last executing test programs: 5.493577861s ago: executing program 0 (id=2350): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000024002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) openat$sequencer(0xffffffffffffff9c, 0x0, 0x40002, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x2a8100, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = mq_open(&(0x7f00000004c0)='\r\x00elinu\xef\xe3elinux\x00\x96\xf6\x92\n#*\xac\x05\xce\xf8D\\\x9a\xe6[]L+\xf6\v\xe8\xf2\xd3\b\x15\n\xb8F!Q9o\x1f#\xbdt\r\xfb\"\x18%\xfdM\xaf_t\xd2\xdcJ\x10\a\xbab\x1a\xdf\xb1\xbdU\xd7Lo\xe7\xac\x81\x10k\xce-\xf5@\xbb\x9d;\xe8\xf6\xffQ\x04\xaai\x92k\x1b;\xddM\xa2\xe1-\x0e\xd8\xde\x00\xff\x18\xdd\bL\xfb\xa2.\xb6{\xb5\x85#\x88\xdc\xf0\x0f\x05\xf1\xc4 \xdeV\x80q\xf7\x04\xf5\x85T\x1f\xc2S]*\xc9lw\xd3J\xc5\xe8\x02\xcb\xbbAHxr\xac\xb77F\xdf\x1c\xcb\xd4\xce\x88L\xf1\xf9[\x98\xd4+pTx\x95\xb5\x1b]x\x1a\x95\xe1c6\xe7`83\xb7n#\xe0\xc1_\xec\xba\xde\a\x8b\xc5\x86woo\xbc\x1c\xa3r\x82\xf3enq-\x90/\xed\xff\xad+\x03\x10\t\xda\xfd\xa2\xd0\xef4\n%\xf1\xd8', 0x6e93ebbbcc0884f2, 0x0, 0x0) socket(0x2a, 0x2, 0x5) mq_getsetattr(r2, 0x0, 0x0) dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x40010, r0, 0xfd084000) fadvise64(r0, 0x9154, 0x5, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 5.249599328s ago: executing program 0 (id=2351): r0 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e", 0x19}], 0x1}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000005e"], 0xfe33) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_TPR_ACCESS_REPORTING(r3, 0xc028ae92, &(0x7f00000000c0)={0x9}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x46) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2, 0x1, {0xa, 0x4e21, 0x7e, @local, 0x7}}}, 0x32) close_range(r4, 0xffffffffffffffff, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x89801) syz_usb_connect$uac1(0x3, 0xa4, &(0x7f0000000040)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r5, @ANYBLOB="05"], 0x0) 4.199464575s ago: executing program 1 (id=2354): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x9, [0x7, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x24d, 0x2, 0x4a732f64, 0x8, 0x9, 0xc, 0x2, 0x12a0, 0x6, 0xf477, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x4, 0x4, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x2, 0x7fff, 0x5, 0x8, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x3, 0x2, 0x2, 0x3, 0x7, 0x1, 0x7ff, 0x4, 0x40083, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x2, 0x5f, 0x4, 0xc66, 0x80a8a9, 0x73, 0x8e, 0x10001, 0x8000, 0x5, 0x2, 0x9, 0x80000c1, 0x5, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x40400, 0xffff58b9, 0x4c2336d3, 0x4, 0x20000001, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x4, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7faf, 0x35db, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x5, 0xfffffff9, 0x200004, 0x1000, 0xfffff800, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x5, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x3ff, 0x80000002, 0x400, 0x100, 0x6, 0x10007, 0x7, 0x5, 0x4, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd83, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x200006, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xfffffffc, 0x10000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0x20bfc, 0x8, 0xfffffe01, 0x7b, 0xfffffff8, 0x100040, 0xff, 0x5, 0x7fffffff, 0x7, 0x4, 0x9, 0x81, 0x3, 0x9, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x6, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x5393, 0x1, 0x1b18]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0xbc}, @NFTA_EXTHDR_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x17}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x4}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0xb3}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xec}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000002c0)={'ip6erspan0\x00', 0x0}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 4.015312004s ago: executing program 1 (id=2358): sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)={0x0, 0x14}, 0x1, 0x100000000000000, 0x0, 0x4044059}, 0x40090) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002400)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000800)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de15aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4dbf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a", 0x257}, {&(0x7f0000000bc0)="ab29d92826349952eb8f7a2a74f535bc9739c1df57144c51a3391625b8b5354134b06ef1355506aeae96e3f097503998f375a054cf3d7de4fe53ea51518955349cdb9742dd8a2f150ab0e8c5fa047c87d310adca60e1c65cc18dbe99369be03e492fb55fc9067bb6f7f7c3ee1720000000054a63ac58225ed0502f5ac8999e0c74a5dbb320bd54ec813e8bee6bfa5cbfb0726ac1b6ad97d802d5fae186f0769421fb965c7396854e2a3ac844a3769f8449901ba5e2b2da1ff6119aeb26ac204cfc6b54be73b6f195491ae2c0cb26b0cba61dae7a17740e8112ff188919c6e2e31a2a074863edba4a0e58b61faec4a42c29d7f9e48a43", 0xf6}, {&(0x7f0000000140)="f610e61ac81cc3edc86f0500194d27a5a443f10dfd1ecda0fd0ed9a444b7fb76afe3a0002f0a5eafcd3555a6cad574af080de74a37f54ee5f10fe3", 0x3b}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0xffffffa1, &(0x7f0000003700)={0x77359400}) 3.925217171s ago: executing program 1 (id=2360): mount(&(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='gfs2\x00', 0x2000c18, &(0x7f0000000100)='barrier') r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000007d00)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="180000006a001501f7bf2ce0039ec5665e2470"], 0x1c}], 0x1}, 0x200000c8) ioctl$FBIOBLANK(r0, 0x4611, 0x0) 3.924594814s ago: executing program 0 (id=2362): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) poll(&(0x7f0000000140)=[{r1, 0x2042}, {0xffffffffffffffff, 0x6358}, {r1, 0x400}, {r0, 0x98}], 0x4, 0x81) readv(r1, &(0x7f0000000680)=[{&(0x7f0000000000)=""/131, 0x83}, {&(0x7f00000000c0)=""/43, 0x2b}, {&(0x7f0000000180)=""/234, 0xea}, {&(0x7f0000000280)=""/181, 0xb5}, {&(0x7f0000000340)=""/182, 0xb6}, {&(0x7f0000000500)=""/189, 0xbd}, {&(0x7f00000005c0)=""/134, 0x86}, {&(0x7f0000000440)=""/104, 0x68}], 0x8) 3.805690326s ago: executing program 1 (id=2364): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009c323f08a5040330b244010203010902120001000200000904"], 0x0) syz_usb_control_io(r0, &(0x7f0000002000)={0x2c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0003160000000403"], 0x0, 0x0, 0x0}, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a32000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000040000000000a40000000160a01080000000000000000020000000900020073797a30000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000200)={0x14, &(0x7f0000000080)={0x0, 0x3, 0x92, {0x92, 0x8, "736d176cf7181f041b88953b9b05abb9137259488336539a99cc4b535bdf155a9003682c94704e9774a7c148630270d116ad23993bf0a9d2856d60ac46edeea527cd55effb14935e5cbac93f2eb7aecd3934603bbfa411c3ddafde05497d19522da07aededb2989f7d1d4dedd443680b305aff8fc4a8208db5c6ff38edf67fd6b11aa129996e5be2a7579309ed9ebe1e"}}, &(0x7f0000000140)={0x0, 0x3, 0xb7, @string={0xb7, 0x3, "f9d1c71aca335013e26ba715b4532a3e87cb603e97743ad0f531b381b9f20fadfdd90241b1dab34f90962f8b0322c6516c3fc9e7ce3259df0affd90ba6bd24727a1ddf0bc9f91d3bb15a547e01eb8c98674e4ba036ab783ed75798bc54b8522b1c684c004214eaf576847c446f4fc0da263689ed32abeeb4266bb59fa9a25a0484575ab432594455c41419f3ebcaf4cbf136826ad8d9577efd9e793b18d353bc283b2d3a563d4ad0da468bec62e055b65dfab2e4bd"}}}, &(0x7f00000003c0)={0x2c, &(0x7f0000000240)={0x20, 0x0, 0x6e, "8c72cd56bcdfc0c193f510cf89b3f5e307cdfef3baaef4f713eed89b2ae9a63ca40e57968d2f0ecbee04246f1302ee351459692a8802de60fb3005dc324ef0a4bcd90b60d8793b6f68aa080f4eb8bf862a0ea2b03211d543a6541938fb2ebabb3b39e6cd39bffc1f5387dbea78bb"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000340)={0xc0, 0x5, 0x5, "1324935def"}, &(0x7f0000000380)={0x40, 0x5, 0x2, 'z\b'}}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000300)='task\x00') 3.557429049s ago: executing program 0 (id=2365): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000080)=0x80000003) r1 = dup2(r0, r0) read$FUSE(r1, &(0x7f00000063c0)={0x2020}, 0x20e0) syz_usb_connect(0x1, 0x2d, 0x0, 0x0) 2.168727872s ago: executing program 2 (id=2374): openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000200), 0xea02, 0x0) ioctl$PTP_PIN_GETFUNC2(r0, 0xc0603d0f, &(0x7f0000000280)={'\x00', 0x9, 0x3, 0xe}) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="02030609100000fe0000004c9e0000000200130002eb0e00000000000000000105000600200000000a00000040010000000500e50000070000001f00001a000000030000a95a6e870200010000e9ff070040000200000000050005000000cc580a"], 0x80}}, 0x4000000) 2.159748427s ago: executing program 2 (id=2375): r0 = fsopen(&(0x7f0000000080)='qnx4\x00', 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f00000000c0)) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000400)=ANY=[@ANYBLOB="180100001f00010000000080000096000601008014000320fc010000000000000000000000000000140001"], 0x118}], 0x1, 0x0, 0x0, 0x4081}, 0x0) 2.120823965s ago: executing program 2 (id=2376): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x9, [0x7, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x24d, 0x2, 0x4a732f64, 0x8, 0x9, 0xc, 0x2, 0x12a0, 0x6, 0xf477, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x4, 0x4, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x2, 0x7fff, 0x5, 0x8, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x3, 0x2, 0x2, 0x3, 0x7, 0x1, 0x7ff, 0x4, 0x40083, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x2, 0x5f, 0x4, 0xc66, 0x80a8a9, 0x73, 0x8e, 0x10001, 0x8000, 0x5, 0x2, 0x9, 0x80000c1, 0x5, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x40400, 0xffff58b9, 0x4c2336d3, 0x4, 0x20000001, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x4, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7faf, 0x35db, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x5, 0xfffffff9, 0x200004, 0x1000, 0xfffff800, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x5, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x3ff, 0x80000002, 0x400, 0x100, 0x6, 0x10007, 0x7, 0x5, 0x4, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd83, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x200006, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xfffffffc, 0x10000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0x20bfc, 0x8, 0xfffffe01, 0x7b, 0xfffffff8, 0x100040, 0xff, 0x5, 0x7fffffff, 0x7, 0x4, 0x9, 0x81, 0x3, 0x9, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x6, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x5393, 0x1, 0x1b18]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0xbc}, @NFTA_EXTHDR_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x17}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x4}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0xb3}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xec}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000002c0)={'ip6erspan0\x00', 0x0}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.00003757s ago: executing program 0 (id=2377): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000003c0)="d800000018007b18e00212ba0d8105040a0a1100fe0f040b067c55a1bc0009001e0006990300000015000500fe803fffe0000000a8aaaafffeaaaa3d01ac04000bd67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b01602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e9cb5", 0xd2}, {&(0x7f00000004c0)="f80ec2e2ba", 0x5}], 0x2, 0x0, 0x0, 0x2663}, 0x0) 1.968350008s ago: executing program 0 (id=2378): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi5\x00', 0x460501, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="120100000109021200010000000009040000009d144e00"/36], 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000240)={0x1c, &(0x7f0000000000)={0x0, 0x31}, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000180)={0x20, 0x18}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000740)={0x40, 0x17}, 0x0, 0x0, 0x0, 0x0}) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'multiq3\x00', [0x4f25, 0x5, 0xfffffffe, 0x47, 0x10001, 0x0, 0xfff, 0x2, 0x5, 0x3ff, 0x7f, 0x1600, 0x1, 0x0, 0x9, 0xe1cb, 0xff7fffc0, 0x30000004, 0x31, 0x395, 0x80000089, 0xfffffffd, 0x7, 0x1007, 0xffffeadb, 0x3, 0x1003c, 0x5, 0x4, 0x7fffffc, 0x5]}) syz_usb_connect(0x3, 0x714, &(0x7f0000000300)={{0x12, 0x1, 0x201, 0x89, 0x66, 0x8d, 0x40, 0xbda, 0xb711, 0x8e18, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x702, 0x2, 0x4, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xa8, 0x40, 0xb, 0xff, 0xff, 0xff, 0x9, [@uac_as={[@as_header={0x7, 0x24, 0x1, 0x4, 0x81, 0x1001}, @as_header={0x7, 0x24, 0x1, 0x80, 0x2, 0x2}]}, @generic={0x11, 0x4, "9b6115f4be26e9cdf9719061e7fc08"}], [{{0x9, 0x5, 0xd, 0x0, 0x8, 0x3, 0x3, 0x8, [@generic={0xb5, 0x1, "facf2f42dd614d42c1bc9b11efaba82d31343f69caae57b1783e75f6f187f119157fbf73c85478fb50d5448853732c8fd59a45cc217a50436bf83508e59d56c056352e0f11679ce53cb87ab10ce6d1c773c58792ddb8572bd1ca4cc5fffd3502e83894bf795cb17466ecd096dbe4bb7e57440d0b5f7799c94e25ecc32badd25ab07c6eee56e222ceb72295df8f62838b7f954539822dc9c74320f08ca8d3e941cb99ef80987ee29713ebb94c4202155d83ce65"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x5, 0xffff}]}}, {{0x9, 0x5, 0xa, 0x2, 0x618, 0x4c, 0x6, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x4, 0x9}]}}, {{0x9, 0x5, 0x5, 0x2, 0x400, 0xdb, 0x3, 0x8}}, {{0x9, 0x5, 0xc, 0x10, 0x10, 0x4, 0xb, 0xa, [@generic={0xb8, 0xf, "c6356a2fb6f8430be74889ce8ad6e0eec884ea48195b3eeaaae2ad0c99b6bdb07ac98fdff14703ab1fd580d967260d813b77cd61a2006c2ef7e6ae80dd11acc503502a42c2021cbe4b99c045b91f616fbdca6b7558f6c8fed775a2ca43b096e32d46c071ef238db5f7276417964bf0c63ab6f1466a70319091dc442ba6772ca402b15ebe507a2d611b2beb3456c71b8c0053d04604d4e4ae2ab661e0cfade84b389c9d370a859f6ff75026cc645045f26cb3d694760c"}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0xf, 0x2}]}}, {{0x9, 0x5, 0x1, 0xc, 0x3ff, 0x2, 0x4, 0x80, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x5, 0x7}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0x9, 0x1000}]}}, {{0x9, 0x5, 0xc, 0x4, 0x10, 0x9, 0x1, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x8, 0x3}, @generic={0x74, 0x10, "48604aa79f727fa2cfee55cb87fd54f983e52664dc99c54a3b295c2168ed0eff110c36ef20c2b8df5ff8d710a7a13aa0a2c1dd4555ec0ee921513706efc66e50d64b827c2700bbcba75922adaa3d5bb77565259337683aaa4ca61951dab1127bbd8dc3b25889b0c2e9154dfccf278a7f9e8f"}]}}, {{0x9, 0x5, 0x0, 0xc, 0x200, 0x0, 0x1b, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0xa5, 0x2}, @uac_iso={0x7, 0x25, 0x1, 0x83, 0x0, 0x1}]}}, {{0x9, 0x5, 0xe, 0x2, 0x408, 0xfc, 0x19, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x2, 0xffff}]}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0xfc, 0x63, 0x70}}, {{0x9, 0x5, 0x1, 0x1, 0x200, 0x8, 0x10, 0x8, [@generic={0x8a, 0x2e, "a0a6ee717021d3fec34f5d3ef7ee8e3b3d8ebc3229d549fe1e91717346974b413a34d3959dcaaf592cad563de3843fbbdee385a23e914b1d533b777b78802d9827dc2d5316f64b1899592e48e8cca9e23b707a34080724d4c6f687db9ef54fcf9c61e45f21a238df87630e7573944f2c331a459bde068c7b463b89d2d9ffc884db01048205293dc1"}]}}, {{0x9, 0x5, 0x1, 0x7, 0x8, 0x5, 0x4, 0xfd}}]}}, {{0x9, 0x4, 0x98, 0xec, 0xe, 0x99, 0x21, 0x49, 0xff, [], [{{0x9, 0x5, 0x80, 0x0, 0x200, 0x6, 0x4, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x6, 0x30e8}]}}, {{0x9, 0x5, 0x5, 0x1, 0x200, 0xb, 0x9a, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x4, 0x77b0}]}}, {{0x9, 0x5, 0xa, 0x10, 0x40, 0x9, 0x9, 0xa8}}, {{0x9, 0x5, 0xd, 0x0, 0x40, 0x2, 0x1, 0x1, [@generic={0x49, 0x31, "886279266176f33849423105ce41523001252f9649988d3c0d15c07be28b09f386a109ed141c2e3dfd4d2464a96e09717ff528a035797a55652eae117dfa2448f1fc9e2df00d78"}]}}, {{0x9, 0x5, 0x7, 0x1, 0x400, 0x3, 0x8, 0x1}}, {{0x9, 0x5, 0x4, 0x0, 0x10, 0x1, 0x1, 0x5}}, {{0x9, 0x5, 0x8, 0x2, 0x10, 0x4, 0x6, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0xce, 0x3}]}}, {{0x9, 0x5, 0xb, 0x0, 0x10, 0x1, 0xf9, 0xfa, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xa, 0x822a}]}}, {{0x9, 0x5, 0x2, 0x2, 0x10, 0x3, 0x6, 0x8, [@generic={0xc1, 0x8, "1f92547b5ac510ac3217ec27414f94aab57d7bbc8c869c5c887540403a8fa8c23d31d8904ded755850f82072f4e7945338575684be13c261c56ed0f761bfa503fd107491196033f5a1efe110615104f301678c41e075926e57a0e2d43f93ae24e48bc8c0184c9432f656c5571bdb2ffc216e7cd0afdda08607852effd029c6753dcf3705e923952a7c26291cb77915869ef4578c978899d3f1d0c801305a5e21970235cff5be24c6aac3906c17670fff8400e4716a9d93de81c3905b64481c"}]}}, {{0x9, 0x5, 0xc, 0x10, 0x8, 0x6, 0x5, 0xd, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x7f, 0xe}, @generic={0xd2, 0x4, "43de33d11cfabf0059b041ee25838f97be7035f56b61d3ccb56f1ce8fc91ab9c6d775fcf13299b06e60d72fef82d7356f82d2a5854904b6b001fe5438730fdbac91f82e9e820de956a5c24c61143c486f505198feefcb219bd8c561c2253b996aadcf52c8f8f024025cc36b0e9e611638041184eb9e91353929c46bb3c94852e9484b56593749103d6902eaeb1816d1d1e5f8b955fb3439aa1b57cf342e67d7f10414097d7a07d4b5bf9cb1a83da1079049b9ed2005f3b9242c14db06cf95001cc58d0805e686e51eff5593f2e23560f"}]}}, {{0x9, 0x5, 0x5, 0x0, 0x0, 0x3, 0xf8, 0x3, [@generic={0xf0, 0xf, "f6003ee8ae2a1311d10e17e0361e14791b2ff0684e68139c37c6c4f120d0f387c68dd2467e935ff7e31e8e340177681eb39c956a78dda7c96ce1aff3ab0ca275603d0f30d6446b2467a962ccad89dca3fe4a81b2f49d5c67416475d04fa0c023dd9d27dcf9128f5c7ec8107fb91b456d39e61b2dce86d183d11e44c1394480bbe158bc4c456f87a4c17ba8f67b27452b23ea343094e57e4f07799df9e7ade9595a4f41711247dcee15c04b3a63b0530f32cedc2737886d6020a2929ccba1e5d79dd941adf231b05cd9da32802543c65a03d999459ef0a6c62374abaf5b89dccebfa536dfb42bdc3e1d7a0a268927"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x8, 0x7}]}}, {{0x9, 0x5, 0x5, 0x1, 0x40, 0x4, 0xe, 0xea, [@generic={0x39, 0x9, "8155e73fffe233f874a05cd3758b4239c2eac6f6836bf37e5236b7e13b9a1280709050f97065ccc2aa6b91d000917434715285d0b48a21"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x8, 0xff, 0x9, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xf, 0x1c}]}}, {{0x9, 0x5, 0x6, 0x4, 0x400, 0x8, 0x7, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x1, 0x35b}]}}]}}]}}]}}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r3 = dup(r2) getsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, 0x0, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r4, {r4}}, './file0\x00'}) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) r7 = socket$rxrpc(0x21, 0x2, 0xa) connect$rxrpc(r7, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e23, 0x1000, @dev={0xfe, 0x80, '\x00', 0x39}, 0x9}}, 0x24) bind$rxrpc(r7, &(0x7f00000001c0)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e20, 0x7, @rand_addr=' \x01\x00', 0x9}}, 0x24) ioctl$AUTOFS_IOC_EXPIRE(0xffffffffffffffff, 0x810c9365, &(0x7f0000000a40)={{0x7, 0xd853}, 0x100, './file0\x00'}) ioctl$FBIOPUT_VSCREENINFO(r6, 0x4601, &(0x7f0000000040)={0x191, 0x78, 0xa0, 0x3f, 0x32, 0x1c0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x32, 0x0, 0x0, 0x0, 0x106, 0x1, 0x1, 0x0, 0xfffffffd, 0x0, 0x8, 0x4, 0x0, 0x2, 0xa}) ioctl$I2C_RDWR(r5, 0x707, &(0x7f0000000240)={&(0x7f0000000280), 0x1000000000000173}) 1.880572658s ago: executing program 2 (id=2379): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090a00000000000000200000000300060000000e0002000000e0000009200000000000000002000100000010000000000200000000030005000000000002"], 0x50}}, 0x0) 1.809370287s ago: executing program 2 (id=2380): r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc38, &(0x7f0000001680)=ANY=[@ANYBLOB="ddf963efbeb08ab473792a75e82e22c26fad70aed1143272a8e808931ea66e189acf83ca0f1c5dd685fb0950f10dae151016eac5222e77", @ANYBLOB="9ebe7c71a123a6fb03cec931f700677e0b126f1f5986ccafe71c1b550f2ad260ec946ea93eebe89a41706be3379af67835b11def814f7ac51b52408b99ce20f30f9aee23926ed84e39a3ff1bf195c5226d69b99d06e54087339373adf824b4fb718af0fe0471186a576891d89c7643972071b738f0161048d2a011c751ca01a8c09e4efa145d0b130efac60ffba07796e33bc7a6027e8dc733e90027a769f2f0ec0093560ff3169887ed13d836582bfcb68c03cd1a47c4dfdcbe830da0e8e1948e245970d95a7154134106b80957e0d03cb91080f1e90b3b91c644fe5564e6946d9645864388374fc644c20c7749064cd80a86b1dc32821c6d4ac4c408993ebe2c3668871ff0fae09077346d84ea4497e56251c233e5ac203b558ca87f0064a2e647b4e5c71402763ba81b7c82eb00b9b36d9a65a9ef09ebe37d453fa989d5fb29eaf4686e5ad112762b03e5ab42dbbd03d376860e2d2925576eab67eaa5b5fa3ee2c431430480e24ca63a8964e1f91d9ab6da5128b8432f4eff3e0f8ec95fc2d04a48f6f10759c61c5566e6d613f685529eb5a2b87e4da439b59800612f38119253c3863222e0c9dcbaf12376745c877471d7a2bc243f516138433793c0094093e13ca3b834137b00b4fb8561474c35bd63c92c50bffa8ebf164c41fd5718b70c7da8dd79a830736434faa517607e97a3812956c3766e46d309a24912822cd77059f900159f7e58c0a72ec60932c84e1ad75e2dadbd217dd60d2937a561e4a887a312dc77a65fd7962484ae6aefaed551b85ce65770fc0b0a5a4f89941cbb8484c38af83c2fea123cd48af455b99fc0c14b186b16e61c73bbacf294e53ffd7a7b804417aab4282cf420a0a3685224c00dae021eb810b467ff68fb49b43742e5b1095f183c1053849fbae276a984419474ed39ca456ccd74185de100b4f607051f40c1471090cd864738d08a952752a67b4bf0ca6c73a9135c5068ea472b70ce126470db14d48f96b9f211dfaed75829b14a1a2cbac87de61c127b4c5063ef0dd40c5ede8a5bd20988862648e274edfcf3d424aa5c0770635d655ca10f09506a9837d73849d90ef533e6e2d9a13d7ee26474261448da7e5a1743b5ceaeebc65672734738881e1134bfddc6328f86312061972404c682e1f09edb22d91351831b6b963fa06e8fbfc250cc66c7d29b69938f0a75662abf4b585d0199928d9377ccf629d3385b10c6adebef1a767f2ad7e2ddcd4278fd56d5638180c920a3ccf50b08c193c932bb86f0101be47e35b5f1f5534b6f080845fc3602e5fa8bff7f806a7e6855a724167e43a01c428d428fb40bd996c6cf743ab524f5f3a0bb2f4b219188407d34ceec56f6ba97dacdcc41480b85edb698945704de95f8019fa80e992974fa400c34138e993c83f8516046e942ab89ae165dd7000cbe218688781a867f4fb75a57cd3dd04d1e4e88d3166c91c5db6fd9935d882a6f2d771e7699aa7e12c4a018df495b567e0f12c91615fb2184ba3ca098f783acd14b0c1ec489a73e3e9e0a759eadf7f646259981393a91e8279d95ed0216ddd593ccf215794aff73d9ed880b8a05a8170bff8bc7a2c556e192a3555780f57d8e9dbb14"]) 1.646790736s ago: executing program 3 (id=2382): syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042402024424"], 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f031c00eee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc9", 0x26, 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) syz_usb_connect$printer(0x2, 0x2d, &(0x7f0000000440)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x0, 0x50, 0x2, [{{0x9, 0x4, 0x0, 0x84, 0x1, 0x7, 0x1, 0x3, 0x8, "", {{{0x9, 0x5, 0x1, 0x2, 0x200, 0x2, 0x8, 0x9f}}}}}]}}]}}, &(0x7f0000000780)={0xa, &(0x7f0000000480)={0xa, 0x6, 0x201, 0x33, 0x0, 0x3, 0x20, 0x81}, 0xfc, &(0x7f00000004c0)={0x5, 0xf, 0xfc, 0x6, [@generic={0xbe, 0x10, 0x4, "eac042effc33f70c03f31353220bc928374574222507d3b760f028ef37ef041904033fd76bd7a27a31df7b4d908946431aacfd2189d0d05e9faaea599c9f4dbf1dcf602b28b0d164fca365ab918fe501171481be6448d90fcc39a29ba42c5dd7576f75b815b54daf73d2bed609010fa9c3a82161dcc3f5518f915236bf0ee7ad4f7892e8eef0137ba1a3663fc322d74519e3ebf546a1882fc0968827f209512ee9f5a74adb1f8773557e09d085f1a133e9f5e9b77804b3a30c01e4"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0xc5, 0x9, 0x4c7}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x3, 0xb, 0x0, 0x1}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x1, 0xc}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x0, 0x9, 0x9}, @ss_container_id={0x14, 0x10, 0x4, 0x8, "a8731cc749784b7ba3f994a2fccab81f"}]}, 0x4, [{0xc3, &(0x7f00000005c0)=@string={0xc3, 0x3, "0626dff9527fd5be17d05b4d37c3f624949118559e612a75b145ea466d739feacffef102e0d3e8d7e3063fbb6205f0839120dad1bc625029f1600ac95259459355e08246e1aac154a74f0c31e6db633aceb583fb3fa4e78b243e233648730090e818c420e5d5c7937cbd361e9391acc25fdb4d8f4378f84f2ec0d1060351b46c1746fc8e0e753b5de876f3bf37a359b9e151fd9705c409c4e420d230f09720df198a05d1820fec81fd200581a0187f4d4c39b2c9e5fc8f7d2967fb1116f9168b19"}}, {0x23, &(0x7f00000006c0)=@string={0x23, 0x3, "f4f240d8942dc13ffb11f1914c74803d9a42cf7a6c1aecac4d986f57af9ac5d7ed"}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0xc57}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x415}}]}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) newfstatat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000840)={&(0x7f0000000800)=[0x0], 0x1, 0x0, 0x0, 0xffffffffffffffff}) sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f0000000940)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x34, 0x4, 0x6, 0x801, 0x0, 0x0, {0xa, 0x0, 0x8}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x40) setresuid(0xee01, r3, r3) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000140)=@updpolicy={0x188, 0x19, 0x20, 0x50bd28, 0x25dfdbff, {{@in6=@empty, @in6=@private0, 0x4e20, 0x2, 0x4e21, 0x9, 0xa, 0x20, 0x80, 0x8, r2, r3}, {0x80000001, 0x7fffffff, 0xc, 0x0, 0x2, 0x9, 0x1, 0x7}, {0x9, 0x3, 0x0, 0x5}, 0x400, 0x6e6bbf, 0x1, 0x1, 0x1}, [@tfcpad={0x8, 0x16, 0x4}, @algo_comp={0x57, 0x3, {{'lzs\x00'}, 0x78, "21c0b741772f6fb261d163727a6953"}}, @sec_ctx={0x36, 0x8, {0x32, 0x8, 0x0, 0x0, 0x2a, "f2d329350351e05f82faf4d62d9b93dbfe2f28ee8331596b3ecc6835ace2a2d62dd07c8f95f0d215a1be"}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0x693}, @lifetime_val={0x24, 0x9, {0x3, 0x8001, 0xd, 0x5}}, @mark={0xc, 0x15, {0x35075c, 0x200}}]}, 0x188}}, 0xc010) 1.162434997s ago: executing program 1 (id=2383): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(r0, 0x0, 0x0) r3 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000340)={{0x84, @loopback, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x5}, {@dev={0xac, 0x14, 0x14, 0x3a}, 0x4e23, 0x2, 0x3, 0x12d61, 0xe}}, 0x44) sendmsg$sock(r3, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0xe000, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 309.294543ms ago: executing program 3 (id=2384): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002880)=[{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000180)="fc4406008e199ae0898c7a8988823619", 0x10}, {&(0x7f00000048c0)="4aa6ebbaadac821a088be79aff597e399b67d0e0d8b16af93d4078939730787afd7ca85bd5aa74fab362b0585f095ee8c513e864ee7783500a577bfbf648389284cb6744ba7d2e73d9d6", 0x4a}], 0x2, 0x0, 0x0, 0x800}], 0x1, 0x4815) recvmmsg(r1, &(0x7f00000022c0)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000200)=""/83, 0x53}], 0x1}, 0x3}], 0x1, 0x2100, 0x0) socket$inet(0x2, 0x1, 0x100) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5393, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="3400a220", @ANYRES16=r5, @ANYBLOB="100029bd7000fedbdf25010000000500050001000000050004000400000006001a004e20000006001b004e220000"], 0x34}, 0x1, 0x0, 0x0, 0x4480}, 0x48040) ioctl$FBIOGET_FSCREENINFO(r3, 0x4602, 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f00000000c0)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x10) shutdown(r2, 0x1) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x30, r5, 0x400, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'sit0\x00'}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x80}]}, 0x30}}, 0x4000000) listen(r2, 0xfff) 290.841576ms ago: executing program 1 (id=2385): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040000000000000000000010902240003000000000904"], 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000e80), r1) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') pwritev(r3, &(0x7f0000000500)=[{&(0x7f0000000000)='0', 0x1}, {&(0x7f00000002c0)='2', 0x1}], 0x2, 0x0, 0x0) ioctl$SIOCAX25GETINFOOLD(r3, 0x89e9, &(0x7f0000000040)) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f00000000c0)=0x0) r6 = socket$inet6(0x10, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000000)=[{0x40, 0x0, 0x7, 0xffeffffe}, {0x16}]}, 0x10) sendto$inet6(r6, &(0x7f00000002c0)="1c0000001200050f0c1000000049b23e9b200a00080001c000000001", 0x1c, 0x0, 0x0, 0x0) sendmsg$NFC_CMD_FW_DOWNLOAD(r1, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000f80)={0x28, r2, 0x1, 0x70bd26, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_FIRMWARE_NAME={0xc, 0x14, 'netpci0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4040) syz_usb_control_io$hid(r0, 0x0, 0x0) 263.416741ms ago: executing program 3 (id=2386): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000004c0)="f80ec2e2badd", 0x6}], 0x1, 0x0, 0x0, 0x2663}, 0x0) 234.795642ms ago: executing program 3 (id=2387): r0 = syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000640), 0x0, 0x0, 0x0, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x80, r0, 0x4, 0x70bd25, 0x25dfdbfe, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @initdev={0xac, 0x1e, 0x1, 0x0}}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0x3a}}, @FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_PEER_V6={0x14, 0x9, @rand_addr=' \x01\x00'}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @empty}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast1}]}, 0x80}, 0x1, 0x0, 0x0, 0x40}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r3 = openat$cgroup_devices(r2, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="62a02a3a340977"], 0xa) 161.033708ms ago: executing program 3 (id=2388): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x9, [0x7, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x24d, 0x2, 0x4a732f64, 0x8, 0x9, 0xc, 0x2, 0x12a0, 0x6, 0xf477, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x4, 0x4, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x2, 0x7fff, 0x5, 0x8, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x3, 0x2, 0x2, 0x3, 0x7, 0x1, 0x7ff, 0x4, 0x40083, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x2, 0x5f, 0x4, 0xc66, 0x80a8a9, 0x73, 0x8e, 0x10001, 0x8000, 0x5, 0x2, 0x9, 0x80000c1, 0x5, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x40400, 0xffff58b9, 0x4c2336d3, 0x4, 0x20000001, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x4, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7faf, 0x35db, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x5, 0xfffffff9, 0x200004, 0x1000, 0xfffff800, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x5, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x3ff, 0x80000002, 0x400, 0x100, 0x6, 0x10007, 0x7, 0x5, 0x4, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd83, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x200006, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xfffffffc, 0x10000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0x20bfc, 0x8, 0xfffffe01, 0x7b, 0xfffffff8, 0x100040, 0xff, 0x5, 0x7fffffff, 0x7, 0x4, 0x9, 0x81, 0x3, 0x9, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x6, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x5393, 0x1, 0x1b18]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x4c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0xbc}, @NFTA_EXTHDR_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x17}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x4}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0xb3}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xec}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000002c0)={'ip6erspan0\x00', 0x0}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 129.940295ms ago: executing program 2 (id=2389): r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000040)={0x2}) close(r1) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) r3 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000002180)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0x0, 0x0) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000240)=@mmap={0x1, 0x2, 0x4, 0x100000, 0x9, {}, {0x2, 0x2, 0x4, 0xc0, 0x0, 0xf0, "18a6fc23"}, 0x1, 0x1, {}, 0x1}) mount(&(0x7f0000000080)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040)='xfs\x00', 0x10003, &(0x7f00000000c0)='norecovery') ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000000)={0x6, 0x1, 0x1, 0x0, 0x3}) prctl$PR_SET_PDEATHSIG(0x1, 0x36) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000080)=0x2) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4040aea0, &(0x7f00000009c0)=@arm64={0x16, 0x98, 0x7, '\x00', 0x5}) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x1, 0x4, 0x8, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x5}) r7 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPROPBLOB(r7, 0xc01064ac, &(0x7f0000000140)={0x0, 0x0, 0x0}) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r8, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000340)=0x4, r9, 0x0, 0x0, 0x1}}, 0x20) r10 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r10, 0x5423, &(0x7f0000000240)=0x7) ioctl$TIOCSTI(r10, 0x5412, &(0x7f0000000200)=0x75) 0s ago: executing program 3 (id=2390): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x2402, 0x0) ioctl$SNAPSHOT_FREE(r1, 0x3305) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$vim2m(&(0x7f0000000080), 0xba, 0x2) sendmmsg$unix(r2, &(0x7f0000000c40)=[{{&(0x7f0000000080)=@abs={0x1, 0x30, 0x5c}, 0x6e, 0x0}}], 0x1, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) syz_usb_connect(0x0, 0x24, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0xf2, 0xc5, 0x96, 0x20, 0x16d0, 0x10b8, 0xde8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x0, 0x0, 0x83, 0xec}}]}}]}}, 0x0) ioctl$KDSETMODE(0xffffffffffffffff, 0x4b3a, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x8000000) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xb6, '\x00', 0x2}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000080000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021440011800a0001006c696d6974000000340002800c00024000000000000000000c000140000000000000000508000540000000010800054000000001080003400000000c"], 0xc8}}, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f00000004c0)=ANY=[@ANYBLOB="010000000000000070000040000000000e00000000000000"]) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001a40)=ANY=[@ANYBLOB="981300003f000701feffffff00000000017c0000040042800c00018006000600800a0000741302807013148008001400"], 0x1398}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) write$UHID_CREATE2(r0, &(0x7f0000000500)=ANY=[@ANYRESOCT=r0, @ANYRESDEC=r0, @ANYRES16=r2, @ANYRES32=r4], 0x119) r8 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r8, &(0x7f0000000080)={&(0x7f0000000280)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) ioctl$sock_SIOCOUTQNSD(r8, 0x894b, &(0x7f0000000100)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c000000020301040000000000000000000000100800010001"], 0x1c}}, 0x0) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r10, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): Error: mce write submit urb error = -90 [ 474.278008][ T7186] usb 2-1: Using ep0 maxpacket: 16 [ 474.284704][ T7186] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 474.296020][ T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 474.303285][ T7186] usb 2-1: config 0 interface 0 has no altsetting 0 [ 474.310897][ T7186] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 474.321573][ T7186] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.332265][ T7186] usb 2-1: config 0 descriptor?? [ 474.348280][ T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 474.378274][ T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 474.398220][ T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 474.407482][ T5869] usb 4-1: unable to get BOS descriptor or descriptor too short [ 474.415796][ T5869] usb 4-1: not running at top speed; connect to a high speed hub [ 474.423855][ T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 474.432313][ T5869] usb 4-1: config 7 has an invalid interface number: 2 but max is 0 [ 474.440396][ T5869] usb 4-1: config 7 has no interface number 0 [ 474.446593][ T5869] usb 4-1: config 7 interface 2 has no altsetting 0 [ 474.453351][ T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 474.463103][ T5869] usb 4-1: New USB device found, idVendor=052b, idProduct=1803, bcdDevice=15.2a [ 474.472395][ T5869] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.480631][ T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 474.487854][ T5869] usb 4-1: Product: syz [ 474.492035][ T5869] usb 4-1: Manufacturer: syz [ 474.496623][ T5869] usb 4-1: SerialNumber: syz [ 474.518094][ T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 474.538055][ T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 474.559353][ T10] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 474.568165][ T10] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 474.582579][ T10] usb 1-1: USB disconnect, device number 37 [ 474.709437][T12262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 474.718459][T12262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.734175][ T5869] gspca_main: sunplus-2.14.0 probing 052b:1803 [ 474.741199][ T5869] gspca_sunplus: reg_r err -71 [ 474.746216][ T5869] sunplus 4-1:7.2: probe with driver sunplus failed with error -71 [ 474.765799][ T5869] usb 4-1: USB disconnect, device number 31 [ 474.776942][ T7186] nzxt-smart2 0003:1E71:2009.0023: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.1-1/input0 [ 474.928088][ T10] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 475.097920][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 475.105133][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 475.116424][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 475.126499][ T10] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 475.136496][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.147352][ T10] usb 1-1: config 0 descriptor?? [ 475.161966][ T5951] usb 2-1: USB disconnect, device number 29 [ 475.358107][ T5954] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 475.358189][T12281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.375429][T12281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.400242][ T10] usbhid 1-1:0.0: can't add hid device: -71 [ 475.406998][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 475.425524][ T10] usb 1-1: USB disconnect, device number 38 [ 475.498142][ T5914] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 475.519535][ T5954] usb 3-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 475.529407][ T5954] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.544198][ T5954] usb 3-1: config 0 descriptor?? [ 475.553353][ T5954] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 475.669953][ T5914] usb 4-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 475.688868][ T5914] usb 4-1: config 0 interface 0 has no altsetting 0 [ 475.695579][ T5914] usb 4-1: New USB device found, idVendor=056a, idProduct=0094, bcdDevice= 0.00 [ 475.705479][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.723203][ T5914] usb 4-1: config 0 descriptor?? [ 475.967534][ T5954] cpia1 3-1:0.0: unexpected state after lo power cmd: 00 [ 475.977933][ T5951] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 476.143813][T12279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.154080][ T5951] usb 2-1: Using ep0 maxpacket: 16 [ 476.155656][T12279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.162384][ T5951] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 476.171254][T12279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.187605][ T5951] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 476.200509][T12279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.215526][ T5914] usb 4-1: string descriptor 0 read error: -71 [ 476.227021][ T5951] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 476.238177][ T5951] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 476.249450][ T5914] usbhid 4-1:0.0: can't add hid device: -71 [ 476.256068][ T5914] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 476.265755][ T5951] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 476.283031][ T5914] usb 4-1: USB disconnect, device number 32 [ 476.296386][ T5951] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 476.306041][ T5951] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 476.314855][ T5951] usb 2-1: Manufacturer: syz [ 476.323411][ T5951] usb 2-1: config 0 descriptor?? [ 476.470101][ T5954] gspca_cpia1: usb_control_msg 02, error -71 [ 476.476728][ T5954] gspca_cpia1: usb_control_msg 05, error -71 [ 476.483546][ T5954] cpia1 3-1:0.0: unexpected systemstate: 00 [ 476.492100][ T5954] usb 3-1: USB disconnect, device number 24 [ 476.540428][ T10] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 476.600349][ T5951] rc_core: IR keymap rc-hauppauge not found [ 476.606302][ T5951] Registered IR keymap rc-empty [ 476.611417][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.638063][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.658841][ T5951] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 476.672744][ T5951] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input80 [ 476.678029][ T10] usb 1-1: device descriptor read/64, error -71 [ 476.689080][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.718086][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.738089][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.758604][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.779151][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.798041][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.818239][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.838036][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.868175][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.888412][ T5951] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 476.909332][ T5951] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 476.918532][ T5951] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 476.927939][ T10] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 477.004689][ T5951] usb 2-1: USB disconnect, device number 30 [ 477.058832][ T10] usb 1-1: device descriptor read/64, error -71 [ 477.097904][ T5869] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 477.168435][ T10] usb usb1-port1: attempt power cycle [ 477.248140][ T5869] usb 4-1: Using ep0 maxpacket: 8 [ 477.258024][ T5869] usb 4-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2 [ 477.267670][ T5869] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.276308][ T5869] usb 4-1: Product: syz [ 477.282022][ T5869] usb 4-1: Manufacturer: syz [ 477.286649][ T5869] usb 4-1: SerialNumber: syz [ 477.294443][ T5869] usb 4-1: config 0 descriptor?? [ 477.514029][ T5869] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 477.529021][ T10] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 477.568590][ T10] usb 1-1: device descriptor read/8, error -71 [ 477.790161][ T5954] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 477.829767][ T10] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 477.848729][ T10] usb 1-1: device descriptor read/8, error -71 [ 477.875890][T12342] FAULT_INJECTION: forcing a failure. [ 477.875890][T12342] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 477.889085][T12342] CPU: 1 UID: 0 PID: 12342 Comm: syz.1.2161 Not tainted syzkaller #0 PREEMPT(full) [ 477.889107][T12342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 477.889117][T12342] Call Trace: [ 477.889127][T12342] [ 477.889135][T12342] dump_stack_lvl+0x189/0x250 [ 477.889158][T12342] ? __pfx____ratelimit+0x10/0x10 [ 477.889182][T12342] ? __pfx_dump_stack_lvl+0x10/0x10 [ 477.889199][T12342] ? __pfx__printk+0x10/0x10 [ 477.889235][T12342] should_fail_ex+0x414/0x560 [ 477.889260][T12342] _copy_to_user+0x31/0xb0 [ 477.889274][T12342] simple_read_from_buffer+0xe1/0x170 [ 477.889300][T12342] proc_fail_nth_read+0x1b3/0x220 [ 477.889325][T12342] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 477.889350][T12342] ? rw_verify_area+0x2a6/0x4d0 [ 477.889371][T12342] ? __lock_acquire+0xab9/0xd20 [ 477.889383][T12342] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 477.889396][T12342] vfs_read+0x200/0xa30 [ 477.889409][T12342] ? fdget_pos+0x247/0x320 [ 477.889421][T12342] ? __pfx___mutex_lock+0x10/0x10 [ 477.889431][T12342] ? __pfx_vfs_read+0x10/0x10 [ 477.889453][T12342] ? __fget_files+0x2a/0x420 [ 477.889474][T12342] ? __fget_files+0x3a0/0x420 [ 477.889490][T12342] ? __fget_files+0x2a/0x420 [ 477.889515][T12342] ksys_read+0x145/0x250 [ 477.889533][T12342] ? __pfx_ksys_read+0x10/0x10 [ 477.889548][T12342] ? do_syscall_64+0xbe/0xfa0 [ 477.889558][T12342] do_syscall_64+0xfa/0xfa0 [ 477.889567][T12342] ? lockdep_hardirqs_on+0x9c/0x150 [ 477.889593][T12342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 477.889610][T12342] ? clear_bhb_loop+0x60/0xb0 [ 477.889632][T12342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 477.889649][T12342] RIP: 0033:0x7fee9cf8d8dc [ 477.889665][T12342] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 477.889675][T12342] RSP: 002b:00007fee9de27030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 477.889686][T12342] RAX: ffffffffffffffda RBX: 00007fee9d1e5fa0 RCX: 00007fee9cf8d8dc [ 477.889694][T12342] RDX: 000000000000000f RSI: 00007fee9de270a0 RDI: 0000000000000007 [ 477.889700][T12342] RBP: 00007fee9de27090 R08: 0000000000000000 R09: 0000000000000000 [ 477.889706][T12342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 477.889712][T12342] R13: 00007fee9d1e6038 R14: 00007fee9d1e5fa0 R15: 00007ffc08b56098 [ 477.889737][T12342] [ 477.999481][ T10] usb usb1-port1: unable to enumerate USB device [ 478.020044][ T5954] usb 3-1: Using ep0 maxpacket: 8 [ 478.027612][ T5954] usb 3-1: config 127 has an invalid interface number: 171 but max is 1 [ 478.153155][ T5954] usb 3-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 478.163522][ T5954] usb 3-1: config 127 has 1 interface, different from the descriptor's value: 2 [ 478.174469][ T5954] usb 3-1: config 127 has no interface number 0 [ 478.183325][ T5954] usb 3-1: config 127 interface 171 has no altsetting 0 [ 478.196167][ T5954] usb 3-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 478.205352][ T5954] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.213490][ T5954] usb 3-1: Product: syz [ 478.217666][ T5954] usb 3-1: Manufacturer: syz [ 478.222444][ T5954] usb 3-1: SerialNumber: syz [ 478.226434][T12347] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 478.234294][T12347] IPv6: NLM_F_CREATE should be set when creating new route [ 478.286961][ T30] audit: type=1326 audit(1758551652.378:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12348 comm="syz.1.2164" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fee9cf8eec9 code=0x0 [ 478.682145][ T5954] usb 3-1: USB disconnect, device number 25 [ 478.723808][ T5869] gspca_sunplus: reg_w_riv err -71 [ 478.740264][ T5869] sunplus 4-1:0.0: probe with driver sunplus failed with error -71 [ 478.778229][ T5869] usb 4-1: USB disconnect, device number 33 [ 478.930119][T12351] bond0: (slave syz_tun): Releasing backup interface [ 478.974477][ T5868] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 478.983238][ T5868] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 478.994052][ T5868] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 479.002291][ T5868] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 479.012233][ T5868] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 479.046133][ T5870] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 479.055544][ T5870] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 479.064933][ T5870] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 479.080207][ T5870] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 479.089558][ T5870] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 479.162593][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.314751][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.475580][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.543573][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.587558][ T5869] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 479.708474][ T5914] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 479.751633][ T5869] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 479.770797][T12358] chnl_net:caif_netlink_parms(): no params data found [ 479.781186][ T5869] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 479.792423][ T5869] usb 4-1: Product: syz [ 479.798592][ T5869] usb 4-1: Manufacturer: syz [ 479.805361][ T5869] usb 4-1: SerialNumber: syz [ 479.895888][ T5914] usb 1-1: Using ep0 maxpacket: 16 [ 479.905684][ T5914] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 479.926234][ T5914] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 479.938833][ T5914] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 479.957985][ T5914] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 479.969219][ T5914] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 479.987243][ T5914] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 480.007755][ T13] bridge_slave_1: left allmulticast mode [ 480.014137][ T5914] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 480.023167][ T13] bridge_slave_1: left promiscuous mode [ 480.031083][ T5914] usb 1-1: Manufacturer: syz [ 480.032457][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 480.042912][ T5914] usb 1-1: config 0 descriptor?? [ 480.068041][ T13] bridge_slave_0: left allmulticast mode [ 480.074441][ T13] bridge_slave_0: left promiscuous mode [ 480.076708][T12378] netlink: 'syz.2.2170': attribute type 27 has an invalid length. [ 480.081588][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 480.382918][ T13] bridge0 (unregistering): left allmulticast mode [ 480.554084][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 480.575298][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 480.597444][ T13] bond0 (unregistering): (slave team0): Releasing backup interface [ 480.608049][ T13] bond0 (unregistering): Released all slaves [ 480.670937][T12378] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 480.848420][T12358] bridge0: port 1(bridge_slave_0) entered blocking state [ 480.868054][T12358] bridge0: port 1(bridge_slave_0) entered disabled state [ 480.881861][T12358] bridge_slave_0: entered allmulticast mode [ 480.906988][T12358] bridge_slave_0: entered promiscuous mode [ 480.957564][T12358] bridge0: port 2(bridge_slave_1) entered blocking state [ 480.987553][T12358] bridge0: port 2(bridge_slave_1) entered disabled state [ 480.998839][T12358] bridge_slave_1: entered allmulticast mode [ 481.007541][T12358] bridge_slave_1: entered promiscuous mode [ 481.092638][ T5869] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000118. ret = -EPIPE [ 481.115180][ T5869] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 481.137413][ T5869] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 481.147998][ T5870] Bluetooth: hci2: command tx timeout [ 481.150861][ T5869] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -32 [ 481.174407][T12358] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 481.229454][T12358] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 481.424160][ T13] hsr_slave_0: left promiscuous mode [ 481.437658][ T13] hsr_slave_1: left promiscuous mode [ 481.453809][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 481.471001][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 481.483349][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 481.491035][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 481.528772][ T13] veth1_macvtap: left promiscuous mode [ 481.535227][ T13] veth0_macvtap: left promiscuous mode [ 481.542964][ T13] veth1_vlan: left promiscuous mode [ 482.124456][ T13] team0 (unregistering): Port device team_slave_1 removed [ 482.172538][ T13] team0 (unregistering): Port device team_slave_0 removed [ 482.322494][ T5954] usb 4-1: USB disconnect, device number 34 [ 482.508217][ T5914] rc_core: IR keymap rc-hauppauge not found [ 482.524582][ T5914] Registered IR keymap rc-empty [ 482.535174][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.582833][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.628261][ T5914] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 482.670082][ T5914] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input82 [ 482.704489][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.739215][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.768121][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.798055][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.821375][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.848074][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.871357][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.887952][T12358] team0: Port device team_slave_0 added [ 482.898045][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.929728][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.931858][T12358] team0: Port device team_slave_1 added [ 482.949394][ T5914] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 482.981822][ T5914] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 483.030177][ T5914] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 483.043792][ T5914] usb 1-1: USB disconnect, device number 43 [ 483.063267][T12358] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 483.081976][T12358] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 483.111625][T12358] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 483.146137][T12358] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 483.155769][T12358] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 483.195089][T12358] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 483.218279][ T5870] Bluetooth: hci2: command tx timeout [ 483.256257][ T5869] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 483.336956][T12358] hsr_slave_0: entered promiscuous mode [ 483.372576][T12358] hsr_slave_1: entered promiscuous mode [ 483.409352][T12358] debugfs: 'hsr0' already exists in 'hsr' [ 483.425413][T12358] Cannot create hsr debugfs directory [ 483.430998][ T5869] usb 3-1: Using ep0 maxpacket: 16 [ 483.440439][ T5869] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 483.451210][ T5869] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 483.456290][T12431] FAULT_INJECTION: forcing a failure. [ 483.456290][T12431] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 483.476691][ T5869] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 483.482020][ T5914] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 483.496150][ T5869] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 483.503805][T12431] CPU: 1 UID: 0 PID: 12431 Comm: syz.3.2179 Not tainted syzkaller #0 PREEMPT(full) [ 483.503832][T12431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 483.503843][T12431] Call Trace: [ 483.503851][T12431] [ 483.503859][T12431] dump_stack_lvl+0x189/0x250 [ 483.503887][T12431] ? __pfx____ratelimit+0x10/0x10 [ 483.503911][T12431] ? __pfx_dump_stack_lvl+0x10/0x10 [ 483.503929][T12431] ? __pfx__printk+0x10/0x10 [ 483.503952][T12431] ? __might_fault+0xb0/0x130 [ 483.503983][T12431] should_fail_ex+0x414/0x560 [ 483.504017][T12431] _copy_from_user+0x2d/0xb0 [ 483.504039][T12431] input_event_from_user+0xb2/0x280 [ 483.504058][T12431] ? __pfx_input_event_from_user+0x10/0x10 [ 483.504081][T12431] ? input_inject_event+0xb6/0x340 [ 483.504104][T12431] evdev_write+0x2a6/0x480 [ 483.504127][T12431] ? __pfx_evdev_write+0x10/0x10 [ 483.504145][T12431] ? bpf_lsm_file_permission+0x9/0x20 [ 483.504161][T12431] ? security_file_permission+0x75/0x290 [ 483.504179][T12431] ? rw_verify_area+0x255/0x4d0 [ 483.504199][T12431] ? __lock_acquire+0xab9/0xd20 [ 483.504216][T12431] ? __pfx_evdev_write+0x10/0x10 [ 483.504234][T12431] vfs_write+0x27e/0xb30 [ 483.504263][T12431] ? __pfx_vfs_write+0x10/0x10 [ 483.504286][T12431] ? __fget_files+0x2a/0x420 [ 483.504306][T12431] ? __fget_files+0x2a/0x420 [ 483.504320][T12431] ? __fget_files+0x3a0/0x420 [ 483.504334][T12431] ? __fget_files+0x2a/0x420 [ 483.504358][T12431] ksys_write+0x145/0x250 [ 483.504382][T12431] ? __pfx_ksys_write+0x10/0x10 [ 483.504408][T12431] ? do_syscall_64+0xbe/0xfa0 [ 483.504427][T12431] do_syscall_64+0xfa/0xfa0 [ 483.504440][T12431] ? lockdep_hardirqs_on+0x9c/0x150 [ 483.504462][T12431] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.504479][T12431] ? clear_bhb_loop+0x60/0xb0 [ 483.504499][T12431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.504514][T12431] RIP: 0033:0x7f226638eec9 [ 483.504530][T12431] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 483.504545][T12431] RSP: 002b:00007f22672c7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 483.504563][T12431] RAX: ffffffffffffffda RBX: 00007f22665e5fa0 RCX: 00007f226638eec9 [ 483.504575][T12431] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000003 [ 483.504586][T12431] RBP: 00007f22672c7090 R08: 0000000000000000 R09: 0000000000000000 [ 483.504596][T12431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 483.504607][T12431] R13: 00007f22665e6038 R14: 00007f22665e5fa0 R15: 00007ffe60d2ac48 [ 483.504636][T12431] [ 483.757893][ T5914] usb 1-1: Using ep0 maxpacket: 8 [ 483.760782][ T5869] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 483.789106][ T5869] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 483.805583][ T5869] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 483.818312][ T5914] usb 1-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2 [ 483.827662][ T5914] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 483.834321][ T5869] usb 3-1: Manufacturer: syz [ 483.853130][ T5869] usb 3-1: config 0 descriptor?? [ 483.872268][ T5914] usb 1-1: Product: syz [ 483.882251][ T5914] usb 1-1: Manufacturer: syz [ 483.888109][ T5914] usb 1-1: SerialNumber: syz [ 483.912831][ T5914] usb 1-1: config 0 descriptor?? [ 484.145691][ T5914] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 484.162129][T12447] autofs: Bad value for 'fd' [ 484.178626][ T5869] rc_core: IR keymap rc-hauppauge not found [ 484.186916][T12447] netlink: 'syz.3.2182': attribute type 10 has an invalid length. [ 484.197998][ T5869] Registered IR keymap rc-empty [ 484.203026][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.233587][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.243701][T12447] 8021q: adding VLAN 0 to HW filter on device team0 [ 484.254662][T12447] bond0: (slave team0): Enslaving as an active interface with an up link [ 484.265241][ T5869] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 484.302304][ T5869] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input83 [ 484.332263][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.384575][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.407965][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.437989][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.458928][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.460605][ T7796] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 484.488489][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.509890][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.530843][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.578139][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.608411][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 484.641786][T12358] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 484.648003][ T7796] usb 4-1: Using ep0 maxpacket: 16 [ 484.649282][ T5869] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 484.662669][ T7796] usb 4-1: New USB device found, idVendor=0c45, idProduct=800a, bcdDevice=db.47 [ 484.662696][ T7796] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.662734][ T7796] usb 4-1: Product: syz [ 484.662747][ T7796] usb 4-1: Manufacturer: syz [ 484.662760][ T7796] usb 4-1: SerialNumber: syz [ 484.666154][ T7796] usb 4-1: config 0 descriptor?? [ 484.674078][ T5869] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 484.716401][T12358] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 484.728343][T12358] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 484.732328][ T7796] gspca_main: sn9c2028-2.14.0 probing 0c45:800a [ 484.750276][ T5869] usb 3-1: USB disconnect, device number 26 [ 484.765081][T12358] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 484.926255][T12358] 8021q: adding VLAN 0 to HW filter on device bond0 [ 484.969392][T12358] 8021q: adding VLAN 0 to HW filter on device team0 [ 484.986082][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 484.993374][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 485.015045][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 485.022301][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 485.271720][ T7796] gspca_sn9c2028: read1 error -110 [ 485.287947][ T7796] gspca_sn9c2028: read1 error -32 [ 485.302778][ T5870] Bluetooth: hci2: command tx timeout [ 485.311722][ T7796] gspca_sn9c2028: read1 error -32 [ 485.316897][ T7796] sn9c2028 4-1:0.0: probe with driver sn9c2028 failed with error -32 [ 485.350772][ T5914] gspca_sunplus: reg_w_riv err -71 [ 485.356353][ T5914] sunplus 1-1:0.0: probe with driver sunplus failed with error -71 [ 485.383971][ T5914] usb 1-1: USB disconnect, device number 44 [ 485.414721][T12358] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 485.562448][T12358] veth0_vlan: entered promiscuous mode [ 485.594331][T12358] veth1_vlan: entered promiscuous mode [ 485.651270][T12358] veth0_macvtap: entered promiscuous mode [ 485.664070][T12358] veth1_macvtap: entered promiscuous mode [ 485.693868][T12358] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 485.716542][T12358] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 485.755284][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.766682][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.793062][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.805344][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.092237][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 486.116262][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 486.184468][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 486.200257][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 486.368328][ T5914] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 486.411187][T12513] FAULT_INJECTION: forcing a failure. [ 486.411187][T12513] name failslab, interval 1, probability 0, space 0, times 0 [ 486.442532][T12513] CPU: 0 UID: 0 PID: 12513 Comm: syz.1.2187 Not tainted syzkaller #0 PREEMPT(full) [ 486.442557][T12513] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 486.442567][T12513] Call Trace: [ 486.442574][T12513] [ 486.442582][T12513] dump_stack_lvl+0x189/0x250 [ 486.442606][T12513] ? __pfx____ratelimit+0x10/0x10 [ 486.442629][T12513] ? __pfx_dump_stack_lvl+0x10/0x10 [ 486.442646][T12513] ? __pfx__printk+0x10/0x10 [ 486.442675][T12513] ? __pfx___might_resched+0x10/0x10 [ 486.442700][T12513] should_fail_ex+0x414/0x560 [ 486.442738][T12513] should_failslab+0xa8/0x100 [ 486.442764][T12513] kmem_cache_alloc_node_noprof+0x77/0x710 [ 486.442785][T12513] ? __alloc_skb+0x112/0x2d0 [ 486.442814][T12513] __alloc_skb+0x112/0x2d0 [ 486.442841][T12513] netlink_ack+0x146/0xa50 [ 486.442862][T12513] ? __pfx_genl_rcv_msg+0x10/0x10 [ 486.442898][T12513] netlink_rcv_skb+0x28c/0x470 [ 486.442918][T12513] ? __lock_acquire+0xab9/0xd20 [ 486.442938][T12513] ? __pfx_genl_rcv_msg+0x10/0x10 [ 486.442956][T12513] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 486.442995][T12513] ? down_read+0x1ad/0x2e0 [ 486.443015][T12513] genl_rcv+0x28/0x40 [ 486.443031][T12513] netlink_unicast+0x82f/0x9e0 [ 486.443060][T12513] ? __pfx_netlink_unicast+0x10/0x10 [ 486.443082][T12513] ? netlink_sendmsg+0x642/0xb30 [ 486.443102][T12513] ? skb_put+0x11b/0x210 [ 486.443128][T12513] netlink_sendmsg+0x805/0xb30 [ 486.443161][T12513] ? __pfx_netlink_sendmsg+0x10/0x10 [ 486.443187][T12513] ? aa_sock_msg_perm+0xf1/0x1d0 [ 486.443210][T12513] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 486.443232][T12513] ? __pfx_netlink_sendmsg+0x10/0x10 [ 486.443256][T12513] __sock_sendmsg+0x21c/0x270 [ 486.443279][T12513] ____sys_sendmsg+0x505/0x830 [ 486.443301][T12513] ? __pfx_____sys_sendmsg+0x10/0x10 [ 486.443332][T12513] ? import_iovec+0x74/0xa0 [ 486.443352][T12513] ___sys_sendmsg+0x21f/0x2a0 [ 486.443371][T12513] ? __pfx____sys_sendmsg+0x10/0x10 [ 486.443420][T12513] ? __fget_files+0x2a/0x420 [ 486.443437][T12513] ? __fget_files+0x3a0/0x420 [ 486.443464][T12513] __x64_sys_sendmsg+0x19b/0x260 [ 486.443484][T12513] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 486.443512][T12513] ? __pfx_ksys_write+0x10/0x10 [ 486.443536][T12513] ? do_syscall_64+0xbe/0xfa0 [ 486.443555][T12513] do_syscall_64+0xfa/0xfa0 [ 486.443567][T12513] ? lockdep_hardirqs_on+0x9c/0x150 [ 486.443587][T12513] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 486.443603][T12513] ? clear_bhb_loop+0x60/0xb0 [ 486.443622][T12513] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 486.443637][T12513] RIP: 0033:0x7f7b0af8eec9 [ 486.443651][T12513] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 486.443665][T12513] RSP: 002b:00007f7b0be4d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 486.443683][T12513] RAX: ffffffffffffffda RBX: 00007f7b0b1e5fa0 RCX: 00007f7b0af8eec9 [ 486.443694][T12513] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 486.443704][T12513] RBP: 00007f7b0be4d090 R08: 0000000000000000 R09: 0000000000000000 [ 486.443722][T12513] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 486.443732][T12513] R13: 00007f7b0b1e6038 R14: 00007f7b0b1e5fa0 R15: 00007fffdc1dd448 [ 486.443761][T12513] [ 486.764598][ T5914] usb 1-1: device descriptor read/64, error -71 [ 487.018123][ T5914] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 487.178341][ T5914] usb 1-1: device descriptor read/64, error -71 [ 487.253980][ T5869] usb 4-1: USB disconnect, device number 35 [ 487.310832][ T5914] usb usb1-port1: attempt power cycle [ 487.335787][T12543] netlink: 'syz.3.2194': attribute type 1 has an invalid length. [ 487.379021][ T5870] Bluetooth: hci2: command tx timeout [ 487.479841][ T5972] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 487.538062][ T7796] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 487.638006][ T5972] usb 2-1: Using ep0 maxpacket: 8 [ 487.647238][ T5972] usb 2-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2 [ 487.660525][ T5914] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 487.670398][ T5972] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.678942][ T5972] usb 2-1: Product: syz [ 487.683453][ T5972] usb 2-1: Manufacturer: syz [ 487.688355][ T5972] usb 2-1: SerialNumber: syz [ 487.696688][ T7796] usb 3-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 487.706851][ T5914] usb 1-1: device descriptor read/8, error -71 [ 487.714790][ T7796] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.726416][ T7796] usb 3-1: Product: syz [ 487.731817][ T5972] usb 2-1: config 0 descriptor?? [ 487.741814][ T7796] usb 3-1: Manufacturer: syz [ 487.746528][ T7796] usb 3-1: SerialNumber: syz [ 487.766091][ T7796] usb 3-1: config 0 descriptor?? [ 487.777233][ T7796] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 487.816544][ T7796] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 487.836936][ T7796] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 487.874553][ T7796] usb 3-1: media controller created [ 487.922269][ T7796] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 487.958800][ T5972] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 487.967948][ T5914] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 487.999218][ T5914] usb 1-1: device descriptor read/8, error -71 [ 488.036985][ T7796] DVB: Unable to find symbol mt352_attach() [ 488.102399][ T7796] DVB: Unable to find symbol nxt6000_attach() [ 488.114512][ T5914] usb usb1-port1: unable to enumerate USB device [ 488.123263][ T7796] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 488.137723][ T7796] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input84 [ 488.152674][ T7796] dvb-usb: schedule remote query interval to 1000 msecs. [ 488.161478][ T7796] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 488.172276][ T7796] dvb-usb: bulk message failed: -22 (7/0) [ 488.178704][ T7796] dvb-usb: bulk message failed: -22 (7/0) [ 488.187696][ T7796] usb 3-1: USB disconnect, device number 27 [ 488.249607][ T7796] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 488.477997][ T898] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 488.639876][ T898] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 488.650753][ T898] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 488.661354][ T898] usb 4-1: config 220 has no interface number 2 [ 488.667677][ T898] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 488.680963][ T898] usb 4-1: config 220 interface 0 has no altsetting 0 [ 488.687762][ T898] usb 4-1: config 220 interface 76 has no altsetting 0 [ 488.695412][ T898] usb 4-1: config 220 interface 1 has no altsetting 0 [ 488.706828][ T898] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 488.716004][ T898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.724147][ T898] usb 4-1: Product: syz [ 488.728591][ T898] usb 4-1: Manufacturer: syz [ 488.733431][ T898] usb 4-1: SerialNumber: syz [ 488.956205][ T898] usb 4-1: selecting invalid altsetting 0 [ 488.962707][ T898] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 488.970539][ T898] uvcvideo 4-1:220.0: No valid video chain found. [ 488.985000][ T898] usb 4-1: selecting invalid altsetting 0 [ 488.991467][ T898] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 489.001150][ T7796] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 489.008141][ T898] usb 4-1: USB disconnect, device number 36 [ 489.108698][T12585] FAULT_INJECTION: forcing a failure. [ 489.108698][T12585] name failslab, interval 1, probability 0, space 0, times 0 [ 489.121878][T12585] CPU: 1 UID: 0 PID: 12585 Comm: syz.0.2203 Not tainted syzkaller #0 PREEMPT(full) [ 489.121903][T12585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 489.121914][T12585] Call Trace: [ 489.121922][T12585] [ 489.121930][T12585] dump_stack_lvl+0x189/0x250 [ 489.121957][T12585] ? __pfx____ratelimit+0x10/0x10 [ 489.121980][T12585] ? __pfx_dump_stack_lvl+0x10/0x10 [ 489.121996][T12585] ? __pfx__printk+0x10/0x10 [ 489.122021][T12585] ? __pfx___might_resched+0x10/0x10 [ 489.122041][T12585] ? fs_reclaim_acquire+0x7d/0x100 [ 489.122068][T12585] should_fail_ex+0x414/0x560 [ 489.122096][T12585] should_failslab+0xa8/0x100 [ 489.122121][T12585] __kmalloc_node_noprof+0xd2/0x800 [ 489.122140][T12585] ? alloc_slab_obj_exts+0x3d/0xc0 [ 489.122164][T12585] alloc_slab_obj_exts+0x3d/0xc0 [ 489.122183][T12585] __memcg_slab_post_alloc_hook+0x31d/0x7d0 [ 489.122220][T12585] kmem_cache_alloc_noprof+0x417/0x6e0 [ 489.122240][T12585] ? alloc_buffer_head+0x2a/0x270 [ 489.122264][T12585] alloc_buffer_head+0x2a/0x270 [ 489.122281][T12585] ? folio_alloc_buffers+0x3ad/0x640 [ 489.122303][T12585] folio_alloc_buffers+0x32d/0x640 [ 489.122330][T12585] create_empty_buffers+0x3a/0x530 [ 489.122357][T12585] __block_write_begin_int+0x3b1/0x1900 [ 489.122377][T12585] ? __pfx_workingset_update_node+0x10/0x10 [ 489.122402][T12585] ? folio_add_lru+0x1b2/0x3d0 [ 489.122427][T12585] ? filemap_add_folio+0x35f/0x540 [ 489.122452][T12585] ? __pfx___block_write_begin_int+0x10/0x10 [ 489.122483][T12585] iomap_write_begin+0xb7b/0x1c70 [ 489.122519][T12585] ? lockdep_hardirqs_on+0x9c/0x150 [ 489.122543][T12585] ? __pfx_iomap_write_begin+0x10/0x10 [ 489.122557][T12585] ? exc_page_fault+0xab/0x100 [ 489.122591][T12585] ? fault_in_readable+0xcc/0x130 [ 489.122610][T12585] ? fault_in_readable+0x8e/0x130 [ 489.122629][T12585] ? fault_in_readable+0xdd/0x130 [ 489.122650][T12585] ? fault_in_iov_iter_readable+0x1b4/0x2f0 [ 489.122670][T12585] iomap_file_buffered_write+0x441/0x9b0 [ 489.122717][T12585] ? __pfx_iomap_file_buffered_write+0x10/0x10 [ 489.122740][T12585] ? __lock_acquire+0xab9/0xd20 [ 489.122784][T12585] ? down_read+0x1ad/0x2e0 [ 489.122803][T12585] blkdev_write_iter+0x524/0x710 [ 489.122837][T12585] vfs_write+0x5c9/0xb30 [ 489.122857][T12585] ? __pfx_blkdev_write_iter+0x10/0x10 [ 489.122871][T12585] ? __pfx_vfs_write+0x10/0x10 [ 489.122890][T12585] ? __fget_files+0x2a/0x420 [ 489.122905][T12585] ksys_write+0x145/0x250 [ 489.122920][T12585] ? __pfx_ksys_write+0x10/0x10 [ 489.122936][T12585] ? do_syscall_64+0xbe/0xfa0 [ 489.122946][T12585] do_syscall_64+0xfa/0xfa0 [ 489.122954][T12585] ? lockdep_hardirqs_on+0x9c/0x150 [ 489.122968][T12585] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.122978][T12585] ? clear_bhb_loop+0x60/0xb0 [ 489.122990][T12585] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.122999][T12585] RIP: 0033:0x7fd140f8eec9 [ 489.123010][T12585] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 489.123018][T12585] RSP: 002b:00007fd141da3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 489.123030][T12585] RAX: ffffffffffffffda RBX: 00007fd1411e5fa0 RCX: 00007fd140f8eec9 [ 489.123037][T12585] RDX: 00000000fffffd2c RSI: 0000200000000000 RDI: 0000000000000004 [ 489.123044][T12585] RBP: 00007fd141da3090 R08: 0000000000000000 R09: 0000000000000000 [ 489.123050][T12585] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 489.123056][T12585] R13: 00007fd1411e6038 R14: 00007fd1411e5fa0 R15: 00007fff9776fa78 [ 489.123072][T12585] [ 489.478222][ T5972] gspca_sunplus: reg_w_riv err -110 [ 489.483618][ T5972] sunplus 2-1:0.0: probe with driver sunplus failed with error -110 [ 489.494323][ T5972] usb 2-1: USB disconnect, device number 31 [ 489.503533][ T7796] usb 3-1: device descriptor read/64, error -71 [ 489.712255][T12588] FAULT_INJECTION: forcing a failure. [ 489.712255][T12588] name failslab, interval 1, probability 0, space 0, times 0 [ 489.725154][T12588] CPU: 0 UID: 0 PID: 12588 Comm: syz.0.2204 Not tainted syzkaller #0 PREEMPT(full) [ 489.725177][T12588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 489.725186][T12588] Call Trace: [ 489.725194][T12588] [ 489.725203][T12588] dump_stack_lvl+0x189/0x250 [ 489.725226][T12588] ? __pfx____ratelimit+0x10/0x10 [ 489.725250][T12588] ? __pfx_dump_stack_lvl+0x10/0x10 [ 489.725265][T12588] ? __pfx__printk+0x10/0x10 [ 489.725290][T12588] ? __pfx___might_resched+0x10/0x10 [ 489.725313][T12588] should_fail_ex+0x414/0x560 [ 489.725341][T12588] should_failslab+0xa8/0x100 [ 489.725366][T12588] __kmalloc_cache_noprof+0x6f/0x6f0 [ 489.725385][T12588] ? kasan_quarantine_put+0xdd/0x220 [ 489.725402][T12588] ? snd_pcm_hw_param_near+0x7f/0x500 [ 489.725423][T12588] ? lockdep_hardirqs_on+0x9c/0x150 [ 489.725451][T12588] snd_pcm_hw_param_near+0x7f/0x500 [ 489.725469][T12588] ? snd_pcm_oss_change_params_locked+0xff9/0x3e40 [ 489.725488][T12588] ? kfree+0x19a/0x6d0 [ 489.725506][T12588] ? snd_pcm_hw_param_value+0x2b9/0x510 [ 489.725530][T12588] snd_pcm_oss_change_params_locked+0x1048/0x3e40 [ 489.725565][T12588] ? __mutex_lock+0x335/0x1350 [ 489.725598][T12588] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 489.725649][T12588] snd_pcm_oss_read+0x26a/0x8d0 [ 489.725678][T12588] ? __pfx_snd_pcm_oss_read+0x10/0x10 [ 489.725696][T12588] vfs_read+0x200/0xa30 [ 489.725728][T12588] ? __pfx_vfs_read+0x10/0x10 [ 489.725751][T12588] ? __fget_files+0x2a/0x420 [ 489.725765][T12588] ? __fget_files+0x2a/0x420 [ 489.725773][T12588] ? __fget_files+0x3a0/0x420 [ 489.725782][T12588] ? __fget_files+0x2a/0x420 [ 489.725796][T12588] ksys_read+0x145/0x250 [ 489.725811][T12588] ? __pfx_ksys_read+0x10/0x10 [ 489.725826][T12588] ? do_syscall_64+0xbe/0xfa0 [ 489.725836][T12588] do_syscall_64+0xfa/0xfa0 [ 489.725844][T12588] ? lockdep_hardirqs_on+0x9c/0x150 [ 489.725858][T12588] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.725868][T12588] ? clear_bhb_loop+0x60/0xb0 [ 489.725880][T12588] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.725889][T12588] RIP: 0033:0x7fd140f8eec9 [ 489.725899][T12588] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 489.725907][T12588] RSP: 002b:00007fd141da3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 489.725919][T12588] RAX: ffffffffffffffda RBX: 00007fd1411e5fa0 RCX: 00007fd140f8eec9 [ 489.725926][T12588] RDX: 0000000000002020 RSI: 00002000000063c0 RDI: 0000000000000003 [ 489.725932][T12588] RBP: 00007fd141da3090 R08: 0000000000000000 R09: 0000000000000000 [ 489.725939][T12588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 489.725945][T12588] R13: 00007fd1411e6038 R14: 00007fd1411e5fa0 R15: 00007fff9776fa78 [ 489.725961][T12588] [ 489.778014][ T7796] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 490.147943][ T7796] usb 3-1: device descriptor read/64, error -71 [ 490.259167][ T7796] usb usb3-port1: attempt power cycle [ 490.327948][ T898] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 490.477962][ T898] usb 4-1: Using ep0 maxpacket: 32 [ 490.485086][ T898] usb 4-1: config 0 interface 0 has no altsetting 0 [ 490.493825][ T898] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 490.503409][ T898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.511576][ T898] usb 4-1: Product: syz [ 490.515756][ T898] usb 4-1: Manufacturer: syz [ 490.520464][ T898] usb 4-1: SerialNumber: syz [ 490.526907][ T898] usb 4-1: config 0 descriptor?? [ 490.534706][ T898] gs_usb 4-1:0.0: Required endpoints not found [ 490.607993][ T7796] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 490.618183][ T5972] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 490.628322][ T7796] usb 3-1: device descriptor read/8, error -71 [ 490.736705][T12590] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 490.767915][ T5972] usb 1-1: Using ep0 maxpacket: 16 [ 490.775041][ T5972] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 490.785654][ T5972] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 490.796996][ T5972] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 490.807515][ T5972] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 490.817434][ T5972] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 490.834107][ T5972] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 490.843736][ T5972] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 490.852084][ T5972] usb 1-1: Manufacturer: syz [ 490.859893][ T5972] usb 1-1: config 0 descriptor?? [ 490.888006][ T7796] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 490.908668][ T7796] usb 3-1: device descriptor read/8, error -71 [ 490.924681][ T5951] usb 4-1: USB disconnect, device number 37 [ 491.018770][ T7796] usb usb3-port1: unable to enumerate USB device [ 491.117964][ T5972] rc_core: IR keymap rc-hauppauge not found [ 491.123912][ T5972] Registered IR keymap rc-empty [ 491.132157][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.158017][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.178704][ T5972] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 491.191856][ T5972] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input85 [ 491.206270][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.228032][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.247962][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.267996][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.288002][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.308014][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.327945][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.348019][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.367920][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.388031][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 491.409297][ T5972] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 491.418669][ T5972] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 491.531826][ T5972] usb 1-1: USB disconnect, device number 49 [ 491.827984][ T898] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 491.900389][T12616] netlink: 'syz.2.2214': attribute type 21 has an invalid length. [ 491.910482][T12616] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2214'. [ 491.988047][ T898] usb 4-1: Using ep0 maxpacket: 8 [ 491.996415][ T898] usb 4-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2 [ 492.005646][ T898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.013880][ T898] usb 4-1: Product: syz [ 492.019384][ T898] usb 4-1: Manufacturer: syz [ 492.024256][ T898] usb 4-1: SerialNumber: syz [ 492.034541][ T898] usb 4-1: config 0 descriptor?? [ 492.079661][T12628] misc userio: Can't change port type on an already running userio instance [ 492.135552][T12630] tun0: tun_chr_ioctl cmd 21731 [ 492.246034][ T898] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 493.664596][ T898] gspca_sunplus: reg_w_riv err -71 [ 493.671546][ T898] sunplus 4-1:0.0: probe with driver sunplus failed with error -71 [ 493.681912][ T898] usb 4-1: USB disconnect, device number 38 [ 493.727956][ T7796] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 493.767921][ T5951] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 493.877872][ T7796] usb 1-1: Using ep0 maxpacket: 16 [ 493.884537][ T7796] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 493.894711][ T7796] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 493.905727][ T7796] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 493.915621][ T7796] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 493.925419][ T7796] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 493.941062][ T7796] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 493.950456][ T5951] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 493.961516][ T7796] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 493.969622][ T5951] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 493.979448][ T7796] usb 1-1: Manufacturer: syz [ 493.984939][ T5951] usb 2-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 493.995003][ T7796] usb 1-1: config 0 descriptor?? [ 494.000173][ T5951] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.012504][ T5951] usb 2-1: config 0 descriptor?? [ 494.206790][T12650] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 494.214117][T12650] IPv6: NLM_F_CREATE should be set when creating new route [ 494.221435][T12650] IPv6: NLM_F_CREATE should be set when creating new route [ 494.228801][T12650] IPv6: NLM_F_CREATE should be set when creating new route [ 494.308185][ T7796] rc_core: IR keymap rc-hauppauge not found [ 494.314447][ T7796] Registered IR keymap rc-empty [ 494.322611][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.348373][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.370835][ T7796] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 494.386733][ T7796] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input87 [ 494.402320][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.428195][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.448962][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.457594][ T5951] hid-steam 0003:28DE:1142.0024: unknown main item tag 0x0 [ 494.470665][ T5951] hid-steam 0003:28DE:1142.0024: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 494.488321][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.502220][T12660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 494.508016][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.512017][T12660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 494.538581][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.545767][ T5951] hid-steam 0003:28DE:1142.0024: Steam wireless receiver connected [ 494.554234][ T5951] hid-steam 0003:28DE:1142.0024: No HID_FEATURE_REPORT submitted - nothing to read [ 494.568822][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.576664][ T5951] hid-steam 0003:28DE:1142.0025: unknown main item tag 0x0 [ 494.589596][ T5951] hid-steam 0003:28DE:1142.0025: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 494.601413][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.638059][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.646313][ T5951] usb 2-1: USB disconnect, device number 32 [ 494.659601][ T7796] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 494.675599][ T5951] hid-steam 0003:28DE:1142.0024: Steam wireless receiver disconnected [ 494.692151][ T7796] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 494.701925][ T7796] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 494.721945][ T7796] usb 1-1: USB disconnect, device number 50 [ 494.738534][ T5972] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 494.897968][ T5972] usb 4-1: Using ep0 maxpacket: 16 [ 494.905048][ T5972] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 494.915553][ T5972] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 494.927364][ T5972] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 494.938025][ T5972] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 494.947667][ T5972] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 494.963160][ T5972] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 494.982855][ T5972] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 495.003887][ T5972] usb 4-1: Manufacturer: syz [ 495.012848][ T5972] usb 4-1: config 0 descriptor?? [ 495.020305][T12663] netlink: 'syz.0.2230': attribute type 10 has an invalid length. [ 495.287985][ T5972] rc_core: IR keymap rc-hauppauge not found [ 495.294173][ T5972] Registered IR keymap rc-empty [ 495.309976][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.338964][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.360177][ T5972] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 495.374715][ T5972] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input88 [ 495.395641][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.424512][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.458919][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.466268][ T7796] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 495.497938][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.521704][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.548335][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.568163][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.588356][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.608506][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.627942][ T7796] usb 2-1: Using ep0 maxpacket: 8 [ 495.633465][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 495.642688][ T7796] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 495.650888][ T7796] usb 2-1: config 0 has no interface number 0 [ 495.657005][ T7796] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 495.670487][ T5972] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 495.678629][ T7796] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 495.690548][ T5972] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 495.700038][ T7796] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 495.713486][ T7796] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 495.727176][ T7796] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 495.737715][ T5972] usb 4-1: USB disconnect, device number 39 [ 495.744348][ T7796] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.777495][ T7796] usb 2-1: config 0 descriptor?? [ 495.814624][ T7796] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 495.828108][ T5869] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 496.008288][ T5869] usb 3-1: Using ep0 maxpacket: 16 [ 496.016157][ T5869] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 496.026950][ T5869] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 496.038161][ T5869] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 496.047984][ T5869] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 496.050487][ T7796] usb 2-1: USB disconnect, device number 33 [ 496.057713][ C0] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 496.071474][T12696] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2241'. [ 496.080949][T12699] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2241'. [ 496.081521][ T5869] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 496.106576][ T5869] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 496.116041][ T5869] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 496.124286][ T5869] usb 3-1: Manufacturer: syz [ 496.131358][ T5869] usb 3-1: config 0 descriptor?? [ 496.177998][ T5972] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 496.287249][ T7796] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 496.287529][T12674] ldusb: No device or device unplugged -19 [ 496.328689][ T5972] usb 4-1: Using ep0 maxpacket: 16 [ 496.335587][ T5972] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 496.353014][ T5972] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 496.364910][ T5972] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 496.374839][ T5972] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 496.384754][ T5972] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 496.399443][ T5972] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 496.408830][ T5972] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 496.416826][ T5972] usb 4-1: Manufacturer: syz [ 496.423247][ T5972] usb 4-1: config 0 descriptor?? [ 496.439094][ T5869] rc_core: IR keymap rc-hauppauge not found [ 496.445266][ T5869] Registered IR keymap rc-empty [ 496.451578][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.478016][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.499356][ T5869] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 496.512939][ T5869] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input89 [ 496.527650][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.548080][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.568054][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.588098][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.607982][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.627963][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.657322][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.678618][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.697982][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.698190][ T5972] rc_core: IR keymap rc-hauppauge not found [ 496.711206][ T5972] Registered IR keymap rc-empty [ 496.716199][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 496.720208][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 496.750513][ T5869] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 496.759820][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 496.760776][ T5869] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 496.789042][ T5972] rc rc1: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc1 [ 496.820988][ T898] usb 3-1: USB disconnect, device number 32 [ 496.826423][ T5972] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc1/input90 [ 496.873500][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 496.919730][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 496.948955][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 496.968876][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 496.988440][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 497.007981][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 497.038320][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 497.060341][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 497.081404][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 497.108864][ T5972] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 497.131498][ T5972] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 497.145723][ T5972] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 497.164478][ T5972] usb 4-1: USB disconnect, device number 40 [ 497.387036][T12729] fuse: Bad value for 'fd' [ 497.520326][ T7796] usb 2-1: new full-speed USB device number 34 using dummy_hcd [ 497.690211][ T7796] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 497.702687][ T7796] usb 2-1: config 0 has no interface number 0 [ 497.729077][ T7796] usb 2-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 497.749009][ T7796] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.761467][ T7796] usb 2-1: config 0 descriptor?? [ 497.789379][ T7796] usb 2-1: selecting invalid altsetting 1 [ 497.795285][ T7796] dvb_ttusb_budget: ttusb_init_controller: error [ 497.804663][ T7796] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 497.902958][ T7796] DVB: Unable to find symbol cx22700_attach() [ 497.949925][ T7796] DVB: Unable to find symbol tda10046_attach() [ 497.961344][ T7796] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 497.987738][ T7796] usb 2-1: USB disconnect, device number 34 [ 498.068648][ T5914] usb 1-1: new full-speed USB device number 51 using dummy_hcd [ 498.187925][ T898] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 498.219794][ T5914] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 498.228057][ T5914] usb 1-1: config 0 has no interface number 0 [ 498.234702][ T5914] usb 1-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 498.243790][ T5914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.253994][ T5914] usb 1-1: config 0 descriptor?? [ 498.263605][ T5914] usb 1-1: selecting invalid altsetting 1 [ 498.269897][ T5914] dvb_ttusb_budget: ttusb_init_controller: error [ 498.276240][ T5914] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 498.322348][ T5914] DVB: Unable to find symbol cx22700_attach() [ 498.338448][ T898] usb 3-1: Using ep0 maxpacket: 16 [ 498.350549][ T898] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 498.357375][ T5914] DVB: Unable to find symbol tda10046_attach() [ 498.361510][ T898] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 498.366931][ T5914] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 498.378947][ T898] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 498.391338][ T5972] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 498.406451][ T898] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 498.416350][ T898] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 498.435376][ T898] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 498.444849][ T898] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 498.453094][ T898] usb 3-1: Manufacturer: syz [ 498.460924][ T898] usb 3-1: config 0 descriptor?? [ 498.475350][ T5869] usb 1-1: USB disconnect, device number 51 [ 498.562351][ T5972] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 498.571899][ T5972] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.581464][ T5972] usb 4-1: Product: syz [ 498.585663][ T5972] usb 4-1: Manufacturer: syz [ 498.594470][ T5972] usb 4-1: SerialNumber: syz [ 498.610398][ T5972] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 498.690185][ T5914] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 498.739472][ T898] rc_core: IR keymap rc-hauppauge not found [ 498.745569][ T898] Registered IR keymap rc-empty [ 498.752194][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 498.777985][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 498.799036][ T898] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 498.812455][ T898] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input91 [ 498.827406][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 498.835151][ T10] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 498.858007][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 498.878096][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 498.900973][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 498.927993][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 498.948044][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 498.968335][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 498.987946][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 498.993487][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 499.003592][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.014230][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 499.026065][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 499.033478][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 499.044985][ T10] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 499.055048][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 499.069957][ T898] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 499.080855][ T10] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 499.092893][ T898] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 499.102893][ T10] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 499.111465][ T898] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 499.120539][ T10] usb 2-1: Manufacturer: syz [ 499.135833][ T10] usb 2-1: config 0 descriptor?? [ 499.165087][ T898] usb 3-1: USB disconnect, device number 33 [ 499.389545][ T5972] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 499.409827][ T10] rc_core: IR keymap rc-hauppauge not found [ 499.415899][ T10] Registered IR keymap rc-empty [ 499.421190][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.447979][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.471000][ T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 499.490070][ T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input92 [ 499.499035][ T5951] usb 4-1: USB disconnect, device number 41 [ 499.511865][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.528787][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.558759][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.569825][ T5972] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 499.578698][ T5972] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 499.589018][ T5972] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 499.591615][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.598318][ T5972] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 499.616899][ T5972] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 499.626087][ T5972] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 499.628325][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.634182][ T5972] usb 1-1: Product: syz [ 499.645663][ T5972] usb 1-1: Manufacturer: syz [ 499.657492][ T5972] cdc_wdm 1-1:1.0: skipping garbage [ 499.658031][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.671161][ T5972] cdc_wdm 1-1:1.0: skipping garbage [ 499.676494][ T5972] cdc_wdm 1-1:1.0: probe with driver cdc_wdm failed with error -22 [ 499.689946][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.727985][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.748192][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.767973][ T10] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 499.778240][ T5914] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 499.785694][ T5914] ath9k_htc: Failed to initialize the device [ 499.790418][ T10] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 499.795952][ T5951] usb 4-1: ath9k_htc: USB layer deinitialized [ 499.802958][ T10] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 499.826788][ T10] usb 2-1: USB disconnect, device number 35 [ 499.865228][T12778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.877642][T12778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.892140][T12778] pim6reg9: entered allmulticast mode [ 499.899998][T12778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.909025][T12778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.918929][ T898] usb 1-1: USB disconnect, device number 52 [ 500.171735][T12790] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 500.180659][T12791] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 500.498487][ T5870] Bluetooth: hci2: ACL packet for unknown connection handle 0 [ 500.650575][T12821] FAULT_INJECTION: forcing a failure. [ 500.650575][T12821] name failslab, interval 1, probability 0, space 0, times 0 [ 500.664026][T12821] CPU: 0 UID: 0 PID: 12821 Comm: syz.0.2283 Not tainted syzkaller #0 PREEMPT(full) [ 500.664041][T12821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 500.664049][T12821] Call Trace: [ 500.664055][T12821] [ 500.664061][T12821] dump_stack_lvl+0x189/0x250 [ 500.664077][T12821] ? __pfx____ratelimit+0x10/0x10 [ 500.664092][T12821] ? __pfx_dump_stack_lvl+0x10/0x10 [ 500.664101][T12821] ? __pfx__printk+0x10/0x10 [ 500.664122][T12821] ? __pfx___might_resched+0x10/0x10 [ 500.664142][T12821] ? fs_reclaim_acquire+0x7d/0x100 [ 500.664168][T12821] should_fail_ex+0x414/0x560 [ 500.664195][T12821] should_failslab+0xa8/0x100 [ 500.664220][T12821] __kmalloc_cache_noprof+0x6f/0x6f0 [ 500.664233][T12821] ? netlink_lookup+0x30/0x200 [ 500.664249][T12821] ? genl_start+0x1c9/0x6c0 [ 500.664263][T12821] genl_start+0x1c9/0x6c0 [ 500.664273][T12821] ? netlink_lookup+0x30/0x200 [ 500.664289][T12821] __netlink_dump_start+0x469/0x7e0 [ 500.664307][T12821] genl_family_rcv_msg_dumpit+0x1e7/0x2c0 [ 500.664321][T12821] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 500.664331][T12821] ? genl_get_cmd+0x7d9/0x910 [ 500.664344][T12821] ? __pfx_genl_start+0x10/0x10 [ 500.664352][T12821] ? __pfx_genl_dumpit+0x10/0x10 [ 500.664361][T12821] ? __pfx_genl_done+0x10/0x10 [ 500.664375][T12821] ? stack_trace_save+0x9c/0xe0 [ 500.664392][T12821] genl_rcv_msg+0x5da/0x790 [ 500.664406][T12821] ? __pfx_genl_rcv_msg+0x10/0x10 [ 500.664416][T12821] ? __pfx_netlbl_cipsov4_listall+0x10/0x10 [ 500.664438][T12821] netlink_rcv_skb+0x208/0x470 [ 500.664451][T12821] ? __lock_acquire+0xab9/0xd20 [ 500.664463][T12821] ? __pfx_genl_rcv_msg+0x10/0x10 [ 500.664473][T12821] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 500.664503][T12821] ? down_read+0x1ad/0x2e0 [ 500.664515][T12821] genl_rcv+0x28/0x40 [ 500.664525][T12821] netlink_unicast+0x82f/0x9e0 [ 500.664542][T12821] ? __pfx_netlink_unicast+0x10/0x10 [ 500.664555][T12821] ? netlink_sendmsg+0x642/0xb30 [ 500.664567][T12821] ? skb_put+0x11b/0x210 [ 500.664584][T12821] netlink_sendmsg+0x805/0xb30 [ 500.664602][T12821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 500.664618][T12821] ? aa_sock_msg_perm+0xf1/0x1d0 [ 500.664632][T12821] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 500.664646][T12821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 500.664660][T12821] __sock_sendmsg+0x21c/0x270 [ 500.664673][T12821] ____sys_sendmsg+0x505/0x830 [ 500.664686][T12821] ? __pfx_____sys_sendmsg+0x10/0x10 [ 500.664706][T12821] ? import_iovec+0x74/0xa0 [ 500.664720][T12821] ___sys_sendmsg+0x21f/0x2a0 [ 500.664730][T12821] ? __pfx____sys_sendmsg+0x10/0x10 [ 500.664759][T12821] ? __fget_files+0x2a/0x420 [ 500.664769][T12821] ? __fget_files+0x3a0/0x420 [ 500.664783][T12821] __x64_sys_sendmsg+0x19b/0x260 [ 500.664794][T12821] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 500.664808][T12821] ? __pfx_ksys_write+0x10/0x10 [ 500.664824][T12821] ? do_syscall_64+0xbe/0xfa0 [ 500.664836][T12821] do_syscall_64+0xfa/0xfa0 [ 500.664844][T12821] ? lockdep_hardirqs_on+0x9c/0x150 [ 500.664858][T12821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.664867][T12821] ? clear_bhb_loop+0x60/0xb0 [ 500.664879][T12821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.664889][T12821] RIP: 0033:0x7fd140f8eec9 [ 500.664900][T12821] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 500.664908][T12821] RSP: 002b:00007fd141da3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 500.664920][T12821] RAX: ffffffffffffffda RBX: 00007fd1411e5fa0 RCX: 00007fd140f8eec9 [ 500.664927][T12821] RDX: 00000000040440d0 RSI: 0000200000001240 RDI: 0000000000000004 [ 500.664933][T12821] RBP: 00007fd141da3090 R08: 0000000000000000 R09: 0000000000000000 [ 500.664940][T12821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 500.664945][T12821] R13: 00007fd1411e6038 R14: 00007fd1411e5fa0 R15: 00007fff9776fa78 [ 500.664962][T12821] [ 501.048954][ T5951] usb 3-1: new full-speed USB device number 34 using dummy_hcd [ 501.178035][ T898] usb 4-1: new low-speed USB device number 42 using dummy_hcd [ 501.208438][ T5951] usb 3-1: device descriptor read/64, error -71 [ 501.327909][ T898] usb 4-1: Invalid ep0 maxpacket: 16 [ 501.327931][ T5972] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 501.447970][ T5951] usb 3-1: new full-speed USB device number 35 using dummy_hcd [ 501.467957][ T898] usb 4-1: new low-speed USB device number 43 using dummy_hcd [ 501.489165][ T5972] usb 1-1: Using ep0 maxpacket: 16 [ 501.495966][ T5972] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 501.506192][ T5972] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 501.517140][ T5972] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 501.527086][ T5972] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 501.537084][ T5972] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 501.555173][ T5972] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 501.564437][ T5972] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 501.572541][ T5972] usb 1-1: Manufacturer: syz [ 501.579551][ T5972] usb 1-1: config 0 descriptor?? [ 501.587941][ T5951] usb 3-1: device descriptor read/64, error -71 [ 501.627896][ T898] usb 4-1: Invalid ep0 maxpacket: 16 [ 501.633649][ T898] usb usb4-port1: attempt power cycle [ 501.698267][ T5951] usb usb3-port1: attempt power cycle [ 501.837988][ T5972] rc_core: IR keymap rc-hauppauge not found [ 501.843978][ T5972] Registered IR keymap rc-empty [ 501.849544][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.867999][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.888865][ T5972] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 501.901950][ T5972] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input93 [ 501.917153][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.940418][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.958290][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.977981][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 501.987940][ T898] usb 4-1: new low-speed USB device number 44 using dummy_hcd [ 501.998010][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 502.008567][ T898] usb 4-1: Invalid ep0 maxpacket: 16 [ 502.018152][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 502.038161][ T5951] usb 3-1: new full-speed USB device number 36 using dummy_hcd [ 502.046318][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 502.068071][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 502.075786][ T5951] usb 3-1: device descriptor read/8, error -71 [ 502.087997][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 502.108004][ T5972] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 502.130514][ T5972] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 502.140414][ T5972] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 502.159923][ T898] usb 4-1: new low-speed USB device number 45 using dummy_hcd [ 502.191249][ T898] usb 4-1: Invalid ep0 maxpacket: 16 [ 502.199715][ T898] usb usb4-port1: unable to enumerate USB device [ 502.264685][ T5869] usb 1-1: USB disconnect, device number 53 [ 502.317940][ T5951] usb 3-1: new full-speed USB device number 37 using dummy_hcd [ 502.338659][ T5951] usb 3-1: device descriptor read/8, error -71 [ 502.448431][ T5951] usb usb3-port1: unable to enumerate USB device [ 502.507964][ T898] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 502.671915][ T898] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 502.681214][ T898] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.689244][ T898] usb 2-1: Product: syz [ 502.693403][ T898] usb 2-1: Manufacturer: syz [ 502.698042][ T898] usb 2-1: SerialNumber: syz [ 502.707096][ T898] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 502.726257][ T5869] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 502.983721][T12849] FAULT_INJECTION: forcing a failure. [ 502.983721][T12849] name failslab, interval 1, probability 0, space 0, times 0 [ 502.996562][T12849] CPU: 1 UID: 0 PID: 12849 Comm: syz.0.2293 Not tainted syzkaller #0 PREEMPT(full) [ 502.996585][T12849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 502.996596][T12849] Call Trace: [ 502.996604][T12849] [ 502.996612][T12849] dump_stack_lvl+0x189/0x250 [ 502.996635][T12849] ? __pfx____ratelimit+0x10/0x10 [ 502.996659][T12849] ? __pfx_dump_stack_lvl+0x10/0x10 [ 502.996670][T12849] ? __pfx__printk+0x10/0x10 [ 502.996687][T12849] ? __pfx___might_resched+0x10/0x10 [ 502.996708][T12849] should_fail_ex+0x414/0x560 [ 502.996736][T12849] should_failslab+0xa8/0x100 [ 502.996761][T12849] __kvmalloc_node_noprof+0x158/0x910 [ 502.996785][T12849] ? __kvm_mmu_topup_memory_cache+0x463/0x610 [ 502.996813][T12849] __kvm_mmu_topup_memory_cache+0x463/0x610 [ 502.996833][T12849] mmu_topup_memory_caches+0x21/0x170 [ 502.996850][T12849] kvm_mmu_load+0x9d/0x2300 [ 502.996863][T12849] ? kvm_msr_allowed+0x9a/0x490 [ 502.996877][T12849] ? kvm_msr_allowed+0x9a/0x490 [ 502.996894][T12849] ? kvm_msr_allowed+0x9a/0x490 [ 502.996910][T12849] ? kvm_msr_allowed+0x3f4/0x490 [ 502.996927][T12849] ? kvm_msr_allowed+0x9a/0x490 [ 502.996943][T12849] ? kvm_apic_has_interrupt+0x744/0x770 [ 502.996974][T12849] vcpu_run+0x48a8/0x7040 [ 502.997032][T12849] ? __pfx_vcpu_run+0x10/0x10 [ 502.997054][T12849] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940 [ 502.997081][T12849] ? rcu_is_watching+0x15/0xb0 [ 502.997107][T12849] kvm_arch_vcpu_ioctl_run+0xfc9/0x1940 [ 502.997132][T12849] ? __mutex_trylock_common+0x153/0x260 [ 502.997153][T12849] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940 [ 502.997163][T12849] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 502.997175][T12849] ? rcu_is_watching+0x15/0xb0 [ 502.997187][T12849] ? trace_contention_end+0x39/0x120 [ 502.997199][T12849] ? look_up_lock_class+0x74/0x170 [ 502.997223][T12849] ? register_lock_class+0x51/0x320 [ 502.997248][T12849] ? __lock_acquire+0xab9/0xd20 [ 502.997297][T12849] kvm_vcpu_ioctl+0x95c/0xe90 [ 502.997318][T12849] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 502.997346][T12849] ? __fget_files+0x2a/0x420 [ 502.997359][T12849] ? __fget_files+0x3a0/0x420 [ 502.997367][T12849] ? __fget_files+0x2a/0x420 [ 502.997382][T12849] ? bpf_lsm_file_ioctl+0x9/0x20 [ 502.997399][T12849] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 502.997417][T12849] __se_sys_ioctl+0xfc/0x170 [ 502.997441][T12849] do_syscall_64+0xfa/0xfa0 [ 502.997456][T12849] ? lockdep_hardirqs_on+0x9c/0x150 [ 502.997479][T12849] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.997490][T12849] ? clear_bhb_loop+0x60/0xb0 [ 502.997502][T12849] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.997511][T12849] RIP: 0033:0x7fd140f8eec9 [ 502.997521][T12849] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 502.997532][T12849] RSP: 002b:00007fd141da3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 502.997545][T12849] RAX: ffffffffffffffda RBX: 00007fd1411e5fa0 RCX: 00007fd140f8eec9 [ 502.997557][T12849] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000009 [ 502.997568][T12849] RBP: 00007fd141da3090 R08: 0000000000000000 R09: 0000000000000000 [ 502.997580][T12849] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 502.997590][T12849] R13: 00007fd1411e6038 R14: 00007fd1411e5fa0 R15: 00007fff9776fa78 [ 502.997622][T12849] [ 503.321152][ C1] vkms_vblank_simulate: vblank timer overrun [ 503.353405][ T5972] usb 2-1: USB disconnect, device number 36 [ 503.594047][T12861] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2296'. [ 503.632026][T12863] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2298'. [ 503.782142][ T5869] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 503.792523][ T5869] ath9k_htc: Failed to initialize the device [ 503.800081][ T5972] usb 2-1: ath9k_htc: USB layer deinitialized [ 503.952423][T12876] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2302'. [ 503.967932][ T5954] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 504.127894][ T5954] usb 4-1: Using ep0 maxpacket: 16 [ 504.139902][ T5954] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 504.160493][ T5954] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 504.184341][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 504.190917][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 504.190919][ T5954] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 504.190943][ T5954] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 504.204605][T12886] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 504.209057][ T5954] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 504.279597][ T5954] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 504.288965][ T5954] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 504.296976][ T5954] usb 4-1: Manufacturer: syz [ 504.318274][ T5954] usb 4-1: config 0 descriptor?? [ 504.388033][ T5869] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 504.443237][T12893] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 504.461411][ T30] audit: type=1804 audit(1758551678.548:46): pid=12893 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.2311" name="/newroot/28/cgroup.controllers" dev="tmpfs" ino=158 res=1 errno=0 [ 504.483709][ C1] vkms_vblank_simulate: vblank timer overrun [ 504.490216][ T30] audit: type=1800 audit(1758551678.558:47): pid=12893 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2311" name="cgroup.controllers" dev="tmpfs" ino=158 res=0 errno=0 [ 504.537941][ T5869] usb 1-1: Using ep0 maxpacket: 8 [ 504.546992][ T5869] usb 1-1: config 12 has an invalid interface number: 84 but max is 1 [ 504.555424][ T898] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 504.563090][ T5869] usb 1-1: config 12 has an invalid interface number: 110 but max is 1 [ 504.572565][ T5869] usb 1-1: config 12 has an invalid descriptor of length 0, skipping remainder of the config [ 504.581166][ T5954] rc_core: IR keymap rc-hauppauge not found [ 504.584456][ T5869] usb 1-1: config 12 has no interface number 0 [ 504.594859][ T5869] usb 1-1: config 12 has no interface number 1 [ 504.601157][ T5869] usb 1-1: config 12 interface 110 altsetting 223 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 504.603792][ T5954] Registered IR keymap rc-empty [ 504.614525][ T5869] usb 1-1: config 12 interface 84 has no altsetting 0 [ 504.614550][ T5869] usb 1-1: config 12 interface 110 has no altsetting 0 [ 504.633525][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.634962][ T5869] usb 1-1: string descriptor 0 read error: -22 [ 504.647084][ T5869] usb 1-1: New USB device found, idVendor=0921, idProduct=1200, bcdDevice=f6.1b [ 504.656757][ T5869] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.675157][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.684278][ T5869] belkin_sa 1-1:12.84: Belkin / Peracom / GoHubs USB Serial Adapter converter detected [ 504.694972][ T5869] usb 1-1: bcdDevice: f61b, bfc: 0 [ 504.701534][ T5869] usb 1-1: Belkin / Peracom / GoHubs USB Serial Adapter converter now attached to ttyUSB0 [ 504.709247][ T5954] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 504.726350][ T5954] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input94 [ 504.732887][ T5869] cdc_ether 1-1:12.110: skipping garbage [ 504.746898][ T5869] cdc_ether 1-1:12.110: skipping garbage [ 504.747778][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.754257][ T898] usb 3-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 504.771680][ T5869] usb 1-1: bad CDC descriptors [ 504.777353][ T5869] belkin_sa 1-1:12.110: Belkin / Peracom / GoHubs USB Serial Adapter converter detected [ 504.787209][ T898] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=16 [ 504.788070][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.796667][ T5869] usb 1-1: bcdDevice: f61b, bfc: 0 [ 504.808148][ T898] usb 3-1: SerialNumber: syz [ 504.815309][ T898] usb 3-1: config 0 descriptor?? [ 504.823153][ T5869] usb 1-1: Belkin / Peracom / GoHubs USB Serial Adapter converter now attached to ttyUSB1 [ 504.828184][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.878193][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.908179][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.927976][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.947999][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.964743][ T5869] usb 1-1: USB disconnect, device number 54 [ 504.968019][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 504.984632][ T5869] belkin ttyUSB0: Belkin / Peracom / GoHubs USB Serial Adapter converter now disconnected from ttyUSB0 [ 504.996823][ T5869] belkin_sa 1-1:12.84: device disconnected [ 504.998094][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 505.012679][ T5869] belkin ttyUSB1: Belkin / Peracom / GoHubs USB Serial Adapter converter now disconnected from ttyUSB1 [ 505.029313][ T5954] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 505.030265][ T5869] belkin_sa 1-1:12.110: device disconnected [ 505.045170][T12889] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.056652][T12889] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.067597][ T5954] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 505.078652][ T5954] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 505.101716][ T5954] usb 4-1: USB disconnect, device number 46 [ 505.265367][ T898] hackrf 3-1:0.0: usb_control_msg() failed -32 request 0e [ 505.281387][ T898] hackrf 3-1:0.0: Could not detect board [ 505.288802][ T898] hackrf 3-1:0.0: probe with driver hackrf failed with error -32 [ 505.299821][ T898] usb 3-1: USB disconnect, device number 38 [ 505.513263][T12904] FAULT_INJECTION: forcing a failure. [ 505.513263][T12904] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 505.526555][T12904] CPU: 0 UID: 0 PID: 12904 Comm: syz.0.2313 Not tainted syzkaller #0 PREEMPT(full) [ 505.526579][T12904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 505.526590][T12904] Call Trace: [ 505.526597][T12904] [ 505.526606][T12904] dump_stack_lvl+0x189/0x250 [ 505.526630][T12904] ? __pfx____ratelimit+0x10/0x10 [ 505.526654][T12904] ? __pfx_dump_stack_lvl+0x10/0x10 [ 505.526671][T12904] ? __pfx__printk+0x10/0x10 [ 505.526695][T12904] ? __might_fault+0xb0/0x130 [ 505.526734][T12904] should_fail_ex+0x414/0x560 [ 505.526762][T12904] _copy_from_user+0x2d/0xb0 [ 505.526789][T12904] input_event_from_user+0xb2/0x280 [ 505.526809][T12904] ? __pfx_input_event_from_user+0x10/0x10 [ 505.526834][T12904] ? input_inject_event+0xb6/0x340 [ 505.526858][T12904] evdev_write+0x2a6/0x480 [ 505.526882][T12904] ? __pfx_evdev_write+0x10/0x10 [ 505.526901][T12904] ? bpf_lsm_file_permission+0x9/0x20 [ 505.526917][T12904] ? security_file_permission+0x75/0x290 [ 505.526937][T12904] ? rw_verify_area+0x255/0x4d0 [ 505.526958][T12904] ? __lock_acquire+0xab9/0xd20 [ 505.526976][T12904] ? __pfx_evdev_write+0x10/0x10 [ 505.526995][T12904] vfs_write+0x27e/0xb30 [ 505.527026][T12904] ? __pfx_vfs_write+0x10/0x10 [ 505.527051][T12904] ? __fget_files+0x2a/0x420 [ 505.527071][T12904] ? __fget_files+0x2a/0x420 [ 505.527087][T12904] ? __fget_files+0x3a0/0x420 [ 505.527102][T12904] ? __fget_files+0x2a/0x420 [ 505.527128][T12904] ksys_write+0x145/0x250 [ 505.527153][T12904] ? __pfx_ksys_write+0x10/0x10 [ 505.527180][T12904] ? do_syscall_64+0xbe/0xfa0 [ 505.527201][T12904] do_syscall_64+0xfa/0xfa0 [ 505.527215][T12904] ? lockdep_hardirqs_on+0x9c/0x150 [ 505.527239][T12904] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 505.527256][T12904] ? clear_bhb_loop+0x60/0xb0 [ 505.527278][T12904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 505.527294][T12904] RIP: 0033:0x7fd140f8eec9 [ 505.527311][T12904] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 505.527326][T12904] RSP: 002b:00007fd141da3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 505.527345][T12904] RAX: ffffffffffffffda RBX: 00007fd1411e5fa0 RCX: 00007fd140f8eec9 [ 505.527358][T12904] RDX: 0000000000002250 RSI: 0000200000000040 RDI: 0000000000000003 [ 505.527369][T12904] RBP: 00007fd141da3090 R08: 0000000000000000 R09: 0000000000000000 [ 505.527381][T12904] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 505.527391][T12904] R13: 00007fd1411e6038 R14: 00007fd1411e5fa0 R15: 00007fff9776fa78 [ 505.527423][T12904] [ 505.937707][T12915] delete_channel: no stack [ 505.944874][T12915] delete_channel: no stack [ 506.366112][T12927] FAULT_INJECTION: forcing a failure. [ 506.366112][T12927] name failslab, interval 1, probability 0, space 0, times 0 [ 506.385634][T12927] CPU: 1 UID: 0 PID: 12927 Comm: syz.3.2322 Not tainted syzkaller #0 PREEMPT(full) [ 506.385659][T12927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 506.385677][T12927] Call Trace: [ 506.385685][T12927] [ 506.385694][T12927] dump_stack_lvl+0x189/0x250 [ 506.385717][T12927] ? __pfx____ratelimit+0x10/0x10 [ 506.385740][T12927] ? __pfx_dump_stack_lvl+0x10/0x10 [ 506.385757][T12927] ? __pfx__printk+0x10/0x10 [ 506.385786][T12927] ? __pfx___might_resched+0x10/0x10 [ 506.385811][T12927] should_fail_ex+0x414/0x560 [ 506.385839][T12927] should_failslab+0xa8/0x100 [ 506.385865][T12927] __kvmalloc_node_noprof+0x158/0x910 [ 506.385889][T12927] ? __kvm_mmu_topup_memory_cache+0x463/0x610 [ 506.385920][T12927] __kvm_mmu_topup_memory_cache+0x463/0x610 [ 506.385956][T12927] mmu_topup_memory_caches+0x21/0x170 [ 506.385980][T12927] kvm_mmu_load+0x9d/0x2300 [ 506.386000][T12927] ? kvm_msr_allowed+0x9a/0x490 [ 506.386017][T12927] ? kvm_msr_allowed+0x9a/0x490 [ 506.386033][T12927] ? kvm_msr_allowed+0x9a/0x490 [ 506.386048][T12927] ? kvm_msr_allowed+0x3f4/0x490 [ 506.386063][T12927] ? kvm_msr_allowed+0x9a/0x490 [ 506.386080][T12927] ? kvm_apic_has_interrupt+0x744/0x770 [ 506.386109][T12927] vcpu_run+0x48a8/0x7040 [ 506.386203][T12927] ? __pfx_vcpu_run+0x10/0x10 [ 506.386229][T12927] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940 [ 506.386256][T12927] ? rcu_is_watching+0x15/0xb0 [ 506.386282][T12927] kvm_arch_vcpu_ioctl_run+0xfc9/0x1940 [ 506.386306][T12927] ? __mutex_trylock_common+0x153/0x260 [ 506.386332][T12927] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940 [ 506.386351][T12927] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 506.386372][T12927] ? rcu_is_watching+0x15/0xb0 [ 506.386393][T12927] ? trace_contention_end+0x39/0x120 [ 506.386414][T12927] ? look_up_lock_class+0x74/0x170 [ 506.386441][T12927] ? register_lock_class+0x51/0x320 [ 506.386466][T12927] ? __lock_acquire+0xab9/0xd20 [ 506.386515][T12927] kvm_vcpu_ioctl+0x95c/0xe90 [ 506.386540][T12927] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 506.386582][T12927] ? __fget_files+0x2a/0x420 [ 506.386604][T12927] ? __fget_files+0x3a0/0x420 [ 506.386620][T12927] ? __fget_files+0x2a/0x420 [ 506.386640][T12927] ? bpf_lsm_file_ioctl+0x9/0x20 [ 506.386657][T12927] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 506.386680][T12927] __se_sys_ioctl+0xfc/0x170 [ 506.386705][T12927] do_syscall_64+0xfa/0xfa0 [ 506.386719][T12927] ? lockdep_hardirqs_on+0x9c/0x150 [ 506.386743][T12927] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.386760][T12927] ? clear_bhb_loop+0x60/0xb0 [ 506.386781][T12927] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.386798][T12927] RIP: 0033:0x7f226638eec9 [ 506.386814][T12927] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 506.386829][T12927] RSP: 002b:00007f22672c7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 506.386848][T12927] RAX: ffffffffffffffda RBX: 00007f22665e5fa0 RCX: 00007f226638eec9 [ 506.386861][T12927] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 506.386872][T12927] RBP: 00007f22672c7090 R08: 0000000000000000 R09: 0000000000000000 [ 506.386880][T12927] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 506.386889][T12927] R13: 00007f22665e6038 R14: 00007f22665e5fa0 R15: 00007ffe60d2ac48 [ 506.386922][T12927] [ 506.857923][ T5869] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 506.968058][ T5954] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 507.055392][ T5869] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 507.069931][ T5869] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 507.086711][ T5869] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 507.117897][ T5954] usb 2-1: Using ep0 maxpacket: 16 [ 507.127556][ T5869] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 507.138404][ T5954] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 507.140239][ T5869] usb 1-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 507.148799][ T5954] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 507.158299][ T5869] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.178964][ T5869] usb 1-1: Product: syz [ 507.183144][ T5869] usb 1-1: Manufacturer: syz [ 507.187735][ T5869] usb 1-1: SerialNumber: syz [ 507.192746][ T5954] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 507.202985][ T5954] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 507.208862][ T5869] usb 1-1: config 0 descriptor?? [ 507.222145][ T5954] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 507.239159][ T5954] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 507.239543][ T5869] ums-isd200 1-1:0.0: USB Mass Storage device detected [ 507.255640][ T5954] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 507.280772][ T5954] usb 2-1: Manufacturer: syz [ 507.297637][ T5954] usb 2-1: config 0 descriptor?? [ 507.368200][ T7186] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 507.425920][T12954] FAULT_INJECTION: forcing a failure. [ 507.425920][T12954] name failslab, interval 1, probability 0, space 0, times 0 [ 507.441092][T12954] CPU: 0 UID: 0 PID: 12954 Comm: syz.3.2331 Not tainted syzkaller #0 PREEMPT(full) [ 507.441117][T12954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 507.441127][T12954] Call Trace: [ 507.441135][T12954] [ 507.441143][T12954] dump_stack_lvl+0x189/0x250 [ 507.441170][T12954] ? __pfx____ratelimit+0x10/0x10 [ 507.441194][T12954] ? __pfx_dump_stack_lvl+0x10/0x10 [ 507.441211][T12954] ? __pfx__printk+0x10/0x10 [ 507.441239][T12954] ? __pfx___might_resched+0x10/0x10 [ 507.441259][T12954] ? fs_reclaim_acquire+0x7d/0x100 [ 507.441286][T12954] should_fail_ex+0x414/0x560 [ 507.441314][T12954] should_failslab+0xa8/0x100 [ 507.441339][T12954] __kmalloc_noprof+0xcb/0x7f0 [ 507.441368][T12954] ? tomoyo_encode+0x28b/0x550 [ 507.441393][T12954] tomoyo_encode+0x28b/0x550 [ 507.441415][T12954] tomoyo_realpath_from_path+0x58d/0x5d0 [ 507.441433][T12954] ? tomoyo_domain+0xd9/0x130 [ 507.441459][T12954] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 507.441475][T12954] tomoyo_path_number_perm+0x1e8/0x5a0 [ 507.441494][T12954] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 507.441540][T12954] ? __fget_files+0x2a/0x420 [ 507.441571][T12954] ? __fget_files+0x3a0/0x420 [ 507.441586][T12954] ? __fget_files+0x2a/0x420 [ 507.441605][T12954] security_file_ioctl+0xcb/0x2d0 [ 507.441621][T12954] __se_sys_ioctl+0x47/0x170 [ 507.441642][T12954] do_syscall_64+0xfa/0xfa0 [ 507.441657][T12954] ? lockdep_hardirqs_on+0x9c/0x150 [ 507.441684][T12954] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.441701][T12954] ? clear_bhb_loop+0x60/0xb0 [ 507.441720][T12954] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.441736][T12954] RIP: 0033:0x7f226638eec9 [ 507.441752][T12954] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 507.441766][T12954] RSP: 002b:00007f22672c7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 507.441784][T12954] RAX: ffffffffffffffda RBX: 00007f22665e5fa0 RCX: 00007f226638eec9 [ 507.441796][T12954] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 507.441807][T12954] RBP: 00007f22672c7090 R08: 0000000000000000 R09: 0000000000000000 [ 507.441817][T12954] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 507.441827][T12954] R13: 00007f22665e6038 R14: 00007f22665e5fa0 R15: 00007ffe60d2ac48 [ 507.441855][T12954] [ 507.441895][T12954] ERROR: Out of memory at tomoyo_realpath_from_path. [ 507.445501][T12933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.539591][ T7186] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 507.594640][T12955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.603515][ T7186] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 507.648196][T12933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.652595][ T7186] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 507.670615][T12955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.678990][ T7186] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 507.701437][ T5954] rc_core: IR keymap rc-hauppauge not found [ 507.729749][ T7186] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.762497][ T7186] usb 3-1: config 0 descriptor?? [ 507.794659][ T5954] Registered IR keymap rc-empty [ 507.799778][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 507.817965][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 507.833693][ T5869] ums-isd200 1-1:0.0: probe with driver ums-isd200 failed with error -22 [ 507.848152][ T5954] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 507.886795][ T5954] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input95 [ 507.903907][T12955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.912824][T12933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.928872][T12955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.936815][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 507.946586][T12933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.960073][ T5972] usb 1-1: USB disconnect, device number 55 [ 508.000102][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 508.018221][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 508.040704][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 508.067973][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 508.088369][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 508.107994][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 508.128539][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 508.148217][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 508.168025][ T5954] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 508.194214][ T7186] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0 [ 508.194670][ T5954] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 508.202122][ T7186] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0 [ 508.230957][ T5954] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 508.234513][ T7186] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0 [ 508.247168][ T7186] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0 [ 508.254185][ T5954] usb 2-1: USB disconnect, device number 37 [ 508.261777][ T7186] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0 [ 508.269884][ T7186] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0 [ 508.277559][ T7186] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0 [ 508.285630][ T7186] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0 [ 508.293175][ T7186] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0 [ 508.301024][ T7186] plantronics 0003:047F:FFFF.0026: unknown main item tag 0x0 [ 508.328589][ T7186] plantronics 0003:047F:FFFF.0026: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 508.467966][ T5869] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 508.474985][ T5954] usb 3-1: USB disconnect, device number 39 [ 508.630544][ T5869] usb 4-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 508.639763][ T5869] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.658863][ T5869] usb 4-1: config 0 descriptor?? [ 508.670335][ T5869] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 508.801173][T12985] FAULT_INJECTION: forcing a failure. [ 508.801173][T12985] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 508.816061][T12985] CPU: 1 UID: 0 PID: 12985 Comm: syz.1.2340 Not tainted syzkaller #0 PREEMPT(full) [ 508.816087][T12985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 508.816099][T12985] Call Trace: [ 508.816107][T12985] [ 508.816115][T12985] dump_stack_lvl+0x189/0x250 [ 508.816138][T12985] ? __pfx____ratelimit+0x10/0x10 [ 508.816162][T12985] ? __pfx_dump_stack_lvl+0x10/0x10 [ 508.816178][T12985] ? __pfx__printk+0x10/0x10 [ 508.816201][T12985] ? __might_fault+0xb0/0x130 [ 508.816231][T12985] should_fail_ex+0x414/0x560 [ 508.816260][T12985] _copy_from_user+0x2d/0xb0 [ 508.816281][T12985] ___sys_sendmsg+0x158/0x2a0 [ 508.816302][T12985] ? __pfx____sys_sendmsg+0x10/0x10 [ 508.816351][T12985] ? __fget_files+0x2a/0x420 [ 508.816367][T12985] ? __fget_files+0x3a0/0x420 [ 508.816392][T12985] __x64_sys_sendmsg+0x19b/0x260 [ 508.816411][T12985] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 508.816436][T12985] ? __pfx_ksys_write+0x10/0x10 [ 508.816462][T12985] ? do_syscall_64+0xbe/0xfa0 [ 508.816481][T12985] do_syscall_64+0xfa/0xfa0 [ 508.816496][T12985] ? lockdep_hardirqs_on+0x9c/0x150 [ 508.816519][T12985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.816536][T12985] ? clear_bhb_loop+0x60/0xb0 [ 508.816557][T12985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.816573][T12985] RIP: 0033:0x7f7b0af8eec9 [ 508.816589][T12985] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 508.816605][T12985] RSP: 002b:00007f7b0be4d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 508.816625][T12985] RAX: ffffffffffffffda RBX: 00007f7b0b1e5fa0 RCX: 00007f7b0af8eec9 [ 508.816638][T12985] RDX: 0000000000008000 RSI: 0000200000000040 RDI: 0000000000000004 [ 508.816650][T12985] RBP: 00007f7b0be4d090 R08: 0000000000000000 R09: 0000000000000000 [ 508.816670][T12985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 508.816681][T12985] R13: 00007f7b0b1e6038 R14: 00007f7b0b1e5fa0 R15: 00007fffdc1dd448 [ 508.816711][T12985] [ 509.072911][T12987] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.098753][ T5869] gspca_cpia1: usb_control_msg 03, error -71 [ 509.105259][ T5869] gspca_cpia1: usb_control_msg 01, error -71 [ 509.120832][ T5869] cpia1 4-1:0.0: only firmware version 1 is supported (got: 0) [ 509.141945][ T5869] usb 4-1: USB disconnect, device number 47 [ 509.226868][T12987] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.295796][T12987] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.359223][ T5954] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 509.382149][T12987] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.438847][ T5972] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 509.471269][ T1110] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 509.487720][T12638] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 509.504700][ T1110] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 509.519804][ T5954] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 509.521799][ T1110] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 509.537973][ T5954] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 509.549044][ T5954] usb 2-1: New USB device found, idVendor=0458, idProduct=5019, bcdDevice= 0.00 [ 509.558371][ T5954] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 509.568762][ T5954] usb 2-1: config 0 descriptor?? [ 509.598055][ T5972] usb 3-1: Using ep0 maxpacket: 8 [ 509.609359][ T5972] usb 3-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2 [ 509.618775][ T5972] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.626836][ T5972] usb 3-1: Product: syz [ 509.631769][ T5972] usb 3-1: Manufacturer: syz [ 509.636448][ T5972] usb 3-1: SerialNumber: syz [ 509.648355][ T5869] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 509.649423][ T5972] usb 3-1: config 0 descriptor?? [ 509.682130][T13008] netlink: 9 bytes leftover after parsing attributes in process `syz.0.2347'. [ 509.693704][T13008] veth0_vlan: left allmulticast mode [ 509.799288][ T5869] usb 4-1: Using ep0 maxpacket: 16 [ 509.808976][ T5869] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 509.818022][ T5869] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 509.828228][ T5869] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 509.849372][ T5869] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 509.858735][ T5869] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.866772][ T5869] usb 4-1: Product: syz [ 509.874637][ T5869] usb 4-1: Manufacturer: syz [ 509.879463][ T5869] usb 4-1: SerialNumber: syz [ 509.880902][ T5972] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 509.989443][ T5954] kye 0003:0458:5019.0027: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 510.015959][ T5954] kye 0003:0458:5019.0027: hidraw0: USB HID v0.00 Device [HID 0458:5019] on usb-dummy_hcd.1-1/input0 [ 510.028366][ T5954] kye 0003:0458:5019.0027: tablet-enabling feature report not found [ 510.038552][ T5954] kye 0003:0458:5019.0027: tablet enabling failed [ 510.297641][ T5869] usb 4-1: 0:2 : does not exist [ 510.419643][ T5951] usb 2-1: USB disconnect, device number 38 [ 510.747933][ T5954] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 510.910039][ T5954] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 510.920372][ T5954] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 510.930823][ T5954] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 510.939992][ T5954] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 510.948655][ T5954] usb 1-1: SerialNumber: syz [ 511.079863][ T5951] hid-generic 0000:0000:0000.0028: hidraw0: HID v0.00 Device [syz1] on syz0 [ 511.099711][ T5972] gspca_sunplus: reg_w_riv err -71 [ 511.107468][ T5972] sunplus 3-1:0.0: probe with driver sunplus failed with error -71 [ 511.107772][T13004] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 511.125087][ T5972] usb 3-1: USB disconnect, device number 40 [ 511.168340][T13004] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 511.270964][ T5869] usb 4-1: 1:0: failed to get current value for ch 0 (-22) [ 511.315350][ T5954] usb 1-1: 0:2 : does not exist [ 511.316251][ T5869] usb 4-1: USB disconnect, device number 48 [ 511.328160][ T5954] usb 1-1: unit 5 not found! [ 511.367755][ T5954] usb 1-1: USB disconnect, device number 56 [ 511.822029][T13048] blk_print_req_error: 138 callbacks suppressed [ 511.822052][T13048] I/O error, dev loop1, sector 128 op 0x0:(READ) flags 0x1800 phys_seg 1 prio class 2 [ 511.840895][T13048] gfs2: error -5 reading superblock [ 511.868412][ T5954] hid-generic 0000:0000:0000.0029: hidraw0: HID v0.00 Device [syz1] on syz0 [ 512.187963][ T898] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 512.337996][ T898] usb 2-1: Using ep0 maxpacket: 8 [ 512.346898][ T898] usb 2-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2 [ 512.356757][ T898] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.365012][ T898] usb 2-1: Product: syz [ 512.369332][ T898] usb 2-1: Manufacturer: syz [ 512.373924][ T898] usb 2-1: SerialNumber: syz [ 512.380628][ T898] usb 2-1: config 0 descriptor?? [ 512.592238][ T898] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 512.677934][ T5972] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 512.827933][ T5972] usb 4-1: Using ep0 maxpacket: 32 [ 512.836821][ T5972] usb 4-1: config 0 interface 0 has no altsetting 0 [ 512.849853][ T5972] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 512.859160][ T5972] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.867168][ T5972] usb 4-1: Product: syz [ 512.872768][ T5972] usb 4-1: Manufacturer: syz [ 512.877395][ T5972] usb 4-1: SerialNumber: syz [ 512.891594][ T5972] usb 4-1: config 0 descriptor?? [ 512.898997][ T5972] gs_usb 4-1:0.0: Required endpoints not found [ 513.062283][T13077] netlink: 'syz.2.2371': attribute type 29 has an invalid length. [ 513.072055][T13077] netlink: 'syz.2.2371': attribute type 29 has an invalid length. [ 513.103867][T13064] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 513.395426][ T5869] usb 4-1: USB disconnect, device number 49 [ 513.454815][T13081] Invalid/unusable pipe [ 513.565173][T13087] netlink: 'syz.2.2375': attribute type 1 has an invalid length. [ 513.573817][T13087] netlink: 220 bytes leftover after parsing attributes in process `syz.2.2375'. [ 514.002269][ T898] gspca_sunplus: reg_r err -71 [ 514.013090][ T898] sunplus 2-1:0.0: probe with driver sunplus failed with error -71 [ 514.025836][ T898] usb 2-1: USB disconnect, device number 39 [ 514.037962][ T5972] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 514.138018][ T5869] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 514.168023][ T5972] usb 1-1: device descriptor read/64, error -71 [ 514.287928][ T5869] usb 3-1: Using ep0 maxpacket: 16 [ 514.295256][ T5869] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 514.305503][ T5869] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 514.316408][ T5869] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 514.326096][ T5869] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 514.327934][ T5914] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 514.335893][ T5869] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 514.337284][ T5869] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 514.365686][ T5869] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 514.373726][ T5869] usb 3-1: Manufacturer: syz [ 514.380406][ T5869] usb 3-1: config 0 descriptor?? [ 514.408252][ T5972] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 514.489931][ T5914] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 514.498328][ T5914] usb 4-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 514.507202][ T5914] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 514.518158][ T5914] usb 4-1: config 220 has no interface number 2 [ 514.524473][ T5914] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 514.537690][ T5914] usb 4-1: config 220 interface 0 has no altsetting 0 [ 514.544711][ T5972] usb 1-1: device descriptor read/64, error -71 [ 514.551157][ T5914] usb 4-1: config 220 interface 76 has no altsetting 0 [ 514.558591][ T5914] usb 4-1: config 220 interface 1 has no altsetting 0 [ 514.568449][ T5914] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 514.577505][ T5914] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.586294][ T5914] usb 4-1: Product: syz [ 514.590832][ T5914] usb 4-1: Manufacturer: syz [ 514.595778][ T5914] usb 4-1: SerialNumber: syz [ 514.648922][ T5869] rc_core: IR keymap rc-hauppauge not found [ 514.654895][ T5869] Registered IR keymap rc-empty [ 514.660311][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.668917][ T5972] usb usb1-port1: attempt power cycle [ 514.678854][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.699473][ T5869] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 514.714275][ T5869] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input97 [ 514.729512][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.748091][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.768035][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.788043][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.808177][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.809417][T13104] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 514.827037][T13104] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 514.835109][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.852193][ T5914] usb 4-1: selecting invalid altsetting 0 [ 514.858356][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.866150][ T5914] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 514.873924][ T5914] uvcvideo 4-1:220.0: No valid video chain found. [ 514.878530][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.888834][ T5914] usb 4-1: selecting invalid altsetting 0 [ 514.894679][ T5914] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 514.907038][ T5914] usb 4-1: USB disconnect, device number 50 [ 514.909103][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.938419][ T5869] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 514.960043][ T5869] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 514.970073][ T5869] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 515.007903][ T5972] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 515.028576][ T5972] usb 1-1: device descriptor read/8, error -71 [ 515.065955][ T5869] usb 3-1: USB disconnect, device number 41 [ 515.287961][ T5972] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 515.308413][ T5972] usb 1-1: device descriptor read/8, error -71 [ 515.418421][ T5972] usb usb1-port1: unable to enumerate USB device [ 515.698331][ T5972] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 515.859628][ T5972] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 515.869846][ T5972] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 515.877952][ T5869] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 515.879622][ T5972] usb 2-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 515.895349][ T5972] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 515.905127][ T5972] usb 2-1: config 0 descriptor?? [ 515.913539][ T5972] gspca_main: spca501-2.14.0 probing 0000:0000 [ 515.977916][ T7186] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 516.031493][ T5869] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 516.041269][ T5869] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.049681][ T5869] usb 3-1: Product: syz [ 516.054201][ T5869] usb 3-1: Manufacturer: syz [ 516.058939][ T5869] usb 3-1: SerialNumber: syz [ 516.069506][ T5869] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 516.086900][ T898] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 516.127915][ T7186] usb 4-1: Using ep0 maxpacket: 32 [ 516.135156][ T7186] usb 4-1: config 0 interface 0 has no altsetting 0 [ 516.145400][ T7186] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 516.154612][ T7186] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.163215][ T7186] usb 4-1: Product: syz [ 516.167458][ T7186] usb 4-1: Manufacturer: syz [ 516.172299][ T7186] usb 4-1: SerialNumber: syz [ 516.180328][ T7186] usb 4-1: config 0 descriptor?? [ 516.187709][ T7186] gs_usb 4-1:0.0: Required endpoints not found [ 516.351246][ T5972] gspca_spca501: reg write: error -71 [ 516.357533][ T5972] spca501 2-1:0.0: Reg write failed for 0x02,0xa048,0x00 [ 516.365744][ T5972] spca501 2-1:0.0: probe with driver spca501 failed with error -22 [ 516.376605][ T5972] usb 2-1: USB disconnect, device number 40 [ 516.393096][T13126] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 516.518693][T13124] genirq: Flags mismatch irq 7. 00200080 (ttyS3) vs. 00200000 (das16m1) [ 516.549372][T13124] sp0: Synchronizing with TNC [ 516.556650][ C0] Oops: divide error: 0000 [#1] SMP KASAN PTI [ 516.562741][ C0] CPU: 0 UID: 0 PID: 13124 Comm: syz.2.2389 Not tainted syzkaller #0 PREEMPT(full) [ 516.572128][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 516.579585][ T5972] usb 4-1: USB disconnect, device number 51 [ 516.582185][ C0] RIP: 0010:comedi_buf_write_free+0x3c8/0x7e0 [ 516.582218][ C0] Code: 41 03 45 00 48 8b 4c 24 78 42 0f b6 0c 21 84 c9 4c 8b bc 24 90 00 00 00 44 8b 74 24 54 0f 85 02 01 00 00 31 d2 48 8b 4c 24 30 31 41 89 55 00 48 8b 44 24 70 42 0f b6 04 20 84 c0 0f 85 09 01 [ 516.613740][ C0] RSP: 0018:ffffc90000007958 EFLAGS: 00010046 [ 516.619802][ C0] RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffff88801c6b0880 [ 516.627759][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88806e2d2000 [ 516.635719][ C0] RBP: 0000000000000002 R08: 0000000000000000 R09: 00000000000000ff [ 516.643677][ C0] R10: dffffc0000000000 R11: ffffffff88fda820 R12: dffffc0000000000 [ 516.651726][ C0] R13: ffff88801c6b0838 R14: 0000000000000000 R15: ffff88801c6b0800 [ 516.659692][ C0] FS: 00007f6a007ee6c0(0000) GS:ffff8881257a2000(0000) knlGS:0000000000000000 [ 516.668607][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 516.675175][ C0] CR2: 000000110c34eca4 CR3: 000000004feb0000 CR4: 00000000003526f0 [ 516.683146][ C0] Call Trace: [ 516.686411][ C0] [ 516.689242][ C0] ? __pfx_das16m1_ai_munge+0x10/0x10 [ 516.694605][ C0] comedi_buf_write_samples+0x369/0x5a0 [ 516.700142][ C0] das16m1_handler+0x213/0x4b0 [ 516.704939][ C0] das16m1_interrupt+0xaf/0x180 [ 516.709776][ C0] ? __pfx_das16m1_interrupt+0x10/0x10 [ 516.715223][ C0] __handle_irq_event_percpu+0x295/0xab0 [ 516.720849][ C0] ? __lock_acquire+0xab9/0xd20 [ 516.725686][ C0] ? __pfx___handle_irq_event_percpu+0x10/0x10 [ 516.731830][ C0] ? do_raw_spin_unlock+0x122/0x240 [ 516.737018][ C0] handle_irq_event+0x8b/0x1e0 [ 516.741767][ C0] ? handle_edge_irq+0x229/0xa10 [ 516.746693][ C0] handle_edge_irq+0x23b/0xa10 [ 516.751444][ C0] __common_interrupt+0x141/0x1f0 [ 516.756448][ C0] common_interrupt+0x5e/0xe0 [ 516.761110][ C0] asm_common_interrupt+0x26/0x40 [ 516.766111][ C0] RIP: 0010:handle_softirqs+0x1b0/0x870 [ 516.771643][ C0] Code: 89 64 24 30 0f b7 db 48 c7 c7 c0 a4 a9 8b e8 67 8f 08 0a 65 66 c7 05 35 b3 62 11 00 00 e8 08 96 42 00 fb 49 c7 c7 c0 c0 20 8e ff ff ff ff 0f bc c3 41 89 c5 41 ff c5 0f 84 c2 03 00 00 89 5c [ 516.791231][ C0] RSP: 0018:ffffc90000007e40 EFLAGS: 00000286 [ 516.797293][ C0] RAX: 94e193c0cda8b500 RBX: 0000000000000100 RCX: 94e193c0cda8b500 [ 516.805260][ C0] RDX: 0000000000000002 RSI: ffffffff8dc89575 RDI: ffffffff8c053d60 [ 516.813243][ C0] RBP: ffffc90000007f50 R08: ffffffff8fe4db77 R09: 1ffffffff1fc9b6e [ 516.821218][ C0] R10: dffffc0000000000 R11: fffffbfff1fc9b6f R12: 000000000000000a [ 516.829180][ C0] R13: 0000000000000000 R14: dffffc0000000000 R15: ffffffff8e20c0c0 [ 516.837178][ C0] ? lapic_next_event+0x11/0x20 [ 516.842037][ C0] ? clockevents_program_event+0x24d/0x360 [ 516.847866][ C0] ? __irq_exit_rcu+0xca/0x1f0 [ 516.852620][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 516.857890][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 516.863253][ C0] __irq_exit_rcu+0xca/0x1f0 [ 516.867832][ C0] ? __pfx___irq_exit_rcu+0x10/0x10 [ 516.873030][ C0] irq_exit_rcu+0x9/0x30 [ 516.877351][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 516.882970][ C0] [ 516.885885][ C0] [ 516.888796][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 516.894756][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xa8/0x110 [ 516.901250][ C0] Code: 74 05 e8 eb 8b 37 f6 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4f f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 93 20 00 f6 65 8b 05 dc a8 57 07 85 c0 74 40 48 c7 04 24 0e 36 [ 516.920876][ C0] RSP: 0018:ffffc90004ebfbe0 EFLAGS: 00000206 [ 516.926943][ C0] RAX: 94e193c0cda8b500 RBX: 0000000000000a02 RCX: 94e193c0cda8b500 [ 516.934900][ C0] RDX: 0000000000000006 RSI: ffffffff8dc89575 RDI: 0000000000000001 [ 516.942864][ C0] RBP: ffffc90004ebfc70 R08: ffffffff8fe4db77 R09: 1ffffffff1fc9b6e [ 516.950816][ C0] R10: dffffc0000000000 R11: fffffbfff1fc9b6f R12: dffffc0000000000 [ 516.958774][ C0] R13: dffffc0000000000 R14: ffffffff9a268da0 R15: 1ffff920009d7f7c [ 516.966739][ C0] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 516.973061][ C0] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 516.978941][ C0] uart_port_unlock_deref+0x111/0x2f0 [ 516.984300][ C0] uart_write+0xe8/0x130 [ 516.988539][ C0] sixpack_open+0x6ce/0x9c0 [ 516.993033][ C0] ? __pfx_sixpack_open+0x10/0x10 [ 516.998046][ C0] ? up_write+0x1c4/0x420 [ 517.002360][ C0] tty_ldisc_open+0xa1/0x100 [ 517.006931][ C0] tty_set_ldisc+0x373/0x560 [ 517.011504][ C0] tty_ioctl+0xc38/0xde0 [ 517.015731][ C0] ? __pfx_tty_ioctl+0x10/0x10 [ 517.020475][ C0] __se_sys_ioctl+0xfc/0x170 [ 517.025049][ C0] do_syscall_64+0xfa/0xfa0 [ 517.029534][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.035581][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 517.041714][ C0] ? clear_bhb_loop+0x60/0xb0 [ 517.046373][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 517.052251][ C0] RIP: 0033:0x7f6a0258eec9 [ 517.056648][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 517.076236][ C0] RSP: 002b:00007f6a007ee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 517.084633][ C0] RAX: ffffffffffffffda RBX: 00007f6a027e5fa0 RCX: 00007f6a0258eec9 [ 517.092585][ C0] RDX: 0000200000000240 RSI: 0000000000005423 RDI: 0000000000000006 [ 517.100559][ C0] RBP: 00007f6a02611f91 R08: 0000000000000000 R09: 0000000000000000 [ 517.108516][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 517.116555][ C0] R13: 00007f6a027e6038 R14: 00007f6a027e5fa0 R15: 00007ffe3de77aa8 [ 517.124524][ C0] [ 517.127536][ C0] Modules linked in: [ 517.131420][ C0] ---[ end trace 0000000000000000 ]--- [ 517.136852][ C0] RIP: 0010:comedi_buf_write_free+0x3c8/0x7e0 [ 517.142909][ C0] Code: 41 03 45 00 48 8b 4c 24 78 42 0f b6 0c 21 84 c9 4c 8b bc 24 90 00 00 00 44 8b 74 24 54 0f 85 02 01 00 00 31 d2 48 8b 4c 24 30 31 41 89 55 00 48 8b 44 24 70 42 0f b6 04 20 84 c0 0f 85 09 01 [ 517.162495][ C0] RSP: 0018:ffffc90000007958 EFLAGS: 00010046 [ 517.168544][ C0] RAX: 0000000000000001 RBX: dffffc0000000000 RCX: ffff88801c6b0880 [ 517.176497][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88806e2d2000 [ 517.184449][ C0] RBP: 0000000000000002 R08: 0000000000000000 R09: 00000000000000ff [ 517.192398][ C0] R10: dffffc0000000000 R11: ffffffff88fda820 R12: dffffc0000000000 [ 517.200352][ C0] R13: ffff88801c6b0838 R14: 0000000000000000 R15: ffff88801c6b0800 [ 517.208305][ C0] FS: 00007f6a007ee6c0(0000) GS:ffff8881257a2000(0000) knlGS:0000000000000000 [ 517.217302][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 517.223866][ C0] CR2: 000000110c34eca4 CR3: 000000004feb0000 CR4: 00000000003526f0 [ 517.231827][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 517.239271][ C0] Kernel Offset: disabled [ 517.243575][ C0] Rebooting in 86400 seconds..