last executing test programs: 7.779500018s ago: executing program 3 (id=2237): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x80}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) (fail_nth: 13) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) 7.498163747s ago: executing program 3 (id=2238): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="120100001d9167204f17316a3f26010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000180)={0x2c, &(0x7f0000000000)={0x40, 0x4, 0x4e, {0x4e, 0x21, "ee31611fcb09711f7fb261c01b2549eec621dda542d2c70f83e0ea01bd35b8050f1bc3cc919cf70a6b29b74661037947804c8e44352e767c1a41803069dedd8b8cb9fbe31aa9cb2ff94cfb12"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40c}}, &(0x7f00000000c0)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f0000000100)={0x20, 0x29, 0xf, {0xf, 0x29, 0x0, 0x1, 0x3d, 0x72, "c74dc3a4", "33d17445"}}, &(0x7f0000000140)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x159790b9fa4e9330, 0x7, 0x33, 0x1, 0x7f, 0xa9}}}, &(0x7f00000006c0)={0x84, &(0x7f00000001c0)={0x20, 0x16, 0xc5, "f46c0c7cb4f28dcc6b8042e6b9a708d13eedc987910a84668861b582b0b286443d310766ab20e7fd0efeb0e8b9eba9804a8f64b3afb0efcdcfc81c45ab3f3d2c014c97274649ce479602a85dbcf6f8171f27b36325540a57822e3a64ea901026da475e2c01f8608c3015bdb1ffa64b7ca4b050a6822e3815b4c024b7399dc90b2a80fac2a2c52caaa688df1e3915f8ca19c8d6cff2bc6ce1d65067387dfd11db098ed91b250b8704a60a79495dbf207e6f6726b4ab12662f573b3c0b916b9437dbade3a3cf"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0x40}, &(0x7f0000000340)={0x20, 0x0, 0x4, {0x1, 0x3}}, &(0x7f0000000380)={0x20, 0x0, 0x4, {0x80, 0x8}}, &(0x7f00000003c0)={0x40, 0x7, 0x2, 0x4}, &(0x7f0000000400)={0x40, 0x9, 0x1, 0xbf}, &(0x7f0000000440)={0x40, 0xb, 0x2, "cceb"}, &(0x7f0000000480)={0x40, 0xf, 0x2, 0xe}, &(0x7f00000004c0)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}}, &(0x7f0000000500)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}}, &(0x7f0000000540)={0x40, 0x19, 0x2, '|%'}, &(0x7f0000000580)={0x40, 0x1a, 0x2, 0x300}, &(0x7f00000005c0)={0x40, 0x1c, 0x1, 0x9}, &(0x7f0000000640)={0x40, 0x1e, 0x1, 0x8}, &(0x7f0000000680)={0x40, 0x21, 0x1, 0x8}}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 7.118085622s ago: executing program 0 (id=2241): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000040000000000a40000000160a01080000000000000000020000000900020073797a30000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0x9, 0x6, 0x0) get_mempolicy(0x0, 0x0, 0x4, &(0x7f0000000000/0x2000)=nil, 0x3) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8f4dd086d0492082a6d0000000109021b0001000000000904"], 0x0) (async) r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8f4dd086d0492082a6d0000000109021b0001000000000904"], 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r4, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r5, 0xae03, 0x9a) (async) ioctl$KVM_CHECK_EXTENSION(r5, 0xae03, 0x9a) syz_usb_control_io$cdc_ncm(r4, 0x0, &(0x7f0000000cc0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000b00)={0x84, &(0x7f0000000640)={0x40, 0xa, 0x3, "25c698"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES64=r0, @ANYBLOB="01002cbd7000040000000500b600080009000200000008000c00a60a0000060001000500004008000b"], 0x40}, 0x1, 0x0, 0x0, 0x94ced4add106a01f}, 0x4040) 3.874053936s ago: executing program 0 (id=2254): shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000002680)=""/4096) (fail_nth: 4) 3.570804736s ago: executing program 0 (id=2255): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x101201, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4020aeb2, &(0x7f0000000080)={0x0, 0x0, @ioapic={0x100010000, 0x1, 0x0, 0x0, 0x0, [{0x6, 0x7, 0x8, '\x00', 0xab}, {0x2, 0x0, 0x2, '\x00', 0x5b}, {0x60, 0x4, 0x8, '\x00', 0x3}, {0x5, 0x6, 0x3, '\x00', 0xf1}, {0xc, 0xc, 0x9, '\x00', 0x43}, {0x4, 0x79, 0xc5, '\x00', 0x6}, {0x94, 0x5, 0x9, '\x00', 0xfe}, {0xf, 0x0, 0x6, '\x00', 0xfc}, {0x1, 0x4, 0x8, '\x00', 0x33}, {0x1, 0xf, 0x57, '\x00', 0x9}, {0x5, 0x4, 0x1, '\x00', 0x6}, {0x81, 0x6, 0x6, '\x00', 0x48}, {0x7, 0x3, 0x8, '\x00', 0xff}, {0x6, 0x3, 0xa3, '\x00', 0x2}, {0x7, 0x0, 0x3, '\x00', 0x50}, {0xd, 0x2, 0xd, '\x00', 0x6}, {0x8, 0x80, 0x80, '\x00', 0xb}, {0x3, 0x89, 0x1, '\x00', 0xe}, {0x78, 0x7, 0x2, '\x00', 0x7}, {0x3, 0x3, 0xc1, '\x00', 0x7}, {0x5, 0x26, 0x5, '\x00', 0x9}, {0x7, 0x9, 0xe2, '\x00', 0x6}, {0xf9, 0xd, 0x81, '\x00', 0x81}, {0xfd, 0x3, 0x80, '\x00', 0x6}]}}) syz_init_net_socket$netrom(0x6, 0x5, 0x0) 3.358074018s ago: executing program 0 (id=2256): r0 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000040)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000540)={0x0, 0x0, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r2, 0xc06864ce, &(0x7f0000000400)={r5, 0x0, 0x0, 0x0, 0x0, [0x0], [], [0x1000], [0x0, 0x0, 0x0, 0xffffffffffffffff]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000100)={r6, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c64d2, &(0x7f0000000180)={0x0, 0x0, r7}) 3.241887229s ago: executing program 0 (id=2257): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000040)={0x86, 0x23, 0x19, 0x4, 0x16}) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000000)=0x8001) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r2 = open(&(0x7f0000000580)='./bus\x00', 0x84242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x4, 0x2, 0x5, 0x7, 0x3, 0x1, {0x400000080001, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x9, 0x3, 0xfffffffc, 0x8000, 0x0, 0x0, 0x0, 0x5, 0x6}}, {0x0, 0x13}}}, 0xa0) sendfile(r2, r2, &(0x7f0000000080), 0x7f03) 3.146220907s ago: executing program 0 (id=2260): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000100)={@host}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x60, 0x21, 0x19, 0x40, 0x1199, 0x9057, 0x6bcc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x8, 0x0, 0x0, 0x7c, 0xe0, 0xc6}}]}}]}}, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000001800)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7cb, &(0x7f0000000140)={&(0x7f0000001080)={{@my=0x0}, {@host}, 0x400, "4145fdc5fec7663a106cef95c8d86f03d655b82e62dc5204ff06732791d90936bf31f7b4eafad3ed43e8da42de6780edce2e2f941399c9b9002a6a538fc1ebd3e994ce6fa4a67c775c476cdbedebbe34904cbe0d5808cf5892aa1e563f949f38cd2ebaa2c46464183ead798b1af0ba7ad5db77736a5329e7297e674242854f87ef03b0fba724523033529e64be44188740b9e9a0ba6944e9724c4aaa8470ab8d35a1746a1da4dfa2112cb5135d97efae0975e7fa5e421fe7ec12a8bbd7714076b63ddaca822d7c0383ccc4e21b11c8a0443850c05f4bb6716b6ba83016b709b44a9959c44daa717ed76b43f7c235fae47730ff2d435ed29d062451ab74bd9f65d9bf96e1afc645ca2249c89146fc815210d465ca0ede0acbfe1165b15d222ed668b79b14f901178d35e7421637588c887b0f2335ea84a442fc95bbcf0ea3b308ee18d913901cb8f40dd2798e781c4b1c620c23565b5bc18e25c206f772c863c8a8864f460c239033717d41f94fbf13b1d0c7271364bd6d144160e1df33fcb33e5d45a5e7ea4264d089397d7e022c6e1f37a2e464c01b4df6a906d3a46d9432ba1966d73aa0627491e3b3c33bee03ff2138896b64862910f24dbacc3c686e0059ff5915c8b69bce3c4022c5c80d574274d1107c9935898ae444a6c38dbd8319e778e1a86a293094bd98d0ae3ae2c32a4bcb20e0517c03e7b46839f4e3601ff98244ca5485cacbfe53c935cf14038bba908af19834a86b56cf68a7170448a434b55d66c080ea095b02ba4c3f8ba492c9e50111bf1b3085cc0f3938a58609a337e89eba9271ee071a8b9f3ab4ad0fc3c92a48cb6bc63ed74877d8425c88eb40d18c6260d2221dc295d1fa1557cfcfe1cb3a1d61b4b1235e28903ae5a4d3d358f6d3e2c87b110e38aab0fd1ca2c047b3ea826d8cd9b980b3fc64fbf38d0d3fed0057b30612880a3d93aa3e16e1c1902cc8c206d7732f426fbb063b020a03d08e3bcd4ff32c30c8ea424ea0c746e72c23e8d53576cc801bdf82f8bba865074e5dde3177820c24be87b9bd36e30a81d1d50b5aa0628262d46d19060ae37a33aa8e515fed3f8bfdf65ba5f8e11e4d517a50ce03f82bc5b3c8e9b3eb6572f1a686430170ce64bc1a61246fd99b2d8a3215104478eead271fcca07bc66e637d5543ad47147f5ad50cc5a203a37b7d2f67bb0387ae189ee7d5cfc0a421b0f0e6286aaf28a3eadfad1b8c83a26ac0a1d4a3846d93e161c82be100278d94e35fc7b5f1feb833f1b975adb33bec5d777cfbdb2c5fe171e205fd6596b37ba646b9ecb163fabcd89a469f6ad539a80937748105298b0a6364d75c6de3cbcbb96c440d5489f3f47149551e7f53d3a22d837cfb59c3e43f0c95760791ed36ff84ae82a679e4e062461bda5db7c27fb00c3238266734bc7c16d45ce7cd3f0b7e63c309877816048f24"}, 0x418, 0x6}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) sendmsg$unix(r3, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="10da"], 0x10, 0x4048010}, 0x20048001) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r3, 0x7ab, &(0x7f0000000180)={&(0x7f0000000400)={{@my=0x0, 0xfffeffff}, {@hyper, 0x101}, 0x400, "7faef4b3fd9377c0921f46a6a78e8e6ebe821bbc6e4dae0d16eb2a39c8960db6533b9eaf85ee31239931d0007174af9d1cb91c04848a5aa532081307e749f75903ae1d634a3bf2ad9313ab083a7a27219e1f58179936113b7ff1c143b77835081f50ee9da593a9ae41c7cccc37cbcf64444e7d10fc7cc85ed6d07e6edb65d137fa147248c2ddd1216a1cd9553ff06057e046d140562cd0af1fa8d2f47bad86658c482541d0ede230d6b8d08f2a817254067d161be905031d9eaebc9fea75a8bbdb47baa0d13cf68f1595ce4a6ee61d77232aacc948b994fa262fcff89840672c5a5ddf6099811050671cfecf3a437777024ece8040a6d4f30e274c4cfbeee9b8fcf3490da488d5ea22980d7008b0e46e4ab8eba245ae0b3bb8adc9d24f979a47158ad7023da890f8f82d6a9b96ae820fdc4b7f91f4d337a4aea30feb2971d4c02150b53d7a646c4929684d3d0ef5d5fb1e6d3ad5a8d4057f05cadc4ce9cc7ada2ea1cdd2291a25edcca08ad50c3c6a93689299f9f5444673fd8ba02064df0d95531ff2fa9cef1e7725b1159537799e814bb4ddc2705fab44d505587438840c30ac7a9e8498cd9d10a494bc012e9b0c3666bf655f49cfce898f8cc234965aefbc66c0573ae65e346cd44c81ab2ef55e07e71f6349c650c856bf7bd264808b83e2de156da60a7cb45473f5431cd3e8a752da9679c17406692da90055fbfd47e8d035628f55261b96b97ae20d419cec8e97d65b1848363fcfb7ee891b86a8451b7a9868d16f07c3a291150c1918d14ae7a37306ef2d929eb871cd2fd54d0b7fa4dcdc220540ba711f03e4baa686beb8662fcba357bba19993a863abf0b9103b2f54a9122038682095989f4c7184db773b395d4a5d3c1fd8283bd8f7d9536c19f2becf07411ee72668e0a4cd8c1194147c2a4f70247785f795507f38b9fcdf2fd3a230691728fd620d3e57810e93ee60a6aa4f049137baaa091d0266d7737a63a42c87555c0af3f27e10505c59f90065be340be3d153b7aebc0b3c52bb5d11002c591c5a6826279772327298d11255e0e36428b055c3d3da2bd4fc45eabfca594e339b00d749ae573640e67a8f7f7c709cef4d4b7d795a2a3834673781f8b644a86adf91fbea842ccfe54dbcd4896cc6bd3fa4443219289bbdc8c0e405b25838764101526789afa2ee208ecbfe0f9083f7a62aaaa346e78e652d2b3107a175a870622215b0fc437784b640701bf969f5a9790d94b466e6745b4d46691ec01b75be51c4344c9ae5b0d0216943927001ee29ce0a4f9936f21ecb1683b3b9b68369d49e7a04ad9fdbf141bfb9cd75c7f1b42bf10f6a3ebffc03e2130934cdf85f693ad54b1dd6bb52e097d5bd8c3be4afe5f70cbf204e524e39657b9bf17cbed90efb1253fddd6d43d525e1bc51e7f3d7af82780df91cd885d2db4838cb0d099661118f"}, 0x418, 0x9}) set_mempolicy(0x2, &(0x7f0000000140)=0x8001, 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) poll(&(0x7f00000001c0)=[{r3, 0x6}], 0x1, 0x5) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_setup(0x4, &(0x7f0000000100)) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r4, 0xffffffffffffffff, 0x0) 2.595596594s ago: executing program 3 (id=2266): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r0, &(0x7f0000000200)="bd4c", 0x2) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SDTEFACILITIES(r1, 0x89eb, &(0x7f0000000000)={0x9b, 0x5, 0x122a, 0x6, 0xff, 0xa4, 0x1b, "89dbcd3e909213be7f403c0a2c0730913c82fda4", "a8948edc9412e5795d79ebe67c7b9c065c4b13d9"}) r2 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000140)) r3 = socket(0x1e, 0x5, 0x0) listen(r3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8b28, &(0x7f0000000000)={'wlan0\x00'}) accept4$nfc_llcp(r3, 0x0, 0x0, 0x800) r5 = socket$kcm(0x10, 0x7, 0x0) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0e00009bd029ef80"], 0xfe33) getsockopt$sock_buf(r5, 0x1, 0x1a, &(0x7f0000000880)=""/253, &(0x7f0000000480)=0xfd) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_BEACONS(r3, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='\b@\x00\x00', @ANYRES16=r6, @ANYBLOB="00042bbd7000fedbdf25550000000800010063000000"], 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0x4080) r7 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x3, 0x216882) ioctl$KVM_REGISTER_COALESCED_MMIO(r7, 0x4010ae67, &(0x7f00000000c0)={0x0, 0x110000}) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000500), r3) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="c300", @ANYRES16=r8, @ANYRES64=r6], 0xb0}, 0x1, 0x0, 0x0, 0x4000011}, 0x4081) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000340)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f0000000a40)={0x7, 0x41546}) mlock2(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0) r9 = socket(0x1e, 0x80000, 0x1) setsockopt$inet_tcp_TLS_RX(r9, 0x6, 0x2, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r9, 0x84, 0x9, &(0x7f0000000d00)={0x0, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x18}}}, 0x548, 0x6, 0x10001, 0x401, 0xa1, 0x1, 0x89}, &(0x7f0000000400)=0x9c) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r10, &(0x7f0000000080)={0x0, 0x69, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001200)=[{&(0x7f0000000f00)=""/258, 0x102}, {&(0x7f0000000600)=""/201, 0xc9}, {&(0x7f0000000ac0)=""/215, 0xd7}, {&(0x7f0000001040)=""/222, 0xde}, {&(0x7f0000003100)=""/4068, 0xfe4}, {&(0x7f00000007c0)=""/190, 0xbe}, {&(0x7f0000001140)=""/171, 0xab}, {&(0x7f0000000c00)=""/197, 0xc5}, {&(0x7f0000000540)=""/96, 0x60}], 0x9}, 0x40012100) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r7, 0xc06c4124, &(0x7f0000000040)) 2.573172852s ago: executing program 2 (id=2267): msgget(0x3, 0x400) syz_usb_connect(0xf48eab26edd82c0, 0x5a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000ec13b2106d04f308280b0102030109024800010000000009046900000e010000084101", @ANYBLOB="32b683adf11f83220156c564000400000000000089c5"], 0x0) 1.921952246s ago: executing program 1 (id=2271): bind$alg(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$inet(0xffffffffffffffff, 0x0, 0x20000004) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYRES32, @ANYRES64=0x0], 0x194}, 0x1, 0x0, 0x0, 0x8000}, 0x20000096) r0 = syz_usb_connect$rtl8150(0x0, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000080)={0x20, 0xa, 0xc, {0xc, 0x22, "7275be37d83619bd6acb"}}, &(0x7f0000000140)={0x0, 0x3, 0x2e, @string={0x2e, 0x3, "78fa42b3ae98a6ada1b2646edcb28a2a8e8891714cb5b75b1507d29ec7c3a4f0d9a0272ab8a87dbcd48ee489"}}}, &(0x7f0000000400)={0x2c, &(0x7f0000000200)={0x20, 0xa, 0x6a, "07c0d67def9dba031e56815ae04d225f603daa26cdb2fdf602bd3dbbb25652fe98801f45c1c6cf9401d25629872d43c9dffec383fc3126b25837d10fdf791af77d992555bb4010d72a24b791415d75cc7a0c9e2d3e932586fd80af69490e06aa7743f79a8d4a42cd6e5c"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x40}, &(0x7f0000000380)={0xc0, 0x5, 0x2, '\r:'}, &(0x7f00000003c0)={0x40, 0x5, 0x3, "1ea667"}}) (async) r1 = syz_usb_connect(0x5, 0x3f, &(0x7f0000000480)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f0000000600)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="2011050000005e07ce2a62d78b8a"], 0x0, 0x0, 0x0, 0x0}) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = dup(r6) ioctl$KVM_SET_MSRS(r7, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000000800008c02"]) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)={0x14, r3, 0x5, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r9, 0x8b06, &(0x7f0000000140)={'virt_wifi0\x00', @random="0100000000eb"}) syz_usb_control_io(r1, 0x0, &(0x7f0000000d40)={0x84, &(0x7f0000000800)={0x0, 0x17}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) sendmsg$NL80211_CMD_GET_MPATH(r7, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x50, r3, 0x20, 0x70bd26, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x9, 0x4c}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x80) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)={0x30, 0x33, 0x107, 0x0, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\xd8'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x72, 0x0, 0x1, [@typed={0x8, 0x9b, 0x0, 0x0, @fd=r6}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) (async) syz_usb_control_io$rtl8150(r1, &(0x7f0000000640)={0x14, &(0x7f0000000500)={0x0, 0x10, 0xd6, {0xd6, 0x0, "da4da049fd829fd84e1f7ff0c07a20ff67b0b1b8b597fdf508b09f66651d820fbd8c027539af4722f4dc91fc8a63ba83449d64d914b698dabb810325918a36e3c57d928cb3a5b84e24900266cc4845ce759e508216ee129d506023751bc95ef3caeecdb6f1c43c00bc71b22e668c351af0e740c01afa2854c20ca566fc186f978470d62ce102753c27632364295ce5d88300ff2fc04e47947b1c44306414068e54c3ddfaf203c9c1b252f076fa33c2138d0c39483cc13374ce21b269a40feadf385beea62ab8818dc7345b4d464cf981c3afb4ba"}}, &(0x7f0000000440)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40d}}}, &(0x7f00000007c0)={0x2c, &(0x7f0000000680)={0x20, 0x1, 0x1f, "dc5705ed9fabfba531a43a5dfde09a8e39c33776cdc7933c07a60c2e2c73a3"}, &(0x7f00000006c0)={0x0, 0xa, 0x1, 0x22}, &(0x7f0000000700)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000740)={0xc0, 0x5, 0x6, "2896e5e27117"}, &(0x7f0000000780)={0x40, 0x5, 0x6, "e6cfe640f446"}}) 1.921682015s ago: executing program 2 (id=2272): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r0) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x14, r1, 0x60b, 0x70bd2d, 0x25dfdbfc}, 0x14}}, 0x0) 1.89439726s ago: executing program 2 (id=2273): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000100)={@host}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7cb, &(0x7f0000000140)={&(0x7f0000001080)={{@my=0x0}, {@host}, 0x400, "4145fdc5fec7663a106cef95c8d86f03d655b82e62dc5204ff06732791d90936bf31f7b4eafad3ed43e8da42de6780edce2e2f941399c9b9002a6a538fc1ebd3e994ce6fa4a67c775c476cdbedebbe34904cbe0d5808cf5892aa1e563f949f38cd2ebaa2c46464183ead798b1af0ba7ad5db77736a5329e7297e674242854f87ef03b0fba724523033529e64be44188740b9e9a0ba6944e9724c4aaa8470ab8d35a1746a1da4dfa2112cb5135d97efae0975e7fa5e421fe7ec12a8bbd7714076b63ddaca822d7c0383ccc4e21b11c8a0443850c05f4bb6716b6ba83016b709b44a9959c44daa717ed76b43f7c235fae47730ff2d435ed29d062451ab74bd9f65d9bf96e1afc645ca2249c89146fc815210d465ca0ede0acbfe1165b15d222ed668b79b14f901178d35e7421637588c887b0f2335ea84a442fc95bbcf0ea3b308ee18d913901cb8f40dd2798e781c4b1c620c23565b5bc18e25c206f772c863c8a8864f460c239033717d41f94fbf13b1d0c7271364bd6d144160e1df33fcb33e5d45a5e7ea4264d089397d7e022c6e1f37a2e464c01b4df6a906d3a46d9432ba1966d73aa0627491e3b3c33bee03ff2138896b64862910f24dbacc3c686e0059ff5915c8b69bce3c4022c5c80d574274d1107c9935898ae444a6c38dbd8319e778e1a86a293094bd98d0ae3ae2c32a4bcb20e0517c03e7b46839f4e3601ff98244ca5485cacbfe53c935cf14038bba908af19834a86b56cf68a7170448a434b55d66c080ea095b02ba4c3f8ba492c9e50111bf1b3085cc0f3938a58609a337e89eba9271ee071a8b9f3ab4ad0fc3c92a48cb6bc63ed74877d8425c88eb40d18c6260d2221dc295d1fa1557cfcfe1cb3a1d61b4b1235e28903ae5a4d3d358f6d3e2c87b110e38aab0fd1ca2c047b3ea826d8cd9b980b3fc64fbf38d0d3fed0057b30612880a3d93aa3e16e1c1902cc8c206d7732f426fbb063b020a03d08e3bcd4ff32c30c8ea424ea0c746e72c23e8d53576cc801bdf82f8bba865074e5dde3177820c24be87b9bd36e30a81d1d50b5aa0628262d46d19060ae37a33aa8e515fed3f8bfdf65ba5f8e11e4d517a50ce03f82bc5b3c8e9b3eb6572f1a686430170ce64bc1a61246fd99b2d8a3215104478eead271fcca07bc66e637d5543ad47147f5ad50cc5a203a37b7d2f67bb0387ae189ee7d5cfc0a421b0f0e6286aaf28a3eadfad1b8c83a26ac0a1d4a3846d93e161c82be100278d94e35fc7b5f1feb833f1b975adb33bec5d777cfbdb2c5fe171e205fd6596b37ba646b9ecb163fabcd89a469f6ad539a80937748105298b0a6364d75c6de3cbcbb96c440d5489f3f47149551e7f53d3a22d837cfb59c3e43f0c95760791ed36ff84ae82a679e4e062461bda5db7c27fb00c3238266734bc7c16d45ce7cd3f0b7e63c309877816048f24"}, 0x418, 0x6}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x7d0) 1.854145979s ago: executing program 2 (id=2274): syz_clone(0x2100, &(0x7f0000000080)="7f", 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x7fff, 0x8, 0x100}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, 0x0, 0x56}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) rt_sigaction(0x13, &(0x7f0000000040)={0x0, 0x44000007, 0x0, {[0x5]}}, 0x0, 0x8, &(0x7f0000000080)) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000002340)={0x0, 0x0, @pic={0x7, 0x10, 0x4, 0x81, 0x0, 0xb, 0x7, 0x9, 0x5d, 0x1, 0x8, 0x40, 0x31, 0x0, 0x5, 0x4b}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f00000000c0)={0x3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x20008881}, 0x4010) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r4) r6 = socket$inet(0x2, 0x3, 0x5009) ioctl$BTRFS_IOC_QGROUP_LIMIT(r6, 0x8030942b, &(0x7f00000002c0)={0x3, {0x6, 0x0, 0xfffffffffffffffc, 0x1, 0x5}}) ioctl$sock_inet_SIOCADDRT(r6, 0x890b, &(0x7f0000000340)={0x0, {0x2, 0x4e24, @empty}, {0x2, 0x4e24, @multicast2}, {0x2, 0x4e22, @empty}, 0x260, 0x0, 0x0, 0x0, 0x15a, 0x0, 0x7, 0x3, 0x6289}) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r5, 0x10, 0x70bd26, 0x25dfdbfd, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x88c0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) socket(0x15, 0x5, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') writev(r7, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) ioctl$FS_IOC_GETVERSION(r4, 0x80087601, &(0x7f00000000c0)) r8 = socket$pppl2tp(0x18, 0x1, 0x1) r9 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r8, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r9, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e) 1.334304151s ago: executing program 2 (id=2275): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r0, &(0x7f0000000200)="bd4c", 0x2) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000140)) r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r2, 0x40044102, &(0x7f0000000040)) 1.066837667s ago: executing program 3 (id=2276): socket$netlink(0x10, 0x3, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc0585611, 0x0) getsockopt$MRT(0xffffffffffffffff, 0x0, 0xcf, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x4, r1}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_VENDOR(r4, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000500)={0x0, 0x1, &(0x7f0000000180)=[r3], &(0x7f00000000c0)=[0x2], &(0x7f0000000580)=[r2], &(0x7f0000000040), 0x101000000000000, 0x2000}) 1.041787816s ago: executing program 1 (id=2277): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000040)={0x86, 0x23, 0x19, 0x4, 0x16}) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000000)=0x8001) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r2 = open(&(0x7f0000000580)='./bus\x00', 0x84242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x4, 0x2, 0x5, 0x7, 0x3, 0x1, {0x400000080001, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x9, 0x3, 0xfffffffc, 0x8000, 0x0, 0x0, 0x0, 0x5, 0x6}}, {0x0, 0x13}}}, 0xa0) sendfile(r2, r2, &(0x7f0000000080), 0x7f03) 903.748162ms ago: executing program 3 (id=2278): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r0, &(0x7f0000000200)="bd4c", 0x2) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000140)) r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r2, 0xc06c4124, &(0x7f0000000040)) (fail_nth: 4) 902.703227ms ago: executing program 1 (id=2279): syz_emit_vhci(&(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x3, 0x3, 0x81}, @l2cap_cid_signaling={{0x7d}, [@l2cap_move_chan_cfm={{0x10, 0x4, 0x4}, {0x1, 0xf283}}, @l2cap_conf_req={{0x4, 0x40, 0x2f}, {0x0, 0x400, [@l2cap_conf_ews={0x7, 0x2, 0x156}, @l2cap_conf_efs={0x6, 0x10, {0x7, 0x1, 0x40, 0x1, 0xbd7, 0x10}}, @l2cap_conf_fcs={0x5, 0x1, 0x1}, @l2cap_conf_efs={0x6, 0x10, {0x3, 0x2, 0x8, 0x400, 0x2, 0xfffffff7}}]}}, @l2cap_conf_req={{0x4, 0x0, 0x30}, {0x1a61, 0x8, [@l2cap_conf_rfc={0x4, 0x9, {0x3, 0x9, 0x80, 0xbf0, 0xd, 0x7fff}}, @l2cap_conf_flushto={0x2, 0x2, 0x5}, @l2cap_conf_flushto={0x2, 0x2, 0x7}, @l2cap_conf_ews={0x7, 0x2, 0x3ff}, @l2cap_conf_fcs={0x5, 0x1, 0x1}, @l2cap_conf_mtu={0x1, 0x2, 0x2}, @l2cap_conf_rfc={0x4, 0x9, {0x2, 0x2, 0x5, 0x8000, 0x2, 0x5}}, @l2cap_conf_fcs={0x5, 0x1}]}}, @l2cap_disconn_req={{0x6, 0x2, 0x4}, {0xb, 0x7}}, @l2cap_info_req={{0xa, 0x2, 0x2}, {0x3}}]}}, 0x86) 498.378367ms ago: executing program 1 (id=2280): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r0) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x14, r1, 0x60b, 0x70bd2d, 0x25dfdbfc}, 0x14}}, 0x0) (fail_nth: 3) 477.768925ms ago: executing program 2 (id=2281): syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1201000002000040257d15a44000010400010902"], 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x200) syz_usb_disconnect(r0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0x4004550d, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_ifreq(r1, 0x8930, &(0x7f0000000000)={'sit0\x00', @ifru_hwaddr=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}}) r2 = syz_open_dev$video(&(0x7f00000010c0), 0x8, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000002c0)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "fc0300", 0x20, 0x2c, 0x0, @empty, @mcast2, {[@fragment={0x3a}], @mld={0x0, 0x0, 0x0, 0x9, 0x0, @dev={0xfe, 0x80, '\x00', 0x36}}}}}}, 0x56) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f00000001c0)={'veth1_vlan\x00', @random="38ddeb42033c"}) ioctl$VIDIOC_S_OUTPUT(r2, 0xc004562f, &(0x7f0000000000)=0xf) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@updpolicy={0x208, 0x19, 0x1, 0x0, 0x1, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x2}, {0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x0, 0x1}, [@tmpl={0x144, 0x5, [{{@in=@local, 0x0, 0x33}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, {{@in6=@remote, 0x0, 0x3c}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x32}, 0x0, 0x3}, {{@in=@private=0xa010100, 0x0, 0x6c}, 0x0, @in=@broadcast, 0x0, 0x4, 0x0, 0x0, 0x0, 0x4000000}, {{@in=@loopback, 0x0, 0x33}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8}, {{@in6=@loopback, 0x0, 0x33}, 0xa, @in6=@private0, 0x0, 0x5}]}, @lastused={0xc, 0xf, 0x5}]}, 0x208}, 0x1, 0x0, 0x0, 0x1}, 0x4000) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89f4, &(0x7f0000000100)="f33cdca5865d8f627cbd149bcde862b6d0f71f7d7929e517af4e9164300a8c042b0c45aa46e61953e0e40c6cbfc5177301b88668dfad5cbea07a037cecf3110fd5e6d4754753") ioctl$sock_netdev_private(r1, 0x89f9, &(0x7f0000000040)="9198c47a1cd0c9dd59faaadd982dd37d05696b78e22a216d63ceb51dbfe09dfc97a007214fb88c6c8d2fe6109013350c90b9e5a785a53bbeb577e6a99bbcd0f31252259c668889638c08f10e7384d04697ebeea922ce754cfa5b1aa1e52a0995c5cebe38b2fc3b2cef7437cb40ed9530fa0ac3d215f51ea5a3743f8d50f48a034635f6d75545485c9e0061cf8cf68e") 472.689043ms ago: executing program 1 (id=2282): creat(&(0x7f0000000100)='./file0\x00', 0x1c) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000300)={0x18, 0x0, 0x0, {0xfffffffffffffffa}}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000002100)=ANY=[@ANYBLOB="b0000000000000001659ec0889419429aa5db97288b0f8a87ea8e66d9a8b"], 0xb0) mount$9p_fd(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="7872616e7373ab44ad735c90b123435b76bf118f3d6f3d00000000000000", @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',\x00']) 318.252036ms ago: executing program 1 (id=2283): r0 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) preadv(r0, &(0x7f00000006c0)=[{&(0x7f0000000200)=""/102, 0x66}, {&(0x7f0000000280)=""/134, 0x86}, {&(0x7f0000000340)=""/150, 0x96}, {&(0x7f0000000480)=""/162, 0xa2}, {&(0x7f0000000000)=""/1, 0x1}, {&(0x7f00000005c0)=""/98, 0x62}, {&(0x7f0000000640)=""/91, 0x5b}], 0x7, 0xf9, 0x7fffffff) close_range(r1, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000040)=[0x0], 0x0, 0x0, 0x0, 0x1}) socket$l2tp6(0xa, 0x2, 0x73) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000740)={0x0, 0x0, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r2, 0xc06864ce, &(0x7f0000000400)={r5, 0x0, 0x0, 0x0, 0x0, [0x0], [], [0x1000], [0x0, 0x0, 0x0, 0xffffffffffffffff]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000100)={r6, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000180)={0x0, 0x0, r7}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f00000001c0)={r8}) 0s ago: executing program 3 (id=2284): r0 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000040)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000540)={0x0, 0x0, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r2, 0xc06864ce, &(0x7f0000000400)={r5, 0x0, 0x0, 0x0, 0x0, [0x0], [], [0x1000], [0x0, 0x0, 0x0, 0xffffffffffffffff]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000100)={r6, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000180)={0x0, 0x0, r7}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c64d2, &(0x7f00000001c0)={r8}) kernel console output (not intermixed with test programs): dvb-usb: error while querying for an remote control event. [ 463.444755][ T5962] m920x_read = error: -19 [ 463.449276][ T5962] dvb-usb: error while querying for an remote control event. [ 463.467207][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 463.477019][ T9] usb 1-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 463.486166][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.494218][ T9] usb 1-1: Product: syz [ 463.503565][ T9] usb 1-1: Manufacturer: syz [ 463.508238][ T9] usb 1-1: SerialNumber: syz [ 463.518326][ T9] usb 1-1: config 0 descriptor?? [ 463.526914][ T9] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 463.573143][ T5962] m920x_read = error: -19 [ 463.577569][ T5962] dvb-usb: error while querying for an remote control event. [ 463.701550][ T5962] m920x_read = error: -19 [ 463.705973][ T5962] dvb-usb: error while querying for an remote control event. [ 463.947486][ T5925] usbhid 3-1:0.0: can't add hid device: -71 [ 463.953594][ T5925] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 463.964688][ T5962] m920x_read = error: -19 [ 463.969218][ T5962] dvb-usb: error while querying for an remote control event. [ 463.979743][ T5925] usb 3-1: USB disconnect, device number 11 [ 464.013303][ T5866] Bluetooth: hci2: unexpected event for opcode 0x2041 [ 464.086496][ T5962] m920x_read = error: -19 [ 464.090965][ T5962] dvb-usb: error while querying for an remote control event. [ 464.236497][ T5925] m920x_read = error: -19 [ 464.240883][ T5925] dvb-usb: error while querying for an remote control event. [ 464.375294][ T5925] m920x_read = error: -19 [ 464.379697][ T5925] dvb-usb: error while querying for an remote control event. [ 464.417121][ T5866] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 464.473200][T12270] netlink: 1343 bytes leftover after parsing attributes in process `syz.3.2132'. [ 464.503751][ T5925] m920x_read = error: -19 [ 464.508115][ T5925] dvb-usb: error while querying for an remote control event. [ 464.613735][ T5865] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 464.632029][ T5925] m920x_read = error: -19 [ 464.636467][ T5925] dvb-usb: error while querying for an remote control event. [ 464.691398][ T5866] Bluetooth: hci1: unexpected event for opcode 0x2041 [ 464.777585][ T5925] m920x_read = error: -19 [ 464.792717][ T5865] usb 2-1: Using ep0 maxpacket: 32 [ 464.793074][ T5925] dvb-usb: error while querying for an remote control event. [ 464.804101][ T5865] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 464.903893][ T5865] usb 2-1: config 0 has no interface number 0 [ 464.913849][ T5865] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 464.923127][ T5865] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.931188][ T5865] usb 2-1: Product: syz [ 464.931460][ T5962] m920x_read = error: -19 [ 464.935466][ T5865] usb 2-1: Manufacturer: syz [ 464.941156][ T5962] dvb-usb: error while querying for an remote control event. [ 464.953586][ T5865] usb 2-1: SerialNumber: syz [ 464.962294][ T5865] usb 2-1: config 0 descriptor?? [ 464.971403][ T5865] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 464.980302][ T5865] usb 2-1: selecting invalid altsetting 1 [ 464.986297][ T5865] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 464.997250][ T5865] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 465.007827][ T5865] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 465.016106][ T5865] usb 2-1: media controller created [ 465.042749][ T5865] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 465.070745][ T43] m920x_read = error: -19 [ 465.075119][ T43] dvb-usb: error while querying for an remote control event. [ 465.114432][ T5962] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 465.173924][T12285] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2139'. [ 465.187699][ T5865] usb 2-1: DVB: registering adapter 4 frontend 0 (Zarlink ZL10353 DVB-T)... [ 465.202209][ T5865] dvbdev: dvb_create_media_entity: media entity 'Zarlink ZL10353 DVB-T' registered. [ 465.203880][ T43] m920x_read = error: -19 [ 465.228427][ T43] dvb-usb: error while querying for an remote control event. [ 465.254152][ T5866] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 465.272816][ T5865] DVB: Unable to find symbol mxl5005s_attach() [ 465.289202][ T5962] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 465.299755][ T5962] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 465.321559][ T5962] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 465.333466][ T5962] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.344564][ T5962] usb 4-1: config 0 descriptor?? [ 465.359409][ T43] m920x_read = error: -19 [ 465.363889][ T43] dvb-usb: error while querying for an remote control event. [ 465.415266][ T5865] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 465.473686][ T5865] usb 2-1: USB disconnect, device number 8 [ 465.493657][ T43] m920x_read = error: -19 [ 465.507973][ T43] dvb-usb: error while querying for an remote control event. [ 465.637650][ T43] m920x_read = error: -19 [ 465.642054][ T43] dvb-usb: error while querying for an remote control event. [ 465.766337][ T43] m920x_read = error: -19 [ 465.770844][ T43] dvb-usb: error while querying for an remote control event. [ 465.786444][ T5962] kovaplus 0003:1E7D:2D50.002E: unknown main item tag 0x1 [ 465.793829][ T5962] kovaplus 0003:1E7D:2D50.002E: item fetching failed at offset 3/5 [ 465.802568][ T5962] kovaplus 0003:1E7D:2D50.002E: parse failed [ 465.808776][ T5962] kovaplus 0003:1E7D:2D50.002E: probe with driver kovaplus failed with error -22 [ 465.894316][ T5962] m920x_read = error: -19 [ 465.898723][ T5962] dvb-usb: error while querying for an remote control event. [ 465.999691][ T5962] usb 4-1: USB disconnect, device number 3 [ 466.024822][ T43] m920x_read = error: -19 [ 466.029220][ T43] dvb-usb: error while querying for an remote control event. [ 466.161900][ T43] m920x_read = error: -19 [ 466.166309][ T43] dvb-usb: error while querying for an remote control event. [ 466.207558][ T9] gspca_stk1135: reg_w 0x300 err -71 [ 466.214129][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 466.238592][ T9] gspca_stk1135: Sensor write failed [ 466.243921][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 466.267030][ T9] gspca_stk1135: Sensor write failed [ 466.273885][ T5866] Bluetooth: hci3: unexpected event for opcode 0x2041 [ 466.289713][ T5962] m920x_read = error: -19 [ 466.289957][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 466.297079][ T5962] dvb-usb: error while querying for an remote control event. [ 466.309592][ T9] gspca_stk1135: Sensor read failed [ 466.315140][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 466.323043][ T9] gspca_stk1135: Sensor read failed [ 466.328355][ T9] gspca_stk1135: Detected sensor type unknown (0x0) [ 466.335432][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 466.341779][ T9] gspca_stk1135: Sensor read failed [ 466.347433][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 466.354071][ T9] gspca_stk1135: Sensor read failed [ 466.359356][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 466.366089][ T9] gspca_stk1135: Sensor write failed [ 466.371432][ T9] gspca_stk1135: serial bus timeout: status=0x00 [ 466.378744][ T9] gspca_stk1135: Sensor write failed [ 466.384111][ T9] stk1135 1-1:0.0: probe with driver stk1135 failed with error -71 [ 466.398464][ T9] usb 1-1: USB disconnect, device number 125 [ 466.460871][ T5925] m920x_read = error: -19 [ 466.465417][ T5925] dvb-usb: error while querying for an remote control event. [ 466.590312][ T5866] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 466.592298][ T5925] m920x_read = error: -19 [ 466.613500][ T5925] dvb-usb: error while querying for an remote control event. [ 466.645245][ T5962] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 466.749762][ T5925] m920x_read = error: -19 [ 466.754389][ T5925] dvb-usb: error while querying for an remote control event. [ 466.813898][ T5962] usb 3-1: Using ep0 maxpacket: 8 [ 466.821224][ T5962] usb 3-1: config 0 interface 0 altsetting 218 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 466.836620][ T5962] usb 3-1: config 0 interface 0 altsetting 218 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 466.850072][ T5962] usb 3-1: config 0 interface 0 has no altsetting 0 [ 466.857075][ T5962] usb 3-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.00 [ 466.866320][ T5962] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.888737][ T5925] m920x_read = error: -19 [ 466.896737][ T5925] dvb-usb: error while querying for an remote control event. [ 466.906508][ T5962] usb 3-1: config 0 descriptor?? [ 466.931412][ T9] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 467.000167][T12318] FAULT_INJECTION: forcing a failure. [ 467.000167][T12318] name failslab, interval 1, probability 0, space 0, times 0 [ 467.016460][T12318] CPU: 0 UID: 0 PID: 12318 Comm: syz.0.2153 Not tainted syzkaller #0 PREEMPT(full) [ 467.016486][T12318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 467.016499][T12318] Call Trace: [ 467.016507][T12318] [ 467.016515][T12318] dump_stack_lvl+0x189/0x250 [ 467.016551][T12318] ? __pfx____ratelimit+0x10/0x10 [ 467.016586][T12318] ? __pfx_dump_stack_lvl+0x10/0x10 [ 467.016617][T12318] ? __pfx__printk+0x10/0x10 [ 467.016648][T12318] ? __pfx___might_resched+0x10/0x10 [ 467.016672][T12318] ? fs_reclaim_acquire+0x7d/0x100 [ 467.016702][T12318] should_fail_ex+0x414/0x560 [ 467.016729][T12318] should_failslab+0xa8/0x100 [ 467.016755][T12318] __kmalloc_cache_noprof+0x6f/0x6f0 [ 467.016776][T12318] ? stack_trace_save+0x9c/0xe0 [ 467.016803][T12318] ? iopt_map_pages+0x116/0xd80 [ 467.016822][T12318] ? __pfx_stack_trace_save+0x10/0x10 [ 467.016855][T12318] iopt_map_pages+0x116/0xd80 [ 467.016880][T12318] ? kasan_save_track+0x4f/0x80 [ 467.016900][T12318] ? __kasan_kmalloc+0x93/0xb0 [ 467.016920][T12318] ? __kmalloc_cache_noprof+0x3d5/0x6f0 [ 467.016939][T12318] ? iopt_alloc_pages+0x85/0x490 [ 467.016966][T12318] ? __pfx_iopt_map_pages+0x10/0x10 [ 467.016983][T12318] ? do_syscall_64+0xfa/0xfa0 [ 467.017000][T12318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.017057][T12318] iopt_map_common+0x2bb/0x4f0 [ 467.017084][T12318] ? __pfx_iopt_map_common+0x10/0x10 [ 467.017123][T12318] iopt_map_user_pages+0xbc/0xd0 [ 467.017149][T12318] iommufd_ioas_map+0x392/0x4c0 [ 467.017181][T12318] ? __pfx_iommufd_ioas_map+0x10/0x10 [ 467.017214][T12318] iommufd_fops_ioctl+0x45b/0x580 [ 467.017246][T12318] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 467.017294][T12318] ? __fget_files+0x3a0/0x420 [ 467.017321][T12318] ? __fget_files+0x2a/0x420 [ 467.017350][T12318] ? bpf_lsm_file_ioctl+0x9/0x20 [ 467.017367][T12318] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 467.017391][T12318] __se_sys_ioctl+0xfc/0x170 [ 467.017415][T12318] do_syscall_64+0xfa/0xfa0 [ 467.017431][T12318] ? lockdep_hardirqs_on+0x9c/0x150 [ 467.017454][T12318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.017472][T12318] ? clear_bhb_loop+0x60/0xb0 [ 467.017495][T12318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.017512][T12318] RIP: 0033:0x7fd64178ebe9 [ 467.017529][T12318] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 467.017545][T12318] RSP: 002b:00007fd6425e6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 467.017563][T12318] RAX: ffffffffffffffda RBX: 00007fd6419c5fa0 RCX: 00007fd64178ebe9 [ 467.017574][T12318] RDX: 0000200000000140 RSI: 0000000000003b85 RDI: 0000000000000003 [ 467.017584][T12318] RBP: 00007fd6425e6090 R08: 0000000000000000 R09: 0000000000000000 [ 467.017593][T12318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 467.017601][T12318] R13: 00007fd6419c6038 R14: 00007fd6419c5fa0 R15: 00007ffdcb3daab8 [ 467.017624][T12318] [ 467.027854][ T5925] m920x_read = error: -19 [ 467.145339][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 467.150776][ T5925] dvb-usb: error while querying for an remote control event. [ 467.172112][ T9] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 467.199159][ T5866] Bluetooth: hci2: unexpected event for opcode 0x2041 [ 467.213562][ T9] usb 4-1: can't read configurations, error -71 [ 467.295292][ T5925] m920x_read = error: -19 [ 467.321243][T12324] overlayfs: failed to resolve './file0': -2 [ 467.323540][ T5925] dvb-usb: error while querying for an remote control event. [ 467.376885][ T5962] redragon 0003:0C45:760B.002F: unknown main item tag 0x0 [ 467.385646][ T5962] redragon 0003:0C45:760B.002F: unknown main item tag 0x0 [ 467.398766][ T5962] redragon 0003:0C45:760B.002F: unknown main item tag 0x0 [ 467.406223][ T5962] redragon 0003:0C45:760B.002F: unknown main item tag 0x0 [ 467.413700][ T5962] redragon 0003:0C45:760B.002F: unknown main item tag 0x0 [ 467.420841][ T5962] redragon 0003:0C45:760B.002F: unknown main item tag 0x0 [ 467.443474][ T5962] redragon 0003:0C45:760B.002F: unknown main item tag 0x0 [ 467.455792][ T5865] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 467.470854][ T5962] redragon 0003:0C45:760B.002F: hidraw0: USB HID v0.00 Device [HID 0c45:760b] on usb-dummy_hcd.2-1/input0 [ 467.488658][ T5925] m920x_read = error: -19 [ 467.493016][ T5925] dvb-usb: error while querying for an remote control event. [ 467.611190][ T10] usb 3-1: USB disconnect, device number 12 [ 467.615954][ T5962] m920x_read = error: -19 [ 467.619601][ T5865] usb 1-1: Using ep0 maxpacket: 8 [ 467.621613][ T5962] dvb-usb: error while querying for an remote control event. [ 467.628410][ T5865] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 467.649391][ T5865] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 467.666311][ T5865] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 467.678240][ T5865] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.686664][ T5865] usb 1-1: Product: ᗅ饯ᱸ鹍㰦ᤚ뜊牿猜甶젛呹谧⵩ꢳ褄岝雋ᱪ⪊〹헍꼻꜋免㼰﵎䯁癞龶荍㟴翫⠿떷䤃䃺怩鄋⹳麜塐ﭸŶ럇ᐓ鏤鐿Ⴃ媛齧ೈÿ尹સ웈連앙乁뢃Ꭸ롂㧽ᆳ测쑍秲勮悷얎藊Ѳ∎賵␭柏竇艧阅㢽윞죮襈 [ 467.714821][ T5858] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 467.723056][ T5865] usb 1-1: Manufacturer: 炜鑱퇊ꕨ꙲蹗砐뾽蠷濕뎏껖쏚鄉栤清ꞈ樣뮡攏䅰ﲀ釗嫂䰩롨蓅䏛ὦ圐㚽솒ꋨﭷძ檾憔蒛׶壯뙝댆蕁聆붆뗾␫೙聲ڄ䴑ꋬ冾祄ڥᮉ덍㨉〜뷠錐眽쐶몏邕䛎ⵋꊴ쪶淌狧㮃韯瑪뾒絹腼㱈耉뙰庋丄ꖴꦨ鱺Ɍ遶뙦 [ 467.752474][ T5865] usb 1-1: SerialNumber: 㷯쯬횒샶ꔙȿ警졊雛ꗁ쇚봌훪鱗䬉迯퓓엳茬䍭笼➃中셇矽ᝈ覍쀉傡헝쵾镞탍뱉豊쪯됴ݮ櫱讬쓎뺞琏轇ᝧ膫Ѳ觡ឳ翌㖘锠磙鞎ひ꒵︞쳊듦㍵賾퉑ಛ夽踚齖讔⻏★ुঙ冗㙅浪ꤠ鸼퀙ꢔ〼䊛᥎ܰ౑ࢸㆊ [ 467.787741][ T5865] usb 1-1: rejected 1 configuration due to insufficient available bus power [ 467.796445][ T5865] usb 1-1: no configuration chosen from 1 choice [ 467.803156][ T5962] m920x_read = error: -19 [ 467.811673][ T5962] dvb-usb: error while querying for an remote control event. [ 467.842206][ T5866] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 467.883241][ T5858] usb 2-1: Using ep0 maxpacket: 8 [ 467.890146][ T5858] usb 2-1: unable to get BOS descriptor or descriptor too short [ 467.900644][ T5858] usb 2-1: config 190 has an invalid interface number: 42 but max is 0 [ 467.908996][ T5858] usb 2-1: config 190 has an invalid descriptor of length 0, skipping remainder of the config [ 467.919786][ T5858] usb 2-1: config 190 has no interface number 0 [ 467.926113][ T5858] usb 2-1: config 190 interface 42 has no altsetting 0 [ 467.935973][ T5858] usb 2-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice=77.12 [ 467.936849][ T5962] m920x_read = error: -19 [ 467.945240][ T5858] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.953318][ T5962] dvb-usb: error while querying for an remote control event. [ 467.958815][ T5858] usb 2-1: Product: syz [ 467.969272][ T5858] usb 2-1: Manufacturer: syz [ 467.973959][ T5858] usb 2-1: SerialNumber: syz [ 468.075836][ T5962] m920x_read = error: -19 [ 468.080221][ T5962] dvb-usb: error while querying for an remote control event. [ 468.204294][ T5962] m920x_read = error: -19 [ 468.208704][ T5962] dvb-usb: error while querying for an remote control event. [ 468.211617][ T5858] usb 2-1: USB disconnect, device number 9 [ 468.241940][ T9] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 468.332519][ T5962] m920x_read = error: -19 [ 468.336930][ T5962] dvb-usb: error while querying for an remote control event. [ 468.420484][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 468.430652][ T9] usb 4-1: config 10 has an invalid descriptor of length 0, skipping remainder of the config [ 468.442769][ T9] usb 4-1: New USB device found, idVendor=0499, idProduct=101b, bcdDevice=56.29 [ 468.452448][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.460447][ T9] usb 4-1: Product: syz [ 468.462232][ T5962] m920x_read = error: -19 [ 468.464634][ T9] usb 4-1: Manufacturer: syz [ 468.469293][ T5962] dvb-usb: error while querying for an remote control event. [ 468.473847][ T9] usb 4-1: SerialNumber: syz [ 468.524998][ T10] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 468.599853][ T5962] m920x_read = error: -19 [ 468.604207][ T5962] dvb-usb: error while querying for an remote control event. [ 468.696067][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 468.709497][ T9] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 468.720353][ T10] usb 3-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 468.728276][ T5962] m920x_read = error: -19 [ 468.729719][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.735341][ T5962] dvb-usb: error while querying for an remote control event. [ 468.753354][ T9] snd-usb-audio 4-1:10.0: probe with driver snd-usb-audio failed with error -2 [ 468.762475][ T10] usb 3-1: Product: syz [ 468.766647][ T10] usb 3-1: Manufacturer: syz [ 468.773277][ T10] usb 3-1: SerialNumber: syz [ 468.786774][ T9] usb 4-1: USB disconnect, device number 5 [ 468.803537][ T10] usb 3-1: config 0 descriptor?? [ 468.816581][ T10] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 468.833055][ T6060] udevd[6060]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:10.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 468.867372][ T5962] m920x_read = error: -19 [ 468.871767][ T5962] dvb-usb: error while querying for an remote control event. [ 468.895634][T12337] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2162'. [ 468.908011][T12337] bridge0: port 3(wlan0) entered blocking state [ 468.915033][T12337] bridge0: port 3(wlan0) entered disabled state [ 468.921824][T12337] mac80211_hwsim hwsim5 wlan0: entered allmulticast mode [ 468.930368][T12337] mac80211_hwsim hwsim5 wlan0: entered promiscuous mode [ 468.995880][ T5962] m920x_read = error: -19 [ 469.000286][ T5962] dvb-usb: error while querying for an remote control event. [ 469.123938][ T5962] m920x_read = error: -19 [ 469.128326][ T5962] dvb-usb: error while querying for an remote control event. [ 469.253535][ T5962] m920x_read = error: -19 [ 469.258088][ T5962] dvb-usb: error while querying for an remote control event. [ 469.380630][ T5962] m920x_read = error: -19 [ 469.385068][ T5962] dvb-usb: error while querying for an remote control event. [ 469.530388][ T43] m920x_read = error: -19 [ 469.534775][ T43] dvb-usb: error while querying for an remote control event. [ 469.661195][ T43] m920x_read = error: -19 [ 469.665649][ T43] dvb-usb: error while querying for an remote control event. [ 469.677545][ T5866] Bluetooth: hci2: unexpected event for opcode 0x2041 [ 469.787056][ T43] m920x_read = error: -19 [ 469.791528][ T43] dvb-usb: error while querying for an remote control event. [ 469.866010][T12345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 469.883905][T12345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 469.939691][ T5962] m920x_read = error: -19 [ 469.944077][ T5962] dvb-usb: error while querying for an remote control event. [ 470.065206][ T5962] m920x_read = error: -19 [ 470.069635][ T5962] dvb-usb: error while querying for an remote control event. [ 470.118634][ T43] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 470.193794][ T5962] m920x_read = error: -19 [ 470.198157][ T5962] dvb-usb: error while querying for an remote control event. [ 470.289651][ T43] usb 2-1: Using ep0 maxpacket: 8 [ 470.301681][ T43] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 470.309976][ T43] usb 2-1: config 179 has no interface number 0 [ 470.316377][ T43] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 470.327565][ T5962] m920x_read = error: -19 [ 470.331935][ T5962] dvb-usb: error while querying for an remote control event. [ 470.339743][ T43] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 470.351147][ T43] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 470.362335][ T43] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 470.373766][ T43] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 470.374271][ T9] usb 1-1: USB disconnect, device number 126 [ 470.387091][ T43] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 470.387117][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 470.426702][T12346] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 470.461312][ T5962] m920x_read = error: -19 [ 470.465855][ T5962] dvb-usb: error while querying for an remote control event. [ 470.500967][T12357] netlink: 'syz.0.2169': attribute type 29 has an invalid length. [ 470.521572][T12357] netlink: 'syz.0.2169': attribute type 29 has an invalid length. [ 470.531735][T12357] netlink: 500 bytes leftover after parsing attributes in process `syz.0.2169'. [ 470.635087][ T43] m920x_read = error: -19 [ 470.639569][ T43] dvb-usb: error while querying for an remote control event. [ 470.701476][ T9] usb 2-1: USB disconnect, device number 10 [ 470.701522][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 470.715959][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 470.781752][ T43] m920x_read = error: -19 [ 470.786214][ T43] dvb-usb: error while querying for an remote control event. [ 470.910502][ T43] m920x_read = error: -19 [ 470.918059][ T43] dvb-usb: error while querying for an remote control event. [ 471.049123][ T43] m920x_read = error: -19 [ 471.053515][ T43] dvb-usb: error while querying for an remote control event. [ 471.110519][T12369] overlayfs: failed to resolve './file0': -2 [ 471.184795][ T5866] Bluetooth: hci0: unexpected event for opcode 0x2041 [ 471.194667][ T43] m920x_read = error: -19 [ 471.208103][ T43] dvb-usb: error while querying for an remote control event. [ 471.327513][ T43] m920x_read = error: -19 [ 471.332082][ T43] dvb-usb: error while querying for an remote control event. [ 471.433117][ T10] gspca_stk1135: reg_w 0x300 err -71 [ 471.445720][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 471.452147][ T10] gspca_stk1135: Sensor write failed [ 471.458072][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 471.464551][ T10] gspca_stk1135: Sensor write failed [ 471.466810][ T5925] m920x_read = error: -19 [ 471.470907][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 471.474183][ T5925] dvb-usb: error while querying for an remote control event. [ 471.480920][ T10] gspca_stk1135: Sensor read failed [ 471.493416][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 471.499823][ T10] gspca_stk1135: Sensor read failed [ 471.505104][ T10] gspca_stk1135: Detected sensor type unknown (0x0) [ 471.511972][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 471.518365][ T10] gspca_stk1135: Sensor read failed [ 471.540995][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 471.547346][ T10] gspca_stk1135: Sensor read failed [ 471.552715][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 471.559054][ T10] gspca_stk1135: Sensor write failed [ 471.564399][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 471.570735][ T10] gspca_stk1135: Sensor write failed [ 471.576161][ T10] stk1135 3-1:0.0: probe with driver stk1135 failed with error -71 [ 471.591195][ T10] usb 3-1: USB disconnect, device number 13 [ 471.605305][ T5925] m920x_read = error: -19 [ 471.609841][ T5925] dvb-usb: error while querying for an remote control event. [ 471.626570][ T43] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 471.680116][ T5962] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 471.733622][ T5925] m920x_read = error: -19 [ 471.738029][ T5925] dvb-usb: error while querying for an remote control event. [ 471.791161][ T43] usb 2-1: unable to get BOS descriptor or descriptor too short [ 471.800022][ T43] usb 2-1: config 0 has an invalid interface number: 158 but max is 0 [ 471.811606][ T43] usb 2-1: config 0 has no interface number 0 [ 471.820448][ T43] usb 2-1: New USB device found, idVendor=0b48, idProduct=300d, bcdDevice=70.01 [ 471.829612][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 471.840347][ T43] usb 2-1: Product: syz [ 471.845718][ T43] usb 2-1: Manufacturer: syz [ 471.850305][ T43] usb 2-1: SerialNumber: syz [ 471.857545][ T43] usb 2-1: config 0 descriptor?? [ 471.862681][ T5925] m920x_read = error: -19 [ 471.867030][ T5925] dvb-usb: error while querying for an remote control event. [ 471.874476][ T5962] usb 1-1: Using ep0 maxpacket: 8 [ 471.882521][ T43] dvb-usb: found a 'Technotrend TT-connect CT-3650' in warm state. [ 471.890610][ T5962] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 471.898103][ T5962] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 471.909489][ T43] dvb-usb: bulk message failed: -22 (4/0) [ 471.915229][ T43] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 471.925515][ T43] dvb-usb: bulk message failed: -22 (5/0) [ 471.931398][ T5962] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 471.942821][ T5962] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 471.954707][ T43] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 471.965003][ T5962] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 471.977588][ T5962] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 471.991186][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 472.000404][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 472.009729][ T5925] m920x_read = error: -19 [ 472.014177][ T5925] dvb-usb: error while querying for an remote control event. [ 472.021599][ T5962] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 472.035285][ T5962] usb 1-1: config 168 interface 0 has no altsetting 0 [ 472.043459][ T43] dvbdev: DVB: registering new adapter (Technotrend TT-connect CT-3650) [ 472.052068][ T43] usb 2-1: media controller created [ 472.057974][ T5962] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 472.075784][ T5962] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 472.079295][ T10] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 472.094744][ T5962] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 472.117506][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 472.126517][ T5962] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 472.140652][ T5925] m920x_read = error: -19 [ 472.145022][ T5925] dvb-usb: error while querying for an remote control event. [ 472.161843][ T5962] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 472.174803][ T5962] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 472.186844][ T43] ttusb2: set interface to alts=3 failed [ 472.204099][ T5962] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 472.225541][ T5962] usb 1-1: config 168 interface 0 has no altsetting 0 [ 472.243030][ T30] audit: type=1326 audit(1756902454.512:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12390 comm="syz.2.2184" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 472.268096][ T30] audit: type=1326 audit(1756902454.512:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12390 comm="syz.2.2184" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 472.268289][ T5962] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 472.291388][ T43] DVB: Unable to find symbol tda10023_attach() [ 472.304893][ T5925] m920x_read = error: -19 [ 472.305716][T12391] XFS (nullb0): Invalid superblock magic number [ 472.309307][ T5925] dvb-usb: error while querying for an remote control event. [ 472.309362][ T43] dvb-usb: no frontend was attached by 'Technotrend TT-connect CT-3650' [ 472.328318][ T30] audit: type=1326 audit(1756902454.512:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12390 comm="syz.2.2184" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 472.331374][ T5962] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 472.353979][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 472.375030][ T10] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 472.376829][T12397] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2184'. [ 472.387963][ T10] usb 4-1: New USB device found, idVendor=07b5, idProduct=0312, bcdDevice= 0.00 [ 472.406134][ T30] audit: type=1326 audit(1756902454.512:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12390 comm="syz.2.2184" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 472.419987][ T5925] m920x_read = error: -19 [ 472.429123][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.447133][ T10] usb 4-1: config 0 descriptor?? [ 472.459962][ T5962] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 472.461660][ T30] audit: type=1326 audit(1756902454.512:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12390 comm="syz.2.2184" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 472.474624][ T5925] dvb-usb: error while querying for an remote control event. [ 472.495475][ T30] audit: type=1326 audit(1756902454.512:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12390 comm="syz.2.2184" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 472.528285][ T5962] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 472.555350][ T30] audit: type=1326 audit(1756902454.512:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12390 comm="syz.2.2184" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 472.578429][ T43] rc_core: IR keymap rc-tt-1500 not found [ 472.584164][ T43] Registered IR keymap rc-empty [ 472.584782][ T30] audit: type=1326 audit(1756902454.512:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12390 comm="syz.2.2184" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 472.590776][ T43] rc rc0: Technotrend TT-connect CT-3650 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 472.616452][ T30] audit: type=1326 audit(1756902454.512:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12390 comm="syz.2.2184" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 472.622831][ T5962] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 472.657443][ T30] audit: type=1326 audit(1756902454.512:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12390 comm="syz.2.2184" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 472.661607][ T43] input: Technotrend TT-connect CT-3650 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input45 [ 472.695025][ T5962] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 472.715156][ T5962] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 472.733733][ T5962] usb 1-1: config 168 interface 0 has no altsetting 0 [ 472.740714][ T5925] m920x_read = error: -19 [ 472.745090][ T5925] dvb-usb: error while querying for an remote control event. [ 472.755950][ T43] dvb-usb: schedule remote query interval to 150 msecs. [ 472.763922][ T43] dvb-usb: bulk message failed: -22 (4/0) [ 472.769676][ T43] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 472.783842][ T43] dvb-usb: bulk message failed: -22 (5/0) [ 472.790242][ T43] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 472.802613][ T43] dvb-usb: Technotrend TT-connect CT-3650 successfully initialized and connected. [ 472.812431][ T5962] usb 1-1: string descriptor 0 read error: -22 [ 472.823283][ T5962] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 472.833421][ T5962] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.862688][ T43] usb 2-1: USB disconnect, device number 11 [ 472.878032][ T24] m920x_read = error: -19 [ 472.882392][ T24] dvb-usb: error while querying for an remote control event. [ 472.896754][ T5962] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 473.008029][ T5962] m920x_read = error: -19 [ 473.012517][ T5962] dvb-usb: error while querying for an remote control event. [ 473.043817][ T10] usbhid 4-1:0.0: can't add hid device: -71 [ 473.049878][ T10] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 473.079675][ T10] usb 4-1: USB disconnect, device number 6 [ 473.097990][ T43] dvb-usb: Technotrend TT-connect CT-3650 successfully deinitialized and disconnected. [ 473.157957][ T5962] m920x_read = error: -19 [ 473.164438][T12406] binder: BINDER_SET_CONTEXT_MGR already set [ 473.174288][T12406] binder: 12404:12406 ioctl 4018620d 200000000040 returned -16 [ 473.174354][ T5962] dvb-usb: error while querying for an remote control event. [ 473.232693][T12407] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.246706][T12407] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.262022][T12406] FAULT_INJECTION: forcing a failure. [ 473.262022][T12406] name failslab, interval 1, probability 0, space 0, times 0 [ 473.276155][T12406] CPU: 0 UID: 0 PID: 12406 Comm: syz.1.2187 Not tainted syzkaller #0 PREEMPT(full) [ 473.276189][T12406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 473.276201][T12406] Call Trace: [ 473.276209][T12406] [ 473.276217][T12406] dump_stack_lvl+0x189/0x250 [ 473.276250][T12406] ? __pfx____ratelimit+0x10/0x10 [ 473.276278][T12406] ? __pfx_dump_stack_lvl+0x10/0x10 [ 473.276305][T12406] ? __pfx__printk+0x10/0x10 [ 473.276337][T12406] ? __pfx___might_resched+0x10/0x10 [ 473.276358][T12406] ? fs_reclaim_acquire+0x7d/0x100 [ 473.276385][T12406] should_fail_ex+0x414/0x560 [ 473.276410][T12406] should_failslab+0xa8/0x100 [ 473.276435][T12406] __kvmalloc_node_noprof+0x158/0x910 [ 473.276458][T12406] ? seq_read_iter+0x202/0xe20 [ 473.276486][T12406] seq_read_iter+0x202/0xe20 [ 473.276505][T12406] ? trace_irq_disable+0x37/0x110 [ 473.276524][T12406] ? preempt_schedule_irq+0xde/0x150 [ 473.276559][T12406] ? __asan_memset+0x22/0x50 [ 473.276592][T12406] seq_read+0x369/0x480 [ 473.276621][T12406] ? __pfx_seq_read+0x10/0x10 [ 473.276649][T12406] ? __pfx_seq_read+0x10/0x10 [ 473.276678][T12406] full_proxy_read+0x127/0x1f0 [ 473.276698][T12406] ? __pfx_full_proxy_read+0x10/0x10 [ 473.276718][T12406] vfs_read+0x1fd/0xa30 [ 473.276739][T12406] ? fdget_pos+0x247/0x320 [ 473.276768][T12406] ? __pfx___mutex_lock+0x10/0x10 [ 473.276787][T12406] ? __pfx_vfs_read+0x10/0x10 [ 473.276811][T12406] ? __fget_files+0x2a/0x420 [ 473.276840][T12406] ? __fget_files+0x3a0/0x420 [ 473.276865][T12406] ? __fget_files+0x2a/0x420 [ 473.276899][T12406] ksys_read+0x145/0x250 [ 473.276920][T12406] ? irqentry_exit+0x74/0x90 [ 473.276939][T12406] ? __pfx_ksys_read+0x10/0x10 [ 473.276964][T12406] ? do_syscall_64+0xbe/0xfa0 [ 473.276985][T12406] do_syscall_64+0xfa/0xfa0 [ 473.277010][T12406] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.277028][T12406] ? asm_sysvec_call_function_single+0x1a/0x20 [ 473.277046][T12406] ? clear_bhb_loop+0x60/0xb0 [ 473.277068][T12406] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.277085][T12406] RIP: 0033:0x7f544bb8ebe9 [ 473.277102][T12406] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 473.277119][T12406] RSP: 002b:00007f544c936038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 473.277139][T12406] RAX: ffffffffffffffda RBX: 00007f544bdc6090 RCX: 00007f544bb8ebe9 [ 473.277153][T12406] RDX: 0000000000002020 RSI: 0000200000005180 RDI: 0000000000000007 [ 473.277165][T12406] RBP: 00007f544c936090 R08: 0000000000000000 R09: 0000000000000000 [ 473.277177][T12406] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 473.277188][T12406] R13: 00007f544bdc6128 R14: 00007f544bdc6090 R15: 00007ffcf1ab23b8 [ 473.277217][T12406] [ 473.317095][ T43] m920x_read = error: -19 [ 473.404554][ T10] usb 1-1: USB disconnect, device number 127 [ 473.593613][ T43] dvb-usb: error while querying for an remote control event. [ 473.627125][ T5874] Bluetooth: hci3: command 0x0c1a tx timeout [ 473.719203][ T5962] m920x_read = error: -19 [ 473.723702][ T5962] dvb-usb: error while querying for an remote control event. [ 473.848443][ T5962] m920x_read = error: -19 [ 473.849865][T12413] binder: BINDER_SET_CONTEXT_MGR already set [ 473.859385][ T5962] dvb-usb: error while querying for an remote control event. [ 473.869222][T12413] binder: 12411:12413 ioctl 4018620d 200000000040 returned -16 [ 473.877235][ T5874] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 474.001243][ T43] m920x_read = error: -19 [ 474.005614][ T43] dvb-usb: error while querying for an remote control event. [ 474.060363][T12419] netlink: 'syz.0.2191': attribute type 2 has an invalid length. [ 474.068435][T12419] netlink: 'syz.0.2191': attribute type 2 has an invalid length. [ 474.150731][ T43] m920x_read = error: -19 [ 474.155173][ T43] dvb-usb: error while querying for an remote control event. [ 474.225492][ T5962] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 474.279062][ T43] m920x_read = error: -19 [ 474.287480][ T43] dvb-usb: error while querying for an remote control event. [ 474.375242][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 474.398390][ T5962] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 474.417505][ T5962] usb 3-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 474.427763][ T43] m920x_read = error: -19 [ 474.439386][ T43] dvb-usb: error while querying for an remote control event. [ 474.447002][ T5962] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 474.479127][ T5962] usb 3-1: config 0 descriptor?? [ 474.557076][ T43] m920x_read = error: -19 [ 474.557124][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 474.561455][ T43] dvb-usb: error while querying for an remote control event. [ 474.593861][ T10] usb 1-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 474.603543][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.613851][ T10] usb 1-1: Product: syz [ 474.620934][ T10] usb 1-1: Manufacturer: syz [ 474.625680][ T10] usb 1-1: SerialNumber: syz [ 474.658709][ T10] usb 1-1: config 0 descriptor?? [ 474.685479][ T43] m920x_read = error: -19 [ 474.689887][ T43] dvb-usb: error while querying for an remote control event. [ 474.699610][ T10] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 474.824478][ T43] m920x_read = error: -19 [ 474.829354][ T43] dvb-usb: error while querying for an remote control event. [ 474.957840][ T5962] lenovo 0003:17EF:6047.0030: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.2-1/input0 [ 474.981468][ T43] m920x_read = error: -19 [ 474.995755][ T43] dvb-usb: error while querying for an remote control event. [ 475.113682][ T43] m920x_read = error: -19 [ 475.118143][ T43] dvb-usb: error while querying for an remote control event. [ 475.150852][T12417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.168967][T12417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.252369][ T43] m920x_read = error: -19 [ 475.257420][ T43] dvb-usb: error while querying for an remote control event. [ 475.391360][ T43] m920x_read = error: -19 [ 475.395784][ T43] dvb-usb: error while querying for an remote control event. [ 475.419239][ T5962] lenovo 0003:17EF:6047.0030: Failed to switch middle button: -71 [ 475.432176][ T5962] lenovo 0003:17EF:6047.0030: Fn-lock setting failed: -71 [ 475.440143][ T5962] lenovo 0003:17EF:6047.0030: Sensitivity setting failed: -71 [ 475.450585][ T5874] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 475.471720][ T5962] usb 3-1: USB disconnect, device number 14 [ 475.531790][ T43] m920x_read = error: -19 [ 475.536189][ T43] dvb-usb: error while querying for an remote control event. [ 475.672063][ T43] m920x_read = error: -19 [ 475.676446][ T43] dvb-usb: error while querying for an remote control event. [ 475.751074][T12443] XFS (nullb0): Invalid superblock magic number [ 475.776971][ T5865] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 475.786326][T12443] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2201'. [ 475.808457][ T5962] m920x_read = error: -19 [ 475.812887][ T5962] dvb-usb: error while querying for an remote control event. [ 475.867751][T12450] loop6: detected capacity change from 0 to 63 [ 475.877122][T12450] Buffer I/O error on dev loop6, logical block 0, async page read [ 475.887813][ T6140] Buffer I/O error on dev loop6, logical block 0, async page read [ 475.896086][T12450] Buffer I/O error on dev loop6, logical block 0, async page read [ 475.904064][T12450] Buffer I/O error on dev loop6, logical block 0, async page read [ 475.912429][ T6140] Buffer I/O error on dev loop6, logical block 0, async page read [ 475.921381][T12450] Buffer I/O error on dev loop6, logical block 0, async page read [ 475.929857][T12450] Buffer I/O error on dev loop6, logical block 0, async page read [ 475.938480][ T6140] Buffer I/O error on dev loop6, logical block 0, async page read [ 475.947622][ T5865] usb 2-1: Using ep0 maxpacket: 8 [ 475.947790][ T5962] m920x_read = error: -19 [ 475.957009][ T5962] dvb-usb: error while querying for an remote control event. [ 475.960083][ T5865] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 475.964593][T12451] Buffer I/O error on dev loop6, logical block 0, async page read [ 475.976253][ T5865] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 475.980201][ T6140] Buffer I/O error on dev loop6, logical block 0, async page read [ 476.025470][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 476.042370][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 476.068679][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 476.085525][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 476.101974][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 476.117651][ T5865] usb 2-1: config 168 interface 0 has no altsetting 0 [ 476.130629][ T5865] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 476.139624][ T5962] m920x_read = error: -19 [ 476.150847][ T5962] dvb-usb: error while querying for an remote control event. [ 476.162922][ T5865] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 476.187351][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 476.201831][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 476.221298][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 476.236057][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 476.251207][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 476.268453][ T5962] m920x_read = error: -19 [ 476.272830][ T5962] dvb-usb: error while querying for an remote control event. [ 476.274069][ T5865] usb 2-1: config 168 interface 0 has no altsetting 0 [ 476.288852][ T5865] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 476.296623][ T5865] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 476.331652][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 476.355016][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 476.390095][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 476.423122][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 476.457178][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 476.492642][ T5865] usb 2-1: config 168 interface 0 has no altsetting 0 [ 476.521542][ T5865] usb 2-1: string descriptor 0 read error: -22 [ 476.531452][ T5865] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 476.558816][ T5865] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.642486][ T5865] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 476.749672][ T5962] m920x_read = error: -19 [ 476.754051][ T5962] dvb-usb: error while querying for an remote control event. [ 476.878914][ T5962] m920x_read = error: -19 [ 476.884004][ T5962] dvb-usb: error while querying for an remote control event. [ 476.994409][T12465] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 477.014884][T12465] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.027969][ T5962] m920x_read = error: -19 [ 477.045386][ T5962] dvb-usb: error while querying for an remote control event. [ 477.174466][ T5962] usb 2-1: USB disconnect, device number 12 [ 477.185480][ T5925] m920x_read = error: -19 [ 477.193433][ T5925] dvb-usb: error while querying for an remote control event. [ 477.312319][ T10] gspca_stk1135: reg_w 0x300 err -71 [ 477.318887][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 477.327528][ T5925] m920x_read = error: -19 [ 477.328778][ T10] gspca_stk1135: Sensor write failed [ 477.334554][ T5925] dvb-usb: error while querying for an remote control event. [ 477.337376][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 477.401928][ T10] gspca_stk1135: Sensor write failed [ 477.407280][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 477.455393][ T10] gspca_stk1135: Sensor read failed [ 477.463219][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 477.473054][ T5866] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 477.480924][ T5925] m920x_read = error: -19 [ 477.485285][ T5925] dvb-usb: error while querying for an remote control event. [ 477.487505][ T10] gspca_stk1135: Sensor read failed [ 477.501384][ T10] gspca_stk1135: Detected sensor type unknown (0x0) [ 477.508013][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 477.514508][ T5866] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 477.522779][ T5866] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 477.532308][ T5866] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 477.539543][ T10] gspca_stk1135: Sensor read failed [ 477.549273][ T5866] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 477.559566][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 477.594664][ T10] gspca_stk1135: Sensor read failed [ 477.599911][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 477.629428][ T10] gspca_stk1135: Sensor write failed [ 477.637373][ T10] gspca_stk1135: serial bus timeout: status=0x00 [ 477.643718][ T10] gspca_stk1135: Sensor write failed [ 477.671941][ T5925] m920x_read = error: -19 [ 477.680063][ T5925] dvb-usb: error while querying for an remote control event. [ 477.681405][ T10] stk1135 1-1:0.0: probe with driver stk1135 failed with error -71 [ 477.749943][ T10] usb 1-1: USB disconnect, device number 2 [ 477.808437][ T5962] m920x_read = error: -19 [ 477.812813][ T5962] dvb-usb: error while querying for an remote control event. [ 477.822756][ T6978] syz_tun (unregistering): left allmulticast mode [ 477.958204][ T5962] m920x_read = error: -19 [ 477.962673][ T5962] dvb-usb: error while querying for an remote control event. [ 478.036637][T12474] netlink: 'syz.0.2210': attribute type 29 has an invalid length. [ 478.074105][T12474] netlink: 'syz.0.2210': attribute type 29 has an invalid length. [ 478.156441][T12479] FAULT_INJECTION: forcing a failure. [ 478.156441][T12479] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 478.170459][T12479] CPU: 0 UID: 0 PID: 12479 Comm: syz.2.2212 Not tainted syzkaller #0 PREEMPT(full) [ 478.170483][T12479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 478.170495][T12479] Call Trace: [ 478.170503][T12479] [ 478.170511][T12479] dump_stack_lvl+0x189/0x250 [ 478.170544][T12479] ? __pfx____ratelimit+0x10/0x10 [ 478.170571][T12479] ? __pfx_dump_stack_lvl+0x10/0x10 [ 478.170599][T12479] ? __pfx__printk+0x10/0x10 [ 478.170640][T12479] should_fail_ex+0x414/0x560 [ 478.170673][T12479] __kvm_read_guest_page+0x18d/0x240 [ 478.170696][T12479] kvm_fetch_guest_virt+0x12b/0x170 [ 478.170724][T12479] ? __pfx_kvm_fetch_guest_virt+0x10/0x10 [ 478.170748][T12479] __do_insn_fetch_bytes+0x2f9/0x6d0 [ 478.170773][T12479] ? __pfx___do_insn_fetch_bytes+0x10/0x10 [ 478.170795][T12479] ? perf_trace_contention_begin+0x1c0/0x2f0 [ 478.170820][T12479] ? x86_decode_insn+0x12d7/0x5310 [ 478.170844][T12479] x86_decode_insn+0x33c/0x5310 [ 478.170861][T12479] ? __pfx_vmx_vcpu_pi_put+0x10/0x10 [ 478.170916][T12479] ? __pfx_x86_decode_insn+0x10/0x10 [ 478.170936][T12479] ? rcu_is_watching+0x15/0xb0 [ 478.170967][T12479] ? __asan_memset+0x22/0x50 [ 478.170995][T12479] ? init_decode_cache+0x78/0x90 [ 478.171014][T12479] ? init_emulate_ctxt+0x4d6/0x660 [ 478.171043][T12479] ? __pfx_init_emulate_ctxt+0x10/0x10 [ 478.171074][T12479] ? trace_rcu_utilization+0x47/0x1d0 [ 478.171102][T12479] x86_emulate_instruction+0x61b/0x1f90 [ 478.171137][T12479] ? trace_sched_exit_tp+0x36/0x110 [ 478.171164][T12479] ? __pfx_x86_emulate_instruction+0x10/0x10 [ 478.171190][T12479] ? __get_current_cr3_fast+0x90/0x150 [ 478.171209][T12479] ? clear_bhb_loop+0x60/0xb0 [ 478.171226][T12479] ? clear_bhb_loop+0x60/0xb0 [ 478.171245][T12479] ? vmx_vcpu_run+0xe92/0x2b70 [ 478.171267][T12479] ? __vmx_complete_interrupts+0xe7/0x690 [ 478.171301][T12479] handle_ud+0x142/0x590 [ 478.171329][T12479] ? __pfx_handle_ud+0x10/0x10 [ 478.171352][T12479] ? vmx_handle_exit_irqoff+0x61e/0x940 [ 478.171373][T12479] ? __pfx_current_save_fsgs+0x10/0x10 [ 478.171407][T12479] ? __lock_acquire+0xab9/0xd20 [ 478.171430][T12479] ? __pfx_handle_exception_nmi+0x10/0x10 [ 478.171455][T12479] vmx_handle_exit+0x10a1/0x18c0 [ 478.171479][T12479] ? vcpu_run+0x35f2/0x6fa0 [ 478.171512][T12479] vcpu_run+0x434f/0x6fa0 [ 478.171530][T12479] ? rcu_is_watching+0x15/0xb0 [ 478.171570][T12479] ? vcpu_run+0x35f2/0x6fa0 [ 478.171633][T12479] ? __pfx_vcpu_run+0x10/0x10 [ 478.171653][T12479] ? __pfx_x86_emulate_instruction+0x10/0x10 [ 478.171687][T12479] ? complete_emulated_mmio+0x18e/0x7a0 [ 478.171716][T12479] ? __asan_memcpy+0x40/0x70 [ 478.171734][T12479] ? complete_emulated_mmio+0x4d2/0x7a0 [ 478.171775][T12479] kvm_arch_vcpu_ioctl_run+0xfc9/0x1940 [ 478.171800][T12479] ? __mutex_trylock_common+0x153/0x260 [ 478.171828][T12479] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940 [ 478.171848][T12479] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 478.171870][T12479] ? rcu_is_watching+0x15/0xb0 [ 478.171892][T12479] ? trace_contention_end+0x39/0x120 [ 478.171917][T12479] ? __mutex_lock+0x335/0x1350 [ 478.171943][T12479] ? kasan_quarantine_put+0xdd/0x220 [ 478.171961][T12479] ? lockdep_hardirqs_on+0x9c/0x150 [ 478.171979][T12479] ? kvm_vcpu_ioctl+0x22e/0xe90 [ 478.172000][T12479] ? __pfx___mutex_lock+0x10/0x10 [ 478.172020][T12479] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 478.172050][T12479] ? do_vfs_ioctl+0xbe8/0x1430 [ 478.172071][T12479] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 478.172098][T12479] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 478.172122][T12479] kvm_vcpu_ioctl+0x95c/0xe90 [ 478.172146][T12479] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 478.172185][T12479] ? __fget_files+0x2a/0x420 [ 478.172216][T12479] ? __fget_files+0x3a0/0x420 [ 478.172241][T12479] ? __fget_files+0x2a/0x420 [ 478.172270][T12479] ? bpf_lsm_file_ioctl+0x9/0x20 [ 478.172287][T12479] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 478.172306][T12479] __se_sys_ioctl+0xfc/0x170 [ 478.172329][T12479] do_syscall_64+0xfa/0xfa0 [ 478.172345][T12479] ? lockdep_hardirqs_on+0x9c/0x150 [ 478.172363][T12479] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.172381][T12479] ? clear_bhb_loop+0x60/0xb0 [ 478.172403][T12479] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.172421][T12479] RIP: 0033:0x7fbbea78ebe9 [ 478.172438][T12479] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 478.172454][T12479] RSP: 002b:00007fbbeb6b1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 478.172473][T12479] RAX: ffffffffffffffda RBX: 00007fbbea9c5fa0 RCX: 00007fbbea78ebe9 [ 478.172486][T12479] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 478.172498][T12479] RBP: 00007fbbeb6b1090 R08: 0000000000000000 R09: 0000000000000000 [ 478.172509][T12479] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 478.172520][T12479] R13: 00007fbbea9c6038 R14: 00007fbbea9c5fa0 R15: 00007ffe893f37a8 [ 478.172551][T12479] [ 478.298332][ T5925] m920x_read = error: -19 [ 478.702423][ T5925] dvb-usb: error while querying for an remote control event. [ 478.712912][ T79] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.819689][T12474] netlink: 'syz.0.2210': attribute type 29 has an invalid length. [ 478.827788][ T5925] m920x_read = error: -19 [ 478.832147][ T5925] dvb-usb: error while querying for an remote control event. [ 478.868781][ T79] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 478.894548][T12481] netlink: 'syz.0.2210': attribute type 29 has an invalid length. [ 478.967368][ T5925] m920x_read = error: -19 [ 478.975478][ T5925] dvb-usb: error while querying for an remote control event. [ 478.985303][ T79] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.007226][T12486] syzkaller1: entered promiscuous mode [ 479.012773][T12486] syzkaller1: entered allmulticast mode [ 479.032296][T12467] chnl_net:caif_netlink_parms(): no params data found [ 479.103609][ T79] netdevsim netdevsim3 netdevsim0 (unregistering): left allmulticast mode [ 479.113317][ T79] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.124101][ T5925] m920x_read = error: -19 [ 479.132195][ T5925] dvb-usb: error while querying for an remote control event. [ 479.235682][T12467] bridge0: port 1(bridge_slave_0) entered blocking state [ 479.243573][T12467] bridge0: port 1(bridge_slave_0) entered disabled state [ 479.250710][T12467] bridge_slave_0: entered allmulticast mode [ 479.258514][T12467] bridge_slave_0: entered promiscuous mode [ 479.264465][ T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 479.272125][ T24] m920x_read = error: -19 [ 479.276659][ T24] dvb-usb: error while querying for an remote control event. [ 479.286629][T12467] bridge0: port 2(bridge_slave_1) entered blocking state [ 479.293749][T12467] bridge0: port 2(bridge_slave_1) entered disabled state [ 479.301046][ T5962] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 479.303679][T12467] bridge_slave_1: entered allmulticast mode [ 479.316974][T12467] bridge_slave_1: entered promiscuous mode [ 479.372488][T12467] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 479.384952][T12467] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 479.394731][ T43] m920x_read = error: -19 [ 479.399133][ T43] dvb-usb: error while querying for an remote control event. [ 479.434193][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 479.442544][ T10] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 479.442815][T12467] team0: Port device team_slave_0 added [ 479.455458][ T5858] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 479.462894][T12467] team0: Port device team_slave_1 added [ 479.466306][ T10] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 479.469682][ T5962] usb 2-1: device descriptor read/64, error -71 [ 479.480612][ T10] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 479.499332][ T10] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 479.514108][ T10] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 479.519743][ T43] m920x_read = error: -19 [ 479.526636][ T10] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 479.541467][ T43] dvb-usb: error while querying for an remote control event. [ 479.550618][ T10] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 479.564187][ T10] usb 1-1: config 168 interface 0 has no altsetting 0 [ 479.572191][ T10] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 479.580190][ T10] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 479.592728][ T10] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 479.604715][ T10] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 479.616937][ T10] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 479.621508][T12467] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 479.628306][ T10] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 479.628342][ T10] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 479.643765][T12467] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 479.647422][ T10] usb 1-1: config 168 interface 0 has no altsetting 0 [ 479.661377][ T43] m920x_read = error: -19 [ 479.686291][T12467] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 479.688983][T12467] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 479.718137][ T5858] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 479.719742][ T43] dvb-usb: error while querying for an remote control event. [ 479.729195][ T5858] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 479.742500][T12467] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 479.747192][ T5858] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 479.772195][ C1] vkms_vblank_simulate: vblank timer overrun [ 479.776351][ T5962] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 479.785217][ T10] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 479.790943][T12467] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 479.795243][ T5874] Bluetooth: hci4: command tx timeout [ 479.819739][ T10] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 479.831029][ T10] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 479.843512][ T10] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 479.855597][ T5858] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.855786][ T43] m920x_read = error: -19 [ 479.863745][ T10] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 479.863772][ T10] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 479.873263][ T43] dvb-usb: error while querying for an remote control event. [ 479.882704][ T5858] usb 3-1: config 0 descriptor?? [ 479.903177][ T10] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 479.916827][ T10] usb 1-1: config 168 interface 0 has no altsetting 0 [ 479.936765][ T5962] usb 2-1: device descriptor read/64, error -71 [ 479.937013][ T10] usb 1-1: string descriptor 0 read error: -22 [ 479.950370][ T10] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 479.962078][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 479.986782][ T10] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 480.045574][ T43] m920x_read = error: -19 [ 480.049956][ T43] dvb-usb: error while querying for an remote control event. [ 480.058347][ T5962] usb usb2-port1: attempt power cycle [ 480.146253][ T5858] usbhid 3-1:0.0: can't add hid device: -71 [ 480.158896][ T5858] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 480.170136][ T5858] usb 3-1: USB disconnect, device number 15 [ 480.186874][ T43] m920x_read = error: -19 [ 480.191267][ T43] dvb-usb: error while querying for an remote control event. [ 480.253133][ T79] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 480.266120][ T79] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 480.287878][ T79] bond0 (unregistering): Released all slaves [ 480.306813][T12501] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 480.321602][ T43] m920x_read = error: -19 [ 480.326114][ T43] dvb-usb: error while querying for an remote control event. [ 480.326444][T12501] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 480.418316][ T5962] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 480.472746][ T43] m920x_read = error: -19 [ 480.477145][ T43] dvb-usb: error while querying for an remote control event. [ 480.491756][ T5962] usb 2-1: device descriptor read/8, error -71 [ 480.537672][ T10] usb 1-1: USB disconnect, device number 3 [ 480.621619][ T43] m920x_read = error: -19 [ 480.636447][ T43] dvb-usb: error while querying for an remote control event. [ 480.659739][T12467] hsr_slave_0: entered promiscuous mode [ 480.668869][T12467] hsr_slave_1: entered promiscuous mode [ 480.677638][T12467] debugfs: 'hsr0' already exists in 'hsr' [ 480.683440][T12467] Cannot create hsr debugfs directory [ 480.739324][ T5858] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 480.760521][ T5962] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 480.768403][ T43] m920x_read = error: -19 [ 480.776488][ T43] dvb-usb: error while querying for an remote control event. [ 480.811763][ T5962] usb 2-1: device descriptor read/8, error -71 [ 480.899809][ T5925] m920x_read = error: -19 [ 480.905107][ T5925] dvb-usb: error while querying for an remote control event. [ 480.932627][ T5962] usb usb2-port1: unable to enumerate USB device [ 480.933163][ T5858] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 480.953585][ T5858] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 480.974748][ T5858] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 480.984447][ T79] hsr_slave_0: left promiscuous mode [ 480.994028][ T79] hsr_slave_1: left promiscuous mode [ 481.000053][ T5858] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.012142][ T79] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 481.019651][ T79] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 481.027893][ T5962] m920x_read = error: -19 [ 481.029666][ T5858] usb 3-1: config 0 descriptor?? [ 481.032251][ T5962] dvb-usb: error while querying for an remote control event. [ 481.053338][ T79] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 481.061243][ T79] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 481.089417][ T79] veth1_macvtap: left promiscuous mode [ 481.096862][ T79] veth0_macvtap: left promiscuous mode [ 481.102867][ T79] veth1_vlan: left promiscuous mode [ 481.108441][ T79] veth0_vlan: left promiscuous mode [ 481.169901][ T5962] m920x_read = error: -19 [ 481.177083][ T5962] dvb-usb: error while querying for an remote control event. [ 481.305895][ T5925] m920x_read = error: -19 [ 481.310287][ T5925] dvb-usb: error while querying for an remote control event. [ 481.434161][ T5925] m920x_read = error: -19 [ 481.438562][ T5925] dvb-usb: error while querying for an remote control event. [ 481.455458][ T5962] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 481.562607][ T5925] m920x_read = error: -19 [ 481.567803][ T5925] dvb-usb: error while querying for an remote control event. [ 481.577356][ T79] team0 (unregistering): Port device team_slave_1 removed [ 481.611075][ T79] team0 (unregistering): Port device team_slave_0 removed [ 481.618370][ T5962] usb 1-1: Using ep0 maxpacket: 32 [ 481.627763][ T5962] usb 1-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 481.636927][ T5962] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.646580][ T5962] usb 1-1: Product: syz [ 481.650904][ T5962] usb 1-1: Manufacturer: syz [ 481.655516][ T5962] usb 1-1: SerialNumber: syz [ 481.669005][ T5962] usb 1-1: config 0 descriptor?? [ 481.688529][ T5858] usbhid 3-1:0.0: can't add hid device: -71 [ 481.691008][ T5925] m920x_read = error: -19 [ 481.699759][ T5962] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 481.708296][ T5858] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 481.710244][ T5925] dvb-usb: error while querying for an remote control event. [ 481.721005][ T5858] usb 3-1: USB disconnect, device number 16 [ 481.864810][ T5925] m920x_read = error: -19 [ 481.869262][ T5925] dvb-usb: error while querying for an remote control event. [ 481.994058][ T5874] Bluetooth: hci4: command tx timeout [ 481.994065][ T5925] m920x_read = error: -19 [ 482.004301][ T5925] dvb-usb: error while querying for an remote control event. [ 482.129377][ T5925] m920x_read = error: -19 [ 482.136578][ T5925] dvb-usb: error while querying for an remote control event. [ 482.306180][ T43] m920x_read = error: -19 [ 482.310608][ T43] dvb-usb: error while querying for an remote control event. [ 482.390477][ T30] kauditd_printk_skb: 108 callbacks suppressed [ 482.390494][ T30] audit: type=1800 audit(1756902464.002:133): pid=12523 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2219" name="bus" dev="overlay" ino=3052 res=0 errno=0 [ 482.451580][ T30] audit: type=1326 audit(1756902464.049:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12526 comm="syz.1.2220" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f544bb8ebe9 code=0x0 [ 482.466853][ T43] m920x_read = error: -19 [ 482.488771][ T43] dvb-usb: error while querying for an remote control event. [ 482.610571][ T43] m920x_read = error: -19 [ 482.620070][ T43] dvb-usb: error while querying for an remote control event. [ 482.622552][T12533] No control pipe specified [ 482.749648][ T43] m920x_read = error: -19 [ 482.754046][ T43] dvb-usb: error while querying for an remote control event. [ 482.833110][T12467] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 482.845068][T12467] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 482.860746][T12467] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 482.879145][T12467] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 482.900013][ T43] m920x_read = error: -19 [ 482.904399][ T43] dvb-usb: error while querying for an remote control event. [ 483.038421][ T43] m920x_read = error: -19 [ 483.043015][ T43] dvb-usb: error while querying for an remote control event. [ 483.114932][T12467] 8021q: adding VLAN 0 to HW filter on device bond0 [ 483.162200][T12467] 8021q: adding VLAN 0 to HW filter on device team0 [ 483.177680][ T24] m920x_read = error: -19 [ 483.191035][ T79] bridge0: port 1(bridge_slave_0) entered blocking state [ 483.198237][ T79] bridge0: port 1(bridge_slave_0) entered forwarding state [ 483.211786][ T24] dvb-usb: error while querying for an remote control event. [ 483.233597][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 483.240710][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 483.267562][ T10] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 483.327210][ T24] m920x_read = error: -19 [ 483.332387][ T24] dvb-usb: error while querying for an remote control event. [ 483.341595][T12467] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 483.355173][T12467] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 483.420037][T12554] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 483.476899][ T24] m920x_read = error: -19 [ 483.476997][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 483.481270][ T24] dvb-usb: error while querying for an remote control event. [ 483.506378][ T10] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 483.516468][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 483.539554][ T10] usb 3-1: Product: syz [ 483.544544][ T10] usb 3-1: Manufacturer: syz [ 483.549187][ T10] usb 3-1: SerialNumber: syz [ 483.576182][ T10] usb 3-1: config 0 descriptor?? [ 483.616213][ T43] m920x_read = error: -19 [ 483.620604][ T43] dvb-usb: error while querying for an remote control event. [ 483.683544][T12467] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 483.753737][T12467] veth0_vlan: entered promiscuous mode [ 483.755065][ T24] m920x_read = error: -19 [ 483.763817][ T24] dvb-usb: error while querying for an remote control event. [ 483.784235][T12467] veth1_vlan: entered promiscuous mode [ 483.811913][ T10] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 483.843549][T12467] veth0_macvtap: entered promiscuous mode [ 483.856882][T12467] veth1_macvtap: entered promiscuous mode [ 483.892374][T12467] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 483.901027][ T24] m920x_read = error: -19 [ 483.905685][ T24] dvb-usb: error while querying for an remote control event. [ 483.911763][T12467] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 483.946587][ T6210] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 483.967118][ T6210] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.003567][ T6210] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.026186][ T24] m920x_read = error: -19 [ 484.030592][ T24] dvb-usb: error while querying for an remote control event. [ 484.039084][ T6210] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.169147][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 484.182863][ T24] m920x_read = error: -19 [ 484.187246][ T24] dvb-usb: error while querying for an remote control event. [ 484.190206][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 484.219495][ T5874] Bluetooth: hci4: command tx timeout [ 484.255922][ T1171] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 484.265747][ T1171] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 484.285912][ T5962] gspca_stk1135: reg_w 0x300 err -71 [ 484.295402][ T5962] gspca_stk1135: serial bus timeout: status=0x00 [ 484.306349][ T5962] gspca_stk1135: Sensor write failed [ 484.321858][ T5865] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 484.328930][ T5962] gspca_stk1135: serial bus timeout: status=0x00 [ 484.336595][ T24] m920x_read = error: -19 [ 484.341092][ T24] dvb-usb: error while querying for an remote control event. [ 484.351887][T12574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 484.367595][ T5962] gspca_stk1135: Sensor write failed [ 484.372935][ T5962] gspca_stk1135: serial bus timeout: status=0x00 [ 484.388400][T12574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 484.403746][ T5962] gspca_stk1135: Sensor read failed [ 484.415573][ T5962] gspca_stk1135: serial bus timeout: status=0x00 [ 484.427921][ T5962] gspca_stk1135: Sensor read failed [ 484.435645][ T5962] gspca_stk1135: Detected sensor type unknown (0x0) [ 484.445107][ T5962] gspca_stk1135: serial bus timeout: status=0x00 [ 484.452430][ T5962] gspca_stk1135: Sensor read failed [ 484.458549][ T5962] gspca_stk1135: serial bus timeout: status=0x00 [ 484.462517][ T10] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 484.493004][ T24] m920x_read = error: -19 [ 484.497370][ T24] dvb-usb: error while querying for an remote control event. [ 484.506846][ T10] usb 3-1: USB disconnect, device number 17 [ 484.512285][ T5962] gspca_stk1135: Sensor read failed [ 484.514989][ T5865] usb 2-1: Using ep0 maxpacket: 8 [ 484.528638][ T5962] gspca_stk1135: serial bus timeout: status=0x00 [ 484.538077][ T5962] gspca_stk1135: Sensor write failed [ 484.543401][ T5962] gspca_stk1135: serial bus timeout: status=0x00 [ 484.558196][ T5865] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 484.560356][ T5962] gspca_stk1135: Sensor write failed [ 484.565988][ T5865] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 484.586238][ T5962] stk1135 1-1:0.0: probe with driver stk1135 failed with error -71 [ 484.616642][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 484.628196][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 484.630797][ T5962] usb 1-1: USB disconnect, device number 4 [ 484.641353][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 484.653372][ T24] m920x_read = error: -19 [ 484.658280][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 484.678352][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 484.680005][ T24] dvb-usb: error while querying for an remote control event. [ 484.692373][ T5865] usb 2-1: config 168 interface 0 has no altsetting 0 [ 484.708487][ T5865] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 484.715900][ T5865] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 484.745613][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 484.757374][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 484.774259][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 484.787768][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 484.801230][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 484.822386][ T5865] usb 2-1: config 168 interface 0 has no altsetting 0 [ 484.830863][ T5865] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 484.841993][ T5865] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 484.843309][ T24] m920x_read = error: -19 [ 484.854805][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 484.872863][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 484.885795][ T5858] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 484.889142][ T24] dvb-usb: error while querying for an remote control event. [ 484.898946][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 484.935230][ T5865] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 484.957301][ T5865] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 484.999113][ T5865] usb 2-1: config 168 interface 0 has no altsetting 0 [ 485.014543][ T5865] usb 2-1: string descriptor 0 read error: -22 [ 485.029873][T12591] FAULT_INJECTION: forcing a failure. [ 485.029873][T12591] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 485.032004][ T5865] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 485.043419][ T24] m920x_read = error: -19 [ 485.055929][ T5865] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.071029][T12591] CPU: 0 UID: 0 PID: 12591 Comm: syz.0.2228 Not tainted syzkaller #0 PREEMPT(full) [ 485.071055][T12591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 485.071069][T12591] Call Trace: [ 485.071078][T12591] [ 485.071087][T12591] dump_stack_lvl+0x189/0x250 [ 485.071124][T12591] ? __pfx____ratelimit+0x10/0x10 [ 485.071156][T12591] ? __pfx_dump_stack_lvl+0x10/0x10 [ 485.071194][T12591] ? __pfx__printk+0x10/0x10 [ 485.071224][T12591] ? __might_fault+0xb0/0x130 [ 485.071257][T12591] should_fail_ex+0x414/0x560 [ 485.071285][T12591] _copy_from_user+0x2d/0xb0 [ 485.071316][T12591] memdup_user+0x5e/0xd0 [ 485.071343][T12591] kvm_arch_vcpu_ioctl+0x18ec/0x2a80 [ 485.071374][T12591] ? __lock_acquire+0xab9/0xd20 [ 485.071398][T12591] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 485.071430][T12591] ? __lock_acquire+0xab9/0xd20 [ 485.071471][T12591] ? is_bpf_text_address+0x26/0x2b0 [ 485.071498][T12591] ? is_bpf_text_address+0x292/0x2b0 [ 485.071519][T12591] ? is_bpf_text_address+0x26/0x2b0 [ 485.071544][T12591] ? kernel_text_address+0xa5/0xe0 [ 485.071564][T12591] ? __kernel_text_address+0xd/0x40 [ 485.071583][T12591] ? unwind_get_return_address+0x4d/0x90 [ 485.071608][T12591] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 485.071637][T12591] ? arch_stack_walk+0xfc/0x150 [ 485.071675][T12591] ? stack_trace_save+0x9c/0xe0 [ 485.071705][T12591] ? stack_depot_save_flags+0x40/0x860 [ 485.071743][T12591] ? __lock_acquire+0xab9/0xd20 [ 485.071772][T12591] ? __mutex_trylock_common+0x153/0x260 [ 485.071811][T12591] ? __pfx___mutex_trylock_common+0x10/0x10 [ 485.071840][T12591] ? rcu_is_watching+0x15/0xb0 [ 485.071879][T12591] ? trace_contention_end+0x39/0x120 [ 485.071918][T12591] ? __mutex_lock+0x335/0x1350 [ 485.071944][T12591] ? kasan_quarantine_put+0xdd/0x220 [ 485.071962][T12591] ? lockdep_hardirqs_on+0x9c/0x150 [ 485.071980][T12591] ? kvm_vcpu_ioctl+0x22e/0xe90 [ 485.072000][T12591] ? __pfx___mutex_lock+0x10/0x10 [ 485.072019][T12591] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 485.072049][T12591] ? do_vfs_ioctl+0xbe8/0x1430 [ 485.072069][T12591] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 485.072095][T12591] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 485.072120][T12591] kvm_vcpu_ioctl+0x74d/0xe90 [ 485.072143][T12591] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 485.072186][T12591] ? __fget_files+0x2a/0x420 [ 485.072216][T12591] ? __fget_files+0x3a0/0x420 [ 485.072240][T12591] ? __fget_files+0x2a/0x420 [ 485.072269][T12591] ? bpf_lsm_file_ioctl+0x9/0x20 [ 485.072286][T12591] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 485.072304][T12591] __se_sys_ioctl+0xfc/0x170 [ 485.072327][T12591] do_syscall_64+0xfa/0xfa0 [ 485.072343][T12591] ? lockdep_hardirqs_on+0x9c/0x150 [ 485.072360][T12591] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.072378][T12591] ? clear_bhb_loop+0x60/0xb0 [ 485.072401][T12591] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.072418][T12591] RIP: 0033:0x7fd64178ebe9 [ 485.072434][T12591] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 485.072449][T12591] RSP: 002b:00007fd6425e6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 485.072469][T12591] RAX: ffffffffffffffda RBX: 00007fd6419c5fa0 RCX: 00007fd64178ebe9 [ 485.072483][T12591] RDX: 0000200000000300 RSI: 000000004140aecd RDI: 0000000000000005 [ 485.072495][T12591] RBP: 00007fd6425e6090 R08: 0000000000000000 R09: 0000000000000000 [ 485.072506][T12591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 485.072518][T12591] R13: 00007fd6419c6038 R14: 00007fd6419c5fa0 R15: 00007ffdcb3daab8 [ 485.072548][T12591] [ 485.079150][ T5858] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 485.094980][ T24] dvb-usb: error while querying for an remote control event. [ 485.109263][ T5858] usb 4-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 485.266303][ T5962] m920x_read = error: -19 [ 485.321545][ T5858] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.357198][ T5962] dvb-usb: error while querying for an remote control event. [ 485.399458][ T5865] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 485.399738][ T30] audit: type=1800 audit(1756902466.677:135): pid=12594 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2229" name="bus" dev="overlay" ino=3077 res=0 errno=0 [ 485.559165][T12570] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 485.581475][T12570] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.639201][ T5962] m920x_read = error: -19 [ 485.643670][ T5962] dvb-usb: error while querying for an remote control event. [ 485.646117][ T5858] usb 4-1: config 0 descriptor?? [ 485.663950][T12600] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 485.670729][T12600] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 485.693785][T12600] vhci_hcd vhci_hcd.0: Device attached [ 485.700106][ T5865] usb 2-1: USB disconnect, device number 17 [ 485.769101][ T920] m920x_read = error: -19 [ 485.773765][ T920] dvb-usb: error while querying for an remote control event. [ 485.820851][T12600] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 485.828471][T12600] overlayfs: failed to set xattr on upper [ 485.834612][T12600] overlayfs: ...falling back to redirect_dir=nofollow. [ 485.841974][T12600] overlayfs: ...falling back to index=off. [ 485.847916][T12600] overlayfs: ...falling back to uuid=null. [ 485.856947][T12600] overlayfs: ...falling back to xino=off. [ 485.875017][T12603] vhci_hcd: connection closed [ 485.876980][ T6210] vhci_hcd: stop threads [ 485.887071][ T6210] vhci_hcd: release socket [ 485.892557][ T6210] vhci_hcd: disconnect device [ 485.897812][ T920] m920x_read = error: -19 [ 485.902164][ T920] dvb-usb: error while querying for an remote control event. [ 485.926147][ T5962] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 486.022391][ T920] m920x_read = error: -19 [ 486.026751][ T920] dvb-usb: error while querying for an remote control event. [ 486.066713][ T5962] usb 3-1: device descriptor read/64, error -71 [ 486.110736][ T5858] lenovo 0003:17EF:6047.0031: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.3-1/input0 [ 486.150718][ T920] m920x_read = error: -19 [ 486.164373][ T920] dvb-usb: error while querying for an remote control event. [ 486.215857][ T30] audit: type=1326 audit(1756902467.584:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12611 comm="syz.1.2232" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544bb8ebe9 code=0x7ffc0000 [ 486.238470][ T30] audit: type=1326 audit(1756902467.584:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12611 comm="syz.1.2232" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544bb8ebe9 code=0x7ffc0000 [ 486.261762][ T30] audit: type=1326 audit(1756902467.584:138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12611 comm="syz.1.2232" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7f544bb8ebe9 code=0x7ffc0000 [ 486.286467][ T30] audit: type=1326 audit(1756902467.584:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12611 comm="syz.1.2232" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544bb8ebe9 code=0x7ffc0000 [ 486.309249][ T30] audit: type=1326 audit(1756902467.584:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12611 comm="syz.1.2232" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544bb8ebe9 code=0x7ffc0000 [ 486.311203][ T920] m920x_read = error: -19 [ 486.340927][ T30] audit: type=1326 audit(1756902467.584:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12611 comm="syz.1.2232" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7f544bb8ebe9 code=0x7ffc0000 [ 486.344108][ T5962] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 486.363309][ C0] vkms_vblank_simulate: vblank timer overrun [ 486.367169][ T30] audit: type=1326 audit(1756902467.584:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12611 comm="syz.1.2232" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f544bb8ebe9 code=0x7ffc0000 [ 486.372533][T12581] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 486.411951][ T920] dvb-usb: error while querying for an remote control event. [ 486.420004][T12581] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 486.450271][ T5874] Bluetooth: hci4: command tx timeout [ 486.523861][ T5874] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 486.535706][ T5917] m920x_read = error: -19 [ 486.540511][ T5917] dvb-usb: error while querying for an remote control event. [ 486.567801][ T5962] usb 3-1: device descriptor read/64, error -71 [ 486.659769][ T5858] lenovo 0003:17EF:6047.0031: Failed to switch middle button: -71 [ 486.666212][ T24] m920x_read = error: -19 [ 486.669652][ T5858] lenovo 0003:17EF:6047.0031: Fn-lock setting failed: -71 [ 486.674128][ T24] dvb-usb: error while querying for an remote control event. [ 486.681526][ T5858] lenovo 0003:17EF:6047.0031: Sensitivity setting failed: -71 [ 486.698123][ T5962] usb usb3-port1: attempt power cycle [ 486.716241][ T5858] usb 4-1: USB disconnect, device number 7 [ 486.824497][ T24] m920x_read = error: -19 [ 486.828878][ T24] dvb-usb: error while querying for an remote control event. [ 486.845811][ T5917] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 486.952898][ T24] m920x_read = error: -19 [ 486.959080][ T24] dvb-usb: error while querying for an remote control event. [ 487.008773][ T5917] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 487.018924][ T5917] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 487.031233][ T5917] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 487.040740][ T5917] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 487.048887][ T5917] usb 1-1: SerialNumber: syz [ 487.073834][ T5962] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 487.081581][ T24] m920x_read = error: -19 [ 487.086318][ T24] dvb-usb: error while querying for an remote control event. [ 487.117385][ T5962] usb 3-1: device descriptor read/8, error -71 [ 487.209538][ T5925] m920x_read = error: -19 [ 487.213929][ T5925] dvb-usb: error while querying for an remote control event. [ 487.277052][T12622] FAULT_INJECTION: forcing a failure. [ 487.277052][T12622] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 487.296444][ T5917] usb 1-1: 0:2 : does not exist [ 487.302816][T12622] CPU: 0 UID: 0 PID: 12622 Comm: syz.3.2237 Not tainted syzkaller #0 PREEMPT(full) [ 487.302834][T12622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 487.302844][T12622] Call Trace: [ 487.302851][T12622] [ 487.302857][T12622] dump_stack_lvl+0x189/0x250 [ 487.302887][T12622] ? __pfx____ratelimit+0x10/0x10 [ 487.302910][T12622] ? __pfx_dump_stack_lvl+0x10/0x10 [ 487.302936][T12622] ? __pfx__printk+0x10/0x10 [ 487.302956][T12622] ? __might_fault+0xb0/0x130 [ 487.302979][T12622] should_fail_ex+0x414/0x560 [ 487.302998][T12622] _copy_from_user+0x2d/0xb0 [ 487.303020][T12622] mfill_atomic_copy+0x728/0x1390 [ 487.303051][T12622] ? __pfx_mfill_atomic_copy+0x10/0x10 [ 487.303094][T12622] userfaultfd_ioctl+0x29fb/0x4c80 [ 487.303119][T12622] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.303140][T12622] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 487.303181][T12622] ? kasan_quarantine_put+0xdd/0x220 [ 487.303196][T12622] ? lockdep_hardirqs_on+0x9c/0x150 [ 487.303218][T12622] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 487.303247][T12622] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 487.303309][T12622] ? __fget_files+0x2a/0x420 [ 487.303336][T12622] ? __fget_files+0x3a0/0x420 [ 487.303358][T12622] ? __fget_files+0x2a/0x420 [ 487.303385][T12622] ? bpf_lsm_file_ioctl+0x9/0x20 [ 487.303401][T12622] ? __pfx_userfaultfd_ioctl+0x10/0x10 [ 487.303424][T12622] __se_sys_ioctl+0xfc/0x170 [ 487.303446][T12622] do_syscall_64+0xfa/0xfa0 [ 487.303465][T12622] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.303481][T12622] ? asm_sysvec_call_function_single+0x1a/0x20 [ 487.303500][T12622] ? clear_bhb_loop+0x60/0xb0 [ 487.303522][T12622] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.303538][T12622] RIP: 0033:0x7f67b658ebe9 [ 487.303553][T12622] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 487.303568][T12622] RSP: 002b:00007f67b73c0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 487.303587][T12622] RAX: ffffffffffffffda RBX: 00007f67b67c5fa0 RCX: 00007f67b658ebe9 [ 487.303617][T12622] RDX: 0000200000000000 RSI: 00000000c028aa03 RDI: 0000000000000003 [ 487.303628][T12622] RBP: 00007f67b73c0090 R08: 0000000000000000 R09: 0000000000000000 [ 487.303639][T12622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 487.303649][T12622] R13: 00007f67b67c6038 R14: 00007f67b67c5fa0 R15: 00007ffd45bc0808 [ 487.303678][T12622] [ 487.330120][ T5917] usb 1-1: USB disconnect, device number 5 [ 487.331285][ C0] vkms_vblank_simulate: vblank timer overrun [ 487.352421][ T5925] m920x_read = error: -19 [ 487.563200][ T5962] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 487.577747][ T5925] dvb-usb: error while querying for an remote control event. [ 487.596043][ T5962] usb 3-1: device descriptor read/8, error -71 [ 487.703679][ T5925] m920x_read = error: -19 [ 487.708143][ T5925] dvb-usb: error while querying for an remote control event. [ 487.715883][ T5962] usb usb3-port1: unable to enumerate USB device [ 487.819512][ T5865] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 487.851275][ T5917] m920x_read = error: -19 [ 487.855643][ T5917] dvb-usb: error while querying for an remote control event. [ 487.889292][T12631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 487.899279][T12631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.979622][ T5925] m920x_read = error: -19 [ 487.979734][ T5865] usb 4-1: Using ep0 maxpacket: 32 [ 487.983983][ T5925] dvb-usb: error while querying for an remote control event. [ 487.999636][ T5865] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 488.008772][ T5865] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.015142][ T5962] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 488.016913][ T5865] usb 4-1: Product: syz [ 488.028559][ T5865] usb 4-1: Manufacturer: syz [ 488.033202][ T5865] usb 4-1: SerialNumber: syz [ 488.039701][ T5865] usb 4-1: config 0 descriptor?? [ 488.048299][ T5865] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 488.097333][ T5925] m920x_read = error: -19 [ 488.102334][ T5925] dvb-usb: error while querying for an remote control event. [ 488.140003][ T5917] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 488.182774][ T5962] usb 2-1: Using ep0 maxpacket: 8 [ 488.191587][ T5962] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 488.199058][ T5962] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 488.210360][ T5962] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 488.221971][ T5962] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 488.234214][ T5925] m920x_read = error: -19 [ 488.238742][ T5925] dvb-usb: error while querying for an remote control event. [ 488.246169][ T5962] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 488.257410][ T5962] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 488.268944][ T5962] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 488.282393][ T5962] usb 2-1: config 168 interface 0 has no altsetting 0 [ 488.289740][ T5917] usb 1-1: device descriptor read/64, error -71 [ 488.296607][ T5962] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 488.304076][ T5962] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 488.315302][ T5962] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 488.327054][ T5962] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 488.338934][ T5962] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 488.351287][ T5962] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 488.363011][ T5925] m920x_read = error: -19 [ 488.367492][ T5962] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 488.380984][ T5925] dvb-usb: error while querying for an remote control event. [ 488.388414][ T5962] usb 2-1: config 168 interface 0 has no altsetting 0 [ 488.396272][ T5962] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 488.404090][ T5962] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 488.416740][ T5962] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 488.428491][ T5962] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 488.440402][ T5962] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 488.451644][ T5962] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 488.463228][ T5962] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 488.476652][ T5962] usb 2-1: config 168 interface 0 has no altsetting 0 [ 488.489358][ T5962] usb 2-1: string descriptor 0 read error: -22 [ 488.495807][ T5962] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 488.505109][ T24] m920x_read = error: -19 [ 488.509756][ T24] dvb-usb: error while querying for an remote control event. [ 488.517743][ T5962] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.539439][ T5962] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 488.546937][ T5917] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 488.631957][ T5962] m920x_read = error: -19 [ 488.636337][ T5962] dvb-usb: error while querying for an remote control event. [ 488.706805][ T5917] usb 1-1: device descriptor read/64, error -71 [ 488.762950][ T5962] m920x_read = error: -19 [ 488.767774][ T5962] dvb-usb: error while querying for an remote control event. [ 488.824859][ T5917] usb usb1-port1: attempt power cycle [ 488.841832][T12633] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.851615][T12633] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.888792][ T24] m920x_read = error: -19 [ 488.895256][ T24] dvb-usb: error while querying for an remote control event. [ 488.926092][T12636] FAULT_INJECTION: forcing a failure. [ 488.926092][T12636] name failslab, interval 1, probability 0, space 0, times 0 [ 488.938933][T12636] CPU: 1 UID: 0 PID: 12636 Comm: syz.2.2242 Not tainted syzkaller #0 PREEMPT(full) [ 488.938956][T12636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 488.938967][T12636] Call Trace: [ 488.938975][T12636] [ 488.938983][T12636] dump_stack_lvl+0x189/0x250 [ 488.939022][T12636] ? __pfx____ratelimit+0x10/0x10 [ 488.939050][T12636] ? __pfx_dump_stack_lvl+0x10/0x10 [ 488.939079][T12636] ? __pfx__printk+0x10/0x10 [ 488.939111][T12636] ? __pfx___might_resched+0x10/0x10 [ 488.939132][T12636] ? fs_reclaim_acquire+0x7d/0x100 [ 488.939157][T12636] should_fail_ex+0x414/0x560 [ 488.939182][T12636] should_failslab+0xa8/0x100 [ 488.939205][T12636] __kmalloc_noprof+0xcb/0x7f0 [ 488.939224][T12636] ? _iommufd_object_alloc+0x26/0x1b0 [ 488.939252][T12636] _iommufd_object_alloc+0x26/0x1b0 [ 488.939276][T12636] iommufd_test+0x61e/0x5180 [ 488.939305][T12636] ? __pfx_iommufd_test+0x10/0x10 [ 488.939326][T12636] ? __lock_acquire+0xab9/0xd20 [ 488.939357][T12636] ? __might_fault+0xb0/0x130 [ 488.939396][T12636] iommufd_fops_ioctl+0x45b/0x580 [ 488.939425][T12636] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 488.939459][T12636] ? __fget_files+0x3a0/0x420 [ 488.939485][T12636] ? __fget_files+0x2a/0x420 [ 488.939514][T12636] ? bpf_lsm_file_ioctl+0x9/0x20 [ 488.939531][T12636] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 488.939554][T12636] __se_sys_ioctl+0xfc/0x170 [ 488.939577][T12636] do_syscall_64+0xfa/0xfa0 [ 488.939593][T12636] ? lockdep_hardirqs_on+0x9c/0x150 [ 488.939610][T12636] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.939627][T12636] ? clear_bhb_loop+0x60/0xb0 [ 488.939650][T12636] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.939667][T12636] RIP: 0033:0x7fbbea78ebe9 [ 488.939683][T12636] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 488.939699][T12636] RSP: 002b:00007fbbeb6b1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 488.939719][T12636] RAX: ffffffffffffffda RBX: 00007fbbea9c5fa0 RCX: 00007fbbea78ebe9 [ 488.939732][T12636] RDX: 0000200000000180 RSI: 0000000000003ba0 RDI: 0000000000000003 [ 488.939744][T12636] RBP: 00007fbbeb6b1090 R08: 0000000000000000 R09: 0000000000000000 [ 488.939756][T12636] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 488.939766][T12636] R13: 00007fbbea9c6038 R14: 00007fbbea9c5fa0 R15: 00007ffe893f37a8 [ 488.939797][T12636] [ 489.035005][ T9] usb 2-1: USB disconnect, device number 18 [ 489.046213][ T5962] m920x_read = error: -19 [ 489.191680][ T5962] dvb-usb: error while querying for an remote control event. [ 489.205306][ T5874] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 489.252268][ T5917] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 489.274958][ T5917] usb 1-1: device descriptor read/8, error -71 [ 489.316439][ T5962] m920x_read = error: -19 [ 489.320807][ T5962] dvb-usb: error while querying for an remote control event. [ 489.444830][ T5962] m920x_read = error: -19 [ 489.449204][ T5962] dvb-usb: error while querying for an remote control event. [ 489.541004][ T5917] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 489.565432][ T5917] usb 1-1: device descriptor read/8, error -71 [ 489.573932][ T5962] m920x_read = error: -19 [ 489.578298][ T5962] dvb-usb: error while querying for an remote control event. [ 489.682568][ T5917] usb usb1-port1: unable to enumerate USB device [ 489.701789][ T5917] m920x_read = error: -19 [ 489.706402][ T5917] dvb-usb: error while querying for an remote control event. [ 489.785251][ T5874] Bluetooth: hci2: unexpected event for opcode 0x0407 [ 489.829812][ T5917] m920x_read = error: -19 [ 489.834179][ T5917] dvb-usb: error while querying for an remote control event. [ 489.851187][ T5962] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 489.958400][ T5917] m920x_read = error: -19 [ 489.962804][ T5917] dvb-usb: error while querying for an remote control event. [ 490.024269][ T5962] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 490.034215][ T5962] usb 3-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 490.046852][ T5962] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.063347][ T5962] usb 3-1: config 0 descriptor?? [ 490.086730][ T5917] m920x_read = error: -19 [ 490.091115][ T5917] dvb-usb: error while querying for an remote control event. [ 490.214862][ T5917] m920x_read = error: -19 [ 490.219271][ T5917] dvb-usb: error while querying for an remote control event. [ 490.343238][ T5917] m920x_read = error: -19 [ 490.347669][ T5917] dvb-usb: error while querying for an remote control event. [ 490.471806][ T5917] m920x_read = error: -19 [ 490.476233][ T5917] dvb-usb: error while querying for an remote control event. [ 490.525295][ T5962] lenovo 0003:17EF:6047.0032: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.2-1/input0 [ 490.605780][ T5917] m920x_read = error: -19 [ 490.610183][ T5917] dvb-usb: error while querying for an remote control event. [ 490.634301][T12652] FAULT_INJECTION: forcing a failure. [ 490.634301][T12652] name failslab, interval 1, probability 0, space 0, times 0 [ 490.647076][T12652] CPU: 1 UID: 0 PID: 12652 Comm: syz.1.2249 Not tainted syzkaller #0 PREEMPT(full) [ 490.647100][T12652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 490.647113][T12652] Call Trace: [ 490.647121][T12652] [ 490.647129][T12652] dump_stack_lvl+0x189/0x250 [ 490.647165][T12652] ? __pfx____ratelimit+0x10/0x10 [ 490.647193][T12652] ? __pfx_dump_stack_lvl+0x10/0x10 [ 490.647220][T12652] ? __pfx__printk+0x10/0x10 [ 490.647249][T12652] ? __pfx___might_resched+0x10/0x10 [ 490.647272][T12652] ? fs_reclaim_acquire+0x7d/0x100 [ 490.647298][T12652] should_fail_ex+0x414/0x560 [ 490.647322][T12652] should_failslab+0xa8/0x100 [ 490.647345][T12652] __kmalloc_cache_noprof+0x6f/0x6f0 [ 490.647364][T12652] ? _copy_from_user+0x94/0xb0 [ 490.647387][T12652] ? __se_sys_mount+0x165/0x410 [ 490.647413][T12652] ? memdup_user+0x99/0xd0 [ 490.647441][T12652] __se_sys_mount+0x165/0x410 [ 490.647471][T12652] ? __pfx___se_sys_mount+0x10/0x10 [ 490.647495][T12652] ? do_syscall_64+0xbe/0xfa0 [ 490.647506][T12652] ? __x64_sys_mount+0x20/0xc0 [ 490.647526][T12652] do_syscall_64+0xfa/0xfa0 [ 490.647541][T12652] ? lockdep_hardirqs_on+0x9c/0x150 [ 490.647565][T12652] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.647583][T12652] ? clear_bhb_loop+0x60/0xb0 [ 490.647604][T12652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.647621][T12652] RIP: 0033:0x7f544bb8ebe9 [ 490.647636][T12652] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 490.647647][T12652] RSP: 002b:00007f544c957038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 490.647661][T12652] RAX: ffffffffffffffda RBX: 00007f544bdc5fa0 RCX: 00007f544bb8ebe9 [ 490.647670][T12652] RDX: 0000200000000b80 RSI: 00002000000003c0 RDI: 0000000000000000 [ 490.647679][T12652] RBP: 00007f544c957090 R08: 0000200000000500 R09: 0000000000000000 [ 490.647691][T12652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 490.647702][T12652] R13: 00007f544bdc6038 R14: 00007f544bdc5fa0 R15: 00007ffcf1ab23b8 [ 490.647732][T12652] [ 490.870225][T12643] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.879174][T12643] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.896353][ T5917] m920x_read = error: -19 [ 490.901009][ T5917] dvb-usb: error while querying for an remote control event. [ 491.017018][ T5917] m920x_read = error: -19 [ 491.021435][ T5917] dvb-usb: error while querying for an remote control event. [ 491.072911][ T5874] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 491.112681][ T5962] lenovo 0003:17EF:6047.0032: Failed to switch middle button: -71 [ 491.122076][ T5962] lenovo 0003:17EF:6047.0032: Fn-lock setting failed: -71 [ 491.131930][ T5962] lenovo 0003:17EF:6047.0032: Sensitivity setting failed: -71 [ 491.146903][ T5917] m920x_read = error: -19 [ 491.151276][ T5917] dvb-usb: error while querying for an remote control event. [ 491.188378][ T5962] usb 3-1: USB disconnect, device number 22 [ 491.197546][T12663] FAULT_INJECTION: forcing a failure. [ 491.197546][T12663] name failslab, interval 1, probability 0, space 0, times 0 [ 491.220156][T12663] CPU: 0 UID: 0 PID: 12663 Comm: syz.0.2254 Not tainted syzkaller #0 PREEMPT(full) [ 491.220183][T12663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 491.220196][T12663] Call Trace: [ 491.220204][T12663] [ 491.220214][T12663] dump_stack_lvl+0x189/0x250 [ 491.220254][T12663] ? __pfx____ratelimit+0x10/0x10 [ 491.220286][T12663] ? __pfx_dump_stack_lvl+0x10/0x10 [ 491.220318][T12663] ? __pfx__printk+0x10/0x10 [ 491.220355][T12663] ? __pfx___might_resched+0x10/0x10 [ 491.220379][T12663] ? fs_reclaim_acquire+0x7d/0x100 [ 491.220410][T12663] should_fail_ex+0x414/0x560 [ 491.220438][T12663] should_failslab+0xa8/0x100 [ 491.220465][T12663] kmem_cache_alloc_noprof+0x74/0x6e0 [ 491.220487][T12663] ? __pmd_alloc+0xc6/0x3b0 [ 491.220513][T12663] __pmd_alloc+0xc6/0x3b0 [ 491.220539][T12663] __handle_mm_fault+0x9ad/0x5400 [ 491.220576][T12663] ? __pfx___handle_mm_fault+0x10/0x10 [ 491.220615][T12663] ? find_vma+0xe7/0x160 [ 491.220635][T12663] ? __pfx_find_vma+0x10/0x10 [ 491.220659][T12663] handle_mm_fault+0x40a/0x8e0 [ 491.220691][T12663] do_user_addr_fault+0x764/0x1390 [ 491.220733][T12663] exc_page_fault+0x82/0x100 [ 491.220774][T12663] asm_exc_page_fault+0x26/0x30 [ 491.220793][T12663] RIP: 0010:rep_movs_alternative+0x33/0x90 [ 491.220819][T12663] Code: 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 bd 36 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb [ 491.220837][T12663] RSP: 0018:ffffc9000ba6fca8 EFLAGS: 00050216 [ 491.220857][T12663] RAX: 0000000000000000 RBX: 0000000000000030 RCX: 0000000000000030 [ 491.220870][T12663] RDX: 0000000000000000 RSI: ffffc9000ba6fe20 RDI: 0000200000002680 [ 491.220884][T12663] RBP: ffffc9000ba6fed0 R08: ffffc9000ba6fe4f R09: 1ffff9200174dfc9 [ 491.220900][T12663] R10: dffffc0000000000 R11: fffff5200174dfca R12: 00002000000026b0 [ 491.220915][T12663] R13: 00007ffffffff000 R14: ffffc9000ba6fe20 R15: 0000200000002680 [ 491.220949][T12663] _copy_to_user+0x8a/0xb0 [ 491.220972][T12663] __se_sys_shmctl+0x320/0x3e0 [ 491.220996][T12663] ? __pfx___se_sys_shmctl+0x10/0x10 [ 491.221026][T12663] ? __fget_files+0x3a0/0x420 [ 491.221064][T12663] ? fput+0xa0/0xd0 [ 491.221085][T12663] ? ksys_write+0x22a/0x250 [ 491.221114][T12663] ? __pfx_ksys_write+0x10/0x10 [ 491.221145][T12663] ? do_syscall_64+0xbe/0xfa0 [ 491.221179][T12663] do_syscall_64+0xfa/0xfa0 [ 491.221196][T12663] ? lockdep_hardirqs_on+0x9c/0x150 [ 491.221214][T12663] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.221233][T12663] ? clear_bhb_loop+0x60/0xb0 [ 491.221256][T12663] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.221274][T12663] RIP: 0033:0x7fd64178ebe9 [ 491.221290][T12663] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 491.221307][T12663] RSP: 002b:00007fd6425e6038 EFLAGS: 00000246 ORIG_RAX: 000000000000001f [ 491.221326][T12663] RAX: ffffffffffffffda RBX: 00007fd6419c5fa0 RCX: 00007fd64178ebe9 [ 491.221340][T12663] RDX: 0000200000002680 RSI: 000000000000000e RDI: 0000000000000000 [ 491.221352][T12663] RBP: 00007fd6425e6090 R08: 0000000000000000 R09: 0000000000000000 [ 491.221364][T12663] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 491.221376][T12663] R13: 00007fd6419c6038 R14: 00007fd6419c5fa0 R15: 00007ffdcb3daab8 [ 491.221409][T12663] [ 491.305789][ T5917] m920x_read = error: -19 [ 491.309855][ C0] vkms_vblank_simulate: vblank timer overrun [ 491.325690][ T5917] dvb-usb: error while querying for an remote control event. [ 491.722853][ T5962] m920x_read = error: -19 [ 491.727228][ T5962] dvb-usb: error while querying for an remote control event. [ 491.776920][T12672] netlink: 'syz.1.2258': attribute type 6 has an invalid length. [ 491.784038][ T5865] gspca_stk1135: reg_w 0x353 err -71 [ 491.793855][ T5865] gspca_stk1135: serial bus timeout: status=0x00 [ 491.805509][ T5865] gspca_stk1135: Sensor write failed [ 491.814997][ T5865] gspca_stk1135: serial bus timeout: status=0x00 [ 491.851334][ T5962] m920x_read = error: -19 [ 491.864753][ T5962] dvb-usb: error while querying for an remote control event. [ 491.881434][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 491.881449][ T30] audit: type=1800 audit(1756902472.829:160): pid=12670 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2257" name="bus" dev="overlay" ino=2861 res=0 errno=0 [ 491.909881][ T5865] gspca_stk1135: Sensor write failed [ 491.909917][ T5865] gspca_stk1135: serial bus timeout: status=0x00 [ 491.909930][ T5865] gspca_stk1135: Sensor read failed [ 491.909962][ T5865] gspca_stk1135: serial bus timeout: status=0x00 [ 491.909975][ T5865] gspca_stk1135: Sensor read failed [ 491.909984][ T5865] gspca_stk1135: Detected sensor type unknown (0x0) [ 491.910020][ T5865] gspca_stk1135: serial bus timeout: status=0x00 [ 491.910032][ T5865] gspca_stk1135: Sensor read failed [ 491.910064][ T5865] gspca_stk1135: serial bus timeout: status=0x00 [ 491.910075][ T5865] gspca_stk1135: Sensor read failed [ 491.910107][ T5865] gspca_stk1135: serial bus timeout: status=0x00 [ 491.910118][ T5865] gspca_stk1135: Sensor write failed [ 491.910150][ T5865] gspca_stk1135: serial bus timeout: status=0x00 [ 491.910161][ T5865] gspca_stk1135: Sensor write failed [ 491.910237][ T5865] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71 [ 491.919925][ T5865] usb 4-1: USB disconnect, device number 8 [ 492.002737][ T5962] m920x_read = error: -19 [ 492.002764][ T5962] dvb-usb: error while querying for an remote control event. [ 492.119260][ T5917] m920x_read = error: -19 [ 492.119291][ T5917] dvb-usb: error while querying for an remote control event. [ 492.236372][ T5962] m920x_read = error: -19 [ 492.236398][ T5962] dvb-usb: error while querying for an remote control event. [ 492.239652][ T5874] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 492.321898][ T5858] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 492.354361][ T5962] m920x_read = error: -19 [ 492.371638][ T5962] dvb-usb: error while querying for an remote control event. [ 492.388260][ T30] audit: type=1326 audit(1756902473.352:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12691 comm="syz.2.2263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 492.410615][ C1] vkms_vblank_simulate: vblank timer overrun [ 492.446943][ T30] audit: type=1326 audit(1756902473.381:162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12691 comm="syz.2.2263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 492.488839][ T30] audit: type=1326 audit(1756902473.381:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12691 comm="syz.2.2263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 492.513838][ T5962] m920x_read = error: -19 [ 492.517863][ T5858] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 492.521811][ T5962] dvb-usb: error while querying for an remote control event. [ 492.533204][ T5858] usb 1-1: config 0 has no interface number 0 [ 492.538775][ T30] audit: type=1326 audit(1756902473.381:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12691 comm="syz.2.2263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 492.553117][ T5858] usb 1-1: New USB device found, idVendor=1199, idProduct=9057, bcdDevice=6b.cc [ 492.566916][ T30] audit: type=1326 audit(1756902473.381:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12691 comm="syz.2.2263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 492.596981][ T30] audit: type=1326 audit(1756902473.381:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12691 comm="syz.2.2263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 492.611062][T12703] netlink: 'syz.3.2266': attribute type 29 has an invalid length. [ 492.631442][ T30] audit: type=1326 audit(1756902473.390:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12691 comm="syz.2.2263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 492.638534][ T5858] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.654109][ T5962] m920x_read = error: -19 [ 492.669982][ T5962] dvb-usb: error while querying for an remote control event. [ 492.676250][ T5858] usb 1-1: Product: syz [ 492.678787][T12703] netlink: 'syz.3.2266': attribute type 29 has an invalid length. [ 492.681510][ T5858] usb 1-1: Manufacturer: syz [ 492.681529][ T5858] usb 1-1: SerialNumber: syz [ 492.696772][ T30] audit: type=1326 audit(1756902473.390:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12691 comm="syz.2.2263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 492.708183][ T5858] usb 1-1: config 0 descriptor?? [ 492.725215][ T30] audit: type=1326 audit(1756902473.390:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12691 comm="syz.2.2263" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbbea78ebe9 code=0x7ffc0000 [ 492.748677][ C1] vkms_vblank_simulate: vblank timer overrun [ 492.778677][T12705] FAULT_INJECTION: forcing a failure. [ 492.778677][T12705] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 492.793596][T12705] CPU: 0 UID: 0 PID: 12705 Comm: syz.1.2269 Not tainted syzkaller #0 PREEMPT(full) [ 492.793621][T12705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 492.793634][T12705] Call Trace: [ 492.793642][T12705] [ 492.793652][T12705] dump_stack_lvl+0x189/0x250 [ 492.793689][T12705] ? __pfx____ratelimit+0x10/0x10 [ 492.793731][T12705] ? __pfx_dump_stack_lvl+0x10/0x10 [ 492.793760][T12705] ? __pfx__printk+0x10/0x10 [ 492.793788][T12705] ? __might_fault+0xb0/0x130 [ 492.793819][T12705] should_fail_ex+0x414/0x560 [ 492.793846][T12705] _copy_from_user+0x2d/0xb0 [ 492.793876][T12705] __se_sys_mount+0x18a/0x410 [ 492.793910][T12705] ? __pfx___se_sys_mount+0x10/0x10 [ 492.793941][T12705] ? do_syscall_64+0xbe/0xfa0 [ 492.793957][T12705] ? __x64_sys_mount+0x20/0xc0 [ 492.793987][T12705] do_syscall_64+0xfa/0xfa0 [ 492.794004][T12705] ? lockdep_hardirqs_on+0x9c/0x150 [ 492.794021][T12705] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.794040][T12705] ? clear_bhb_loop+0x60/0xb0 [ 492.794064][T12705] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.794082][T12705] RIP: 0033:0x7f544bb8ebe9 [ 492.794099][T12705] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 492.794115][T12705] RSP: 002b:00007f544c957038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 492.794135][T12705] RAX: ffffffffffffffda RBX: 00007f544bdc5fa0 RCX: 00007f544bb8ebe9 [ 492.794149][T12705] RDX: 0000200000000b80 RSI: 00002000000003c0 RDI: 0000000000000000 [ 492.794162][T12705] RBP: 00007f544c957090 R08: 0000200000000500 R09: 0000000000000000 [ 492.794174][T12705] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 492.794186][T12705] R13: 00007f544bdc6038 R14: 00007f544bdc5fa0 R15: 00007ffcf1ab23b8 [ 492.794218][T12705] [ 492.813907][ T5962] m920x_read = error: -19 [ 492.988629][ T5962] dvb-usb: error while querying for an remote control event. [ 493.040039][ T5874] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 493.114330][ T5962] m920x_read = error: -19 [ 493.118748][ T5962] dvb-usb: error while querying for an remote control event. [ 493.241678][ T5917] m920x_read = error: -19 [ 493.246071][ T5917] dvb-usb: error while querying for an remote control event. [ 493.348637][ T5858] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 493.369943][ T5917] m920x_read = error: -19 [ 493.378944][ T5917] dvb-usb: error while querying for an remote control event. [ 493.498370][ T5917] m920x_read = error: -19 [ 493.502859][ T5917] dvb-usb: error while querying for an remote control event. [ 493.530052][ T5858] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 493.539882][ T5858] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.548852][ T5858] usb 2-1: Product: syz [ 493.553659][ T5858] usb 2-1: Manufacturer: syz [ 493.562928][ T5858] usb 2-1: SerialNumber: syz [ 493.626663][ T5917] m920x_read = error: -19 [ 493.631031][ T5917] dvb-usb: error while querying for an remote control event. [ 493.754983][ T5917] m920x_read = error: -19 [ 493.759405][ T5917] dvb-usb: error while querying for an remote control event. [ 493.788337][T12710] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.803308][T12710] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.887674][ T5917] m920x_read = error: -19 [ 493.892074][ T5917] dvb-usb: error while querying for an remote control event. [ 494.033118][ T5917] m920x_read = error: -19 [ 494.039985][ T5917] dvb-usb: error while querying for an remote control event. [ 494.053047][ T5858] rtl8150 2-1:1.0: couldn't reset the device [ 494.102932][ T5858] rtl8150 2-1:1.0: probe with driver rtl8150 failed with error -5 [ 494.129712][ T5858] usb 2-1: USB disconnect, device number 19 [ 494.145833][ T5874] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 494.155359][ T5874] Bluetooth: hci2: Injecting HCI hardware error event [ 494.164598][ T5866] Bluetooth: hci2: hardware error 0x00 [ 494.172745][ T5917] m920x_read = error: -19 [ 494.185749][ T5917] dvb-usb: error while querying for an remote control event. [ 494.190304][T12733] FAULT_INJECTION: forcing a failure. [ 494.190304][T12733] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 494.206644][T12733] CPU: 0 UID: 0 PID: 12733 Comm: syz.3.2278 Not tainted syzkaller #0 PREEMPT(full) [ 494.206669][T12733] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 494.206683][T12733] Call Trace: [ 494.206692][T12733] [ 494.206701][T12733] dump_stack_lvl+0x189/0x250 [ 494.206738][T12733] ? __pfx____ratelimit+0x10/0x10 [ 494.206769][T12733] ? __pfx_dump_stack_lvl+0x10/0x10 [ 494.206799][T12733] ? __pfx__printk+0x10/0x10 [ 494.206842][T12733] should_fail_ex+0x414/0x560 [ 494.206870][T12733] _copy_to_user+0x31/0xb0 [ 494.206891][T12733] simple_read_from_buffer+0xe1/0x170 [ 494.206924][T12733] proc_fail_nth_read+0x1b3/0x220 [ 494.206947][T12733] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 494.206970][T12733] ? rw_verify_area+0x2a6/0x4d0 [ 494.206993][T12733] ? __lock_acquire+0xab9/0xd20 [ 494.207014][T12733] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 494.207049][T12733] vfs_read+0x1fd/0xa30 [ 494.207070][T12733] ? fdget_pos+0x247/0x320 [ 494.207101][T12733] ? __pfx___mutex_lock+0x10/0x10 [ 494.207121][T12733] ? __pfx_vfs_read+0x10/0x10 [ 494.207145][T12733] ? __fget_files+0x2a/0x420 [ 494.207176][T12733] ? __fget_files+0x3a0/0x420 [ 494.207200][T12733] ? __fget_files+0x2a/0x420 [ 494.207232][T12733] ksys_read+0x145/0x250 [ 494.207257][T12733] ? __pfx_ksys_read+0x10/0x10 [ 494.207279][T12733] ? do_syscall_64+0xbe/0xfa0 [ 494.207300][T12733] do_syscall_64+0xfa/0xfa0 [ 494.207318][T12733] ? lockdep_hardirqs_on+0x9c/0x150 [ 494.207336][T12733] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.207353][T12733] ? clear_bhb_loop+0x60/0xb0 [ 494.207376][T12733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.207394][T12733] RIP: 0033:0x7f67b658d5fc [ 494.207411][T12733] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 494.207426][T12733] RSP: 002b:00007f67b73c0030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 494.207447][T12733] RAX: ffffffffffffffda RBX: 00007f67b67c5fa0 RCX: 00007f67b658d5fc [ 494.207460][T12733] RDX: 000000000000000f RSI: 00007f67b73c00a0 RDI: 0000000000000006 [ 494.207472][T12733] RBP: 00007f67b73c0090 R08: 0000000000000000 R09: 0000000000000000 [ 494.207484][T12733] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 494.207495][T12733] R13: 00007f67b67c6038 R14: 00007f67b67c5fa0 R15: 00007ffd45bc0808 [ 494.207526][T12733] [ 494.451350][ T5917] m920x_read = error: -19 [ 494.455725][ T5917] dvb-usb: error while querying for an remote control event. [ 494.581807][ T5962] m920x_read = error: -19 [ 494.586370][ T5962] dvb-usb: error while querying for an remote control event. [ 494.710033][ T5962] m920x_read = error: -19 [ 494.714692][ T5962] dvb-usb: error while querying for an remote control event. [ 494.835267][ T5962] m920x_read = error: -19 [ 494.839677][ T5962] dvb-usb: error while querying for an remote control event. [ 494.910255][ T5858] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 494.974173][ T5962] m920x_read = error: -19 [ 494.978586][ T5962] dvb-usb: error while querying for an remote control event. [ 495.066006][T12745] ------------[ cut here ]------------ [ 495.071654][T12745] WARNING: drivers/gpu/drm/drm_prime.c:223 at drm_prime_destroy_file_private+0x4b/0x60, CPU#1: syz.3.2284/12745 [ 495.083974][T12745] Modules linked in: [ 495.087903][T12745] CPU: 1 UID: 0 PID: 12745 Comm: syz.3.2284 Not tainted syzkaller #0 PREEMPT(full) [ 495.097580][T12745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 495.099728][ T5858] usb 3-1: config 0 has no interfaces? [ 495.107705][T12745] RIP: 0010:drm_prime_destroy_file_private+0x4b/0x60 [ 495.107742][T12745] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 ed af ac fc 48 83 3b 00 75 0c e8 a2 98 48 fc 5b c3 cc cc cc cc cc e8 96 98 48 fc 90 <0f> 0b 90 5b c3 cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 [ 495.107760][T12745] RSP: 0018:ffffc9000b667c60 EFLAGS: 00010293 [ 495.107780][T12745] RAX: ffffffff85786eba RBX: ffff88805e0d8410 RCX: ffff888079fa9e00 [ 495.107796][T12745] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88805e0d8380 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 495.107809][T12745] RBP: ffff88805e0d82c8 R08: ffffc9000b667be7 R09: 1ffff920016ccf7c [ 495.107824][T12745] R10: dffffc0000000000 R11: fffff520016ccf7d R12: dffffc0000000000 [ 495.107839][T12745] R13: dead000000000100 R14: 0000000000000000 R15: ffff88805e0d82d8 [ 495.107854][T12745] FS: 0000555572535500(0000) GS:ffff8881258b9000(0000) knlGS:0000000000000000 [ 495.173378][ T5858] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 495.178037][T12745] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 495.178056][T12745] CR2: 000000110c348b4a CR3: 000000003341c000 CR4: 00000000003526f0 [ 495.178074][T12745] DR0: 0000000000000000 DR1: 00000000ddf6ee63 DR2: 0000000000000000 [ 495.178086][T12745] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 495.178099][T12745] Call Trace: [ 495.178107][T12745] [ 495.178115][T12745] drm_file_free+0x7f2/0xa00 [ 495.178154][T12745] drm_release+0x2de/0x3f0 [ 495.178181][T12745] ? __pfx_drm_release+0x10/0x10 [ 495.178206][T12745] __fput+0x449/0xa70 [ 495.178234][T12745] task_work_run+0x1d1/0x260 [ 495.178258][T12745] ? __pfx_task_work_run+0x10/0x10 [ 495.178281][T12745] ? exit_to_user_mode_loop+0x40/0x130 [ 495.244778][ T5858] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 495.246284][T12745] exit_to_user_mode_loop+0xec/0x130 [ 495.288304][T12745] do_syscall_64+0x2bd/0xfa0 [ 495.292911][T12745] ? lockdep_hardirqs_on+0x9c/0x150 [ 495.297320][ T5858] usb 3-1: Product: syz [ 495.298349][T12745] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.298375][T12745] ? clear_bhb_loop+0x60/0xb0 [ 495.298398][T12745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.298416][T12745] RIP: 0033:0x7f67b658ebe9 [ 495.298434][T12745] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 495.302611][ T5858] usb 3-1: Manufacturer: syz [ 495.308959][T12745] RSP: 002b:00007ffd45bc0968 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 495.308988][T12745] RAX: 0000000000000000 RBX: 0000000000073284 RCX: 00007f67b658ebe9 [ 495.364842][T12745] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 495.369014][ T5858] usb 3-1: config 0 descriptor?? [ 495.372866][T12745] RBP: 00007f67b67c7da0 R08: 0000000000000001 R09: 0000000b45bc0c5f [ 495.372884][T12745] R10: 0000001b2ee20000 R11: 0000000000000246 R12: 00007f67b67c5fac [ 495.372899][T12745] R13: 00007f67b67c5fa0 R14: ffffffffffffffff R15: 00007ffd45bc0a80 [ 495.372948][T12745] [ 495.372976][T12745] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 495.372992][T12745] CPU: 1 UID: 0 PID: 12745 Comm: syz.3.2284 Not tainted syzkaller #0 PREEMPT(full) [ 495.373014][T12745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 495.373027][T12745] Call Trace: [ 495.373037][T12745] [ 495.373046][T12745] dump_stack_lvl+0x99/0x250 [ 495.373097][T12745] ? __asan_memcpy+0x40/0x70 [ 495.373119][T12745] ? __pfx_dump_stack_lvl+0x10/0x10 [ 495.373150][T12745] ? __pfx__printk+0x10/0x10 [ 495.373194][T12745] vpanic+0x229/0x6d0 [ 495.373227][T12745] ? __pfx_vpanic+0x10/0x10 [ 495.373250][T12745] ? is_bpf_text_address+0x292/0x2b0 [ 495.373275][T12745] ? is_bpf_text_address+0x26/0x2b0 [ 495.373308][T12745] panic+0xb9/0xc0 [ 495.373332][T12745] ? __pfx_panic+0x10/0x10 [ 495.373374][T12745] __warn+0x334/0x4c0 [ 495.373397][T12745] ? drm_prime_destroy_file_private+0x4b/0x60 [ 495.373432][T12745] ? drm_prime_destroy_file_private+0x4b/0x60 [ 495.373462][T12745] report_bug+0x2be/0x4f0 [ 495.373490][T12745] ? drm_prime_destroy_file_private+0x4b/0x60 [ 495.373521][T12745] ? drm_prime_destroy_file_private+0x4b/0x60 [ 495.373551][T12745] ? drm_prime_destroy_file_private+0x4d/0x60 [ 495.373579][T12745] handle_bug+0x84/0x160 [ 495.373605][T12745] exc_invalid_op+0x1a/0x50 [ 495.373628][T12745] asm_exc_invalid_op+0x1a/0x20 [ 495.373647][T12745] RIP: 0010:drm_prime_destroy_file_private+0x4b/0x60 [ 495.373678][T12745] Code: 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 ed af ac fc 48 83 3b 00 75 0c e8 a2 98 48 fc 5b c3 cc cc cc cc cc e8 96 98 48 fc 90 <0f> 0b 90 5b c3 cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 [ 495.373697][T12745] RSP: 0018:ffffc9000b667c60 EFLAGS: 00010293 [ 495.373717][T12745] RAX: ffffffff85786eba RBX: ffff88805e0d8410 RCX: ffff888079fa9e00 [ 495.373733][T12745] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88805e0d8380 [ 495.373748][T12745] RBP: ffff88805e0d82c8 R08: ffffc9000b667be7 R09: 1ffff920016ccf7c [ 495.373764][T12745] R10: dffffc0000000000 R11: fffff520016ccf7d R12: dffffc0000000000 [ 495.373780][T12745] R13: dead000000000100 R14: 0000000000000000 R15: ffff88805e0d82d8 [ 495.373803][T12745] ? drm_prime_destroy_file_private+0x4a/0x60 [ 495.373840][T12745] drm_file_free+0x7f2/0xa00 [ 495.373880][T12745] drm_release+0x2de/0x3f0 [ 495.373910][T12745] ? __pfx_drm_release+0x10/0x10 [ 495.373938][T12745] __fput+0x449/0xa70 [ 495.373970][T12745] task_work_run+0x1d1/0x260 [ 495.373994][T12745] ? __pfx_task_work_run+0x10/0x10 [ 495.374019][T12745] ? exit_to_user_mode_loop+0x40/0x130 [ 495.374046][T12745] exit_to_user_mode_loop+0xec/0x130 [ 495.374069][T12745] do_syscall_64+0x2bd/0xfa0 [ 495.374088][T12745] ? lockdep_hardirqs_on+0x9c/0x150 [ 495.374108][T12745] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.374128][T12745] ? clear_bhb_loop+0x60/0xb0 [ 495.374154][T12745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.374174][T12745] RIP: 0033:0x7f67b658ebe9 [ 495.374194][T12745] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 495.374211][T12745] RSP: 002b:00007ffd45bc0968 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 495.374239][T12745] RAX: 0000000000000000 RBX: 0000000000073284 RCX: 00007f67b658ebe9 [ 495.374257][T12745] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 495.374269][T12745] RBP: 00007f67b67c7da0 R08: 0000000000000001 R09: 0000000b45bc0c5f [ 495.374284][T12745] R10: 0000001b2ee20000 R11: 0000000000000246 R12: 00007f67b67c5fac [ 495.374299][T12745] R13: 00007f67b67c5fa0 R14: ffffffffffffffff R15: 00007ffd45bc0a80 [ 495.374333][T12745] [ 495.378236][T12745] Kernel Offset: disabled