709 res=0 errno=0 [ 359.929301][ T49] gs_usb 1-1:0.0: probe with driver gs_usb failed with error -22 [ 360.046243][ T10] usb 1-1: USB disconnect, device number 39 [ 360.610427][ T9098] netlink: 'syz.3.902': attribute type 20 has an invalid length. [ 361.357894][ T9106] netlink: 4 bytes leftover after parsing attributes in process `syz.4.903'. [ 361.947113][ T30] audit: type=1326 audit(1747131207.947:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9116 comm="syz.2.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 362.068459][ T5880] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 362.089258][ T9117] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 362.089327][ T9117] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 362.290864][ T30] audit: type=1326 audit(1747131207.977:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9116 comm="syz.2.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 362.347278][ T30] audit: type=1326 audit(1747131207.977:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9116 comm="syz.2.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 362.380921][ T30] audit: type=1326 audit(1747131207.977:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9116 comm="syz.2.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 362.403368][ T5880] usb 4-1: Using ep0 maxpacket: 16 [ 362.407782][ T5880] usb 4-1: unable to get BOS descriptor or descriptor too short [ 362.417989][ T5880] usb 4-1: config 7 has an invalid interface number: 79 but max is 0 [ 362.437081][ T9117] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 362.444046][ T9117] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 362.454109][ T5880] usb 4-1: config 7 has no interface number 0 [ 362.480403][ T30] audit: type=1326 audit(1747131207.977:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9116 comm="syz.2.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 362.508617][ T30] audit: type=1326 audit(1747131207.977:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9116 comm="syz.2.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 362.543810][ T9117] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 362.557172][ T9117] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 362.569425][ T5880] usb 4-1: config 7 interface 79 altsetting 6 endpoint 0xF has invalid maxpacket 512, setting to 64 [ 362.589994][ T9117] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 362.601580][ T9117] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 362.607420][ T5880] usb 4-1: config 7 interface 79 altsetting 6 endpoint 0x7 has an invalid bInterval 64, changing to 10 [ 362.620574][ T30] audit: type=1326 audit(1747131207.977:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9116 comm="syz.2.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 362.645069][ T30] audit: type=1326 audit(1747131207.977:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9116 comm="syz.2.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=84 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 362.667447][ T30] audit: type=1326 audit(1747131207.977:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9116 comm="syz.2.907" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 362.696988][ T9117] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 362.705225][ T9117] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 362.940769][ T5880] usb 4-1: config 7 interface 79 has no altsetting 0 [ 362.978055][ T5880] usb 4-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=f4.98 [ 363.000789][ T5880] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.014279][ T5880] usb 4-1: Product: syz [ 363.018753][ T5880] usb 4-1: Manufacturer: syz [ 363.151080][ T5880] usb 4-1: SerialNumber: syz [ 363.640189][ T5821] usb 3-1: new full-speed USB device number 35 using dummy_hcd [ 363.872791][ T9133] netlink: 'syz.3.906': attribute type 20 has an invalid length. [ 364.210501][ T5821] usb 3-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice=30.62 [ 364.220208][ T5821] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.228877][ T5821] usb 3-1: Product: syz [ 364.240251][ T5821] usb 3-1: Manufacturer: syz [ 364.247832][ T5821] usb 3-1: SerialNumber: syz [ 364.328228][ T5821] usb 3-1: config 0 descriptor?? [ 364.675842][ T5821] usb 3-1: selecting invalid altsetting 3 [ 364.691290][ T5821] comedi comedi0: could not set alternate setting 3 in high speed [ 364.713227][ T5821] usbdux 3-1:0.0: driver 'usbdux' failed to auto-configure device. [ 364.936779][ T5821] usbdux 3-1:0.0: probe with driver usbdux failed with error -22 [ 366.051551][ T5899] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 366.220427][ T5899] usb 2-1: Using ep0 maxpacket: 32 [ 366.227907][ T5899] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 366.239386][ T5899] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 366.285028][ T5899] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 366.319957][ T9] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 366.335919][ T5899] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.378204][ T5899] usb 2-1: config 0 descriptor?? [ 366.398049][ T5899] hub 2-1:0.0: USB hub found [ 366.479814][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 366.491598][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 366.507078][ T9] usb 5-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 366.590172][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.593538][ T9] usb 5-1: config 0 descriptor?? [ 366.598346][ T5899] hub 2-1:0.0: 1 port detected [ 366.610680][ T9] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 366.646381][ T9156] tipc: Failed to remove unknown binding: 66,1,1/2130706433:2404817617/2404817619 [ 366.646423][ T9156] tipc: Failed to remove unknown binding: 66,1,1/2130706433:2404817617/2404817619 [ 366.739415][ T5880] usb 4-1: USB disconnect, device number 54 [ 367.215075][ T5899] hub 2-1:0.0: activate --> -90 [ 367.240296][ T5880] usb 3-1: USB disconnect, device number 35 [ 367.633665][ T9146] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 367.698961][ T9146] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 367.714792][ T9146] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 367.724320][ T9146] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 367.860143][ T5899] usb 2-1: USB disconnect, device number 37 [ 368.052161][ T10] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 368.269834][ T9] gspca_vc032x: reg_w err -71 [ 368.275106][ T9] vc032x 5-1:0.0: probe with driver vc032x failed with error -71 [ 368.323842][ T9] usb 5-1: USB disconnect, device number 42 [ 368.329980][ T10] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 368.341956][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 368.394306][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 368.419801][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 368.456466][ T10] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 368.533918][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 368.652021][ T5913] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 368.737766][ T10] usb 4-1: config 0 descriptor?? [ 368.786702][ T9174] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 369.297858][ T5913] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 369.338784][ T5913] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 369.353895][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 369.438432][ T5913] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 369.459236][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 369.568814][ T9174] team_slave_0: entered promiscuous mode [ 369.574827][ T9174] team_slave_1: entered promiscuous mode [ 369.614094][ T9174] vlan2: entered promiscuous mode [ 369.632524][ T9174] team0: entered promiscuous mode [ 369.654536][ T5913] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.665976][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 369.700497][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 369.707967][ T10] plantronics 0003:047F:FFFF.0004: unknown main item tag 0x0 [ 369.730861][ T5913] usb 2-1: config 0 descriptor?? [ 369.832172][ T10] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 369.980885][ T10] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 370.170937][ T10] usb 4-1: USB disconnect, device number 55 [ 370.437310][ T9190] fido_id[9190]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 370.519388][ T9202] vcan0: tx drop: invalid sa for name 0xfffffffffffffffc [ 370.646529][ T9202] netlink: 28 bytes leftover after parsing attributes in process `syz.4.927'. [ 370.689936][ T9202] netlink: 'syz.4.927': attribute type 7 has an invalid length. [ 370.719301][ T9203] bond0: entered promiscuous mode [ 370.759033][ T9203] bond_slave_0: entered promiscuous mode [ 370.766596][ T9202] netlink: 'syz.4.927': attribute type 8 has an invalid length. [ 370.775191][ T9202] netlink: 4 bytes leftover after parsing attributes in process `syz.4.927'. [ 370.820702][ T9203] bond_slave_1: entered promiscuous mode [ 370.898353][ T9203] bond0: left promiscuous mode [ 371.032666][ T9203] bond_slave_0: left promiscuous mode [ 371.038456][ T9203] bond_slave_1: left promiscuous mode [ 371.139110][ T9206] batadv_slave_0: entered promiscuous mode [ 371.178120][ T9214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 371.193049][ T9214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 371.204677][ T9214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 371.216107][ T9214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 371.279816][ T976] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 371.365554][ T9214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 371.404753][ T9214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 371.434810][ T9214] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 371.450202][ T9214] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 371.581160][ T976] usb 1-1: config 0 has no interfaces? [ 371.701060][ T976] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 371.729826][ T976] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.742193][ T976] usb 1-1: Product: syz [ 371.746470][ T976] usb 1-1: Manufacturer: syz [ 371.770025][ T976] usb 1-1: SerialNumber: syz [ 371.793562][ T976] usb 1-1: config 0 descriptor?? [ 371.800559][ T9200] batadv_slave_0: left promiscuous mode [ 372.132103][ T9213] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 372.142467][ T9213] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 372.372366][ T5913] usbhid 2-1:0.0: can't add hid device: -71 [ 372.378730][ T5913] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 372.409878][ T5880] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 372.448769][ T5913] usb 2-1: USB disconnect, device number 38 [ 372.600122][ T5880] usb 3-1: Using ep0 maxpacket: 32 [ 372.616154][ T5880] usb 3-1: config 0 has an invalid interface number: 13 but max is 0 [ 372.638036][ T5880] usb 3-1: config 0 has no interface number 0 [ 372.658674][ T5880] usb 3-1: New USB device found, idVendor=0bfd, idProduct=0113, bcdDevice=75.bc [ 372.668507][ T5880] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.677065][ T5880] usb 3-1: Product: syz [ 372.684769][ T5880] usb 3-1: Manufacturer: syz [ 372.693718][ T5880] usb 3-1: SerialNumber: syz [ 372.726091][ T5880] usb 3-1: config 0 descriptor?? [ 372.752940][ T5880] kvaser_usb 3-1:0.13: error -ENODEV: Cannot get usb endpoint(s) [ 372.956864][ T5880] usb 3-1: USB disconnect, device number 36 [ 373.273158][ T9235] pimreg3: entered allmulticast mode [ 373.988046][ T5880] usb 1-1: USB disconnect, device number 40 [ 374.145051][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 374.145072][ T30] audit: type=1326 audit(1747131220.147:449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9246 comm="syz.3.940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2272b8e969 code=0x7ffc0000 [ 374.257419][ T30] audit: type=1326 audit(1747131220.147:450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9246 comm="syz.3.940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2272b8e969 code=0x7ffc0000 [ 374.313119][ T30] audit: type=1326 audit(1747131220.147:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9246 comm="syz.3.940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f2272b8e969 code=0x7ffc0000 [ 374.506530][ T30] audit: type=1326 audit(1747131220.147:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9246 comm="syz.3.940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2272b8e969 code=0x7ffc0000 [ 374.565669][ T30] audit: type=1326 audit(1747131220.147:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9246 comm="syz.3.940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2272b8e969 code=0x7ffc0000 [ 374.632080][ T30] audit: type=1326 audit(1747131220.177:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9246 comm="syz.3.940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2272b8e969 code=0x7ffc0000 [ 374.799266][ T30] audit: type=1326 audit(1747131220.177:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9246 comm="syz.3.940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2272b8e969 code=0x7ffc0000 [ 374.859009][ T30] audit: type=1326 audit(1747131220.187:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9246 comm="syz.3.940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2272b8e969 code=0x7ffc0000 [ 374.898218][ T30] audit: type=1326 audit(1747131220.187:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9246 comm="syz.3.940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f2272b8e969 code=0x7ffc0000 [ 374.926798][ T30] audit: type=1326 audit(1747131220.187:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9246 comm="syz.3.940" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2272b8e969 code=0x7ffc0000 [ 375.640690][ T49] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 375.793528][ T49] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 375.812796][ T49] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 375.879003][ T49] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 375.925787][ T49] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 375.963043][ T49] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 376.000764][ T49] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 376.014226][ T49] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 376.022545][ T49] usb 4-1: Product: syz [ 376.026865][ T49] usb 4-1: Manufacturer: syz [ 376.069561][ T49] cdc_wdm 4-1:1.0: skipping garbage [ 376.306056][ T49] cdc_wdm 4-1:1.0: skipping garbage [ 376.322404][ T49] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 376.336773][ T49] cdc_wdm 4-1:1.0: Unknown control protocol [ 376.553612][ T9268] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 376.828902][ T49] usb 4-1: USB disconnect, device number 56 [ 377.129998][ T5880] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 377.294227][ T5880] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 377.305336][ T5880] usb 5-1: config 0 has no interfaces? [ 377.313191][ T5880] usb 5-1: New USB device found, idVendor=045e, idProduct=02bf, bcdDevice=9e.06 [ 377.323836][ T5880] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 377.336780][ T5880] usb 5-1: config 0 descriptor?? [ 377.429312][ T9280] netlink: 28 bytes leftover after parsing attributes in process `syz.3.952'. [ 377.509831][ T5913] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 377.545650][ T9272] FAULT_INJECTION: forcing a failure. [ 377.545650][ T9272] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 377.560432][ T9272] CPU: 1 UID: 0 PID: 9272 Comm: syz.4.949 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 377.560461][ T9272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 377.560478][ T9272] Call Trace: [ 377.560489][ T9272] [ 377.560498][ T9272] dump_stack_lvl+0x189/0x250 [ 377.560537][ T9272] ? __pfx_dump_stack_lvl+0x10/0x10 [ 377.560569][ T9272] ? __pfx__printk+0x10/0x10 [ 377.560598][ T9272] should_fail_ex+0x414/0x560 [ 377.560627][ T9272] _copy_to_user+0x31/0xb0 [ 377.560659][ T9272] simple_read_from_buffer+0xe1/0x170 [ 377.560691][ T9272] proc_fail_nth_read+0x1df/0x250 [ 377.560722][ T9272] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 377.560755][ T9272] ? rw_verify_area+0x258/0x650 [ 377.560779][ T9272] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 377.560812][ T9272] vfs_read+0x200/0x980 [ 377.560843][ T9272] ? __pfx___mutex_lock+0x10/0x10 [ 377.560871][ T9272] ? __pfx_vfs_read+0x10/0x10 [ 377.560898][ T9272] ? __fget_files+0x2a/0x420 [ 377.560931][ T9272] ? __fget_files+0x3a0/0x420 [ 377.560959][ T9272] ? __fget_files+0x2a/0x420 [ 377.560998][ T9272] ksys_read+0x145/0x250 [ 377.561025][ T9272] ? __pfx_ksys_read+0x10/0x10 [ 377.561054][ T9272] ? do_syscall_64+0xba/0x210 [ 377.561086][ T9272] do_syscall_64+0xf6/0x210 [ 377.561116][ T9272] ? clear_bhb_loop+0x60/0xb0 [ 377.561142][ T9272] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.561163][ T9272] RIP: 0033:0x7f1a3578d37c [ 377.561183][ T9272] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 377.561201][ T9272] RSP: 002b:00007f1a365fa030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 377.561224][ T9272] RAX: ffffffffffffffda RBX: 00007f1a359b5fa0 RCX: 00007f1a3578d37c [ 377.561240][ T9272] RDX: 000000000000000f RSI: 00007f1a365fa0a0 RDI: 0000000000000005 [ 377.561259][ T9272] RBP: 00007f1a365fa090 R08: 0000000000000000 R09: 0000000000000000 [ 377.561273][ T9272] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 377.561286][ T9272] R13: 0000000000000000 R14: 00007f1a359b5fa0 R15: 00007f1a35adfa28 [ 377.561319][ T9272] [ 377.801822][ T5913] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 377.811482][ T5913] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 377.826535][ T5913] usb 2-1: config 0 descriptor?? [ 377.844583][ T5880] usb 5-1: USB disconnect, device number 43 [ 377.885510][ T5913] cp210x 2-1:0.0: cp210x converter detected [ 378.285251][ T5913] cp210x 2-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 378.358252][ T5913] usb 2-1: cp210x converter now attached to ttyUSB0 [ 378.429856][ T5880] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 378.542273][ T5913] usb 2-1: USB disconnect, device number 39 [ 378.573265][ T5821] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 378.595259][ T5913] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 378.610952][ T9305] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 378.640621][ T5880] usb 5-1: Using ep0 maxpacket: 16 [ 378.649439][ T5913] cp210x 2-1:0.0: device disconnected [ 378.657975][ T5880] usb 5-1: config 0 interface 0 has no altsetting 0 [ 378.671599][ T5880] usb 5-1: New USB device found, idVendor=05ac, idProduct=abdf, bcdDevice=3d.49 [ 378.686200][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.696401][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.740159][ T5880] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 378.749859][ T5821] usb 4-1: Using ep0 maxpacket: 32 [ 378.759610][ T5821] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 378.769905][ T5880] usb 5-1: Product: syz [ 378.779744][ T5880] usb 5-1: Manufacturer: syz [ 378.785285][ T5821] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 378.794546][ T5880] usb 5-1: SerialNumber: syz [ 378.803858][ T5821] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 378.813371][ T5880] usb 5-1: config 0 descriptor?? [ 378.818618][ T5821] usb 4-1: Product: syz [ 378.823318][ T5821] usb 4-1: Manufacturer: syz [ 378.828777][ T5821] usb 4-1: SerialNumber: syz [ 378.834121][ T5880] ipheth 5-1:0.0: Unable to find endpoints [ 378.842777][ T5821] usb 4-1: config 0 descriptor?? [ 378.869046][ T9300] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 379.033950][ T5913] usb 5-1: USB disconnect, device number 44 [ 380.398254][ T9322] mmap: syz.2.967 (9322) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 380.666180][ T9332] netlink: 'syz.4.965': attribute type 20 has an invalid length. [ 381.182635][ T976] usb 4-1: USB disconnect, device number 57 [ 381.389793][ T10] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 381.595023][ T10] usb 2-1: config 0 has no interfaces? [ 381.614266][ T10] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 381.638948][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.659778][ T10] usb 2-1: Product: syz [ 381.664029][ T10] usb 2-1: Manufacturer: syz [ 381.684185][ T10] usb 2-1: SerialNumber: syz [ 381.710314][ T10] usb 2-1: config 0 descriptor?? [ 381.921991][ T9341] netlink: 104 bytes leftover after parsing attributes in process `syz.1.972'. [ 382.049969][ T24] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 382.329360][ T9364] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 382.397501][ T24] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 382.421559][ T24] usb 5-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 382.452976][ T24] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 382.485662][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 382.622980][ T9368] netlink: 8 bytes leftover after parsing attributes in process `syz.2.981'. [ 382.658569][ T9368] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: invalid value (0) [ 382.699601][ T9368] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: allowed values 1 - 65535 [ 382.780663][ T9352] netlink: 'syz.4.974': attribute type 10 has an invalid length. [ 382.796391][ T9352] team0: Device veth1_macvtap failed to register rx_handler [ 383.189764][ T10] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 383.229830][ T24] usb 3-1: new full-speed USB device number 37 using dummy_hcd [ 383.488087][ T10] usb 4-1: config 0 has no interfaces? [ 383.508896][ T10] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 383.518335][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.531652][ T10] usb 4-1: Product: syz [ 383.544230][ T10] usb 4-1: Manufacturer: syz [ 383.553608][ T24] usb 3-1: config 0 has an invalid interface number: 29 but max is 0 [ 383.562524][ T10] usb 4-1: SerialNumber: syz [ 383.578531][ T10] usb 4-1: config 0 descriptor?? [ 383.599035][ T24] usb 3-1: config 0 has no interface number 0 [ 383.640276][ T24] usb 3-1: config 0 interface 29 has no altsetting 0 [ 383.704808][ T24] usb 3-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 383.864428][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.889025][ T24] usb 3-1: Product: syz [ 383.897814][ T24] usb 3-1: Manufacturer: syz [ 383.908755][ T24] usb 3-1: SerialNumber: syz [ 383.926472][ T24] usb 3-1: config 0 descriptor?? [ 384.212120][ T9372] trusted_key: encrypted_key: hex blob is missing [ 384.223986][ T24] peak_usb 3-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 384.256768][ T5880] usb 2-1: USB disconnect, device number 40 [ 384.442914][ T24] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 384.462754][ T24] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 384.497088][ T24] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 384.565278][ T9380] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.982'. [ 384.587001][ T9380] netlink: 'syz.1.982': attribute type 4 has an invalid length. [ 384.595123][ T9380] netlink: 152 bytes leftover after parsing attributes in process `syz.1.982'. [ 384.671192][ T9372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 384.681651][ T9372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 384.707542][ T9380] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 384.941259][ T10] usb 5-1: USB disconnect, device number 45 [ 384.989846][ T5821] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 385.020463][ T24] peak_usb 3-1:0.29: probe with driver peak_usb failed with error -22 [ 385.129803][ T5821] usb 2-1: device descriptor read/64, error -71 [ 385.409902][ T5821] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 385.549760][ T5821] usb 2-1: device descriptor read/64, error -71 [ 385.671545][ T5821] usb usb2-port1: attempt power cycle [ 386.439930][ T5821] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 386.460438][ T5821] usb 2-1: device descriptor read/8, error -71 [ 386.639388][ T5913] usb 4-1: USB disconnect, device number 58 [ 386.720015][ T5821] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 386.770492][ T5821] usb 2-1: device descriptor read/8, error -71 [ 386.800067][ T10] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 386.843686][ T5880] usb 3-1: USB disconnect, device number 37 [ 386.910151][ T5821] usb usb2-port1: unable to enumerate USB device [ 386.969886][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 387.000155][ T10] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 387.018885][ T10] usb 1-1: config 0 has no interface number 0 [ 387.035677][ T10] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 387.046773][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.068170][ T10] usb 1-1: Product: syz [ 387.093446][ T10] usb 1-1: Manufacturer: syz [ 387.100418][ T10] usb 1-1: SerialNumber: syz [ 387.116246][ T10] usb 1-1: config 0 descriptor?? [ 387.125651][ T9403] netlink: 4 bytes leftover after parsing attributes in process `syz.4.991'. [ 387.138118][ T10] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 387.365398][ T10] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 387.398080][ T9412] input: syz0 as /devices/virtual/input/input16 [ 387.447998][ T9380] delete_channel: no stack [ 387.463831][ T10] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 387.563185][ C0] quatech-serial ttyUSB0: qt2_process_read_urb - port change to invalid port: 255 [ 387.650818][ T9417] x_tables: duplicate underflow at hook 1 [ 387.990718][ T9420] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 388.196398][ T9422] vlan2: entered promiscuous mode [ 388.689234][ T9428] netlink: 8 bytes leftover after parsing attributes in process `syz.3.998'. [ 388.737166][ T9428] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: invalid value (0) [ 388.766831][ T9428] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: allowed values 1 - 65535 [ 388.955863][ C0] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 388.974785][ T10] usb 1-1: USB disconnect, device number 41 [ 388.990946][ T10] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 389.098638][ T10] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 389.129808][ T5913] usb 4-1: new full-speed USB device number 59 using dummy_hcd [ 389.257172][ T10] quatech2 1-1:0.51: device disconnected [ 389.529008][ T5913] usb 4-1: config 0 has an invalid interface number: 29 but max is 0 [ 389.559122][ T5913] usb 4-1: config 0 has no interface number 0 [ 389.613970][ T5913] usb 4-1: config 0 interface 29 has no altsetting 0 [ 389.716547][ T9436] veth1_vlan: entered allmulticast mode [ 389.724304][ T5913] usb 4-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 389.849924][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.881384][ T5913] usb 4-1: Product: syz [ 389.930141][ T5913] usb 4-1: Manufacturer: syz [ 389.949757][ T5821] usb 2-1: new full-speed USB device number 45 using dummy_hcd [ 389.965806][ T5913] usb 4-1: SerialNumber: syz [ 390.006366][ T5913] usb 4-1: config 0 descriptor?? [ 390.162037][ T5821] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 390.189518][ T5821] usb 2-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 390.229055][ T5821] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.249862][ T5821] usb 2-1: Product: syz [ 390.255006][ T5821] usb 2-1: Manufacturer: syz [ 390.278722][ T5821] usb 2-1: SerialNumber: syz [ 390.293577][ T9428] trusted_key: encrypted_key: hex blob is missing [ 390.307478][ T5821] usb 2-1: config 0 descriptor?? [ 390.323341][ T5913] peak_usb 4-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 390.499827][ T5821] usb 3-1: new full-speed USB device number 38 using dummy_hcd [ 390.513217][ T5913] peak_usb 4-1:0.29 can0: sending command failure: -22 [ 390.524005][ T5913] peak_usb 4-1:0.29 can0: sending command failure: -22 [ 390.531346][ T5913] peak_usb 4-1:0.29 can0: sending command failure: -22 [ 390.591017][ T5913] peak_usb 4-1:0.29: probe with driver peak_usb failed with error -22 [ 390.654499][ T9444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.676367][ T5821] usb 3-1: config 54 has an invalid descriptor of length 0, skipping remainder of the config [ 390.709361][ T5821] usb 3-1: New USB device found, idVendor=15f4, idProduct=0015, bcdDevice=d1.6e [ 390.719584][ T5821] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 390.728861][ T9444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.749518][ T9428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 390.760361][ T9428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 390.777745][ T5821] usb 3-1: Product: syz [ 390.799984][ T5821] usb 3-1: Manufacturer: syz [ 390.851853][ T5821] usb 3-1: SerialNumber: syz [ 390.871339][ T5821] dvb-usb: found a 'Hanftek UMT-010 DVB-T USB2.0' in warm state. [ 390.884744][ T5821] dvb-usb: bulk message failed: -22 (3/0) [ 390.914944][ T5821] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 390.928128][ T9449] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.1005'. [ 390.943189][ T5821] dvb-usb: Hanftek UMT-010 DVB-T USB2.0 error while loading driver (-19) [ 390.961446][ T5821] dvb_usb_umt_010 3-1:54.0: probe with driver dvb_usb_umt_010 failed with error -22 [ 391.024230][ T9450] netlink: 'syz.4.1005': attribute type 4 has an invalid length. [ 391.035598][ T9450] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1005'. [ 391.072866][ T5821] usb 3-1: USB disconnect, device number 38 [ 391.349952][ T5880] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 391.489803][ T5880] usb 5-1: device descriptor read/64, error -71 [ 391.739775][ T5880] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 391.900843][ T5880] usb 5-1: device descriptor read/64, error -71 [ 392.044917][ T5880] usb usb5-port1: attempt power cycle [ 392.083093][ T9] usb 4-1: USB disconnect, device number 59 [ 392.125297][ T9463] netlink: zone id is out of range [ 392.156274][ T9463] netlink: zone id is out of range [ 392.180936][ T9463] netlink: zone id is out of range [ 392.215760][ T9463] netlink: zone id is out of range [ 392.234845][ T9463] netlink: zone id is out of range [ 392.242865][ T9465] fuse: Unknown parameter '00000000000000000000' [ 392.257935][ T9463] netlink: zone id is out of range [ 392.278075][ T9463] netlink: zone id is out of range [ 392.295214][ T9463] netlink: zone id is out of range [ 392.309481][ T9463] netlink: zone id is out of range [ 392.317817][ T9463] netlink: zone id is out of range [ 392.444289][ T5880] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 392.473136][ T5880] usb 5-1: device descriptor read/8, error -71 [ 392.484121][ T9473] netlink: 'syz.0.1012': attribute type 1 has an invalid length. [ 392.526881][ T9473] 8021q: adding VLAN 0 to HW filter on device bond1 [ 392.542120][ T9] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 392.700008][ T5913] usb 2-1: USB disconnect, device number 45 [ 392.720094][ T5880] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 392.720161][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 392.751718][ T5880] usb 5-1: device descriptor read/8, error -71 [ 392.776029][ T9] usb 4-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 392.826305][ T9] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 392.869588][ T9] usb 4-1: Product: syz [ 392.873484][ T9485] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 392.884927][ T5880] usb usb5-port1: unable to enumerate USB device [ 392.895727][ T9] usb 4-1: Manufacturer: syz [ 392.925754][ T9] usb 4-1: SerialNumber: syz [ 392.943039][ T9] usb 4-1: config 0 descriptor?? [ 393.206134][ T5880] usb 4-1: USB disconnect, device number 60 [ 393.796397][ T9493] unsupported nla_type 52263 [ 394.081808][ T9450] delete_channel: no stack [ 394.285909][ T9502] FAULT_INJECTION: forcing a failure. [ 394.285909][ T9502] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 394.327993][ T9502] CPU: 0 UID: 0 PID: 9502 Comm: syz.4.1021 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 394.328026][ T9502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 394.328046][ T9502] Call Trace: [ 394.328055][ T9502] [ 394.328066][ T9502] dump_stack_lvl+0x189/0x250 [ 394.328100][ T9502] ? __lock_acquire+0xaac/0xd20 [ 394.328134][ T9502] ? __pfx_dump_stack_lvl+0x10/0x10 [ 394.328164][ T9502] ? __pfx__printk+0x10/0x10 [ 394.328186][ T9502] ? __might_fault+0xb0/0x130 [ 394.328226][ T9502] should_fail_ex+0x414/0x560 [ 394.328254][ T9502] _copy_from_user+0x2d/0xb0 [ 394.328286][ T9502] snd_seq_oss_write+0x515/0x930 [ 394.328327][ T9502] ? __pfx_snd_seq_oss_write+0x10/0x10 [ 394.328352][ T9502] ? common_file_perm+0x199/0x200 [ 394.328381][ T9502] ? security_file_permission+0x75/0x290 [ 394.328420][ T9502] odev_write+0x5a/0x80 [ 394.328454][ T9502] vfs_writev+0x4a5/0x9a0 [ 394.328484][ T9502] ? vfs_write+0x8d8/0xa90 [ 394.328507][ T9502] ? __pfx_odev_write+0x10/0x10 [ 394.328545][ T9502] ? __pfx_vfs_writev+0x10/0x10 [ 394.328591][ T9502] ? __fget_files+0x2a/0x420 [ 394.328624][ T9502] ? __fget_files+0x3a0/0x420 [ 394.328652][ T9502] ? __fget_files+0x2a/0x420 [ 394.328689][ T9502] __x64_sys_pwritev+0x197/0x2a0 [ 394.328717][ T9502] ? rcu_is_watching+0x15/0xb0 [ 394.328737][ T9502] ? __pfx___x64_sys_pwritev+0x10/0x10 [ 394.328770][ T9502] ? do_syscall_64+0xba/0x210 [ 394.328803][ T9502] do_syscall_64+0xf6/0x210 [ 394.328832][ T9502] ? clear_bhb_loop+0x60/0xb0 [ 394.328858][ T9502] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.328879][ T9502] RIP: 0033:0x7f1a3578e969 [ 394.328898][ T9502] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 394.328917][ T9502] RSP: 002b:00007f1a365fa038 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 394.328940][ T9502] RAX: ffffffffffffffda RBX: 00007f1a359b5fa0 RCX: 00007f1a3578e969 [ 394.328956][ T9502] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000003 [ 394.328974][ T9502] RBP: 00007f1a365fa090 R08: 0000000000000001 R09: 0000000000000000 [ 394.328987][ T9502] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 394.328999][ T9502] R13: 0000000000000000 R14: 00007f1a359b5fa0 R15: 00007f1a35adfa28 [ 394.329037][ T9502] [ 394.569858][ T49] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 394.780038][ T49] usb 4-1: Using ep0 maxpacket: 32 [ 394.791987][ T49] usb 4-1: config 1 interface 0 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 394.819973][ T49] usb 4-1: config 1 interface 0 has no altsetting 0 [ 394.848809][ T49] usb 4-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.40 [ 394.863085][ T49] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 394.909788][ T5913] usb 5-1: new full-speed USB device number 50 using dummy_hcd [ 394.912609][ T49] usb 4-1: Product: ᐌ [ 394.943887][ T49] usb 4-1: Manufacturer: 惮룀Р暕ण徬䶏ᇁ튂薒톆䅧譳擱뇦羞꟮袢糛퐇硣ત⤅字ꦂ誫脨ሎ㔁ڈ [ 394.988123][ T24] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 394.999680][ T49] usb 4-1: SerialNumber: Љ [ 395.101986][ T5913] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 395.142582][ T5913] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 395.173383][ T5913] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 395.198621][ T24] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 395.229745][ T5913] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 395.239584][ T5913] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 395.248901][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 395.281348][ T24] usb 1-1: config 0 descriptor?? [ 395.308403][ T5913] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 395.310203][ T24] cp210x 1-1:0.0: cp210x converter detected [ 395.317860][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 395.348729][ T5913] usb 5-1: Product: syz [ 395.359327][ T5913] usb 5-1: Manufacturer: syz [ 395.364903][ T5913] usb 5-1: SerialNumber: syz [ 395.379837][ T5913] usb 5-1: config 0 descriptor?? [ 395.500993][ T9514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 395.535605][ T9514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 395.550954][ T9516] syz.2.1027 (9516): drop_caches: 4 [ 395.599118][ T5913] radio-si470x 5-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 395.608712][ T5913] radio-si470x 5-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 395.630062][ T9517] binder: 9515:9517 ioctl c0306201 200000000640 returned -22 [ 395.713653][ T24] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 395.723414][ T9519] FAULT_INJECTION: forcing a failure. [ 395.723414][ T9519] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 395.737032][ T9519] CPU: 0 UID: 0 PID: 9519 Comm: syz.1.1028 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 395.737065][ T9519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 395.737079][ T9519] Call Trace: [ 395.737088][ T9519] [ 395.737097][ T9519] dump_stack_lvl+0x189/0x250 [ 395.737131][ T9519] ? __lock_acquire+0xaac/0xd20 [ 395.737165][ T9519] ? __pfx_dump_stack_lvl+0x10/0x10 [ 395.737195][ T9519] ? __pfx__printk+0x10/0x10 [ 395.737217][ T9519] ? __might_fault+0xb0/0x130 [ 395.737257][ T9519] should_fail_ex+0x414/0x560 [ 395.737285][ T9519] _copy_from_iter+0x1db/0x15a0 [ 395.737325][ T9519] ? __pfx__copy_from_iter+0x10/0x10 [ 395.737355][ T9519] ? __build_skb_around+0x257/0x3e0 [ 395.737386][ T9519] ? netlink_sendmsg+0x642/0xb30 [ 395.737421][ T9519] ? skb_put+0x11b/0x210 [ 395.737452][ T9519] netlink_sendmsg+0x6b2/0xb30 [ 395.737485][ T9519] ? __pfx_netlink_sendmsg+0x10/0x10 [ 395.737514][ T9519] ? aa_sock_msg_perm+0x94/0x160 [ 395.737540][ T9519] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 395.737563][ T9519] ? __pfx_netlink_sendmsg+0x10/0x10 [ 395.737587][ T9519] __sock_sendmsg+0x21c/0x270 [ 395.737611][ T9519] sock_write_iter+0x258/0x330 [ 395.737647][ T9519] ? __pfx_sock_write_iter+0x10/0x10 [ 395.737697][ T9519] ? bpf_lsm_file_permission+0x9/0x20 [ 395.737722][ T9519] ? security_file_permission+0x75/0x290 [ 395.737762][ T9519] vfs_write+0x548/0xa90 [ 395.737792][ T9519] ? __pfx_sock_write_iter+0x10/0x10 [ 395.737842][ T9519] ? __pfx_vfs_write+0x10/0x10 [ 395.737892][ T9519] ? __fget_files+0x2a/0x420 [ 395.737930][ T9519] ksys_write+0x145/0x250 [ 395.737952][ T9519] ? rcu_is_watching+0x15/0xb0 [ 395.737972][ T9519] ? __pfx_ksys_write+0x10/0x10 [ 395.737999][ T9519] ? do_syscall_64+0xba/0x210 [ 395.738031][ T9519] do_syscall_64+0xf6/0x210 [ 395.738058][ T9519] ? clear_bhb_loop+0x60/0xb0 [ 395.738085][ T9519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.738103][ T9519] RIP: 0033:0x7f0b1778e969 [ 395.738121][ T9519] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 395.738139][ T9519] RSP: 002b:00007f0b186cf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 395.738158][ T9519] RAX: ffffffffffffffda RBX: 00007f0b179b5fa0 RCX: 00007f0b1778e969 [ 395.738173][ T9519] RDX: 000000000000fe33 RSI: 0000200000000080 RDI: 0000000000000003 [ 395.738204][ T9519] RBP: 00007f0b186cf090 R08: 0000000000000000 R09: 0000000000000000 [ 395.738218][ T9519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 395.738230][ T9519] R13: 0000000000000000 R14: 00007f0b179b5fa0 R15: 00007f0b17adfa28 [ 395.738261][ T9519] [ 396.000256][ C0] vkms_vblank_simulate: vblank timer overrun [ 396.021465][ T24] cp210x 1-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 396.029740][ T24] cp210x 1-1:0.0: GPIO initialisation failed: -71 [ 396.033015][ T5913] radio-si470x 5-1:0.0: software version 0, hardware version 0 [ 396.043857][ T24] usb 1-1: cp210x converter now attached to ttyUSB0 [ 396.049325][ T24] usb 1-1: USB disconnect, device number 42 [ 396.050753][ T5913] radio-si470x 5-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 396.050779][ T5913] radio-si470x 5-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 396.105295][ T24] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 396.154107][ T24] cp210x 1-1:0.0: device disconnected [ 396.219235][ T5913] radio-si470x 5-1:0.0: submitting int urb failed (-90) [ 396.444562][ T9525] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.1031'. [ 396.522844][ T9526] netlink: 'syz.2.1031': attribute type 4 has an invalid length. [ 396.533661][ T9526] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1031'. [ 396.558707][ T9528] netlink: 9 bytes leftover after parsing attributes in process `syz.1.1032'. [ 396.574573][ T9528] gretap0: entered promiscuous mode [ 396.588858][ T9528] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1032'. [ 396.600260][ T9528] 0XD: renamed from gretap0 [ 396.622758][ T9528] 0XD: left promiscuous mode [ 396.627921][ T9528] 0XD: entered allmulticast mode [ 396.683731][ T9528] bridge_slave_0: left allmulticast mode [ 396.690009][ T9528] bridge_slave_0: left promiscuous mode [ 396.696021][ T9528] bridge0: port 1(bridge_slave_0) entered disabled state [ 396.717429][ T9528] bridge_slave_1: left allmulticast mode [ 396.725039][ T9528] bridge_slave_1: left promiscuous mode [ 396.734511][ T9528] bridge0: port 2(bridge_slave_1) entered disabled state [ 396.753049][ T9528] bond0: (slave bond_slave_0): Releasing backup interface [ 396.766953][ T9528] bond0: (slave bond_slave_1): Releasing backup interface [ 396.800427][ T9] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 396.812815][ T9528] team0: Port device team_slave_0 removed [ 396.834568][ T9528] team0: Port device team_slave_1 removed [ 396.842623][ T9528] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 396.850916][ T9528] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 396.860927][ T9528] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 396.868438][ T9528] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 396.896366][ T9528] bond2: (slave ip6gretap1): Removing an active aggregator [ 396.906472][ T9528] bond2: (slave ip6gretap1): Releasing backup interface [ 396.926781][ T9528] bond2: (slave ip6gretap1): the permanent HWaddr of slave - b2:df:23:90:0d:cc - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 396.944543][ T9] usb 3-1: device descriptor read/64, error -71 [ 396.961227][ T9528] bond2: (slave veth3): Releasing backup interface [ 397.108701][ T9530] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 397.228372][ T9] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 397.398262][ T49] usbhid 4-1:1.0: can't add hid device: -71 [ 397.420525][ T9] usb 3-1: device descriptor read/64, error -71 [ 397.432001][ T49] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 397.494090][ T49] usb 4-1: USB disconnect, device number 61 [ 397.531051][ T9] usb usb3-port1: attempt power cycle [ 397.573038][ T5913] radio-si470x 5-1:0.0: si470x_set_report: usb_control_msg returned -110 [ 397.600910][ T5913] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -22 [ 397.615746][ T9541] fuse: Bad value for 'fd' [ 397.879893][ T9] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 397.920595][ T9] usb 3-1: device descriptor read/8, error -71 [ 398.189991][ T9] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 398.237656][ T9] usb 3-1: device descriptor read/8, error -71 [ 398.390128][ T9] usb usb3-port1: unable to enumerate USB device [ 399.323595][ T5913] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 399.487160][ T5913] usb 2-1: Using ep0 maxpacket: 8 [ 399.507857][ T5913] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 399.537358][ T5913] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 399.549122][ T9526] delete_channel: no stack [ 399.557162][ T49] usb 5-1: USB disconnect, device number 50 [ 399.798300][ T5913] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 399.832657][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 399.832674][ T30] audit: type=1800 audit(1747131245.737:516): pid=9557 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1039" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=8207 res=0 errno=0 [ 399.870294][ C0] vkms_vblank_simulate: vblank timer overrun [ 399.899782][ T5913] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2e22, bcdDevice= 0.00 [ 399.993627][ T5913] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.121654][ T5913] usb 2-1: config 0 descriptor?? [ 400.787849][ T9576] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1045'. [ 400.810164][ T9576] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: invalid value (0) [ 400.825008][ T9576] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: allowed values 1 - 65535 [ 401.209809][ T10] usb 3-1: new full-speed USB device number 43 using dummy_hcd [ 401.490847][ T9582] loop2: detected capacity change from 0 to 7 [ 401.500619][ T9582] Dev loop2: unable to read RDB block 7 [ 401.509894][ T24] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 401.520445][ T9582] loop2: AHDI p1 p2 p3 [ 401.561098][ T9582] loop2: partition table partially beyond EOD, truncated [ 401.574056][ T10] usb 3-1: config 0 has an invalid interface number: 29 but max is 0 [ 401.606524][ T9582] loop2: p1 start 1601398130 is beyond EOD, truncated [ 401.614197][ T10] usb 3-1: config 0 has no interface number 0 [ 401.627594][ T9582] loop2: p2 start 1702059890 is beyond EOD, truncated [ 401.642139][ T10] usb 3-1: config 0 interface 29 has no altsetting 0 [ 401.699789][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 401.714901][ T10] usb 3-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 401.719058][ T24] usb 5-1: config 0 has an invalid interface number: 9 but max is 0 [ 401.746639][ T24] usb 5-1: config 0 has no interface number 0 [ 401.785921][ T24] usb 5-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 401.811267][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.832753][ T24] usb 5-1: Product: syz [ 401.851514][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.861904][ T24] usb 5-1: Manufacturer: syz [ 401.891423][ T24] usb 5-1: SerialNumber: syz [ 401.919598][ T24] usb 5-1: config 0 descriptor?? [ 401.935003][ T10] usb 3-1: Product: syz [ 401.939294][ T10] usb 3-1: Manufacturer: syz [ 401.943020][ T24] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 401.971714][ T9588] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 402.117654][ T10] usb 3-1: SerialNumber: syz [ 402.145685][ T5913] usbhid 2-1:0.0: can't add hid device: -71 [ 402.152885][ T5913] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 402.194773][ T9590] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1049'. [ 402.231649][ T10] usb 3-1: config 0 descriptor?? [ 402.238476][ T9590] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1049'. [ 402.257542][ T5913] usb 2-1: USB disconnect, device number 46 [ 402.511326][ T9578] trusted_key: encrypted_key: hex blob is missing [ 402.524139][ T10] peak_usb 3-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 402.730223][ T10] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 402.748642][ T10] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 402.789886][ T10] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 402.938526][ T9578] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 402.948888][ T9578] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 403.183829][ T10] peak_usb 3-1:0.29: probe with driver peak_usb failed with error -22 [ 403.576567][ T24] gspca_topro: reg_r err -71 [ 403.586439][ T24] gspca_topro: Sensor soi763a [ 403.939945][ T24] usb 5-1: USB disconnect, device number 51 [ 404.540177][ T24] usb 3-1: USB disconnect, device number 43 [ 405.099813][ T5913] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 405.129765][ T120] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 405.267078][ T5913] usb 4-1: Using ep0 maxpacket: 16 [ 405.285434][ T5913] usb 4-1: config 0 has an invalid interface number: 161 but max is 0 [ 405.309256][ T5913] usb 4-1: config 0 has no interface number 0 [ 405.329790][ T5913] usb 4-1: config 0 interface 161 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 405.358756][ T24] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 405.399754][ T120] usb 5-1: Using ep0 maxpacket: 8 [ 405.406341][ T5913] usb 4-1: New USB device found, idVendor=0bfd, idProduct=0102, bcdDevice=9a.fd [ 405.438174][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.454064][ T5913] usb 4-1: Product: syz [ 405.459253][ T5913] usb 4-1: Manufacturer: syz [ 405.468020][ T5913] usb 4-1: SerialNumber: syz [ 405.557436][ T120] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 405.587465][ T120] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 405.594315][ T5913] usb 4-1: config 0 descriptor?? [ 405.607576][ T120] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 405.626169][ T120] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2e22, bcdDevice= 0.00 [ 405.668807][ T120] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.690939][ T9613] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 405.692466][ T120] usb 5-1: config 0 descriptor?? [ 405.714390][ T5913] kvaser_usb 4-1:0.161: error -ENODEV: Cannot get usb endpoint(s) [ 405.842573][ T9635] FAULT_INJECTION: forcing a failure. [ 405.842573][ T9635] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 405.855858][ T5882] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 405.908335][ T9635] CPU: 1 UID: 0 PID: 9635 Comm: syz.1.1062 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 405.908367][ T9635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 405.908380][ T9635] Call Trace: [ 405.908389][ T9635] [ 405.908398][ T9635] dump_stack_lvl+0x189/0x250 [ 405.908440][ T9635] ? __pfx_dump_stack_lvl+0x10/0x10 [ 405.908470][ T9635] ? __pfx__printk+0x10/0x10 [ 405.908505][ T9635] should_fail_ex+0x414/0x560 [ 405.908531][ T9635] _copy_to_user+0x31/0xb0 [ 405.908563][ T9635] simple_read_from_buffer+0xe1/0x170 [ 405.908594][ T9635] proc_fail_nth_read+0x1df/0x250 [ 405.908630][ T9635] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 405.908664][ T9635] ? rw_verify_area+0x258/0x650 [ 405.908689][ T9635] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 405.908722][ T9635] vfs_read+0x200/0x980 [ 405.908751][ T9635] ? __pfx___mutex_lock+0x10/0x10 [ 405.908781][ T9635] ? __pfx_vfs_read+0x10/0x10 [ 405.908807][ T9635] ? __fget_files+0x2a/0x420 [ 405.908838][ T9635] ? __fget_files+0x3a0/0x420 [ 405.908863][ T9635] ? __fget_files+0x2a/0x420 [ 405.908900][ T9635] ksys_read+0x145/0x250 [ 405.908926][ T9635] ? __pfx_ksys_read+0x10/0x10 [ 405.908956][ T9635] ? do_syscall_64+0xba/0x210 [ 405.908989][ T9635] do_syscall_64+0xf6/0x210 [ 405.909017][ T9635] ? clear_bhb_loop+0x60/0xb0 [ 405.909042][ T9635] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.909073][ T9635] RIP: 0033:0x7f0b1778d37c [ 405.909091][ T9635] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 405.909110][ T9635] RSP: 002b:00007f0b186cf030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 405.909133][ T9635] RAX: ffffffffffffffda RBX: 00007f0b179b5fa0 RCX: 00007f0b1778d37c [ 405.909149][ T9635] RDX: 000000000000000f RSI: 00007f0b186cf0a0 RDI: 0000000000000004 [ 405.909163][ T9635] RBP: 00007f0b186cf090 R08: 0000000000000000 R09: 0000000000000000 [ 405.909177][ T9635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 405.909189][ T9635] R13: 0000000000000000 R14: 00007f0b179b5fa0 R15: 00007f0b17adfa28 [ 405.909222][ T9635] [ 406.133961][ T9637] tipc: Enabled bearer , priority 10 [ 406.209780][ T5882] usb 1-1: Using ep0 maxpacket: 32 [ 406.217267][ T5882] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 406.225863][ T5882] usb 1-1: config 0 has no interface number 0 [ 406.232505][ T5882] usb 1-1: config 0 interface 184 has no altsetting 0 [ 406.245315][ T5882] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 406.255673][ T5882] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.263812][ T5882] usb 1-1: Product: syz [ 406.268049][ T5882] usb 1-1: Manufacturer: syz [ 406.272753][ T5882] usb 1-1: SerialNumber: syz [ 406.350040][ T9640] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1065'. [ 406.359202][ T9640] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: invalid value (0) [ 406.370765][ T5882] usb 1-1: config 0 descriptor?? [ 406.383337][ T5882] smsc75xx v1.0.0 [ 406.398777][ T9640] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: allowed values 1 - 65535 [ 406.840762][ T24] usb 3-1: new full-speed USB device number 45 using dummy_hcd [ 407.018367][ T24] usb 3-1: config 0 has an invalid interface number: 29 but max is 0 [ 407.027389][ T5882] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 407.041354][ T24] usb 3-1: config 0 has no interface number 0 [ 407.047887][ T5882] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 407.119807][ T24] usb 3-1: config 0 interface 29 has no altsetting 0 [ 407.137343][ T24] usb 3-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 407.199997][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 407.208291][ T24] usb 3-1: Product: syz [ 407.212623][ T24] usb 3-1: Manufacturer: syz [ 407.218957][ T24] usb 3-1: SerialNumber: syz [ 407.249432][ T24] usb 3-1: config 0 descriptor?? [ 407.260031][ T5913] tipc: Node number set to 523894784 [ 407.482695][ T9644] trusted_key: encrypted_key: hex blob is missing [ 407.492882][ T24] peak_usb 3-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 407.574339][ T120] usbhid 5-1:0.0: can't add hid device: -71 [ 407.580679][ T120] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 407.651022][ T120] usb 5-1: USB disconnect, device number 52 [ 407.693481][ T24] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 407.700573][ T24] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 407.707515][ T24] peak_usb 3-1:0.29 can0: sending command failure: -22 [ 407.728174][ T5880] usb 4-1: USB disconnect, device number 62 [ 407.911463][ T24] peak_usb 3-1:0.29: probe with driver peak_usb failed with error -22 [ 407.926006][ T9644] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 407.935184][ T9644] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 408.145612][ T30] audit: type=1326 audit(1747131254.147:517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9630 comm="syz.0.1060" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0d4178e969 code=0x0 [ 409.079852][ T30] audit: type=1800 audit(1747131254.847:518): pid=9659 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1068" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=11677 res=0 errno=0 [ 409.619778][ T5880] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 410.211959][ T24] usb 3-1: USB disconnect, device number 45 [ 410.279233][ T5880] usb 2-1: config 0 has no interfaces? [ 410.351302][ T5880] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 410.381089][ T5880] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.389137][ T5880] usb 2-1: Product: syz [ 410.435374][ T9670] fuse: Unknown parameter '0x0000000000000003' [ 410.450392][ T5880] usb 2-1: Manufacturer: syz [ 410.455790][ T5880] usb 2-1: SerialNumber: syz [ 410.598788][ T5880] usb 2-1: config 0 descriptor?? [ 411.501660][ T9688] binder: 9687:9688 ioctl c0306201 0 returned -14 [ 411.738542][ T9693] FAULT_INJECTION: forcing a failure. [ 411.738542][ T9693] name failslab, interval 1, probability 0, space 0, times 0 [ 411.765320][ T9693] CPU: 0 UID: 0 PID: 9693 Comm: syz.3.1077 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 411.765353][ T9693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 411.765363][ T9693] Call Trace: [ 411.765371][ T9693] [ 411.765377][ T9693] dump_stack_lvl+0x189/0x250 [ 411.765421][ T9693] ? __pfx_dump_stack_lvl+0x10/0x10 [ 411.765452][ T9693] ? __pfx__printk+0x10/0x10 [ 411.765475][ T9693] ? __pfx___might_resched+0x10/0x10 [ 411.765495][ T9693] ? fs_reclaim_acquire+0x7d/0x100 [ 411.765523][ T9693] should_fail_ex+0x414/0x560 [ 411.765548][ T9693] should_failslab+0xa8/0x100 [ 411.765580][ T9693] __kmalloc_node_track_caller_noprof+0xcc/0x4e0 [ 411.765610][ T9693] ? vfs_parse_monolithic_sep+0x21b/0x310 [ 411.765644][ T9693] kmemdup_nul+0x36/0xf0 [ 411.765662][ T9693] vfs_parse_monolithic_sep+0x21b/0x310 [ 411.765683][ T9693] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 411.765708][ T9693] ? __pfx_vfs_parse_monolithic_sep+0x10/0x10 [ 411.765743][ T9693] ? fuse_init_fs_context+0xfd/0x210 [ 411.765772][ T9693] ? alloc_fs_context+0x665/0x7d0 [ 411.765806][ T9693] do_new_mount+0x21a/0xa40 [ 411.765832][ T9693] __se_sys_mount+0x317/0x410 [ 411.765862][ T9693] ? __pfx___se_sys_mount+0x10/0x10 [ 411.765897][ T9693] ? do_syscall_64+0xba/0x210 [ 411.765923][ T9693] ? __x64_sys_mount+0x20/0xc0 [ 411.765953][ T9693] do_syscall_64+0xf6/0x210 [ 411.765974][ T9693] ? clear_bhb_loop+0x60/0xb0 [ 411.765993][ T9693] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.766009][ T9693] RIP: 0033:0x7f2272b8e969 [ 411.766031][ T9693] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 411.766051][ T9693] RSP: 002b:00007f2273aac038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 411.766075][ T9693] RAX: ffffffffffffffda RBX: 00007f2272db5fa0 RCX: 00007f2272b8e969 [ 411.766090][ T9693] RDX: 0000200000002100 RSI: 0000200000000100 RDI: 0000000000000000 [ 411.766105][ T9693] RBP: 00007f2273aac090 R08: 0000200000000240 R09: 0000000000000000 [ 411.766115][ T9693] R10: 000000000280449c R11: 0000000000000246 R12: 0000000000000002 [ 411.766124][ T9693] R13: 0000000000000000 R14: 00007f2272db5fa0 R15: 00007f2272edfa28 [ 411.766146][ T9693] [ 411.989981][ C0] vkms_vblank_simulate: vblank timer overrun [ 412.060061][ T5882] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 412.071036][ T5882] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 412.080915][ T5882] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 412.090700][ T5882] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 412.105634][ T5882] usb 1-1: USB disconnect, device number 43 [ 412.312633][ T9699] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1080'. [ 412.395335][ T5880] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 412.408259][ T9699] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: invalid value (0) [ 412.476337][ T9699] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: allowed values 1 - 65535 [ 412.530119][ T5821] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 412.795446][ T5880] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 412.818953][ T5880] usb 5-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 412.830833][ T5880] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 412.846606][ T5821] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 412.860130][ T5821] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 412.875768][ T5880] usb 5-1: config 0 descriptor?? [ 412.889962][ T9] usb 1-1: new full-speed USB device number 44 using dummy_hcd [ 412.928105][ T5821] usb 3-1: config 0 descriptor?? [ 412.956777][ T5821] cp210x 3-1:0.0: cp210x converter detected [ 413.063740][ T5880] usb 2-1: USB disconnect, device number 47 [ 413.075966][ T9] usb 1-1: config 0 has an invalid interface number: 29 but max is 0 [ 413.150007][ T9] usb 1-1: config 0 has no interface number 0 [ 413.177834][ T9] usb 1-1: config 0 interface 29 has no altsetting 0 [ 413.336096][ T9] usb 1-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 413.357804][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.366780][ T5821] cp210x 3-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 413.385050][ T5821] cp210x 3-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 413.393858][ T9] usb 1-1: Product: syz [ 413.399474][ T9] usb 1-1: Manufacturer: syz [ 413.421349][ T5821] cp210x 3-1:0.0: GPIO initialisation failed: -71 [ 413.463324][ T9] usb 1-1: SerialNumber: syz [ 413.469880][ T5821] usb 3-1: cp210x converter now attached to ttyUSB0 [ 413.506274][ T9] usb 1-1: config 0 descriptor?? [ 413.641189][ T5821] usb 3-1: USB disconnect, device number 46 [ 413.697229][ T5821] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 413.718413][ T5821] cp210x 3-1:0.0: device disconnected [ 413.779738][ T5880] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 413.791665][ T9699] trusted_key: encrypted_key: hex blob is missing [ 413.802446][ T9] peak_usb 1-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 414.009232][ T9] peak_usb 1-1:0.29 can0: sending command failure: -22 [ 414.010901][ T5880] usb 2-1: config index 0 descriptor too short (expected 44288, got 77) [ 414.043111][ T5880] usb 2-1: config 79 has too many interfaces: 111, using maximum allowed: 32 [ 414.062983][ T5880] usb 2-1: config 79 has an invalid descriptor of length 0, skipping remainder of the config [ 414.082259][ T5880] usb 2-1: config 79 has 0 interfaces, different from the descriptor's value: 111 [ 414.137283][ T9] peak_usb 1-1:0.29 can0: sending command failure: -22 [ 414.165650][ T5880] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 414.174753][ T9] peak_usb 1-1:0.29 can0: sending command failure: -22 [ 414.203042][ T5880] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.236184][ T9699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 414.260604][ T5880] usb 2-1: Product: syz [ 414.260604][ T9] peak_usb 1-1:0.29: probe with driver peak_usb failed with error -22 [ 414.260630][ T5880] usb 2-1: Manufacturer: syz [ 414.302061][ T9699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 414.328869][ T5880] usb 2-1: SerialNumber: syz [ 414.703612][ T9708] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1081'. [ 414.724961][ T9716] delete_channel: no stack [ 415.134222][ T5821] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 415.279808][ T5821] usb 3-1: device descriptor read/64, error -71 [ 415.519857][ T5821] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 415.739814][ T5821] usb 3-1: device descriptor read/64, error -71 [ 415.872656][ T5821] usb usb3-port1: attempt power cycle [ 416.271172][ T49] usb 1-1: USB disconnect, device number 44 [ 416.437508][ T5821] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 416.867391][ T5821] usb 3-1: device descriptor read/8, error -71 [ 416.929756][ T5913] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 416.950231][ T9736] FAULT_INJECTION: forcing a failure. [ 416.950231][ T9736] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 416.967281][ T9736] CPU: 0 UID: 0 PID: 9736 Comm: syz.0.1088 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 416.967313][ T9736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 416.967326][ T9736] Call Trace: [ 416.967335][ T9736] [ 416.967344][ T9736] dump_stack_lvl+0x189/0x250 [ 416.967378][ T9736] ? __pfx_dump_stack_lvl+0x10/0x10 [ 416.967401][ T9736] ? __pfx__printk+0x10/0x10 [ 416.967437][ T9736] should_fail_ex+0x414/0x560 [ 416.967466][ T9736] _copy_to_user+0x31/0xb0 [ 416.967497][ T9736] simple_read_from_buffer+0xe1/0x170 [ 416.967525][ T9736] proc_fail_nth_read+0x1df/0x250 [ 416.967551][ T9736] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 416.967583][ T9736] ? rw_verify_area+0x258/0x650 [ 416.967608][ T9736] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 416.967640][ T9736] vfs_read+0x200/0x980 [ 416.967669][ T9736] ? __pfx___mutex_lock+0x10/0x10 [ 416.967690][ T9736] ? __pfx_vfs_read+0x10/0x10 [ 416.967708][ T9736] ? __fget_files+0x2a/0x420 [ 416.967741][ T9736] ? __fget_files+0x3a0/0x420 [ 416.967769][ T9736] ? __fget_files+0x2a/0x420 [ 416.967815][ T9736] ksys_read+0x145/0x250 [ 416.967832][ T9736] ? rcu_is_watching+0x15/0xb0 [ 416.967848][ T9736] ? __pfx_ksys_read+0x10/0x10 [ 416.967868][ T9736] ? do_syscall_64+0xba/0x210 [ 416.967905][ T9736] do_syscall_64+0xf6/0x210 [ 416.967934][ T9736] ? clear_bhb_loop+0x60/0xb0 [ 416.967959][ T9736] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 416.967979][ T9736] RIP: 0033:0x7f0d4178d37c [ 416.967993][ T9736] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 416.968006][ T9736] RSP: 002b:00007f0d42516030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 416.968022][ T9736] RAX: ffffffffffffffda RBX: 00007f0d419b6160 RCX: 00007f0d4178d37c [ 416.968039][ T9736] RDX: 000000000000000f RSI: 00007f0d425160a0 RDI: 0000000000000005 [ 416.968053][ T9736] RBP: 00007f0d42516090 R08: 0000000000000000 R09: 0000000000000002 [ 416.968067][ T9736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 416.968079][ T9736] R13: 0000000000000000 R14: 00007f0d419b6160 R15: 00007f0d41adfa28 [ 416.968110][ T9736] [ 417.592039][ T5913] usb 4-1: config 0 has no interfaces? [ 417.599997][ T5821] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 417.603126][ T5913] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 417.639486][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.670185][ T10] usb 5-1: USB disconnect, device number 53 [ 417.678595][ T5821] usb 3-1: device descriptor read/8, error -71 [ 417.740682][ T5913] usb 4-1: Product: syz [ 417.752853][ T5913] usb 4-1: Manufacturer: syz [ 417.757522][ T5913] usb 4-1: SerialNumber: syz [ 417.847786][ T5913] usb 4-1: config 0 descriptor?? [ 417.860193][ T5821] usb usb3-port1: unable to enumerate USB device [ 417.933246][ T9743] binder: 9741:9743 ioctl c0306201 200000000640 returned -22 [ 418.107838][ T9731] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 418.152892][ T9746] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 418.163184][ T9731] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 418.190636][ T9746] net_ratelimit: 13 callbacks suppressed [ 418.190659][ T9746] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 418.221899][ T24] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 418.432983][ T24] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 418.462264][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.553468][ T24] usb 1-1: config 0 descriptor?? [ 418.567358][ T5880] usb 2-1: USB disconnect, device number 48 [ 418.600448][ T24] cp210x 1-1:0.0: cp210x converter detected [ 419.021382][ T24] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 419.107681][ T24] cp210x 1-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 419.137145][ T24] cp210x 1-1:0.0: GPIO initialisation failed: -71 [ 419.196465][ T24] usb 1-1: cp210x converter now attached to ttyUSB0 [ 419.220066][ T5913] usb 4-1: USB disconnect, device number 63 [ 419.232092][ T24] usb 1-1: USB disconnect, device number 45 [ 419.394115][ T24] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 419.424910][ T9762] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1098'. [ 419.444397][ T24] cp210x 1-1:0.0: device disconnected [ 419.506692][ T9762] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: invalid value (0) [ 419.608307][ T9762] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: allowed values 1 - 65535 [ 419.666464][ T9764] pimreg3: entered allmulticast mode [ 420.019750][ T5913] usb 2-1: new full-speed USB device number 49 using dummy_hcd [ 420.570682][ T9773] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1100'. [ 420.598244][ T5913] usb 2-1: config 0 has an invalid interface number: 29 but max is 0 [ 420.615345][ T5913] usb 2-1: config 0 has no interface number 0 [ 420.622260][ T9773] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1100'. [ 420.680002][ T5913] usb 2-1: config 0 interface 29 has no altsetting 0 [ 420.803615][ T9772] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1099'. [ 420.825143][ T9772] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1099'. [ 420.834149][ T9772] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1099'. [ 420.843449][ T9772] netlink: 'syz.0.1099': attribute type 14 has an invalid length. [ 420.851360][ T9772] netlink: 'syz.0.1099': attribute type 13 has an invalid length. [ 421.120284][ T5913] usb 2-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 421.131769][ T5913] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.177798][ T5913] usb 2-1: Product: syz [ 421.186329][ T5913] usb 2-1: Manufacturer: syz [ 421.202070][ T5913] usb 2-1: SerialNumber: syz [ 421.417704][ T5913] usb 2-1: config 0 descriptor?? [ 421.636623][ T9766] trusted_key: encrypted_key: hex blob is missing [ 421.646348][ T5913] peak_usb 2-1:0.29: PEAK-System PCAN-USB X6 v0 fw v0.0.0 (2 channels) [ 421.862228][ T5913] peak_usb 2-1:0.29 can0: sending command failure: -22 [ 421.869888][ T5913] peak_usb 2-1:0.29 can0: sending command failure: -22 [ 421.883596][ T5913] peak_usb 2-1:0.29 can0: sending command failure: -22 [ 422.023105][ T5913] peak_usb 2-1:0.29: probe with driver peak_usb failed with error -22 [ 422.332596][ T24] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 422.526325][ T24] usb 3-1: config 0 has no interfaces? [ 422.538657][ T24] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 422.548085][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.590630][ T24] usb 3-1: Product: syz [ 422.614294][ T24] usb 3-1: Manufacturer: syz [ 422.625753][ T24] usb 3-1: SerialNumber: syz [ 422.647186][ T24] usb 3-1: config 0 descriptor?? [ 422.766150][ T9798] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1107'. [ 422.813592][ T9798] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1107'. [ 423.311267][ T49] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 423.541675][ T49] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 423.551106][ T49] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.579601][ T49] usb 5-1: config 0 descriptor?? [ 423.620282][ T49] cp210x 5-1:0.0: cp210x converter detected [ 423.706922][ T5913] usb 2-1: USB disconnect, device number 49 [ 424.023054][ T49] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 424.056702][ T49] cp210x 5-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 424.120082][ T49] cp210x 5-1:0.0: GPIO initialisation failed: -71 [ 424.149369][ T49] usb 5-1: cp210x converter now attached to ttyUSB0 [ 424.169464][ T49] usb 5-1: USB disconnect, device number 54 [ 424.197688][ T49] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 424.310427][ T49] cp210x 5-1:0.0: device disconnected [ 424.736556][ T9814] netlink: 'syz.1.1112': attribute type 20 has an invalid length. [ 425.956186][ T10] usb 3-1: USB disconnect, device number 51 [ 426.032969][ T9827] tipc: Enabling of bearer rejected, already enabled [ 426.354294][ T9840] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1119'. [ 426.385227][ T9840] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1119'. [ 428.056864][ T9867] FAULT_INJECTION: forcing a failure. [ 428.056864][ T9867] name failslab, interval 1, probability 0, space 0, times 0 [ 428.069900][ T9867] CPU: 0 UID: 0 PID: 9867 Comm: syz.0.1128 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 428.069924][ T9867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 428.069934][ T9867] Call Trace: [ 428.069942][ T9867] [ 428.069948][ T9867] dump_stack_lvl+0x189/0x250 [ 428.069977][ T9867] ? __pfx_dump_stack_lvl+0x10/0x10 [ 428.069998][ T9867] ? __pfx__printk+0x10/0x10 [ 428.070015][ T9867] ? trace_fib_table_lookup+0x85/0x200 [ 428.070035][ T9867] ? fib_table_lookup+0x11ba/0x16e0 [ 428.070054][ T9867] should_fail_ex+0x414/0x560 [ 428.070074][ T9867] should_failslab+0xa8/0x100 [ 428.070098][ T9867] kmem_cache_alloc_noprof+0x73/0x3c0 [ 428.070117][ T9867] ? dst_alloc+0x105/0x170 [ 428.070138][ T9867] ? fib_lookup+0x76/0x440 [ 428.070159][ T9867] dst_alloc+0x105/0x170 [ 428.070183][ T9867] ip_route_input_rcu+0x1ed5/0x2ff0 [ 428.070213][ T9867] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 428.070234][ T9867] ? __local_bh_enable_ip+0x12d/0x1c0 [ 428.070263][ T9867] ? ipt_do_table+0x13dd/0x1610 [ 428.070282][ T9867] ? ip_route_input_noref+0x98/0x250 [ 428.070303][ T9867] ip_route_input_noref+0x167/0x250 [ 428.070326][ T9867] ? __pfx_ip_route_input_noref+0x10/0x10 [ 428.070351][ T9867] ? ipt_do_table+0x2a3/0x1610 [ 428.070366][ T9867] ? __pfx_ipt_do_table+0x10/0x10 [ 428.070383][ T9867] ip_rcv_finish_core+0x5af/0x1c00 [ 428.070408][ T9867] ip_rcv_finish+0x14c/0x2f0 [ 428.070426][ T9867] NF_HOOK+0x309/0x3a0 [ 428.070442][ T9867] ? __pfx_ip_rcv_finish+0x10/0x10 [ 428.070457][ T9867] ? NF_HOOK+0x9a/0x3a0 [ 428.070470][ T9867] ? __pfx_NF_HOOK+0x10/0x10 [ 428.070483][ T9867] ? ip_rcv_core+0x7f7/0xd00 [ 428.070500][ T9867] ? __pfx_ip_rcv_finish+0x10/0x10 [ 428.070522][ T9867] ? __pfx_ip_rcv+0x10/0x10 [ 428.070535][ T9867] __netif_receive_skb+0x143/0x380 [ 428.070555][ T9867] ? netif_receive_skb+0x115/0x790 [ 428.070569][ T9867] netif_receive_skb+0x1cb/0x790 [ 428.070583][ T9867] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 428.070597][ T9867] ? __pfx_netif_receive_skb+0x10/0x10 [ 428.070616][ T9867] ? tun_rx_batched+0x160/0x730 [ 428.070639][ T9867] tun_rx_batched+0x1b9/0x730 [ 428.070665][ T9867] ? __pfx_tun_rx_batched+0x10/0x10 [ 428.070690][ T9867] ? tun_get_user+0x2444/0x3c20 [ 428.070716][ T9867] ? tun_get_user+0x2444/0x3c20 [ 428.070738][ T9867] ? tun_get_user+0x2444/0x3c20 [ 428.070758][ T9867] tun_get_user+0x2879/0x3c20 [ 428.070782][ T9867] ? tun_get_user+0x687/0x3c20 [ 428.070814][ T9867] ? __pfx_tun_get_user+0x10/0x10 [ 428.070836][ T9867] ? aa_file_perm+0x3e7/0xed0 [ 428.070864][ T9867] ? ref_tracker_alloc+0x318/0x460 [ 428.070882][ T9867] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 428.070907][ T9867] ? tun_get+0x1c/0x2f0 [ 428.070933][ T9867] ? tun_get+0x1c/0x2f0 [ 428.070953][ T9867] ? tun_get+0x1c/0x2f0 [ 428.070977][ T9867] tun_chr_write_iter+0x113/0x200 [ 428.071001][ T9867] vfs_write+0x548/0xa90 [ 428.071022][ T9867] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 428.071044][ T9867] ? __pfx_vfs_write+0x10/0x10 [ 428.071068][ T9867] ? __fget_files+0x2a/0x420 [ 428.071095][ T9867] ksys_write+0x145/0x250 [ 428.071114][ T9867] ? __pfx_ksys_write+0x10/0x10 [ 428.071134][ T9867] ? do_syscall_64+0xba/0x210 [ 428.071156][ T9867] do_syscall_64+0xf6/0x210 [ 428.071176][ T9867] ? clear_bhb_loop+0x60/0xb0 [ 428.071194][ T9867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.071210][ T9867] RIP: 0033:0x7f0d4178d41f [ 428.071225][ T9867] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 428.071237][ T9867] RSP: 002b:00007f0d42558000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 428.071252][ T9867] RAX: ffffffffffffffda RBX: 00007f0d419b5fa0 RCX: 00007f0d4178d41f [ 428.071263][ T9867] RDX: 000000000000004e RSI: 0000200000000240 RDI: 00000000000000c8 [ 428.071272][ T9867] RBP: 00007f0d42558090 R08: 0000000000000000 R09: 0000000000000000 [ 428.071281][ T9867] R10: 000000000000004e R11: 0000000000000293 R12: 0000000000000001 [ 428.071289][ T9867] R13: 0000000000000001 R14: 00007f0d419b5fa0 R15: 00007f0d41adfa28 [ 428.071310][ T9867] [ 428.841716][ T9875] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1131'. [ 428.850770][ T9875] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1131'. [ 428.859867][ T9875] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1131'. [ 429.544752][ T9893] ptrace attach of "./syz-executor exec"[5850] was attempted by "./syz-executor exec"[9893] [ 429.575240][ T9893] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1130'. [ 429.799751][ T10] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 429.855669][ T9897] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.1138'. [ 430.018164][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 430.045065][ T10] usb 2-1: config 0 has an invalid interface number: 194 but max is 0 [ 430.281472][ T10] usb 2-1: config 0 has no interface number 0 [ 430.328099][ T10] usb 2-1: New USB device found, idVendor=0a2c, idProduct=0008, bcdDevice=b4.25 [ 430.347281][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.480384][ T10] usb 2-1: Product: syz [ 430.561904][ T10] usb 2-1: Manufacturer: syz [ 430.582914][ T10] usb 2-1: SerialNumber: syz [ 430.611161][ T10] usb 2-1: config 0 descriptor?? [ 430.636285][ T10] cypress_cy7c63 2-1:0.194: Cypress CY7C63xxx device now attached [ 432.492117][ T9913] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1142'. [ 432.531905][ T9913] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1142'. [ 432.588125][ T9913] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1142'. [ 432.652009][ T9923] FAULT_INJECTION: forcing a failure. [ 432.652009][ T9923] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 432.789798][ T9923] CPU: 1 UID: 0 PID: 9923 Comm: syz.3.1145 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 432.789821][ T9923] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 432.789830][ T9923] Call Trace: [ 432.789836][ T9923] [ 432.789842][ T9923] dump_stack_lvl+0x189/0x250 [ 432.789868][ T9923] ? __lock_acquire+0xaac/0xd20 [ 432.789891][ T9923] ? __pfx_dump_stack_lvl+0x10/0x10 [ 432.789911][ T9923] ? __pfx__printk+0x10/0x10 [ 432.789925][ T9923] ? __might_fault+0xb0/0x130 [ 432.789952][ T9923] should_fail_ex+0x414/0x560 [ 432.789970][ T9923] _copy_from_user+0x2d/0xb0 [ 432.789992][ T9923] snd_seq_oss_write+0x382/0x930 [ 432.790019][ T9923] ? __pfx_snd_seq_oss_write+0x10/0x10 [ 432.790035][ T9923] ? common_file_perm+0x199/0x200 [ 432.790055][ T9923] ? security_file_permission+0x75/0x290 [ 432.790081][ T9923] odev_write+0x5a/0x80 [ 432.790104][ T9923] vfs_writev+0x4a5/0x9a0 [ 432.790124][ T9923] ? vfs_write+0x8d8/0xa90 [ 432.790139][ T9923] ? __pfx_odev_write+0x10/0x10 [ 432.790164][ T9923] ? __pfx_vfs_writev+0x10/0x10 [ 432.790195][ T9923] ? __fget_files+0x2a/0x420 [ 432.790217][ T9923] ? __fget_files+0x3a0/0x420 [ 432.790234][ T9923] ? __fget_files+0x2a/0x420 [ 432.790263][ T9923] __x64_sys_pwritev+0x197/0x2a0 [ 432.790281][ T9923] ? rcu_is_watching+0x15/0xb0 [ 432.790296][ T9923] ? __pfx___x64_sys_pwritev+0x10/0x10 [ 432.790318][ T9923] ? do_syscall_64+0xba/0x210 [ 432.790340][ T9923] do_syscall_64+0xf6/0x210 [ 432.790360][ T9923] ? clear_bhb_loop+0x60/0xb0 [ 432.790377][ T9923] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.790391][ T9923] RIP: 0033:0x7f2272b8e969 [ 432.790404][ T9923] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 432.790416][ T9923] RSP: 002b:00007f2273aac038 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 432.790431][ T9923] RAX: ffffffffffffffda RBX: 00007f2272db5fa0 RCX: 00007f2272b8e969 [ 432.790442][ T9923] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000003 [ 432.790451][ T9923] RBP: 00007f2273aac090 R08: 0000000000000001 R09: 0000000000000000 [ 432.790460][ T9923] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 432.790468][ T9923] R13: 0000000000000000 R14: 00007f2272db5fa0 R15: 00007f2272edfa28 [ 432.790489][ T9923] [ 433.440225][ T24] usb 2-1: USB disconnect, device number 50 [ 433.476589][ T24] cypress_cy7c63 2-1:0.194: Cypress CY7C63xxx device now disconnected [ 434.029804][ T24] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 434.090675][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.100100][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.240219][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.261646][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 434.285251][ T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 434.299863][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.332832][ T24] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 434.350017][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.361256][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.369116][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.377337][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.384986][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.387115][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.418108][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.443220][ T24] usb 2-1: config 0 descriptor?? [ 434.451779][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.467767][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.492333][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.513346][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.528458][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.581665][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.600664][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.617193][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.658266][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.677755][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.723228][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.746574][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.764725][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.775260][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaabe0 returned -22 [ 434.785394][ T9946] binder: 9945:9946 ioctl 4020ae46 7f2273aaa8e0 returned -22 [ 435.744091][ T9958] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.756079][ T9958] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.839237][ T9959] ptrace attach of "./syz-executor exec"[5847] was attempted by "./syz-executor exec"[9959] [ 435.932066][ T9959] netlink: 88 bytes leftover after parsing attributes in process `syz.4.1153'. [ 436.341821][ T30] audit: type=1800 audit(1747131282.337:519): pid=9967 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1156" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=8709 res=0 errno=0 [ 436.609442][ T24] usbhid 2-1:0.0: can't add hid device: -71 [ 436.621796][ T24] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 436.669059][ T24] usb 2-1: USB disconnect, device number 51 [ 436.803376][ T9972] xt_cgroup: invalid path, errno=-2 [ 437.155413][ T9983] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1160'. [ 437.715882][ T9987] netlink: 9 bytes leftover after parsing attributes in process `syz.2.1162'. [ 437.768357][ T9990] netlink: 5 bytes leftover after parsing attributes in process `syz.2.1162'. [ 437.861024][ T9987] gretap0: entered promiscuous mode [ 437.873791][ T9990] 0XD: renamed from gretap0 [ 437.961773][ T9990] 0XD: left promiscuous mode [ 438.009481][ T9990] 0XD: entered allmulticast mode [ 438.056113][ T9990] A link change request failed with some changes committed already. Interface 30XD may have been left with an inconsistent configuration, please check. [ 438.209866][ T10] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 438.353609][T10000] macsec0: entered promiscuous mode [ 438.359069][T10000] macsec0: entered allmulticast mode [ 438.370542][T10000] veth1_macvtap: entered allmulticast mode [ 438.457458][ T9990] bridge_slave_0: left allmulticast mode [ 438.463555][ T9990] bridge_slave_0: left promiscuous mode [ 438.469450][ T9990] bridge0: port 1(bridge_slave_0) entered disabled state [ 438.493440][ T10] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 438.525626][ T10] usb 4-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 438.557806][ T9990] bridge_slave_1: left allmulticast mode [ 438.575645][ T9990] bridge_slave_1: left promiscuous mode [ 438.582013][ T10] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 438.590125][ T9990] bridge0: port 2(bridge_slave_1) entered disabled state [ 438.666401][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.688852][ T9990] bond0: (slave bond_slave_0): Releasing backup interface [ 438.707041][ T9990] bond0: (slave bond_slave_1): Releasing backup interface [ 438.913885][ T9990] team0: Port device team_slave_0 removed [ 439.114109][T10009] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 439.772089][ T9997] netlink: 'syz.3.1164': attribute type 10 has an invalid length. [ 439.803616][ T9990] team0: Port device team_slave_1 removed [ 439.811424][ T9990] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 439.826054][ T9990] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 439.838636][ T9990] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 440.107901][ T9997] team0: Device veth1_macvtap failed to register rx_handler [ 440.123618][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.130854][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.978989][ T10] usb 4-1: USB disconnect, device number 64 [ 442.449094][T10048] ptrace attach of "./syz-executor exec"[5837] was attempted by "./syz-executor exec"[10048] [ 442.466821][T10048] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1175'. [ 442.720473][T10052] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 443.019880][ T10] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 443.071555][T10056] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1182'. [ 443.161856][T10056] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1182'. [ 443.179753][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 443.189279][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 443.245246][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 443.255361][ T10] usb 3-1: New USB device found, idVendor=1e71, idProduct=170e, bcdDevice= 0.00 [ 443.268700][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.297973][ T10] usb 3-1: config 0 descriptor?? [ 443.779805][ T10] usbhid 3-1:0.0: can't add hid device: -71 [ 443.789970][ T10] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 443.867947][ T10] usb 3-1: USB disconnect, device number 52 [ 444.337938][T10072] tipc: Failed to remove unknown binding: 66,1,1/2130706433:3654831833/3654831835 [ 444.349786][T10072] tipc: Failed to remove unknown binding: 66,1,1/2130706433:3654831833/3654831835 [ 444.384745][T10077] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1190'. [ 445.645774][T10091] tipc: Failed to remove unknown binding: 66,1,1/523894784:3892098750/3892098752 [ 445.692783][T10091] tipc: Failed to remove unknown binding: 66,1,1/523894784:3892098750/3892098752 [ 447.021946][T10108] netlink: ct family unspecified [ 447.027159][T10108] openvswitch: netlink: Actions may not be safe on all matching packets [ 447.307687][T10112] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 448.432503][T10124] netlink: 'syz.0.1201': attribute type 4 has an invalid length. [ 448.440579][T10124] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1201'. [ 448.480372][T10124] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 448.780617][T10116] ptrace attach of "./syz-executor exec"[5847] was attempted by "./syz-executor exec"[10116] [ 448.816852][ T5880] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 448.833879][T10116] netlink: 88 bytes leftover after parsing attributes in process `syz.4.1200'. [ 449.011039][ T5880] usb 1-1: device descriptor read/64, error -71 [ 449.127647][ T49] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 449.310077][ T5880] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 449.376147][ T49] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 449.439534][ T49] usb 3-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 449.496304][ T5880] usb 1-1: device descriptor read/64, error -71 [ 449.537732][ T49] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 449.579832][ T49] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.636824][ T5880] usb usb1-port1: attempt power cycle [ 449.712784][ T49] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 449.937609][T10131] delete_channel: no stack [ 449.989740][ T5880] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 449.998662][ T49] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 450.028420][ T49] usb 3-1: USB disconnect, device number 53 [ 450.037766][ T5880] usb 1-1: device descriptor read/8, error -71 [ 450.364345][ T5880] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 450.432281][ T5880] usb 1-1: device descriptor read/8, error -71 [ 450.550229][ T5880] usb usb1-port1: unable to enumerate USB device [ 450.739696][ T49] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 451.077786][ T49] usb 4-1: config index 0 descriptor too short (expected 65405, got 72) [ 451.126207][ T49] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 451.194712][ T49] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.207559][ T49] usb 4-1: Product: syz [ 451.211884][ T49] usb 4-1: Manufacturer: syz [ 451.216562][ T49] usb 4-1: SerialNumber: syz [ 451.245965][ T49] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 451.330421][ T5821] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 451.348663][ T5880] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 451.491626][T10124] delete_channel: no stack [ 451.526149][ T5821] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 451.540195][ T5821] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.566789][ T5821] usb 5-1: config 0 descriptor?? [ 451.575349][T10156] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 451.610175][T10156] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 451.654526][T10156] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 451.682849][T10156] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 451.741618][ T5821] usb 4-1: USB disconnect, device number 65 [ 451.876325][ T49] usb 5-1: USB disconnect, device number 55 [ 452.005388][T10171] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 452.371791][ T30] audit: type=1326 audit(1747131298.367:520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10177 comm="syz.2.1218" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 452.400422][ T9] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 452.480856][ T5880] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 452.511024][ T5880] ath9k_htc: Failed to initialize the device [ 452.519781][ T30] audit: type=1326 audit(1747131298.397:521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10177 comm="syz.2.1218" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 452.560873][ T5821] usb 4-1: ath9k_htc: USB layer deinitialized [ 452.570201][ T30] audit: type=1326 audit(1747131298.407:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10177 comm="syz.2.1218" exe="/root/syz-executor" sig=0 arch=c000003e syscall=323 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 452.607497][ T9] usb 2-1: config 0 has no interfaces? [ 452.637594][ T30] audit: type=1326 audit(1747131298.407:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10177 comm="syz.2.1218" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 452.679282][ T30] audit: type=1326 audit(1747131298.407:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10177 comm="syz.2.1218" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 452.702100][ T49] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 452.711449][ T5882] usb 5-1: new low-speed USB device number 56 using dummy_hcd [ 452.726091][ T30] audit: type=1326 audit(1747131298.407:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10177 comm="syz.2.1218" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 452.758239][ T30] audit: type=1326 audit(1747131298.417:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10177 comm="syz.2.1218" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 452.790329][ T9] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 452.793134][ T30] audit: type=1326 audit(1747131298.417:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10177 comm="syz.2.1218" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 452.799406][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.799431][ T9] usb 2-1: Product: syz [ 452.799448][ T9] usb 2-1: Manufacturer: syz [ 452.826863][ T30] audit: type=1326 audit(1747131298.417:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10177 comm="syz.2.1218" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 452.862021][ T49] usb 3-1: device descriptor read/64, error -71 [ 452.871482][ T30] audit: type=1326 audit(1747131298.417:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10177 comm="syz.2.1218" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f399798e969 code=0x7ffc0000 [ 452.895015][ T5882] usb 5-1: device descriptor read/64, error -71 [ 452.969828][ T9] usb 2-1: SerialNumber: syz [ 452.999081][ T9] usb 2-1: config 0 descriptor?? [ 453.099901][ T49] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 453.139771][ T5882] usb 5-1: new low-speed USB device number 57 using dummy_hcd [ 453.266177][ T49] usb 3-1: device descriptor read/64, error -71 [ 453.274133][ T5882] usb 5-1: device descriptor read/64, error -71 [ 453.380087][ T49] usb usb3-port1: attempt power cycle [ 453.527414][ T5882] usb usb5-port1: attempt power cycle [ 453.645605][T10190] ptrace attach of "./syz-executor exec"[5850] was attempted by "./syz-executor exec"[10190] [ 453.668517][T10190] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1220'. [ 453.869809][ T49] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 453.893159][ T49] usb 3-1: device descriptor read/8, error -71 [ 453.949814][ T5882] usb 5-1: new low-speed USB device number 58 using dummy_hcd [ 453.975329][ T5882] usb 5-1: device descriptor read/8, error -71 [ 454.190810][ T49] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 454.220274][ T5882] usb 5-1: new low-speed USB device number 59 using dummy_hcd [ 454.231451][ T49] usb 3-1: device descriptor read/8, error -71 [ 454.253675][ T5882] usb 5-1: device descriptor read/8, error -71 [ 454.341484][ T49] usb usb3-port1: unable to enumerate USB device [ 454.370844][ T5882] usb usb5-port1: unable to enumerate USB device [ 454.412522][ T5880] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 454.587396][ T5880] usb 1-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 454.596729][ T5880] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 454.618471][ T5880] usb 1-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice= 0.9c [ 454.628261][ T5880] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.642908][ T5880] usb 1-1: Product: syz [ 454.655806][ T5880] usb 1-1: Manufacturer: syz [ 454.668562][ T5880] usb 1-1: SerialNumber: syz [ 454.696339][ T5880] usb 1-1: config 0 descriptor?? [ 454.706198][ T5880] ims_pcu 1-1:0.0: Missing CDC union descriptor [ 454.716128][ T5880] ims_pcu 1-1:0.0: probe with driver ims_pcu failed with error -22 [ 454.921482][ T5880] usb 1-1: USB disconnect, device number 50 [ 455.159743][ T5913] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 455.319870][ T5913] usb 4-1: Using ep0 maxpacket: 8 [ 455.387476][ T5913] usb 4-1: New USB device found, idVendor=04b4, idProduct=8613, bcdDevice=95.8f [ 455.397077][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 455.407216][ T5913] usb 4-1: Product: syz [ 455.411634][ T5913] usb 4-1: Manufacturer: syz [ 455.416437][ T5913] usb 4-1: SerialNumber: syz [ 455.429831][ T5913] usb 4-1: config 0 descriptor?? [ 455.531238][ T5913] usbtest 4-1:0.0: FX2 device [ 455.536877][ T5913] usbtest 4-1:0.0: high-speed {control bulk-in bulk-out} tests (+alt) [ 455.640719][T10204] netlink: 'syz.0.1223': attribute type 4 has an invalid length. [ 455.655351][T10204] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1223'. [ 455.697038][T10203] bridge0: port 1(vlan2) entered blocking state [ 455.767939][T10203] bridge0: port 1(vlan2) entered disabled state [ 455.783489][T10203] vlan2: entered allmulticast mode [ 455.805709][T10203] bond0: entered allmulticast mode [ 455.856241][T10203] vlan2: entered promiscuous mode [ 455.867704][ T5882] usb 2-1: USB disconnect, device number 52 [ 455.903718][T10203] bond0: entered promiscuous mode [ 455.960758][ T5913] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 455.979443][T10204] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 456.129899][ T5913] usb 1-1: device descriptor read/64, error -71 [ 456.379852][ T5913] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 456.449727][ T5882] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 456.511642][ T5913] usb 1-1: device descriptor read/64, error -71 [ 456.787197][ T5913] usb usb1-port1: attempt power cycle [ 456.798585][ T5882] usb 2-1: config 0 has an invalid interface number: 141 but max is 0 [ 456.807206][ T5882] usb 2-1: config 0 has no interface number 0 [ 456.816730][ T5882] usb 2-1: New USB device found, idVendor=2040, idProduct=7270, bcdDevice=e8.b2 [ 456.829956][ T5882] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.842549][ T5882] usb 2-1: Product: syz [ 456.851611][ T5882] usb 2-1: Manufacturer: syz [ 456.860797][ T5882] usb 2-1: SerialNumber: syz [ 456.907261][ T5882] usb 2-1: config 0 descriptor?? [ 457.121551][T10214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 457.130505][T10214] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 457.141074][T10214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 457.155993][T10214] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 457.170561][ T5913] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 457.203420][ T5913] usb 1-1: device descriptor read/8, error -71 [ 457.210644][T10221] capability: warning: `syz.4.1228' uses 32-bit capabilities (legacy support in use) [ 457.480056][ T5913] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 457.500469][ T5913] usb 1-1: device descriptor read/8, error -71 [ 457.609741][ T9] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 457.618393][ T5913] usb usb1-port1: unable to enumerate USB device [ 457.806686][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 457.817841][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 458.109694][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 458.123117][ T9] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 458.132640][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 458.145309][ T9] usb 5-1: config 0 descriptor?? [ 458.207511][T10233] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 458.538744][ T10] usb 4-1: USB disconnect, device number 66 [ 458.562018][T10224] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1229'. [ 458.697971][T10204] delete_channel: no stack [ 458.786160][ T9] plantronics 0003:047F:FFFF.0005: reserved main item tag 0xe [ 458.809843][ T9] plantronics 0003:047F:FFFF.0005: item fetching failed at offset 14/15 [ 458.874702][ T9] plantronics 0003:047F:FFFF.0005: parse failed [ 458.919783][ T9] plantronics 0003:047F:FFFF.0005: probe with driver plantronics failed with error -22 [ 458.941984][T10241] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1233'. [ 459.070889][T10243] fuse: Bad value for 'fd' [ 459.097249][ T9] usb 2-1: USB disconnect, device number 53 [ 459.464647][T10252] ptrace attach of "./syz-executor exec"[5837] was attempted by "./syz-executor exec"[10252] [ 459.534762][T10256] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1232'. [ 459.586647][ T9] usb 5-1: USB disconnect, device number 60 [ 459.754439][T10261] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1237'. [ 459.778399][T10261] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1237'. [ 459.939775][ T5882] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 460.120496][ T49] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 460.160975][ T5882] usb 3-1: config 0 has no interfaces? [ 460.222564][ T5882] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 460.231725][ T5882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.272040][ T5882] usb 3-1: Product: syz [ 460.283288][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 460.294409][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 460.313870][ T5882] usb 3-1: Manufacturer: syz [ 460.334144][ T5882] usb 3-1: SerialNumber: syz [ 460.346364][ T49] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 460.380516][ T5882] usb 3-1: config 0 descriptor?? [ 460.406059][ T49] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 460.475669][ T49] usb 2-1: config 0 descriptor?? [ 461.065129][T10280] netlink: 'syz.4.1242': attribute type 4 has an invalid length. [ 461.080860][T10280] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1242'. [ 461.394769][T10286] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1245'. [ 461.480229][ T9] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 461.628338][T10291] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1245'. [ 461.637823][ T9] usb 5-1: device descriptor read/64, error -71 [ 461.889763][ T9] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 461.979779][ T5913] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 462.029793][ T9] usb 5-1: device descriptor read/64, error -71 [ 462.253598][ T9] usb usb5-port1: attempt power cycle [ 462.269772][ T5913] usb 4-1: Using ep0 maxpacket: 16 [ 462.345917][ T5913] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 462.364980][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.418787][ T5913] usb 4-1: Product: syz [ 462.443606][ T5913] usb 4-1: Manufacturer: syz [ 462.521503][ T5913] usb 4-1: SerialNumber: syz [ 462.613577][ T9] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 462.671616][ T5913] usb 4-1: config 0 descriptor?? [ 462.730610][ T9] usb 5-1: device descriptor read/8, error -71 [ 462.737274][ T5913] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 462.861082][ T5821] usb 3-1: USB disconnect, device number 58 [ 462.891737][ T5913] usb 4-1: Detected FT-X [ 463.007387][ T9] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 463.070265][ T9] usb 5-1: device descriptor read/8, error -71 [ 463.102235][T10287] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 463.113839][T10287] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 463.261261][ T9] usb usb5-port1: unable to enumerate USB device [ 463.281820][T10301] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1247'. [ 463.296710][ T49] usbhid 2-1:0.0: can't add hid device: -71 [ 463.303514][ T49] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 463.366640][ T49] usb 2-1: USB disconnect, device number 54 [ 463.375823][T10301] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1247'. [ 463.930915][T10281] delete_channel: no stack [ 463.965526][ T30] kauditd_printk_skb: 40 callbacks suppressed [ 463.965545][ T30] audit: type=1326 audit(1747131309.967:570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10313 comm="syz.1.1251" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0b1778e969 code=0x0 [ 464.005319][T10319] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1252'. [ 464.213226][T10328] xt_cgroup: invalid path, errno=-2 [ 464.845665][T10338] netdevsim netdevsim2: Direct firmware load for JngkNq>*x(O@ēƙaWfV! _)ADIwC7;gB|hV`f?:VmUWX:SZ;˩6h?Aeim/S6_C?F failed with error -2 [ 464.884117][ T5913] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 464.913017][ T5913] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 464.931770][ T5913] ftdi_sio 4-1:0.0: GPIO initialisation failed: -71 [ 465.010143][T10338] netdevsim netdevsim2: Falling back to sysfs fallback for: JngkNq>*x(O@ēƙaWfV! _)ADIwC7;gB|hV`f?:VmUWX:SZ;˩6h?Aeim/S6_C?F [ 465.050504][ T5913] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 465.109244][ T5913] usb 4-1: USB disconnect, device number 67 [ 465.137103][ T5913] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 465.148060][ T5913] ftdi_sio 4-1:0.0: device disconnected [ 465.149900][ T5821] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 465.365694][ T5821] usb 2-1: config 0 has no interfaces? [ 465.380029][ T5821] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 465.389417][ T5821] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.398034][ T5821] usb 2-1: Product: syz [ 465.433199][ T5821] usb 2-1: Manufacturer: syz [ 465.468283][ T5821] usb 2-1: SerialNumber: syz [ 465.490302][ T5821] usb 2-1: config 0 descriptor?? [ 465.669855][ T5913] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 465.692955][ T9] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 465.696142][T10351] ptrace attach of "./syz-executor exec"[5847] was attempted by "./syz-executor exec"[10351] [ 465.779380][T10351] netlink: 88 bytes leftover after parsing attributes in process `syz.4.1255'. [ 465.938963][ T5913] usb 4-1: Using ep0 maxpacket: 32 [ 465.948056][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 465.958722][ T9] usb 1-1: config 0 has no interfaces? [ 465.971692][ T9] usb 1-1: New USB device found, idVendor=045e, idProduct=02bf, bcdDevice=9e.06 [ 465.971832][ T5913] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 465.993607][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.013469][ T5913] usb 4-1: config 0 has no interface number 0 [ 466.023714][ T9] usb 1-1: config 0 descriptor?? [ 466.028929][ T5913] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 466.054831][ T5913] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 466.067044][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.077246][ T5913] usb 4-1: Product: syz [ 466.087369][ T5913] usb 4-1: Manufacturer: syz [ 466.092245][ T5913] usb 4-1: SerialNumber: syz [ 466.104490][ T5913] usb 4-1: config 0 descriptor?? [ 466.241704][T10347] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 466.260095][T10347] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 466.332543][ T5913] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 466.358448][ T9] usb 1-1: USB disconnect, device number 55 [ 466.379776][ T5913] em28xx 4-1:0.132: Video interface 132 found: [ 466.703994][ T5913] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 466.715762][T10346] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 466.729290][T10346] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 467.055904][T10361] tipc: Enabling of bearer rejected, already enabled [ 467.148948][T10362] netlink: 'syz.0.1265': attribute type 4 has an invalid length. [ 467.157179][T10362] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1265'. [ 467.189699][T10362] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 467.244666][ T5913] em28xx 4-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=0) [ 467.266821][ T5913] em28xx 4-1:0.132: board has no eeprom [ 467.422896][T10367] FAULT_INJECTION: forcing a failure. [ 467.422896][T10367] name failslab, interval 1, probability 0, space 0, times 0 [ 467.439113][T10367] CPU: 1 UID: 0 PID: 10367 Comm: syz.2.1268 Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 467.439143][T10367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 467.439156][T10367] Call Trace: [ 467.439164][T10367] [ 467.439173][T10367] dump_stack_lvl+0x189/0x250 [ 467.439212][T10367] ? __pfx_dump_stack_lvl+0x10/0x10 [ 467.439243][T10367] ? __pfx__printk+0x10/0x10 [ 467.439266][T10367] ? __pfx___might_resched+0x10/0x10 [ 467.439287][T10367] ? fs_reclaim_acquire+0x7d/0x100 [ 467.439325][T10367] should_fail_ex+0x414/0x560 [ 467.439353][T10367] should_failslab+0xa8/0x100 [ 467.439383][T10367] __kmalloc_noprof+0xcb/0x4f0 [ 467.439409][T10367] ? tomoyo_encode+0x28b/0x550 [ 467.439440][T10367] tomoyo_encode+0x28b/0x550 [ 467.439473][T10367] tomoyo_realpath_from_path+0x58d/0x5d0 [ 467.439502][T10367] ? tomoyo_domain+0xda/0x130 [ 467.439535][T10367] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 467.439555][T10367] tomoyo_path_number_perm+0x1e8/0x5a0 [ 467.439578][T10367] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 467.439618][T10367] ? __lock_acquire+0xaac/0xd20 [ 467.439666][T10367] ? __fget_files+0x2a/0x420 [ 467.439700][T10367] ? __fget_files+0x3a0/0x420 [ 467.439726][T10367] ? __fget_files+0x2a/0x420 [ 467.439758][T10367] security_file_ioctl+0xcb/0x2d0 [ 467.439795][T10367] __se_sys_ioctl+0x47/0x170 [ 467.439828][T10367] do_syscall_64+0xf6/0x210 [ 467.439857][T10367] ? clear_bhb_loop+0x60/0xb0 [ 467.439883][T10367] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.439903][T10367] RIP: 0033:0x7f399798e969 [ 467.439921][T10367] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 467.439939][T10367] RSP: 002b:00007f39988a0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 467.439962][T10367] RAX: ffffffffffffffda RBX: 00007f3997bb5fa0 RCX: 00007f399798e969 [ 467.439977][T10367] RDX: 0000200000000380 RSI: 000000000000890b RDI: 0000000000000003 [ 467.439991][T10367] RBP: 00007f39988a0090 R08: 0000000000000000 R09: 0000000000000000 [ 467.440004][T10367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 467.440016][T10367] R13: 0000000000000000 R14: 00007f3997bb5fa0 R15: 00007f3997cdfa28 [ 467.440047][T10367] [ 467.664760][ T9] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 467.698177][T10367] ERROR: Out of memory at tomoyo_realpath_from_path. [ 467.789871][ T5913] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 467.807392][ T9] usb 1-1: device descriptor read/64, error -71 [ 467.827358][ T5913] em28xx 4-1:0.132: analog set to bulk mode. [ 467.836809][ T976] em28xx 4-1:0.132: Registering V4L2 extension [ 468.019852][ T5821] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 468.049869][ T9] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 468.181784][ T5821] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 468.190946][ T5821] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 468.201985][ T5821] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 468.209885][ T9] usb 1-1: device descriptor read/64, error -71 [ 468.228852][ T5821] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 468.259925][ T5821] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 468.284143][ T5821] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 468.293880][ T5821] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 468.341527][ T5821] usb 3-1: Product: syz [ 468.343151][ T9] usb usb1-port1: attempt power cycle [ 468.345973][ T5821] usb 3-1: Manufacturer: syz [ 468.374878][ T5821] cdc_wdm 3-1:1.0: skipping garbage [ 468.380993][ T5821] cdc_wdm 3-1:1.0: skipping garbage [ 468.390081][ T5821] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 468.401225][ T5821] cdc_wdm 3-1:1.0: Unknown control protocol [ 468.506501][ T5821] usb 2-1: USB disconnect, device number 55 [ 468.842065][ T9] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 468.917379][ T9] usb 1-1: device descriptor read/8, error -71 [ 468.924272][ T976] em28xx 4-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 468.938711][ T976] em28xx 4-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 468.951346][ T976] em28xx 4-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 468.960704][ T976] em28xx 4-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 468.993926][ T5821] usb 4-1: USB disconnect, device number 68 [ 469.026422][ T5821] em28xx 4-1:0.132: Disconnecting em28xx [ 469.170199][ T9] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 469.220313][ T9] usb 1-1: device descriptor read/8, error -71 [ 469.486115][ T9] usb usb1-port1: unable to enumerate USB device [ 469.919724][ T49] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 470.089812][ T49] usb 2-1: Using ep0 maxpacket: 8 [ 470.098722][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 470.111843][T10362] delete_channel: no stack [ 470.138588][ T49] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 470.153545][ T49] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 470.153558][ T976] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 470.210205][ T49] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2e22, bcdDevice= 0.00 [ 470.347337][ T976] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 470.363834][ T976] em28xx 4-1:0.132: No AC97 audio processor [ 470.397019][ T976] usb 4-1: Decoder not found [ 470.415752][ T49] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 470.471586][ T49] usb 2-1: config 0 descriptor?? [ 470.506526][ T976] em28xx 4-1:0.132: failed to create media graph [ 470.587781][ T976] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 470.767053][T10409] ================================================================== [ 470.775164][T10409] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 470.782550][T10409] Read of size 8 at addr ffff88807b504738 by task v4l_id/10409 [ 470.790121][T10409] [ 470.792448][T10409] CPU: 1 UID: 0 PID: 10409 Comm: v4l_id Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 470.792468][T10409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 470.792477][T10409] Call Trace: [ 470.792485][T10409] [ 470.792492][T10409] dump_stack_lvl+0x189/0x250 [ 470.792516][T10409] ? __virt_addr_valid+0x18c/0x540 [ 470.792538][T10409] ? rcu_is_watching+0x15/0xb0 [ 470.792551][T10409] ? __pfx_dump_stack_lvl+0x10/0x10 [ 470.792572][T10409] ? rcu_is_watching+0x15/0xb0 [ 470.792584][T10409] ? lock_release+0x4b/0x3e0 [ 470.792607][T10409] ? __virt_addr_valid+0x18c/0x540 [ 470.792625][T10409] ? __virt_addr_valid+0x469/0x540 [ 470.792645][T10409] print_report+0xb4/0x290 [ 470.792663][T10409] ? v4l2_fh_open+0xc7/0x430 [ 470.792681][T10409] kasan_report+0x118/0x150 [ 470.792701][T10409] ? v4l2_fh_open+0xc7/0x430 [ 470.792721][T10409] v4l2_fh_open+0xc7/0x430 [ 470.792739][T10409] ? __pfx___mutex_lock+0x10/0x10 [ 470.792760][T10409] em28xx_v4l2_open+0x157/0x9a0 [ 470.792782][T10409] v4l2_open+0x20f/0x360 [ 470.792804][T10409] chrdev_open+0x4cc/0x5e0 [ 470.792832][T10409] ? __pfx_chrdev_open+0x10/0x10 [ 470.792864][T10409] ? __pfx_chrdev_open+0x10/0x10 [ 470.792891][T10409] do_dentry_open+0xdf3/0x1970 [ 470.792926][T10409] vfs_open+0x3b/0x340 [ 470.792951][T10409] ? path_openat+0x2ecd/0x3830 [ 470.792967][T10409] path_openat+0x2ee5/0x3830 [ 470.792980][T10409] ? arch_stack_walk+0xfc/0x150 [ 470.793011][T10409] ? __pfx_path_openat+0x10/0x10 [ 470.793025][T10409] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.793046][T10409] do_filp_open+0x1fa/0x410 [ 470.793062][T10409] ? __pfx_do_filp_open+0x10/0x10 [ 470.793084][T10409] ? _raw_spin_unlock+0x28/0x50 [ 470.793098][T10409] ? alloc_fd+0x64c/0x6c0 [ 470.793121][T10409] do_sys_openat2+0x121/0x1c0 [ 470.793134][T10409] ? __pfx_do_sys_openat2+0x10/0x10 [ 470.793147][T10409] ? exc_page_fault+0x68/0x110 [ 470.793166][T10409] ? do_user_addr_fault+0xc8a/0x1390 [ 470.793182][T10409] __x64_sys_openat+0x138/0x170 [ 470.793197][T10409] do_syscall_64+0xf6/0x210 [ 470.793236][T10409] ? clear_bhb_loop+0x60/0xb0 [ 470.793252][T10409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.793267][T10409] RIP: 0033:0x7fa2b40a7407 [ 470.793281][T10409] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 470.793300][T10409] RSP: 002b:00007fff36a49640 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 470.793317][T10409] RAX: ffffffffffffffda RBX: 00007fa2b476a880 RCX: 00007fa2b40a7407 [ 470.793329][T10409] RDX: 0000000000000000 RSI: 00007fff36a49f1c RDI: ffffffffffffff9c [ 470.793339][T10409] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 470.793348][T10409] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 470.793358][T10409] R13: 00007fff36a49890 R14: 00007fa2b48d1000 R15: 000055759541e4d8 [ 470.793387][T10409] [ 470.793392][T10409] [ 471.081103][T10409] Allocated by task 976: [ 471.085343][T10409] kasan_save_track+0x3e/0x80 [ 471.090029][T10409] __kasan_kmalloc+0x93/0xb0 [ 471.094630][T10409] __kmalloc_cache_noprof+0x230/0x3d0 [ 471.100012][T10409] em28xx_v4l2_init+0x10b/0x2e70 [ 471.104954][T10409] em28xx_init_extension+0x11d/0x1c0 [ 471.110243][T10409] process_scheduled_works+0xade/0x17a0 [ 471.115785][T10409] worker_thread+0x8a0/0xda0 [ 471.120377][T10409] kthread+0x711/0x8a0 [ 471.124463][T10409] ret_from_fork+0x4b/0x80 [ 471.128880][T10409] ret_from_fork_asm+0x1a/0x30 [ 471.133644][T10409] [ 471.135963][T10409] Freed by task 976: [ 471.139853][T10409] kasan_save_track+0x3e/0x80 [ 471.144532][T10409] kasan_save_free_info+0x46/0x50 [ 471.149574][T10409] __kasan_slab_free+0x62/0x70 [ 471.154354][T10409] kfree+0x193/0x440 [ 471.158257][T10409] em28xx_v4l2_init+0x1683/0x2e70 [ 471.163291][T10409] em28xx_init_extension+0x11d/0x1c0 [ 471.168579][T10409] process_scheduled_works+0xade/0x17a0 [ 471.174126][T10409] worker_thread+0x8a0/0xda0 [ 471.178720][T10409] kthread+0x711/0x8a0 [ 471.182795][T10409] ret_from_fork+0x4b/0x80 [ 471.187213][T10409] ret_from_fork_asm+0x1a/0x30 [ 471.191979][T10409] [ 471.194303][T10409] The buggy address belongs to the object at ffff88807b504000 [ 471.194303][T10409] which belongs to the cache kmalloc-8k of size 8192 [ 471.208382][T10409] The buggy address is located 1848 bytes inside of [ 471.208382][T10409] freed 8192-byte region [ffff88807b504000, ffff88807b506000) [ 471.222353][T10409] [ 471.224695][T10409] The buggy address belongs to the physical page: [ 471.231102][T10409] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b500 [ 471.239873][T10409] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 471.248379][T10409] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 471.255940][T10409] page_type: f5(slab) [ 471.259928][T10409] raw: 00fff00000000040 ffff88801a042280 ffffea0001fa0c00 dead000000000002 [ 471.268515][T10409] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 471.277108][T10409] head: 00fff00000000040 ffff88801a042280 ffffea0001fa0c00 dead000000000002 [ 471.285788][T10409] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 471.294462][T10409] head: 00fff00000000003 ffffea0001ed4001 00000000ffffffff 00000000ffffffff [ 471.303140][T10409] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 471.311811][T10409] page dumped because: kasan: bad access detected [ 471.318233][T10409] page_owner tracks the page as allocated [ 471.323947][T10409] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9247, tgid 9246 (syz.3.940), ts 374255359792, free_ts 374039229529 [ 471.345231][T10409] post_alloc_hook+0x1d8/0x230 [ 471.350012][T10409] get_page_from_freelist+0x21ce/0x22b0 [ 471.355584][T10409] __alloc_frozen_pages_noprof+0x181/0x370 [ 471.361405][T10409] alloc_pages_mpol+0x232/0x4a0 [ 471.366287][T10409] allocate_slab+0x8a/0x3b0 [ 471.370792][T10409] ___slab_alloc+0xbfc/0x1480 [ 471.375480][T10409] __kmalloc_cache_noprof+0x296/0x3d0 [ 471.380864][T10409] audit_log_d_path+0xb5/0x190 [ 471.385638][T10409] audit_log_d_path_exe+0x42/0x70 [ 471.390668][T10409] audit_log_task+0x2b3/0x3c0 [ 471.395357][T10409] audit_seccomp+0x86/0x190 [ 471.399891][T10409] __seccomp_filter+0x9aa/0x1a40 [ 471.404853][T10409] syscall_trace_enter+0xaa/0x160 [ 471.409888][T10409] do_syscall_64+0xcf/0x210 [ 471.414416][T10409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.420329][T10409] page last free pid 5189 tgid 5189 stack trace: [ 471.426659][T10409] __free_frozen_pages+0xb0e/0xcd0 [ 471.431789][T10409] __put_partials+0x161/0x1c0 [ 471.436477][T10409] put_cpu_partial+0x17c/0x250 [ 471.441242][T10409] __slab_free+0x2f7/0x400 [ 471.445658][T10409] qlist_free_all+0x9a/0x140 [ 471.450255][T10409] kasan_quarantine_reduce+0x148/0x160 [ 471.455723][T10409] __kasan_slab_alloc+0x22/0x80 [ 471.460587][T10409] kmem_cache_alloc_node_noprof+0x1bb/0x3c0 [ 471.466493][T10409] __alloc_skb+0x112/0x2d0 [ 471.470918][T10409] alloc_skb_with_frags+0xca/0x890 [ 471.476037][T10409] sock_alloc_send_pskb+0x857/0x990 [ 471.481248][T10409] unix_dgram_sendmsg+0x5c2/0x17c0 [ 471.486368][T10409] __sock_sendmsg+0x21c/0x270 [ 471.491051][T10409] __sys_sendto+0x3bd/0x520 [ 471.495563][T10409] __x64_sys_sendto+0xde/0x100 [ 471.500336][T10409] do_syscall_64+0xf6/0x210 [ 471.504857][T10409] [ 471.507186][T10409] Memory state around the buggy address: [ 471.512816][T10409] ffff88807b504600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 471.520881][T10409] ffff88807b504680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 471.528944][T10409] >ffff88807b504700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 471.537002][T10409] ^ [ 471.542891][T10409] ffff88807b504780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 471.550953][T10409] ffff88807b504800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 471.559017][T10409] ================================================================== [ 471.567261][ C1] vkms_vblank_simulate: vblank timer overrun [ 471.576861][ T976] em28xx 4-1:0.132: Remote control support is not available for this card. [ 471.759910][ T5821] em28xx 4-1:0.132: Closing input extension [ 472.060408][ T5880] usb 3-1: USB disconnect, device number 59 [ 472.173272][T10409] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 472.180626][T10409] CPU: 0 UID: 0 PID: 10409 Comm: v4l_id Not tainted 6.15.0-rc6-syzkaller-00047-ge9565e23cd89 #0 PREEMPT(full) [ 472.192367][T10409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 472.202446][T10409] Call Trace: [ 472.205744][T10409] [ 472.208690][T10409] dump_stack_lvl+0x99/0x250 [ 472.213303][T10409] ? __asan_memcpy+0x40/0x70 [ 472.217901][T10409] ? __pfx_dump_stack_lvl+0x10/0x10 [ 472.223116][T10409] ? __pfx__printk+0x10/0x10 [ 472.227723][T10409] panic+0x2db/0x790 [ 472.231649][T10409] ? __pfx_panic+0x10/0x10 [ 472.236112][T10409] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 472.242051][T10409] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 472.248394][T10409] ? print_memory_metadata+0x314/0x400 [ 472.253873][T10409] ? v4l2_fh_open+0xc7/0x430 [ 472.258529][T10409] check_panic_on_warn+0x89/0xb0 [ 472.263487][T10409] ? v4l2_fh_open+0xc7/0x430 [ 472.268104][T10409] end_report+0x78/0x160 [ 472.272379][T10409] kasan_report+0x129/0x150 [ 472.276912][T10409] ? v4l2_fh_open+0xc7/0x430 [ 472.281538][T10409] v4l2_fh_open+0xc7/0x430 [ 472.285985][T10409] ? __pfx___mutex_lock+0x10/0x10 [ 472.291036][T10409] em28xx_v4l2_open+0x157/0x9a0 [ 472.295907][T10409] v4l2_open+0x20f/0x360 [ 472.300170][T10409] chrdev_open+0x4cc/0x5e0 [ 472.304602][T10409] ? __pfx_chrdev_open+0x10/0x10 [ 472.309568][T10409] ? __pfx_chrdev_open+0x10/0x10 [ 472.314516][T10409] do_dentry_open+0xdf3/0x1970 [ 472.319298][T10409] vfs_open+0x3b/0x340 [ 472.323380][T10409] ? path_openat+0x2ecd/0x3830 [ 472.328149][T10409] path_openat+0x2ee5/0x3830 [ 472.332745][T10409] ? arch_stack_walk+0xfc/0x150 [ 472.337622][T10409] ? __pfx_path_openat+0x10/0x10 [ 472.342563][T10409] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.348640][T10409] do_filp_open+0x1fa/0x410 [ 472.353162][T10409] ? __pfx_do_filp_open+0x10/0x10 [ 472.358204][T10409] ? _raw_spin_unlock+0x28/0x50 [ 472.363066][T10409] ? alloc_fd+0x64c/0x6c0 [ 472.367417][T10409] do_sys_openat2+0x121/0x1c0 [ 472.372147][T10409] ? __pfx_do_sys_openat2+0x10/0x10 [ 472.377357][T10409] ? exc_page_fault+0x68/0x110 [ 472.382153][T10409] ? do_user_addr_fault+0xc8a/0x1390 [ 472.387451][T10409] __x64_sys_openat+0x138/0x170 [ 472.392320][T10409] do_syscall_64+0xf6/0x210 [ 472.396848][T10409] ? clear_bhb_loop+0x60/0xb0 [ 472.401546][T10409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.407452][T10409] RIP: 0033:0x7fa2b40a7407 [ 472.411882][T10409] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 472.431513][T10409] RSP: 002b:00007fff36a49640 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 472.439940][T10409] RAX: ffffffffffffffda RBX: 00007fa2b476a880 RCX: 00007fa2b40a7407 [ 472.447932][T10409] RDX: 0000000000000000 RSI: 00007fff36a49f1c RDI: ffffffffffffff9c [ 472.455917][T10409] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 472.463901][T10409] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 472.471883][T10409] R13: 00007fff36a49890 R14: 00007fa2b48d1000 R15: 000055759541e4d8 [ 472.479874][T10409] [ 472.483238][T10409] Kernel Offset: disabled [ 472.487570][T10409] Rebooting in 86400 seconds..