last executing test programs: 53.436747918s ago: executing program 3 (id=723): mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000080)=@sack_info={0x0, 0x210801, 0x1}, 0xc) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000787000/0x2000)=nil, 0x2000, &(0x7f00000003c0)='+++\x00') mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0xb, 0x202812, r1, 0x7dfff000) 53.434305912s ago: executing program 3 (id=724): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a02, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x9, 0x10200) futex(0x0, 0x100, 0x2, &(0x7f00000017c0), 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x1000000, 0x4) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @none}, &(0x7f0000000100)=0xe, 0x800) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) r6 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCL_GETMOUSEREPORTING(r6, 0x5412, &(0x7f0000000640)=0x13) ioctl$TIOCL_GETMOUSEREPORTING(r6, 0x5412, &(0x7f00000006c0)=0xa) ioctl$TCSETSF2(r6, 0x402c542d, &(0x7f0000000240)={0xcdd, 0x5, 0xa, 0x3, 0x0, "00000100", 0x3, 0x3}) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r7, 0x3d13, 0x0) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000380)=0x1) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="00000000ad287a8f07049b7f4e3b4c55ecd89d3c2c1708dc7a9af9057279c88b9cc3260ca778e1dd219e4edbafc4916c62ec53705392be25557bb4595f8e5045b1476ec78f1afcdf55907ef1601d4c6aaa801d", @ANYRESDEC=r1, @ANYRESHEX=r2, @ANYRES32=r4], 0x1c}, 0x1, 0x0, 0x0, 0x8010}, 0x24040000) readv(r2, &(0x7f0000000740)=[{&(0x7f0000000240)=""/152, 0x98}], 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, &(0x7f0000000040)) pwritev(r0, &(0x7f0000001280)=[{0x0}, {0x0}, {&(0x7f0000001080)="2b97", 0x2}], 0x3, 0x0, 0xfffffffe) 52.555304875s ago: executing program 3 (id=726): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) 52.452626674s ago: executing program 3 (id=727): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @local}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @loopback={0xfffffffffffffff5}}]}]}, 0xac}}, 0x0) brk(0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x12b) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001a80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x30, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0xa, 0x84}}}, 0xb4}, 0x1, 0x0, 0x0, 0xc800}, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee8, 0x8031, 0xffffffffffffffff, 0x0) r5 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r5, 0x114, 0x6, &(0x7f0000000300), 0x4) sendmsg$TIPC_NL_MON_GET(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000580)={0x14, r4, 0x1, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0x48800) umount2(&(0x7f0000000000)='./file0/file0\x00', 0x5) move_mount(r2, &(0x7f0000000580)='./file0/../file0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file0/file0\x00', 0x100) creat(&(0x7f0000001380)='./file0\x00', 0x0) 52.406812808s ago: executing program 3 (id=729): syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000580)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0xfffffffe}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000003000000000a0000205e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000800000000000000000000000000000700000000000000000000000000000000000000000000000300000000000000070000000000000000000000000000000000000000000000e02700000000000000030000000000002d00000000000000000000000000000084010500ac1414bb000000000000000000000000000000006c00000000000000ac14142c000000000000000000000000000000000000560000000000fdffffff01000000ac141410000000000000000000000000000000003200000000000000fe800000000000000000000000000500023500000000000000000000feffffff00000000ff010000000000000000000000000001000000003c00000002000000ff0200000000000000000000000000010000000001030000000000000000000000000000ff020000000000000000000000000001000004d33c00000002000000ffffffff00000000000000000000000000000000000000000000000003000000000000000a010102000000000000000000000000000000003200000002"], 0x23c}}, 0x0) 52.142423106s ago: executing program 3 (id=730): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) (async, rerun: 64) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x4000000b, 0x0) (rerun: 64) ioctl$USBDEVFS_RELEASEINTERFACE(r1, 0xc00c5512, 0xffffffffffffffff) socket$xdp(0x2c, 0x3, 0x0) (async, rerun: 64) r2 = socket$netlink(0x10, 0x3, 0x400000000000004) (rerun: 64) writev(r2, &(0x7f0000000100)=[{&(0x7f00000003c0)="480000001400190d7ebdeb75fd0d8c562c84d8c033edca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff000000030999ea01aa7753c5497b9849e3135c29e8", 0x48}], 0x1) r3 = syz_open_dev$dmmidi(&(0x7f0000000080), 0x200, 0x5) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r3, 0xc0385720, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r4, 0x0) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) utimes(0x0, &(0x7f0000001200)) (async) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000000000086d042fc50000000000010902240001000000000904000001030000000921000000012205200905810300000001"], 0x0) (async) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) (async) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0xe4}}, 0x0) (async, rerun: 32) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(generic-gcm-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4004800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async, rerun: 32) recvmsg(r8, &(0x7f00000004c0)={0x0, 0xffffffffffffff8c, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async, rerun: 32) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) (async, rerun: 32) sendmsg$NL80211_CMD_TRIGGER_SCAN(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=ANY=[], 0x24}}, 0x91) (rerun: 32) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0x5a051feb1f984a1d, 0x202812, r0, 0x7dfff000) (async) setsockopt$netrom_NETROM_T4(0xffffffffffffffff, 0x103, 0x6, &(0x7f0000000000)=0x8, 0x4) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r4) 51.984837057s ago: executing program 32 (id=730): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) (async, rerun: 64) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x4000000b, 0x0) (rerun: 64) ioctl$USBDEVFS_RELEASEINTERFACE(r1, 0xc00c5512, 0xffffffffffffffff) socket$xdp(0x2c, 0x3, 0x0) (async, rerun: 64) r2 = socket$netlink(0x10, 0x3, 0x400000000000004) (rerun: 64) writev(r2, &(0x7f0000000100)=[{&(0x7f00000003c0)="480000001400190d7ebdeb75fd0d8c562c84d8c033edca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff000000030999ea01aa7753c5497b9849e3135c29e8", 0x48}], 0x1) r3 = syz_open_dev$dmmidi(&(0x7f0000000080), 0x200, 0x5) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r3, 0xc0385720, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r4, 0x0) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) utimes(0x0, &(0x7f0000001200)) (async) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000000000086d042fc50000000000010902240001000000000904000001030000000921000000012205200905810300000001"], 0x0) (async) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) (async) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0xe4}}, 0x0) (async, rerun: 32) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(generic-gcm-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4004800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async, rerun: 32) recvmsg(r8, &(0x7f00000004c0)={0x0, 0xffffffffffffff8c, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async, rerun: 32) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) (async, rerun: 32) sendmsg$NL80211_CMD_TRIGGER_SCAN(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=ANY=[], 0x24}}, 0x91) (rerun: 32) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0x5a051feb1f984a1d, 0x202812, r0, 0x7dfff000) (async) setsockopt$netrom_NETROM_T4(0xffffffffffffffff, 0x103, 0x6, &(0x7f0000000000)=0x8, 0x4) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r4) 5.896702669s ago: executing program 1 (id=1023): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r2 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sysvipc/sem\x00', 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffe000/0x2000)=nil, 0x930, 0x0, 0x11, r3, 0x0) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f00000007c0)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000ffff00000000000000bd0000000000000000000000e4ec01000000004000000000fc00000000000000000000000000013da51fd47aa2e2f700000000000000000000000000000000000000000000000000000000000000060000000000000000050000000a004e200e8a34c38f36f0c7eb2700d609bcf41076d88144448ebe7994dd1b33d7c8787734cc315672f62261ceeede940774fd94d2767288cfb3a20882449d601ff878eedd3d57c9eb3a723b62102bd534c8a304a975d752e82cc8d5f969771c94a1d69cfd8694e29b9468fca5df65ece31ed7c209325604001fcd06adc3ac391f60a3523d6d0b4a8a"], 0x310) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10) getsockname$packet(r4, 0x0, &(0x7f0000000500)) setsockopt$inet6_group_source_req(r2, 0x29, 0x2c, &(0x7f0000000100)={0x1, {{0xa, 0x0, 0x4, @mcast1, 0x8000}}, {{0xa, 0x0, 0x2, @empty}}}, 0x108) close_range(r1, 0xffffffffffffffff, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000080)={'macsec0\x00', &(0x7f00000000c0)=@ethtool_rxfh={0x46, 0x3ff, 0x5, 0x9, 0x5, "04d07f", 0x8}}) setsockopt$inet6_group_source_req(r3, 0x29, 0x2c, &(0x7f0000000380)={0x7ff, {{0xa, 0x4e22, 0x1844, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8}}, {{0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x6}}}, 0x108) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/212, 0xfffffed3}], 0x1, 0xffeffffb, 0x1007) 5.88102861s ago: executing program 1 (id=1024): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010bd28710000000000000109022400010000000009040100010300000009210200000122"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0xc, "fe9e2572"}]}}, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000400)={0x0, 0x31, 0x82, {0x82, 0xf, "4714a90d7ddceb8ad09055bbc7f98583e16ed3865c705032e85d21b62fbbff1506ff90bb7c7f641950d261a6aeb0a62a3b476549419b334d8b71077cfd0a6a31a1c0fb134a7407776de61938b96d82a8efabfd7d8756c15317e83e27bc8fd996eb4f0699f37162f4cbb7b7556504fadeb31bed9e3a7f4242d4e5756b31248803"}}, &(0x7f0000000540)=ANY=[@ANYBLOB="00032900b130873952e651286b0000da03e6f6f763e6fceea272cf3b14eb4736fe0ccbdca275db7f895c74722f0649b2cf8d53b5ece572662855bde11a60916b77a3059df6450af291667798871ad06d5997d3c93bd5f41497b8fd57f0ea12faee32d2202a3735c57d9a7adbd368a3ddaa2990c3b969dcc2fab4790ec917748931d1e84a8f639607609382f45745dbb63ec34ce08795d927be8af5f7b7cbb6f57e840a80c5a562ef6af4a29523295ed7f9c468213a15cc250428bc82d7621a3157c25bba49a4e002b0b74c4169bf57a3a557a8e87626ba11d934c4aea4d2387c"], &(0x7f0000000200)={0x0, 0xf, 0x19, {0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0xf7, "8048fe7f65b2f6c9647f958768958681"}]}}, &(0x7f0000000280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x0, 0x81, 0x4, "44912d58", "dcfe2c39"}}, &(0x7f0000000340)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x64, 0x1, 0x0, 0x5, 0xa, 0x4, 0x2}}}, &(0x7f0000000a40)={0x84, &(0x7f0000000640)={0x0, 0x5, 0x4e, "dd138699d7c27a4a16305621bb46a1f7d73f93c35c860ada1b823dbceeea9d67d9ba3411e1ae07feb2fbebdddabb9c9fe09953dfc2078016a984e64dc1dfe3e24e2de06094a16c7ab602502620c3"}, &(0x7f00000004c0)={0x0, 0xa, 0x1, 0x8}, &(0x7f00000006c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000700)={0x20, 0x0, 0x4, {0x3}}, &(0x7f0000000740)={0x20, 0x0, 0x4, {0x140, 0x8}}, &(0x7f0000000780)={0x40, 0x7, 0x2, 0x8}, &(0x7f00000007c0)={0x40, 0x9, 0x1, 0x26}, &(0x7f0000000800)={0x40, 0xb, 0x2, '&6'}, &(0x7f0000000840)={0x40, 0xf, 0x2, 0x40}, &(0x7f0000000880)={0x40, 0x13, 0x6, @broadcast}, &(0x7f00000008c0)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000900)={0x40, 0x19, 0x2, 'Ap'}, &(0x7f0000000940)={0x40, 0x1a, 0x2, 0x7fff}, &(0x7f0000000b00)={0x40, 0x1c, 0x1, 0x4}, &(0x7f00000009c0)={0x40, 0x1e, 0x1, 0xff}, &(0x7f0000000a00)={0x40, 0x21, 0x1, 0x5}}) 4.208596493s ago: executing program 2 (id=1035): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000180), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c00500", "e9be1eae", "bb10000000000001"}, 0x28) recvfrom$inet6(r1, 0x0, 0x0, 0x40012101, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000100)=@gcm_128={{0x303}, "49698de417777144", "0af93ad9bc10bdb6532e14f6c907f06b", "e0c715b9", "f9fec6a134318ae2"}, 0x28) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r3) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f00000003c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000800)={0x68, r4, 0x1, 0x0, 0x3, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r5}, @WGDEVICE_A_PEERS={0x4c, 0x8, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e21, 0x0, @mcast1}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4009041}, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) ioctl$IOMMU_VFIO_IOAS$SET(r6, 0x3b88, &(0x7f00000000c0)={0xc, r2}) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f00000001c0)={0x90, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}, {}, {}, {}, {}, {}]}}) 4.185193245s ago: executing program 2 (id=1036): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000200)={'tunl0\x00', 0x0}) 4.141006733s ago: executing program 2 (id=1037): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$X25_QBITINCL(r0, 0x106, 0x1, &(0x7f0000000000), 0x4) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_IPV6_RTHDR(r1, 0x29, 0x39, &(0x7f0000000080)=ANY=[@ANYBLOB="00020201"], 0x18) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}}, 0x20040880) sendmmsg$inet6(r1, &(0x7f0000000a80)=[{{&(0x7f0000000200)={0xa, 0x4e20, 0x4d7, @private0={0xfc, 0x0, '\x00', 0x1}}, 0x1c, &(0x7f0000000900)=[{&(0x7f0000000400)="fc", 0x1}], 0x1}}], 0x1, 0x4c040) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x208002, 0x0) 4.036677775s ago: executing program 2 (id=1038): mkdir(&(0x7f0000000200)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000240), 0x8840, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000100), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f0000000140)={0x0, 0xc1, 0x804, 0x34325241, 0x0, [0x2], [0x800], [0xffffff7f]}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f00000003c0)={0x38, r2, 0x201, 0x70bd26, 0x25dfdbfc, {}, [@ETHTOOL_A_FEATURES_WANTED={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x8}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000094}, 0x404c004) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) preadv(r3, &(0x7f0000000080)=[{&(0x7f0000000380)=""/215, 0xfffffffffffffe78}], 0x1, 0xffeffffb, 0x1007) 3.99899151s ago: executing program 2 (id=1040): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x4080, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3000001, 0xc3072, 0xffffffffffffffff, 0x200000) r1 = syz_clone(0x0, 0x0, 0x20, 0x0, 0x0, 0x0) ptrace(0x10, r1) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r2, 0x45809000) get_mempolicy(0x0, 0x0, 0x4, &(0x7f0000000000/0x2000)=nil, 0x3) ptrace$poke(0x5, r1, &(0x7f0000000100), 0xff) r3 = syz_clone(0x2b1c00, 0x0, 0x5c, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$setregs(0xd, r3, 0x0, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63defb87d698be5c749450b350a789dcfc6b2d6a696b5026d1e52f19274566d1da0f353dd65e330ebf71c5e823f2753c5fd76724828ef31b353e71805205c3dceb44cc4c7b3664e29fb") ptrace$getregset(0x4205, r3, 0x2, &(0x7f0000000080)={0x0}) ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @broadcast}) r4 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="36400000260091"], 0xfe33) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x193a42, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r5, 0x45809000) r6 = socket$igmp6(0xa, 0x3, 0x2) pipe(&(0x7f0000000100)) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6(0xa, 0x2, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000340)=ANY=[@ANYBLOB="2a01000020000040b708000000000000430109029200030172e5000904000000010100000a24010000000201020c0d240700000500006e626805000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r8, @ANYRES16=r7], 0x0) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(r8, 0x3312, 0x1ff) getsockopt$inet6_int(r6, 0x29, 0x7, 0x0, &(0x7f0000000dc0)) 3.668559449s ago: executing program 0 (id=1044): unshare(0x64000600) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001040)={0xe, {"a2e3ad21ed0d09f91b0b380987f70e06d038e7ff7fc6e5539b0d3d0e8b089b3f37096c060890e0878f0e1ac6e7049b094a959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130f91850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153fae46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c343f7f140f319539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004c0400000000000000ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d984836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885e94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xfffffffffffffd6f}}, 0x1006) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000009800)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, &(0x7f0000003640)=[{&(0x7f0000002180)=""/4096, 0x1000}], 0x1}, 0x81}], 0x2, 0x2100, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c0260000410007010000000007000000037c00000400fc80a72601"], 0x26c0}}, 0x4010) r2 = socket(0xa, 0x801, 0x0) getsockopt(r2, 0x0, 0x40, &(0x7f0000b3ffac)=""/84, &(0x7f00000000c0)=0x54) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r3, 0x3b88, &(0x7f00000000c0)={0xc, r4}) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r3, 0x3b71, &(0x7f0000000000)={0x20, 0x2, &(0x7f0000000100)="13dfbadfdf589ae06349fbc7adea8261bd156409ae431dc2d1902b4962d86bdbaf1ee3bf5744e2daa68355ff4dc7539d04ccd5c0bfd07e86faed77c763540d826f6de35e8d5a5cc8c18bed72f776120c5a93915253e11aa7a919d1984ba8baf7ee868f41434fca84799ce0c9ab1dd5a0c5e2eec4fc9f84d1cf964238566db8809c677f06228d1e35c7d9", 0x4, 0x7}) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r3, 0x3b70, &(0x7f0000000240)={0x28}) 3.364175856s ago: executing program 0 (id=1045): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000200)={'tunl0\x00', 0x0}) 3.281773434s ago: executing program 0 (id=1046): r0 = socket$igmp(0x2, 0x3, 0x2) shutdown(r0, 0x1) setsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000080)="6edbca734a35a57fa26a12a16395e5e40022e0075f6563c4a22c169bee238ec161df7350623a7646a969ca31af3ea77baf5c20501bc6b04250f38c7f6c6e67cce6a377643de62436671088d5e1492bfcd108ef1b729b06a840086df775f672db2570c6ea1997", 0xc5871f2668ce4e3d) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000002e80), 0x4) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r0, 0x40049366, &(0x7f0000000040)=0x4) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x212380, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x891c, &(0x7f0000000600)={'batadv_slave_1\x00', {0x2, 0x0, @empty}}) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0xb, 0x202812, r1, 0x7dfff000) 3.096343378s ago: executing program 0 (id=1047): syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000580)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x8}, {0xd, 0x24, 0xf, 0x1, 0xfffffffe}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000003000000000a0000205e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000800000000000000000000000000000700000000000000000000000000000000000000000000000300000000000000070000000000000000000000000000000000000000000000e02700000000000000000100000000002d00000000000000000000000000000084010500ac1414bb000000000000000000000000000000006c00000000000000ac14142c000000000000000000000000000000000000560000000000fdffffff01000000ac141410000000000000000000000000000000003200000000000000fe800000000000000000000000000500023500000000000000000000feffffff00000000ff010000000000000000000000000001000000003c00000002000000ff0200000000000000000000000000010000000001030000000000000000000000000000ff020000000000000000000000000001000004d33c00000002000000ffffffff00000000000000000000000000000000000000000000000003000000000000000a010102000000000000000000000000000000003200000002"], 0x23c}}, 0x0) 3.027714423s ago: executing program 4 (id=1048): mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x0, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="dfbf00000000000000006700000008000300", @ANYRES32=r2, @ANYBLOB="0800c300741300000800c40001"], 0x30}, 0x1, 0x0, 0x0, 0x40002}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x80000, 0x0, 0xffffffffffffffff}) readv(r3, &(0x7f00000016c0)=[{&(0x7f0000000140)=""/219, 0xdb}, {&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f0000001240)=""/208, 0xd0}, {&(0x7f0000001340)=""/238, 0xee}, {&(0x7f0000001440)=""/52, 0x34}, {&(0x7f0000001480)=""/167, 0xa7}, {&(0x7f0000001540)=""/185, 0xb9}, {&(0x7f0000001600)=""/184, 0xb8}], 0x8) 2.921736822s ago: executing program 4 (id=1049): ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000000), 0x2a14048, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x15) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000001580), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="74010000", @ANYRES16=r2, @ANYBLOB="11060000000000000000010000000800050001000000200108803c0000801400040002000000ac1e00010000000000000000240001000000000000000000000000000000000000000000000000000000000000000000e0000080a400098028000080060001000a0000001400020020010000000000000000000000000001050003000100000028000080060001000a00000014000200ff010000000000000000000000000001050003002aea091428000080060001000a00000014000200ff010000000000000000000000000001050003000300000028020080060001000a00000014000200ff0100000000000000000000000000010500030000000000240001000000000000000000000000000000000000000000000000000000000000000000140004000200000000000000000000000000000024000300000000000000000000000000000000000000000000000000000000000000000014000200776731"], 0x174}, 0x1, 0x0, 0x0, 0x60}, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r3, 0x4b71, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000000)=0x0) capget(&(0x7f0000000100)={0x19980330, r4}, &(0x7f0000000140)={0xe, 0x3, 0x8, 0x1, 0x5, 0x6}) r5 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) ioctl$NBD_DISCONNECT(r5, 0xab08) ioctl$NBD_CLEAR_SOCK(r5, 0x125f) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f00000002c0)="38889170a4e43d9d8dc27bd4", 0xc}], 0x1) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='hfs\x00', 0x2208080, 0x0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/keys\x00', 0x0, 0x0) preadv(r7, &(0x7f0000001680)=[{&(0x7f00000000c0)=""/114, 0x72}, {&(0x7f0000000140)=""/102, 0x66}, {&(0x7f00000001c0)=""/174, 0xae}, {&(0x7f0000000280)=""/198, 0xc6}, {0x0}], 0x5, 0x402, 0xffffffff) (fail_nth: 6) 2.81459178s ago: executing program 1 (id=1050): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x13, r0, 0x45809000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x25d, 0x0, 0x7}]}) socket$packet(0x11, 0x3, 0x300) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) write(r4, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000200100000000000008000f0001000000", 0x24) setsockopt$packet_int(r4, 0x107, 0x3, &(0x7f0000000080)=0x99dc, 0x4) open$dir(&(0x7f0000000040)='./file0\x00', 0x80, 0x20) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYRESDEC=r5], 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='net_prio.prioidx\x00', 0x275a, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.kill\x00', 0x275a, 0x0) fcntl$lock(r7, 0x7, &(0x7f0000000000)={0x0, 0x2, 0x1b9, 0x7fffffff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fcntl$lock(r7, 0x6, &(0x7f0000000200)={0x0, 0x0, 0x3, 0x1fd}) r8 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) dup2(r8, r6) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x12, r6, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x9, 0x10, 0xffffffffffffffff, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000002440), 0x82000, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) mlock2(&(0x7f00002e5000/0xc00000)=nil, 0xc00000, 0x0) 2.400646177s ago: executing program 1 (id=1051): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, &(0x7f0000000000)=@x86={0x9, 0x7, 0x8c, 0x0, 0x7, 0x8, 0xff, 0xb, 0xc, 0xf9, 0x2, 0xfb, 0x0, 0x8, 0x5, 0xb, 0x3, 0x7, 0x9, '\x00', 0x1c, 0x6}) ioctl$KVM_RUN(r1, 0xae80, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x180000f, 0x13, r4, 0x1000) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000200040010000800014004000000", 0x58}], 0x1) sendmmsg$unix(r4, 0x0, 0x0, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r2, 0x45809000) 1.99317892s ago: executing program 4 (id=1052): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) fadvise64(r1, 0x3, 0x40000, 0x300) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f00000000c0)={0xc, r2}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r4, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc73}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r5, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x5, 0x6], 0x0, 0xa340}) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4040aea0, &(0x7f0000000080)=@x86={0x7c, 0x3, 0xfd, 0x0, 0x1, 0x7e, 0xcb, 0x10, 0x8, 0x5, 0xb, 0x8, 0x0, 0x10003, 0x9, 0xff, 0x6, 0x5, 0x12, '\x00', 0x1}) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x5, 0x31, 0xffffffffffffffff, 0xf983e000) r6 = syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r6, 0xc0844123, &(0x7f0000002fc0)) ioctl$KVM_RUN(r5, 0xae80, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r7, 0x7ab, &(0x7f0000000180)={&(0x7f0000000480)={{@host, 0x7}, {@hyper, 0xfff}, 0x400, "2beccd40b70cd42db55acc0f6c452557ab6acee53bc5552ae1753ac6a7156508df28a610c5e4b20f1c4a196c204279b7fc37973772ddcc443709190863352bbb9e1a63a69c7d49c4c42a8067966feefed80e40c14fe3a89165921ec56b6d2b93ddd0727a89507313dfcbf1a5fd66a21dbed0d86fd4f269818b55bfc80eba56761c5afbb9c1fea92d01716d189f77d058480d5ad208a618308cda3bd8e111ba1ac298fc5be19f7d8f7a55b0d675f882b252ccdcca3d723c486c4d09f57c835e73fa9d57d04059205217562198231f91080f3c1ba0b0ceca5d24ad319343c1d5d654c13e9f6edcfbbf2a7927e625024328a15217953ce59ec14799a50fd9abaa5f592e1fa1ac0607d206c85aa795e09c5f0bd44b9ab8e654563b91edc0f9d2ea49049e8033528affd8d63a7d589ef51a1595d62a12b21635fda23e79efe07dc7f8f41b4fff90e26d513aca473df446354f58c111b5282bf42483ce72d0b252e4e8da2f5dd5bf821266cf1cadbfd6010b72f8f40f4a836df509c5a9b4449972a45181ba68fb85a532a6218545edef5d5317738644317ba19a41026a0a01752bae5f62927d19bcadf30c7f3903216e808ae5bca9bf681c97474ee599c8e23be6e4496007d80493ba52ffafa8c503713e8d286008a26e666824f7a5797c1218d6b30cb5cc3026525f0cc668be8fa922b3a276c789933e72b02cb1721b22e238f373b04a7e600234b82ad45c7dd91133eaa8ddd56d617efe75131216fa65f985cc0e4fb9972cf06cb34030711a3788d3b87ba34b301c57b59ef623c911c8a39615f2e89884125a6329e70f9d9feb154170b0e767f571a0f81dd79a7543f8464e9597603b2601c8c2fc59aa7e4fdede15d7aa9052a814999b15adf4dc09e354d43c0aeb9b9e05d42e357d1253de15d586132aa08818f2dbd852ea6aaf3b8ea9231b18f231d62ce1afc5665f6c83d1a1716329876ea354cdfc653f599e9dfe6f8e9a1367b62e2349b98fab2719d63fc549dd03a2193876acf7fd3bdd546f71d3bdc7b5a9835cc2646c0f95256812911c8ae82efc190f9f38cc6b8f98a1a49770bbdcce640fc3e475def040a70722f298dabba5c67c26499d747000962266735594915ea37b2d3ea1d71fc72b683892891817d41d8bd537dcbe371065dea2ad7a4aa98fd06589d08b33b15e219df0f7eda5da3d943baf194e4001ea2fa843afc5c1eccf0a1686971da6fff0dd63d0eb8e27eaf5a33487c0baaf1653943b6c10d8b10020ae2ed2db67239bee832e5962824aef519fc1c6b1b7eb64331f50cccef5534e0b1ebcd71783bd46a32435f77982ef586a71b3428c540ca4e9e92dde5383f4554b04b6cb79144f0ecb0e764b5cd5709a0d0b5cc579a6b7af9870d0ce1ad838ee2e845d8233fc522aa35d63995d603011de2830c88e3d050751989073130647394891"}, 0x418, 0x7}) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f0000000240)={0x48}) 1.770157049s ago: executing program 4 (id=1053): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) close(r0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) listen(r1, 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x8000, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r2, 0x3b88, &(0x7f00000000c0)={0xc, r3}) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r4, 0x8946, &(0x7f0000000100)) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) syz_open_dev$ndb(&(0x7f0000000300), 0x0, 0x128400) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r5}) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r2, 0x3b70, &(0x7f0000000240)={0x28}) 1.680674888s ago: executing program 1 (id=1054): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='attr\x00') fchdir(r2) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x90) getdents(r3, &(0x7f0000001000)=""/4096, 0x1000) getdents(r3, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYRES16=r3], 0x0}, 0x0) r4 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r5 = socket$kcm(0x10, 0x2, 0x4) r6 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x8, 0x50, 0x2, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x0, 0xc2, 0x8, 0x6e}}, [{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x2, 0x4, 0xb}}]}}}]}}]}}, &(0x7f0000000200)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x110, 0xa4, 0xa7, 0x5, 0x70, 0x7f}, 0x2b, &(0x7f0000000140)={0x5, 0xf, 0x2b, 0x1, [@generic={0x26, 0x10, 0xb, "89977cf19c75e956becec2d2015aabb193f37fb81be567f17d2cac5657f19a34c5f2a3"}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x40f}}, {0x91, &(0x7f0000000380)=@string={0x91, 0x3, "40cc4fdeaa92a6168f4bcc79766b2803ffbbe3db4749acb60c9f9770932e07edf9d9c41300795074f812d22b8cec42c313cf4a2c5b569a7cd37a9d6e8ba162e7e94eb3d34e654c07ae180c849f033bc2bff1cb916b9e886f4fccc420570a7f3bdbe46035593f28a5b0372eb64c8dd86808d6b6320ffbe8b2f71462343310abba5dc2e520c2746a826f28b2b2101485"}}]}) syz_usb_control_io$printer(r6, &(0x7f0000000300)={0x14, &(0x7f0000000240)={0x0, 0x3, 0x10, {0x10, 0xf, "6e66e0f24965c32084469499b07d"}}, &(0x7f00000002c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x4c0a}}}, &(0x7f0000000780)={0x34, &(0x7f0000000580)={0x40, 0x2, 0xde, "d91bd49f750368f0f527ea4016989d3c7cabe2f159a9e8b81b6be9b3d19b313d003788cbca40a1cfb048f30f8958930c62033458997d2f4bf976744d6c2da20c9c92872abf7e3f6f62e6a1d904d3731eca432f178e9722299ee5ec1952e94a8be9b7cb6e1cd266defc08e1620ed1de0ddafd390d894f0781b65fb100e3a045f54114352bf98cc7c314194f09ae340325797c034df10cacec558ba79df6a91387c1fbee1e510e4a8329b2693472a630eb2ca66bf123ef2145122b3feebe3574bf721adce101546c6651c5c7264c9dbf308bfecfa016186326ff2ca0db4a66"}, &(0x7f0000000480)={0x0, 0xa, 0x1, 0x8}, &(0x7f00000004c0)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000680)={0x20, 0x0, 0x97, {0x95, "c3c03d1a5120aaa2de21f9f5fa36f2d5d6718687a07b14f7bdca131c12909c956e8af600fdaad0ef1808ae7bb777805a0fadfada6a496c434a2d672d5c95243570daff4c5d42069d5cbb22d2ad37d10cf9de4475c654497d0c686bc2a6e328b56ba8a8b494ab2873de0f6f270ae5629c5064ba402c85d65d5af42af9909dac466903a7ce1fbdeb497fbc36eea216280174fcbf6294"}}, &(0x7f0000000500)={0x20, 0x1, 0x1, 0x9}, &(0x7f0000000740)={0x20, 0x0, 0x1, 0x5}}) r7 = socket(0x1e, 0x1, 0x7) syz_clone3(&(0x7f0000000800)={0x4004000, 0x0, 0x0, 0x0, {0x23}, 0x0, 0x0, 0x0, 0x0}, 0x58) r8 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SNDCTL_DSP_SETFMT(r8, 0xc0045005, &(0x7f0000000440)=0x1000) ioctl$SNDCTL_DSP_SYNC(r8, 0x5001, 0x0) connect$inet(r7, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r7, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r7, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) close_range(r5, 0xffffffffffffffff, 0x0) ioctl$HIDIOCGUCODE(r4, 0xc018480d, &(0x7f00000011c0)={0x3, 0x100, 0x300, 0x8000005, 0x590f, 0x9}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x45809000) 929.23224ms ago: executing program 2 (id=1055): mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x1200051, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000a40)=ANY=[@ANYBLOB="44010000100001000000000000000000fe8000000000000000000000000000bbac1414bb0000000000000000000000000000fff920000001000000003b000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ffffffff000000000000000000000000000000006c000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000fdffffffffffffff04000000000000007f0e000000000000020000000000000004000000000000000000004000000000000000000000000000000002000000000000000025bd7000000000000a0000010000000000000000480003006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001c"], 0x144}, 0x1, 0x0, 0x0, 0x44}, 0x4810) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) r2 = getpgid(0xffffffffffffffff) write$cgroup_pid(r1, &(0x7f00000001c0)=r2, 0x12) write$binfmt_script(r1, &(0x7f00000004c0), 0x208e24b) mmap(&(0x7f0000453000/0x4000)=nil, 0x4000, 0x200000a, 0x118811, r1, 0xe985e000) cachestat(r1, &(0x7f0000000040), &(0x7f0000000080), 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000006c0), r3) sendmsg$NLBL_MGMT_C_REMOVE(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000700)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="f9002dbd7000fcdbdf2502002000050001"], 0x1c}, 0x1, 0x0, 0x0, 0x20008011}, 0x10) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$uac1(r5, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x0, 0x0, 0x3, 'Yf\''}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)={0x20, 0x1, 0x34, "712bab"}, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000001300)={0x84, &(0x7f0000000e40)={0x0, 0x0, 0x3, "0b3b81"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x20, 0x1, 0x3, "a343ed"}, 0xfffffffffffffffd}) sendto$unix(r1, &(0x7f00000000c0)="83b577842160efa76390ce556cdc59d52aadb4ccda33b76d03ee267decda907fe683353f9e2d4dc68e0c4d4321f7a9aba65f32bf4e814886c8a519941b47046e385cfab00acb70306fe5edcf3441f9", 0x4f, 0x4004800, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) 838.161911ms ago: executing program 4 (id=1056): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000200)={'tunl0\x00', &(0x7f00000002c0)=@ethtool_cmd={0x9, 0x4, 0xfffffffc, 0xfffe, 0x0, 0x4, 0xfc, 0xfa, 0x3, 0x9, 0x7, 0x400, 0xfffe, 0x0, 0x0, 0x40000045, [0x2000]}}) 709.296361ms ago: executing program 4 (id=1057): syz_usb_connect(0x2, 0x2d, &(0x7f0000000800)={{0x12, 0x1, 0x201, 0xc0, 0x5f, 0x56, 0x8, 0x582, 0x120, 0x9ccd, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x2, 0xb, 0xb, 0x60, 0x9, [{{0x9, 0x4, 0x10, 0x9, 0x0, 0x80, 0xc, 0x4c, 0x3}}, {{0x9, 0x4, 0x3, 0x5, 0x0, 0x90, 0xc6, 0xa1, 0xe0}}]}}]}}, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={0x0, 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[], 0x70}}, 0x0) sendmmsg(r1, &(0x7f0000000180), 0x3ef, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000000)="02fbff008600000000003271a5bf00", 0x10) getsockopt$inet_tcp_buf(r2, 0x6, 0x21, 0x0, &(0x7f0000000100)) ioctl$sock_SIOCETHTOOL(r0, 0x89f1, &(0x7f0000000200)={'tunl0\x00', &(0x7f00000002c0)=@ethtool_cmd={0x9, 0x4, 0xfffffffc, 0xfffe, 0x0, 0x4, 0xfc, 0xfa, 0x3, 0x9, 0x7, 0x400, 0xfffe, 0x0, 0x0, 0x40000045, [0x2000]}}) 32.746315ms ago: executing program 0 (id=1058): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x18d2c1, 0x0) mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0xb, 0x202812, r0, 0x7dfff000) 32.346751ms ago: executing program 1 (id=1059): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') move_mount(r0, 0x0, r0, &(0x7f0000000080)='./mnt\x00', 0x214) ioctl$SIOCAX25CTLCON(r0, 0x89e8, &(0x7f0000000080)={@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x3, 0xfffffffffffffffe, 0x7, [@default, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4040}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x804) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000408c0d220000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000740)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="00000001000000090090"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000400)={0x24, &(0x7f0000000200)={0x0, 0x22, 0x82, {0x82, 0xf, "4271e96383ab95aa22473ca1acbb65b330fa90b59e74b55277c7554422008a24953187ab031ff065c3b0f9abd48236b69ba4bc2d9ccac8460f645ad0da96df2e2f3a57e466248f6e16f286349586ea75845b412cff29241f5f1ad252ec7bb31b73816893c975465e9db10a3de05e95667c3aed39af7b79063cc4c814b0922e10"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x429}}, &(0x7f00000002c0)={0x0, 0x22, 0x17, {[@main=@item_012={0x2, 0x0, 0x8, "9b84"}, @local=@item_012={0x1, 0x2, 0x2, "9a"}, @local=@item_012={0x2, 0x2, 0xa, "e0bb"}, @main=@item_4={0x3, 0x0, 0x3, "8a25a470"}, @local=@item_4={0x3, 0x2, 0x8, "21843bdd"}, @global=@item_012={0x2, 0x1, 0x6, "4abd"}, @global=@item_012={0x1, 0x1, 0x5, 'j'}]}}, &(0x7f00000003c0)={0x0, 0x21, 0x9, {0x9, 0x21, 0x8, 0x5, 0x1, {0x22, 0xf2}}}}, &(0x7f0000000640)={0x2c, &(0x7f0000000440)={0x20, 0x14, 0x8f, "c759b5682f9a30ebd1629aa3d6d3f0ff3503e2b8fb862cd4954e2b546e79635a41d965d3767dd97bf551c38dec69e22e5ad044348f91d620609b02276c9df670009c007069fbc97b4a956a4efdd1056d8426337211fae306f6a7478d85aae3f8f8d3fe7501c213394087568fa22a1bb02272a087b22ecdce560aa1ef5cddbf1c42467a28d55d6137e1220008f0475e"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000540)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000580)={0x20, 0x1, 0x4f, "e2b23583f95da3479b11086e7cdcc2535c26648de862b3d55c77208c2cf8b37bacfe05ad1de9dd15eb6c8ab1361b565b0aeb6e4279ca94a65f9f3fb3ef3b1e7ef83281fbeb3e8222742ef543ec70a3"}, &(0x7f0000000600)={0x20, 0x3, 0x1, 0x3}}) syz_usb_control_io(r1, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000001a80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x4) ioctl$FS_IOC_GETVERSION(r2, 0x5b14, &(0x7f0000000040)) 0s ago: executing program 0 (id=1060): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa02, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TCSETSF(r3, 0x5404, &(0x7f0000000040)={0x6, 0x1, 0x80000000, 0x0, 0x16, "2526be2b200000000000000300"}) ioctl$TIOCL_PASTESEL(r3, 0x541c, &(0x7f0000000000)) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f00000001c0)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000000)={r4, 0x7}, 0x8) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000100)={0x1d, r5}, 0x18) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f00000047c0)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="180000007a000106"], 0x18}], 0x1}, 0x0) connect$can_j1939(r1, &(0x7f0000000140)={0x1d, r5, 0x0, {0x0, 0x0, 0x2}, 0xff}, 0x18) socket$inet6_mptcp(0xa, 0x1, 0x106) mmap(&(0x7f00007fd000/0x3000)=nil, 0x3000, 0x3000001, 0x810, r0, 0xd0966000) ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000040)='ocfs2\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r7 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r8 = open(&(0x7f0000000000)='.\x00', 0x0, 0x244) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r7, 0xc0189379, &(0x7f0000000200)={{0x1, 0x1, 0x18, r8}, './file2\x00'}) ioctl$DRM_IOCTL_IRQ_BUSID(r8, 0xc0106403, &(0x7f0000000180)={0x0, 0x4, 0x7, 0x2}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r8, 0x9360, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r9, 0xc0845657, &(0x7f0000000440)={0x0, @reserved}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) mlock2(&(0x7f00002e5000/0xc00000)=nil, 0xc00000, 0x0) kernel console output (not intermixed with test programs): t: 8 [ 170.930005][ T10] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 170.949625][ T10] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 170.969665][ T10] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 170.979862][ T10] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 170.984062][ T7925] 9pnet: Could not find request transport: xen [ 171.000014][ T10] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 171.017231][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.165024][ T7934] syz.0.654: attempt to access beyond end of device [ 171.165024][ T7934] nbd0: rw=0, sector=2, nr_sectors = 1 limit=0 [ 171.178231][ T7934] hfs: can't find a HFS filesystem on dev nbd0 [ 171.249165][ T10] usb 2-1: GET_CAPABILITIES returned 0 [ 171.258203][ T10] usbtmc 2-1:16.0: can't read capabilities [ 171.365754][ T7940] exFAT-fs (rnullb0): invalid boot record signature [ 171.372497][ T7940] exFAT-fs (rnullb0): failed to read boot sector [ 171.380125][ T7940] exFAT-fs (rnullb0): failed to recognize exfat type [ 171.460675][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 171.501431][ T10] usb 2-1: USB disconnect, device number 35 [ 171.695456][ T7953] FAULT_INJECTION: forcing a failure. [ 171.695456][ T7953] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 171.712914][ T7953] CPU: 0 UID: 0 PID: 7953 Comm: syz.2.658 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 171.712943][ T7953] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 171.712955][ T7953] Call Trace: [ 171.712963][ T7953] [ 171.712971][ T7953] dump_stack_lvl+0x189/0x250 [ 171.712998][ T7953] ? __pfx____ratelimit+0x10/0x10 [ 171.713028][ T7953] ? __pfx_dump_stack_lvl+0x10/0x10 [ 171.713050][ T7953] ? __pfx__printk+0x10/0x10 [ 171.713080][ T7953] should_fail_ex+0x414/0x560 [ 171.713110][ T7953] _copy_to_user+0x31/0xb0 [ 171.713130][ T7953] simple_read_from_buffer+0xe1/0x170 [ 171.713157][ T7953] proc_fail_nth_read+0x1df/0x250 [ 171.713186][ T7953] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 171.713215][ T7953] ? rw_verify_area+0x258/0x650 [ 171.713235][ T7953] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 171.713262][ T7953] vfs_read+0x1fd/0x980 [ 171.713289][ T7953] ? __pfx___mutex_lock+0x10/0x10 [ 171.713308][ T7953] ? __pfx_vfs_read+0x10/0x10 [ 171.713331][ T7953] ? __fget_files+0x2a/0x420 [ 171.713360][ T7953] ? __fget_files+0x3a0/0x420 [ 171.713382][ T7953] ? __fget_files+0x2a/0x420 [ 171.713414][ T7953] ksys_read+0x145/0x250 [ 171.713433][ T7953] ? __fget_files+0x3a0/0x420 [ 171.713457][ T7953] ? __pfx_ksys_read+0x10/0x10 [ 171.713485][ T7953] ? do_syscall_64+0xbe/0x3b0 [ 171.713508][ T7953] do_syscall_64+0xfa/0x3b0 [ 171.713524][ T7953] ? lockdep_hardirqs_on+0x9c/0x150 [ 171.713550][ T7953] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.713569][ T7953] ? clear_bhb_loop+0x60/0xb0 [ 171.713590][ T7953] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.713608][ T7953] RIP: 0033:0x7f987318d33c [ 171.713626][ T7953] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 171.713643][ T7953] RSP: 002b:00007f98740aa030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 171.713663][ T7953] RAX: ffffffffffffffda RBX: 00007f98733b5fa0 RCX: 00007f987318d33c [ 171.713677][ T7953] RDX: 000000000000000f RSI: 00007f98740aa0a0 RDI: 0000000000000005 [ 171.713689][ T7953] RBP: 00007f98740aa090 R08: 0000000000000000 R09: 0000000000000000 [ 171.713700][ T7953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 171.713712][ T7953] R13: 0000000000000000 R14: 00007f98733b5fa0 R15: 00007fff20fa3ef8 [ 171.713742][ T7953] [ 172.403974][ T5973] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 172.423975][ T5980] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 172.564804][ T5973] usb 4-1: Using ep0 maxpacket: 32 [ 172.571748][ T5973] usb 4-1: config 0 has an invalid interface number: 247 but max is 0 [ 172.583042][ T5980] usb 3-1: Using ep0 maxpacket: 8 [ 172.595128][ T5973] usb 4-1: config 0 has no interface number 0 [ 172.605931][ T5980] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 172.624095][ T5980] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 172.644082][ T5973] usb 4-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 172.653147][ T5973] usb 4-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 172.661208][ T5980] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 172.683965][ T5980] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 172.703771][ T5973] usb 4-1: Product: syz [ 172.708603][ T5973] usb 4-1: Manufacturer: syz [ 172.722883][ T5980] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 172.733436][ T5973] usb 4-1: config 0 descriptor?? [ 172.754841][ T5980] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 172.936549][ T8000] FAULT_INJECTION: forcing a failure. [ 172.936549][ T8000] name failslab, interval 1, probability 0, space 0, times 0 [ 172.950828][ T8000] CPU: 0 UID: 0 PID: 8000 Comm: syz.1.667 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 172.950857][ T8000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 172.950870][ T8000] Call Trace: [ 172.950878][ T8000] [ 172.950886][ T8000] dump_stack_lvl+0x189/0x250 [ 172.950913][ T8000] ? __pfx____ratelimit+0x10/0x10 [ 172.950942][ T8000] ? __pfx_dump_stack_lvl+0x10/0x10 [ 172.950964][ T8000] ? __pfx__printk+0x10/0x10 [ 172.950991][ T8000] ? __pfx___might_resched+0x10/0x10 [ 172.951011][ T8000] ? fs_reclaim_acquire+0x7d/0x100 [ 172.951040][ T8000] should_fail_ex+0x414/0x560 [ 172.951075][ T8000] should_failslab+0xa8/0x100 [ 172.951097][ T8000] __kmalloc_noprof+0xcb/0x4f0 [ 172.951115][ T8000] ? kfree+0x4d/0x440 [ 172.951128][ T8000] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 172.951156][ T8000] tomoyo_realpath_from_path+0xe3/0x5d0 [ 172.951182][ T8000] ? tomoyo_domain+0xd9/0x130 [ 172.951212][ T8000] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 172.951233][ T8000] tomoyo_path_number_perm+0x1e8/0x5a0 [ 172.951256][ T8000] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 172.951295][ T8000] ? __lock_acquire+0xab9/0xd20 [ 172.951344][ T8000] ? __fget_files+0x2a/0x420 [ 172.951373][ T8000] ? __fget_files+0x2a/0x420 [ 172.951396][ T8000] ? __fget_files+0x3a0/0x420 [ 172.951420][ T8000] ? __fget_files+0x2a/0x420 [ 172.951448][ T8000] security_file_ioctl+0xcb/0x2d0 [ 172.951469][ T8000] __se_sys_ioctl+0x47/0x170 [ 172.951492][ T8000] do_syscall_64+0xfa/0x3b0 [ 172.951509][ T8000] ? lockdep_hardirqs_on+0x9c/0x150 [ 172.951537][ T8000] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.951556][ T8000] ? clear_bhb_loop+0x60/0xb0 [ 172.951579][ T8000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 172.951598][ T8000] RIP: 0033:0x7f2d5818e929 [ 172.951615][ T8000] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 172.951632][ T8000] RSP: 002b:00007f2d58fc7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 172.951653][ T8000] RAX: ffffffffffffffda RBX: 00007f2d583b5fa0 RCX: 00007f2d5818e929 [ 172.951667][ T8000] RDX: 0000200000000240 RSI: 0000000000003b70 RDI: 0000000000000003 [ 172.951681][ T8000] RBP: 00007f2d58fc7090 R08: 0000000000000000 R09: 0000000000000000 [ 172.951699][ T8000] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 172.951710][ T8000] R13: 0000000000000000 R14: 00007f2d583b5fa0 R15: 00007ffe3046cde8 [ 172.951740][ T8000] [ 172.951748][ T8000] ERROR: Out of memory at tomoyo_realpath_from_path. [ 173.010994][ T5980] usb 3-1: usb_control_msg returned -71 [ 173.230199][ T5980] usbtmc 3-1:16.0: can't read capabilities [ 173.257925][ T5980] usb 3-1: USB disconnect, device number 45 [ 173.294473][ T5896] usb 4-1: USB disconnect, device number 35 [ 173.574105][ T10] usb 2-1: new full-speed USB device number 36 using dummy_hcd [ 173.736391][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 173.753817][ T10] usb 2-1: can't read configurations, error -61 [ 173.894145][ T10] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 174.079927][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 174.087774][ T5896] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 174.096515][ T10] usb 2-1: can't read configurations, error -61 [ 174.105653][ T10] usb usb2-port1: attempt power cycle [ 174.264929][ T5896] usb 3-1: Using ep0 maxpacket: 8 [ 174.272245][ T5896] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 174.282495][ T5896] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 174.298374][ T5896] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 174.308630][ T5896] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 174.324839][ T5896] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 174.334198][ T5896] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 174.454215][ T10] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 174.490887][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 174.499030][ T10] usb 2-1: can't read configurations, error -61 [ 174.547822][ T5896] usb 3-1: GET_CAPABILITIES returned 0 [ 174.553459][ T5896] usbtmc 3-1:16.0: can't read capabilities [ 174.554050][ T5980] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 174.602157][ T8056] vxfs: WRONG superblock magic 00000000 at 1 [ 174.613016][ T8056] vxfs: WRONG superblock magic 00000000 at 8 [ 174.619459][ T8056] vxfs: can't find superblock. [ 174.634042][ T10] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 174.656740][ T10] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 174.667702][ T10] usb 2-1: can't read configurations, error -61 [ 174.674838][ T10] usb usb2-port1: unable to enumerate USB device [ 174.745495][ T5980] usb 4-1: Using ep0 maxpacket: 8 [ 174.753207][ C1] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 174.769111][ T5973] usb 3-1: USB disconnect, device number 46 [ 174.786462][ T5980] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 174.804223][ T5980] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 174.825859][ T5980] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 174.841203][ T5980] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 174.858259][ T5980] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 174.867675][ T5980] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.088543][ T5980] usb 4-1: usb_control_msg returned -71 [ 175.094943][ T5980] usbtmc 4-1:16.0: can't read capabilities [ 175.111749][ T5980] usb 4-1: USB disconnect, device number 36 [ 175.771702][ T8081] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 175.778644][ T8081] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 175.994008][ T10] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 176.063977][ T5980] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 176.167473][ T10] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 176.176606][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.187402][ T10] usb 4-1: config 0 descriptor?? [ 176.199205][ T10] cp210x 4-1:0.0: cp210x converter detected [ 176.219270][ T5980] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 176.228849][ T5980] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.238104][ T5980] usb 3-1: Product: syz [ 176.242426][ T5980] usb 3-1: Manufacturer: syz [ 176.248974][ T5980] usb 3-1: SerialNumber: syz [ 176.256682][ T5980] usb 3-1: config 0 descriptor?? [ 176.412327][ T10] cp210x 4-1:0.0: failed to get vendor val 0x0010 size 3: -71 [ 176.428220][ T10] cp210x 4-1:0.0: failed to get vendor val 0x000e size 678: -71 [ 176.436411][ T10] cp210x 4-1:0.0: GPIO initialisation failed: -71 [ 176.455400][ T10] usb 4-1: cp210x converter now attached to ttyUSB0 [ 176.476904][ T10] usb 4-1: USB disconnect, device number 37 [ 176.490062][ T10] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 176.499792][ T10] cp210x 4-1:0.0: device disconnected [ 176.574062][ T5973] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 176.677107][ T5980] usb 3-1: Firmware: major: 0, minor: 0, hardware type: ATUSB (0) [ 176.685401][ T5980] usb 3-1: Firmware version (0.0) predates our first public release. [ 176.693476][ T5980] usb 3-1: Please update to version 0.2 or newer [ 176.744064][ T5973] usb 2-1: Using ep0 maxpacket: 8 [ 176.750620][ T5973] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 176.761523][ T5973] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 176.771816][ T5973] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 176.781824][ T5973] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 176.795176][ T5973] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 176.804265][ T5973] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 176.879641][ T8083] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.888509][ T8083] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.974011][ T24] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 177.017071][ T5973] usb 2-1: GET_CAPABILITIES returned 0 [ 177.022597][ T5973] usbtmc 2-1:16.0: can't read capabilities [ 177.124029][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 177.132239][ T24] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 177.142033][ T24] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 177.151952][ T24] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 177.161915][ T24] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 177.174952][ T24] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 177.184116][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.219304][ T5973] usb 2-1: USB disconnect, device number 40 [ 177.401939][ T24] usb 4-1: usb_control_msg returned -71 [ 177.413554][ T24] usbtmc 4-1:16.0: can't read capabilities [ 177.429616][ T24] usb 4-1: USB disconnect, device number 38 [ 177.530820][ T5980] usb 3-1: USB disconnect, device number 47 [ 178.290803][ T8124] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 178.298769][ T8124] VFS: Can't find a romfs filesystem on dev rnullb0. [ 178.298769][ T8124] [ 178.424402][ T5980] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 178.584526][ T5980] usb 2-1: Using ep0 maxpacket: 8 [ 178.593125][ T5980] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 178.613970][ T5980] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 178.623715][ T5980] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 178.634058][ T5980] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 178.650524][ T5980] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 178.660006][ T5980] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 178.856703][ T8141] binder: 8140:8141 ioctl 80489439 200000000080 returned -22 [ 178.858881][ T8142] binder: 8140:8142 ioctl 80489439 200000000080 returned -22 [ 178.885616][ T5980] usb 2-1: GET_CAPABILITIES returned 0 [ 178.891098][ T5980] usbtmc 2-1:16.0: can't read capabilities [ 179.001435][ T8145] hfs: can't find a HFS filesystem on dev rnullb0 [ 179.039273][ T8147] qnx4: no qnx4 filesystem (no root dir). [ 179.048451][ T8148] qnx4: no qnx4 filesystem (no root dir). [ 179.098783][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.104046][ T24] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 179.107893][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.124735][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.133791][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.150764][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.159864][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.168936][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.178011][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.191636][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.200739][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.209827][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.218909][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.231775][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.241477][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.250575][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.259655][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 179.275457][ T10] usb 2-1: USB disconnect, device number 41 [ 179.297603][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 179.316755][ T24] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 179.336092][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.354401][ T24] usb 3-1: Product: syz [ 179.358594][ T24] usb 3-1: Manufacturer: syz [ 179.363187][ T24] usb 3-1: SerialNumber: syz [ 179.378249][ T8161] syz.3.713: attempt to access beyond end of device [ 179.378249][ T8161] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 179.414994][ T8161] syz.3.713: attempt to access beyond end of device [ 179.414994][ T8161] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 179.440158][ T8161] syz.3.713: attempt to access beyond end of device [ 179.440158][ T8161] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 179.460704][ T8161] syz.3.713: attempt to access beyond end of device [ 179.460704][ T8161] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 179.504958][ T8161] syz.3.713: attempt to access beyond end of device [ 179.504958][ T8161] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 179.524845][ T8161] syz.3.713: attempt to access beyond end of device [ 179.524845][ T8161] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 179.567137][ T8161] syz.3.713: attempt to access beyond end of device [ 179.567137][ T8161] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 179.584840][ T8161] syz.3.713: attempt to access beyond end of device [ 179.584840][ T8161] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 179.594877][ T24] cdc_ncm 3-1:1.0: bind() failure [ 179.616441][ T24] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 179.623377][ T24] cdc_ncm 3-1:1.1: bind() failure [ 179.635066][ T8161] syz.3.713: attempt to access beyond end of device [ 179.635066][ T8161] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 179.641232][ T24] usb 3-1: USB disconnect, device number 48 [ 179.662093][ T8161] syz.3.713: attempt to access beyond end of device [ 179.662093][ T8161] nbd3: rw=0, sector=0, nr_sectors = 2 limit=0 [ 180.250941][ T8182] random: crng reseeded on system resumption [ 180.446928][ T8189] /dev/rnullb0: Can't open blockdev [ 180.455115][ T30] audit: type=1326 audit(1750812344.137:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8188 comm="syz.1.725" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f2d5818e929 code=0x0 [ 180.534007][ T24] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 180.684073][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 180.690844][ T24] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 180.701152][ T24] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 180.712320][ T24] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 180.721542][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.729636][ T24] usb 3-1: Product: syz [ 180.733991][ T24] usb 3-1: Manufacturer: syz [ 180.738624][ T24] usb 3-1: SerialNumber: syz [ 181.151239][ T24] usb 3-1: cannot find UAC_HEADER [ 181.172550][ T24] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 181.205316][ T6008] udevd[6008]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 181.430722][ T5896] usb 3-1: USB disconnect, device number 49 [ 181.584143][ T10] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 181.645551][ T6219] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.734139][ T10] usb 2-1: device descriptor read/64, error -71 [ 181.756156][ T6219] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.847355][ T6219] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.923747][ T5896] IPVS: starting estimator thread 0... [ 181.932482][ T8202] IPVS: set_ctl: invalid protocol: 43 172.30.253.1:20001 [ 181.953474][ T6219] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.994054][ T10] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 182.024211][ T8201] IPVS: using max 25 ests per chain, 60000 per kthread [ 182.145716][ T10] usb 2-1: device descriptor read/64, error -71 [ 182.168150][ T6219] bridge_slave_1: left allmulticast mode [ 182.190344][ T6219] bridge_slave_1: left promiscuous mode [ 182.204408][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 182.213190][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 182.228890][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 182.245292][ T6219] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.256229][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 182.266548][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 182.274591][ T10] usb usb2-port1: attempt power cycle [ 182.300292][ T5841] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 182.308483][ T5841] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 182.316542][ T5841] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 182.330983][ T6219] bridge_slave_0: left allmulticast mode [ 182.340101][ T5841] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 182.360255][ T6219] bridge_slave_0: left promiscuous mode [ 182.366987][ T5841] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 182.393221][ T6219] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.636457][ T10] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 182.656846][ T8222] __vm_enough_memory: pid: 8222, comm: syz.2.737, bytes: 21200638177280 not enough memory for the allocation [ 182.677421][ T10] usb 2-1: device descriptor read/8, error -71 [ 182.937634][ T10] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 182.968408][ T10] usb 2-1: device descriptor read/8, error -71 [ 183.076097][ T6219] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 183.087974][ T6219] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 183.098024][ T6219] bond0 (unregistering): Released all slaves [ 183.105793][ T10] usb usb2-port1: unable to enumerate USB device [ 183.360218][ T8242] hpfs: Bad magic ... probably not HPFS [ 183.502964][ T8250] hfs: can't find a HFS filesystem on dev rnullb0 [ 183.693985][ T6219] hsr_slave_0: left promiscuous mode [ 183.722257][ T6219] hsr_slave_1: left promiscuous mode [ 183.733768][ T6219] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 183.741966][ T6219] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 183.762706][ T6219] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 183.783994][ T6219] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 183.890685][ T6219] veth1_macvtap: left promiscuous mode [ 183.907189][ T6219] veth0_macvtap: left promiscuous mode [ 183.912920][ T6219] veth1_vlan: left promiscuous mode [ 183.937609][ T6219] veth0_vlan: left promiscuous mode [ 183.978655][ T8268] program syz.2.744 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 183.998373][ T8268] gfs2: not a GFS2 filesystem [ 184.444194][ T5841] Bluetooth: hci3: command tx timeout [ 184.491110][ T8273] omfs: Invalid superblock (0) [ 184.693832][ T6219] team0 (unregistering): Port device team_slave_1 removed [ 184.783537][ T6219] team0 (unregistering): Port device team_slave_0 removed [ 184.875332][ T5889] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 185.049744][ T5889] usb 2-1: not running at top speed; connect to a high speed hub [ 185.059700][ T5889] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 185.091134][ T5889] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 185.102875][ T5889] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 185.115879][ T5889] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.126049][ T5889] usb 2-1: Product: syz [ 185.130226][ T5889] usb 2-1: Manufacturer: syz [ 185.137412][ T5889] usb 2-1: SerialNumber: syz [ 185.363036][ T5889] usb 2-1: 0:2 : does not exist [ 185.392263][ T5889] usb 2-1: USB disconnect, device number 46 [ 185.450401][ T6008] udevd[6008]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 185.605652][ T8208] chnl_net:caif_netlink_parms(): no params data found [ 185.957518][ T8208] bridge0: port 1(bridge_slave_0) entered blocking state [ 185.957604][ T8208] bridge0: port 1(bridge_slave_0) entered disabled state [ 185.957742][ T8208] bridge_slave_0: entered allmulticast mode [ 185.960737][ T8208] bridge_slave_0: entered promiscuous mode [ 185.984158][ T8208] bridge0: port 2(bridge_slave_1) entered blocking state [ 185.984278][ T8208] bridge0: port 2(bridge_slave_1) entered disabled state [ 185.984452][ T8208] bridge_slave_1: entered allmulticast mode [ 185.988541][ T8208] bridge_slave_1: entered promiscuous mode [ 186.156998][ T8208] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 186.209626][ T8208] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 186.395877][ T8208] team0: Port device team_slave_0 added [ 186.427416][ T8208] team0: Port device team_slave_1 added [ 186.526544][ T5841] Bluetooth: hci3: command tx timeout [ 186.627767][ T8208] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 186.657902][ T8208] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 186.715693][ T8208] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 186.736020][ T8208] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 186.748807][ T8208] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 186.763155][ T8307] loop6: detected capacity change from 0 to 524287487 [ 186.783587][ T8208] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 186.811440][ T8307] buffer_io_error: 14 callbacks suppressed [ 186.811458][ T8307] Buffer I/O error on dev loop6, logical block 0, async page read [ 186.907059][ T8310] loop6: detected capacity change from 524287487 to 0 [ 186.907070][ T8307] Buffer I/O error on dev loop6, logical block 0, async page read [ 186.907205][ T8307] ldm_validate_partition_table(): Disk read failed. [ 186.916741][ T8208] hsr_slave_0: entered promiscuous mode [ 186.958509][ T8307] Dev loop6: unable to read RDB block 0 [ 186.962274][ T8208] hsr_slave_1: entered promiscuous mode [ 186.978665][ T8208] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 186.980114][ T8307] loop6: unable to read partition table [ 186.998751][ T8208] Cannot create hsr debugfs directory [ 187.020192][ T8307] loop6: partition table beyond EOD, truncated [ 187.051423][ T8307] loop_reread_partitions: partition scan of loop6 (^L A;b@֔:Bw<gnf. -ӑ.i >^.dDd) failed (rc=-5) [ 187.242845][ T8314] /dev/rnullb0: Can't open blockdev [ 187.620420][ T8329] /dev/nullb0: Can't open blockdev [ 187.816495][ T8208] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 187.848348][ T8208] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 187.873310][ T8208] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 187.912210][ T8208] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 188.202779][ T8208] 8021q: adding VLAN 0 to HW filter on device bond0 [ 188.258285][ T8208] 8021q: adding VLAN 0 to HW filter on device team0 [ 188.295797][ T6220] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.303001][ T6220] bridge0: port 1(bridge_slave_0) entered forwarding state [ 188.370090][ T6220] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.377304][ T6220] bridge0: port 2(bridge_slave_1) entered forwarding state [ 188.472449][ T8359] loop6: detected capacity change from 0 to 524287487 [ 188.490228][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 188.499513][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 188.517123][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 188.564726][ T8360] loop6: detected capacity change from 524287487 to 0 [ 188.571699][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 188.592646][ T6008] ldm_validate_partition_table(): Disk read failed. [ 188.604440][ T5841] Bluetooth: hci3: command tx timeout [ 188.608414][ T6008] Dev loop6: unable to read RDB block 0 [ 188.627494][ T6008] loop6: unable to read partition table [ 188.664275][ T6008] loop6: partition table beyond EOD, truncated [ 189.180396][ T8208] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 189.947622][ T8407] bio_check_eod: 23 callbacks suppressed [ 189.947639][ T8407] syz.1.770: attempt to access beyond end of device [ 189.947639][ T8407] loop1: rw=0, sector=2, nr_sectors = 1 limit=0 [ 189.969223][ T8208] veth0_vlan: entered promiscuous mode [ 190.007058][ T8208] veth1_vlan: entered promiscuous mode [ 190.033661][ T8410] loop6: detected capacity change from 0 to 524287487 [ 190.040910][ T8208] veth0_macvtap: entered promiscuous mode [ 190.053122][ T8208] veth1_macvtap: entered promiscuous mode [ 190.074584][ T8410] Buffer I/O error on dev loop6, logical block 0, async page read [ 190.128783][ T8208] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 190.136950][ T8414] netlink: 'syz.1.772': attribute type 1 has an invalid length. [ 190.147655][ T8411] loop6: detected capacity change from 524287487 to 0 [ 190.158737][ T8208] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 190.166269][ T8410] Buffer I/O error on dev loop6, logical block 0, async page read [ 190.174570][ T8414] netlink: 8 bytes leftover after parsing attributes in process `syz.1.772'. [ 190.184549][ T8410] ldm_validate_partition_table(): Disk read failed. [ 190.194439][ T8414] vxfs: WRONG superblock magic 00000000 at 1 [ 190.206810][ T8410] Dev loop6: unable to read RDB block 0 [ 190.213095][ T6220] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.213149][ T8414] vxfs: WRONG superblock magic 00000000 at 8 [ 190.229719][ T6219] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.240649][ T8410] loop6: unable to read partition table [ 190.251457][ T6219] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.260186][ T8414] vxfs: can't find superblock. [ 190.266675][ T8410] loop6: partition table beyond EOD, truncated [ 190.272883][ T8410] loop_reread_partitions: partition scan of loop6 (^L A;b@֔:Bw<gnf. -ӑ.i >^.dDd) failed (rc=-5) [ 190.291469][ T6219] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.487929][ T6220] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 190.524079][ T6220] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 190.605129][ T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 190.619144][ T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 190.620339][ T8423] netlink: 184 bytes leftover after parsing attributes in process `syz.1.776'. [ 190.674207][ T8425] UDF-fs: warning (device rnullb0): udf_load_vrs: No VRS found [ 190.684843][ T5841] Bluetooth: hci3: command tx timeout [ 190.702190][ T8425] UDF-fs: Scanning with blocksize 4096 failed [ 190.717829][ T8427] netlink: 18128 bytes leftover after parsing attributes in process `syz.2.777'. [ 190.908543][ T8435] syzkaller1: entered promiscuous mode [ 190.926337][ T8435] syzkaller1: entered allmulticast mode [ 191.054004][ T5980] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 191.184767][ T8449] loop6: detected capacity change from 0 to 524287487 [ 191.191683][ T5980] usb 3-1: device descriptor read/64, error -71 [ 191.203391][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 191.224152][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 191.242858][ T6008] ldm_validate_partition_table(): Disk read failed. [ 191.270401][ T8454] loop6: detected capacity change from 524287487 to 0 [ 191.270480][ T6008] Dev loop6: unable to read RDB block 0 [ 191.286365][ T6008] loop6: unable to read partition table [ 191.292245][ T6008] loop6: partition table beyond EOD, truncated [ 191.435977][ T5980] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 191.574003][ T5980] usb 3-1: device descriptor read/64, error -71 [ 191.584691][ T5876] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 191.685590][ T5980] usb usb3-port1: attempt power cycle [ 191.714005][ T5876] usb 5-1: device descriptor read/64, error -71 [ 191.956912][ T5876] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 192.034072][ T5980] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 192.072756][ T5980] usb 3-1: device descriptor read/8, error -71 [ 192.094166][ T5876] usb 5-1: device descriptor read/64, error -71 [ 192.206897][ T5876] usb usb5-port1: attempt power cycle [ 192.316538][ T5980] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 192.375583][ T5980] usb 3-1: device descriptor read/8, error -71 [ 192.412742][ T8481] netlink: 16 bytes leftover after parsing attributes in process `syz.1.785'. [ 192.494384][ T5980] usb usb3-port1: unable to enumerate USB device [ 192.575187][ T5876] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 192.633479][ T5876] usb 5-1: device descriptor read/8, error -71 [ 192.904653][ T5876] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 192.957805][ T5876] usb 5-1: device descriptor read/8, error -71 [ 193.084343][ T5876] usb usb5-port1: unable to enumerate USB device [ 193.313431][ T8516] vxfs: WRONG superblock magic 00000000 at 1 [ 193.320090][ T8516] vxfs: WRONG superblock magic 00000000 at 8 [ 193.327505][ T8516] vxfs: can't find superblock. [ 193.647378][ T10] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 193.805323][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 193.825828][ T10] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 193.845252][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.851161][ T8527] syzkaller1: entered promiscuous mode [ 193.853393][ T10] usb 2-1: Product: syz [ 193.867045][ T10] usb 2-1: Manufacturer: syz [ 193.871675][ T10] usb 2-1: SerialNumber: syz [ 193.874188][ T8527] syzkaller1: entered allmulticast mode [ 194.100506][ T10] cdc_ncm 2-1:1.0: bind() failure [ 194.133586][ T10] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 194.145983][ T10] cdc_ncm 2-1:1.1: bind() failure [ 194.176363][ T10] usb 2-1: USB disconnect, device number 47 [ 194.212468][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.228993][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.409768][ T8546] syzkaller1: entered promiscuous mode [ 194.415348][ T8546] syzkaller1: entered allmulticast mode [ 194.423578][ T8546] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 194.432318][ T8546] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 194.657338][ T8553] netlink: 48 bytes leftover after parsing attributes in process `syz.1.804'. [ 194.704014][ T5980] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 194.743234][ T8556] syzkaller1: entered promiscuous mode [ 194.751102][ T8556] syzkaller1: entered allmulticast mode [ 194.761891][ T8556] bad cache= option: none[()bvتr [ 194.761891][ T8556] ٟ 9;^d!/7u\ݴMDҏeYo P50eB>KX/TJ*)J()ՀKf5&Lqq2WhWd0 [ 194.761891][ T8556] [ 194.782970][ T8556] CIFS: VFS: bad cache= option: none[()bvتr [ 194.782970][ T8556] ٟ 9;^d!/7u\ݴMDҏeYo P50eB>KX/TJ*)J()ՀKf5&Lqq2WhWd0 [ 194.807023][ T8556] vxfs: WRONG superblock magic 00000000 at 1 [ 194.813175][ T8556] vxfs: WRONG superblock magic 00000000 at 8 [ 194.820659][ T8556] vxfs: can't find superblock. [ 194.846660][ T5973] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 194.876720][ T5980] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 194.887055][ T5980] usb 5-1: config 0 interface 0 has no altsetting 0 [ 194.895899][ T5980] usb 5-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 194.906073][ T5980] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.925052][ T5980] usb 5-1: Product: syz [ 194.929235][ T5980] usb 5-1: Manufacturer: syz [ 194.934237][ T5980] usb 5-1: SerialNumber: syz [ 194.950777][ T5980] usb 5-1: config 0 descriptor?? [ 194.963419][ T5980] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 194.985944][ T5980] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 194.998586][ T5980] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 195.008152][ T5973] usb 3-1: Using ep0 maxpacket: 32 [ 195.013422][ T5980] usb 5-1: media controller created [ 195.025349][ T5973] usb 3-1: config 0 has an invalid interface number: 247 but max is 0 [ 195.033533][ T5973] usb 3-1: config 0 has no interface number 0 [ 195.058643][ T5973] usb 3-1: New USB device found, idVendor=1d50, idProduct=60c6, bcdDevice=62.9b [ 195.070263][ T5973] usb 3-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 [ 195.091214][ T5980] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 195.099681][ T5973] usb 3-1: Product: syz [ 195.103852][ T5973] usb 3-1: Manufacturer: syz [ 195.116699][ T5973] usb 3-1: config 0 descriptor?? [ 195.187034][ T8542] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 195.224430][ T8542] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 195.238628][ T5980] DVB: Unable to find symbol tda10046_attach() [ 195.252296][ T5980] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 195.271227][ T5980] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 195.281347][ T5980] dvb_usb_m920x 5-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 195.293025][ T5980] usb 5-1: USB disconnect, device number 6 [ 195.579177][ T5896] usb 3-1: USB disconnect, device number 54 [ 195.684309][ T8581] loop6: detected capacity change from 0 to 524287487 [ 195.691738][ T8581] buffer_io_error: 7 callbacks suppressed [ 195.691752][ T8581] Buffer I/O error on dev loop6, logical block 0, async page read [ 195.708895][ T8581] Buffer I/O error on dev loop6, logical block 0, async page read [ 195.714217][ T849] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 195.716935][ T8581] Buffer I/O error on dev loop6, logical block 0, async page read [ 195.732911][ T8581] Buffer I/O error on dev loop6, logical block 0, async page read [ 195.741106][ T8581] Buffer I/O error on dev loop6, logical block 0, async page read [ 195.796281][ T8582] loop6: detected capacity change from 524287487 to 0 [ 195.803251][ T8581] Buffer I/O error on dev loop6, logical block 0, async page read [ 195.818788][ T8581] ldm_validate_partition_table(): Disk read failed. [ 195.826874][ T8581] Dev loop6: unable to read RDB block 0 [ 195.832465][ T8581] loop6: unable to read partition table [ 195.840086][ T8581] loop6: partition table beyond EOD, truncated [ 195.846766][ T8581] loop_reread_partitions: partition scan of loop6 (^L A;b@֔:Bw<gnf. -ӑ.i >^.dDd) failed (rc=-5) [ 195.899964][ T849] usb 2-1: Using ep0 maxpacket: 16 [ 195.909947][ T849] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 195.927825][ T849] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.946160][ T849] usb 2-1: Product: syz [ 195.954009][ T849] usb 2-1: Manufacturer: syz [ 195.965493][ T849] usb 2-1: SerialNumber: syz [ 196.209746][ T849] cdc_ncm 2-1:1.0: bind() failure [ 196.224695][ T8601] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 196.234885][ T8601] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 196.238474][ T849] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 196.249155][ T8601] vxfs: WRONG superblock magic 00000000 at 1 [ 196.266799][ T849] cdc_ncm 2-1:1.1: bind() failure [ 196.285791][ T8601] vxfs: WRONG superblock magic 00000000 at 8 [ 196.290236][ T849] usb 2-1: USB disconnect, device number 48 [ 196.298383][ T8601] vxfs: can't find superblock. [ 196.306036][ T8603] vxfs: WRONG superblock magic 00000000 at 1 [ 196.318624][ T8603] vxfs: WRONG superblock magic 00000000 at 8 [ 196.333994][ T8603] vxfs: can't find superblock. [ 196.419845][ C1] Unknown status report in ack skb [ 196.453980][ T5980] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 196.504860][ T8611] loop6: detected capacity change from 0 to 524287487 [ 196.513655][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 196.524133][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 196.532070][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 196.540447][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 196.549791][ T6008] ldm_validate_partition_table(): Disk read failed. [ 196.557143][ T6008] Dev loop6: unable to read RDB block 0 [ 196.604183][ T8613] loop6: detected capacity change from 524287487 to 0 [ 196.604425][ T5980] usb 3-1: device descriptor read/64, error -71 [ 196.617590][ T6008] loop6: unable to read partition table [ 196.627685][ T6008] loop6: partition table beyond EOD, truncated [ 196.799547][ T8617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 196.813878][ T8617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 196.833116][ T8617] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 196.843862][ T8617] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 196.884116][ T5980] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 197.024020][ T5980] usb 3-1: device descriptor read/64, error -71 [ 197.034014][ T849] usb 5-1: new low-speed USB device number 7 using dummy_hcd [ 197.147130][ T5980] usb usb3-port1: attempt power cycle [ 197.174007][ T849] usb 5-1: device descriptor read/64, error -71 [ 197.294512][ T5876] usb 2-1: new low-speed USB device number 49 using dummy_hcd [ 197.413831][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.414000][ T849] usb 5-1: new low-speed USB device number 8 using dummy_hcd [ 197.421376][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.441409][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.449668][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.459976][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.467041][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.474460][ T5876] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 197.482544][ T5876] usb 2-1: config 0 has no interface number 0 [ 197.489676][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.496587][ T5876] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 197.507519][ T5980] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 197.515273][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.522532][ T5876] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 197.534566][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.541330][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.548512][ T5876] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 197.560210][ T5876] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 197.570320][ T5876] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 197.574237][ T849] usb 5-1: device descriptor read/64, error -71 [ 197.583462][ T5980] usb 3-1: device descriptor read/8, error -71 [ 197.596939][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.603724][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.610958][ T5876] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 197.620371][ T5876] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 197.629046][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.638872][ T5876] usb 2-1: config 0 descriptor?? [ 197.644272][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.652531][ T8621] raw-gadget.5 gadget.1: fail, usb_ep_enable returned -22 [ 197.652784][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.661987][ T5876] ldusb 2-1:0.55: Interrupt in endpoint not found [ 197.671875][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.682504][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.691758][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.700787][ T849] usb usb5-port1: attempt power cycle [ 197.709751][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.716792][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.725604][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.732399][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.740393][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.747239][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.755235][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.762000][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.769807][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.778246][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.786240][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.793017][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.800947][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.808753][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.816944][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.823701][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.832044][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.838848][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.844136][ T5980] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 197.846900][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.860389][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.868309][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.875106][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.883146][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.884658][ T5980] usb 3-1: device descriptor read/8, error -71 [ 197.890370][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.904582][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.906182][ T8619] /dev/rnullb0: Can't open blockdev [ 197.911363][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.912732][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.931581][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.934359][ T5876] usb 2-1: USB disconnect, device number 49 [ 197.939649][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.952906][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.961426][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.968919][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.976967][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.983754][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 197.992038][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 197.998942][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 198.007880][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 198.015024][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 198.022804][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 198.024277][ T5980] usb usb3-port1: unable to enumerate USB device [ 198.029945][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 198.044479][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 198.051274][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 198.058904][ T849] usb 5-1: new low-speed USB device number 9 using dummy_hcd [ 198.064958][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 198.073227][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 198.081873][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 198.089062][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 198.096813][ T849] usb 5-1: device descriptor read/8, error -71 [ 198.098441][ T8626] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 198.110154][ T8626] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 198.279507][ T8634] FAULT_INJECTION: forcing a failure. [ 198.279507][ T8634] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 198.298284][ T8634] CPU: 1 UID: 0 PID: 8634 Comm: syz.0.829 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 198.298311][ T8634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 198.298323][ T8634] Call Trace: [ 198.298330][ T8634] [ 198.298338][ T8634] dump_stack_lvl+0x189/0x250 [ 198.298364][ T8634] ? __pfx____ratelimit+0x10/0x10 [ 198.298393][ T8634] ? __pfx_dump_stack_lvl+0x10/0x10 [ 198.298414][ T8634] ? __pfx__printk+0x10/0x10 [ 198.298449][ T8634] should_fail_ex+0x414/0x560 [ 198.298489][ T8634] _copy_to_user+0x31/0xb0 [ 198.298510][ T8634] simple_read_from_buffer+0xe1/0x170 [ 198.298539][ T8634] proc_fail_nth_read+0x1df/0x250 [ 198.298570][ T8634] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 198.298600][ T8634] ? rw_verify_area+0x258/0x650 [ 198.298620][ T8634] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 198.298649][ T8634] vfs_read+0x1fd/0x980 [ 198.298675][ T8634] ? __pfx___mutex_lock+0x10/0x10 [ 198.298694][ T8634] ? __pfx_vfs_read+0x10/0x10 [ 198.298716][ T8634] ? __fget_files+0x2a/0x420 [ 198.298746][ T8634] ? __fget_files+0x3a0/0x420 [ 198.298770][ T8634] ? __fget_files+0x2a/0x420 [ 198.298803][ T8634] ksys_read+0x145/0x250 [ 198.298823][ T8634] ? __fget_files+0x3a0/0x420 [ 198.298849][ T8634] ? __pfx_ksys_read+0x10/0x10 [ 198.298876][ T8634] ? do_syscall_64+0xbe/0x3b0 [ 198.298898][ T8634] do_syscall_64+0xfa/0x3b0 [ 198.298914][ T8634] ? lockdep_hardirqs_on+0x9c/0x150 [ 198.298941][ T8634] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.298961][ T8634] ? clear_bhb_loop+0x60/0xb0 [ 198.298984][ T8634] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 198.299003][ T8634] RIP: 0033:0x7f8ddef8d33c [ 198.299020][ T8634] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 198.299037][ T8634] RSP: 002b:00007f8ddfd33030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 198.299058][ T8634] RAX: ffffffffffffffda RBX: 00007f8ddf1b5fa0 RCX: 00007f8ddef8d33c [ 198.299072][ T8634] RDX: 000000000000000f RSI: 00007f8ddfd330a0 RDI: 0000000000000003 [ 198.299084][ T8634] RBP: 00007f8ddfd33090 R08: 0000000000000000 R09: 0000000000000000 [ 198.299096][ T8634] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 198.299108][ T8634] R13: 0000000000000000 R14: 00007f8ddf1b5fa0 R15: 00007ffe999d8a78 [ 198.299139][ T8634] [ 198.533020][ C1] vkms_vblank_simulate: vblank timer overrun [ 198.539049][ C1] hrtimer: interrupt took 235178168 ns [ 198.554023][ T849] usb 5-1: new low-speed USB device number 10 using dummy_hcd [ 198.578486][ T8636] netlink: 24 bytes leftover after parsing attributes in process `syz.0.830'. [ 198.597774][ T849] usb 5-1: device descriptor read/8, error -71 [ 198.639085][ C1] vkms_vblank_simulate: vblank timer overrun [ 198.704346][ T849] usb usb5-port1: unable to enumerate USB device [ 198.809437][ T8644] loop3: detected capacity change from 0 to 1 [ 198.819852][ T6008] Dev loop3: unable to read RDB block 1 [ 198.828217][ T6008] loop3: unable to read partition table [ 198.834178][ T6008] loop3: partition table beyond EOD, truncated [ 198.849514][ T8644] Dev loop3: unable to read RDB block 1 [ 198.863251][ T8644] loop3: unable to read partition table [ 198.883320][ T8644] loop3: partition table beyond EOD, truncated [ 198.908609][ T8644] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 199.069018][ T8651] Bluetooth: MGMT ver 1.23 [ 199.654123][ T5980] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 199.823987][ T5980] usb 3-1: Using ep0 maxpacket: 16 [ 199.834714][ T5980] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 199.847825][ T5980] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 199.875056][ T5980] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 199.893204][ T5980] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.922956][ T5980] usb 3-1: config 0 descriptor?? [ 200.048594][ T8681] netlink: 44 bytes leftover after parsing attributes in process `syz.4.844'. [ 200.074151][ T8681] netlink: 43 bytes leftover after parsing attributes in process `syz.4.844'. [ 200.093947][ T8681] netlink: 'syz.4.844': attribute type 5 has an invalid length. [ 200.105711][ T8682] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 200.113522][ T8681] netlink: 43 bytes leftover after parsing attributes in process `syz.4.844'. [ 200.123742][ T8682] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 200.186488][ T5980] usbhid 3-1:0.0: can't add hid device: -71 [ 200.192542][ T5980] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 200.227737][ T5980] usb 3-1: USB disconnect, device number 59 [ 200.264390][ T849] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 200.424032][ T849] usb 2-1: Using ep0 maxpacket: 16 [ 200.433855][ T849] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 200.453963][ T849] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.462068][ T849] usb 2-1: Product: syz [ 200.466404][ T849] usb 2-1: Manufacturer: syz [ 200.471008][ T849] usb 2-1: SerialNumber: syz [ 200.635702][ T5896] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 200.723539][ T849] cdc_ncm 2-1:1.0: bind() failure [ 200.757098][ T849] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 200.765778][ T849] cdc_ncm 2-1:1.1: bind() failure [ 200.785609][ T849] usb 2-1: USB disconnect, device number 50 [ 200.804025][ T5896] usb 5-1: Using ep0 maxpacket: 8 [ 200.829985][ T5896] usb 5-1: config 1 interface 0 altsetting 7 endpoint 0x81 has invalid wMaxPacketSize 0 [ 200.848842][ T5896] usb 5-1: config 1 interface 0 altsetting 7 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 200.863602][ T5896] usb 5-1: config 1 interface 0 has no altsetting 0 [ 200.875583][ T5896] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 200.889515][ T5896] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 200.912088][ T5896] usb 5-1: Product: ㋘揍姳ﳲ䈹킑㴏좗ష泀摲垵㡂茔鼹䊵疯ꦠꙑ폠♁鰩摼핞轇떍̱毕隺粹㨆嗅匢橆ꁱ챌珪㸕㛪葠눈젹淥띖錄夳 [ 200.944186][ T5896] usb 5-1: Manufacturer: 蠚좦ꀿⲏ缻쥷눬澮쑔ࢪ둧햫坿㈫頹뇍쯯뇈ৄ÷ꇩ⻺ऑ㕀讶맼㿝鍼屸塿迀עと똴筟囎ꍴ㱑㜪✅孟ꨒ䇥ﳳ車趘떤浠ܤ뺒嫏戏꾒斃ꘓ㥎喦ﷀ곁⪷퓽뤘噄釵忣컪Ộ늵臜庛떪疍搑ꔠ㕨䀭屉穋ᯥ㞸樋㎚蓕뚕惜乭 [ 200.994128][ T5896] usb 5-1: SerialNumber: 户瀡穪Ⱞ촼䕪날ᶨ䉒嘒ᧄె潲窫蝷蜎弃諤㾢᷀鑅ᠵ傠ໆ懾靦涒驗┖뫉잓鸤芄བ꠩幁蝞⪲쩉闓匒即醰㽄뻡죶瞊䷸앗 [ 201.049319][ T8690] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 201.279422][ T5896] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 201.305695][ T927] usb 3-1: new full-speed USB device number 60 using dummy_hcd [ 201.308511][ T5896] usb 5-1: USB disconnect, device number 11 [ 201.465844][ T927] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 201.484067][ T927] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 201.505802][ T927] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 201.515586][ T927] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 201.523618][ T927] usb 3-1: Product: syz [ 201.548437][ T927] usb 3-1: Manufacturer: syz [ 201.558783][ T927] usb 3-1: SerialNumber: syz [ 201.790009][ T927] usb 3-1: 0:2 : does not exist [ 201.835401][ T927] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 201.909609][ T927] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 201.951874][ T927] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 202.034009][ T927] usb 3-1: USB disconnect, device number 60 [ 202.121197][ T6008] udevd[6008]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 202.622679][ T8734] hpfs: Bad magic ... probably not HPFS [ 202.639422][ T8735] hpfs: Bad magic ... probably not HPFS [ 202.706025][ T8737] loop6: detected capacity change from 0 to 524287487 [ 202.715448][ T6008] buffer_io_error: 9 callbacks suppressed [ 202.715463][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 202.749628][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 202.789239][ T8740] CUSE: info not properly terminated [ 202.794283][ T8739] loop6: detected capacity change from 524287487 to 0 [ 202.802200][ T6008] Buffer I/O error on dev loop6, logical block 0, async page read [ 202.810632][ T6008] ldm_validate_partition_table(): Disk read failed. [ 202.818470][ T6008] Dev loop6: unable to read RDB block 0 [ 202.824781][ T6008] loop6: unable to read partition table [ 202.830766][ T6008] loop6: partition table beyond EOD, truncated [ 202.834057][ T10] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 203.024312][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 203.041419][ T10] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 203.062492][ T10] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 203.103784][ T10] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 203.124726][ T10] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 203.170840][ T10] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 203.191520][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.220948][ C0] Unknown status report in ack skb [ 203.387204][ T8756] Can't find a SQUASHFS superblock on rnullb0 [ 203.418479][ T10] usb 2-1: GET_CAPABILITIES returned 0 [ 203.427973][ T10] usbtmc 2-1:16.0: can't read capabilities [ 203.528188][ T8762] hpfs: Bad magic ... probably not HPFS [ 203.629713][ T8730] netlink: 24 bytes leftover after parsing attributes in process `syz.1.856'. [ 203.638927][ T8730] netlink: 68 bytes leftover after parsing attributes in process `syz.1.856'. [ 203.650367][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 203.662281][ T5980] usb 2-1: USB disconnect, device number 51 [ 203.714100][ T927] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 203.867839][ T927] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 203.878896][ T927] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 203.888804][ T927] usb 3-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 203.898058][ T927] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 203.908476][ T927] usb 3-1: config 0 descriptor?? [ 204.326320][ T927] hid_parser_main: 5 callbacks suppressed [ 204.326343][ T927] cm6533_jd 0003:0D8C:0022.0014: unknown main item tag 0x0 [ 204.380228][ T927] cm6533_jd 0003:0D8C:0022.0014: unknown main item tag 0x0 [ 204.416466][ T927] cm6533_jd 0003:0D8C:0022.0014: hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.2-1/input0 [ 204.492672][ T8786] loop3: detected capacity change from 0 to 1 [ 204.517484][ T8786] Dev loop3: unable to read RDB block 1 [ 204.532351][ T8786] loop3: unable to read partition table [ 204.551874][ T8786] loop3: partition table beyond EOD, truncated [ 204.584397][ T8786] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 204.643497][ T8789] FAULT_INJECTION: forcing a failure. [ 204.643497][ T8789] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 204.701426][ T8789] CPU: 0 UID: 0 PID: 8789 Comm: syz.1.877 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 204.701455][ T8789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 204.701466][ T8789] Call Trace: [ 204.701474][ T8789] [ 204.701483][ T8789] dump_stack_lvl+0x189/0x250 [ 204.701508][ T8789] ? __pfx____ratelimit+0x10/0x10 [ 204.701538][ T8789] ? __pfx_dump_stack_lvl+0x10/0x10 [ 204.701577][ T8789] ? __pfx__printk+0x10/0x10 [ 204.701599][ T8789] ? __might_fault+0xb0/0x130 [ 204.701630][ T8789] should_fail_ex+0x414/0x560 [ 204.701664][ T8789] _copy_from_user+0x2d/0xb0 [ 204.701683][ T8789] ___sys_sendmsg+0x158/0x2a0 [ 204.701713][ T8789] ? __pfx____sys_sendmsg+0x10/0x10 [ 204.701775][ T8789] ? __fget_files+0x2a/0x420 [ 204.701799][ T8789] ? __fget_files+0x3a0/0x420 [ 204.701839][ T8789] __x64_sys_sendmsg+0x19b/0x260 [ 204.701868][ T8789] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 204.701904][ T8789] ? __pfx_ksys_write+0x10/0x10 [ 204.701923][ T8789] ? rcu_is_watching+0x15/0xb0 [ 204.701949][ T8789] ? do_syscall_64+0xbe/0x3b0 [ 204.701971][ T8789] do_syscall_64+0xfa/0x3b0 [ 204.701987][ T8789] ? lockdep_hardirqs_on+0x9c/0x150 [ 204.702015][ T8789] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.702034][ T8789] ? clear_bhb_loop+0x60/0xb0 [ 204.702058][ T8789] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.702076][ T8789] RIP: 0033:0x7f2d5818e929 [ 204.702093][ T8789] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 204.702111][ T8789] RSP: 002b:00007f2d58fc7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 204.702140][ T8789] RAX: ffffffffffffffda RBX: 00007f2d583b5fa0 RCX: 00007f2d5818e929 [ 204.702155][ T8789] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 204.702168][ T8789] RBP: 00007f2d58fc7090 R08: 0000000000000000 R09: 0000000000000000 [ 204.702180][ T8789] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 204.702192][ T8789] R13: 0000000000000000 R14: 00007f2d583b5fa0 R15: 00007ffe3046cde8 [ 204.702221][ T8789] [ 205.321165][ T8807] loop6: detected capacity change from 0 to 524287487 [ 205.332623][ T8807] Buffer I/O error on dev loop6, logical block 0, async page read [ 205.341092][ T8807] Buffer I/O error on dev loop6, logical block 0, async page read [ 205.349297][ T8807] Buffer I/O error on dev loop6, logical block 0, async page read [ 205.357460][ T8807] Buffer I/O error on dev loop6, logical block 0, async page read [ 205.365437][ T8807] Buffer I/O error on dev loop6, logical block 0, async page read [ 205.394072][ T8809] loop6: detected capacity change from 524287487 to 0 [ 205.401231][ T8807] Buffer I/O error on dev loop6, logical block 0, async page read [ 205.411062][ T8807] ldm_validate_partition_table(): Disk read failed. [ 205.434039][ T927] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 205.434099][ T8807] Dev loop6: unable to read RDB block 0 [ 205.454131][ T8807] loop6: unable to read partition table [ 205.459957][ T8807] loop6: partition table beyond EOD, truncated [ 205.485644][ T8807] loop_reread_partitions: partition scan of loop6 (^L A;b@֔:Bw<gnf. -ӑ.i >^.dDd) failed (rc=-5) [ 205.587001][ T927] usb 5-1: config 1 interface 0 altsetting 5 bulk endpoint 0x1 has invalid maxpacket 72 [ 205.629713][ T927] usb 5-1: config 1 interface 0 has no altsetting 0 [ 205.655513][ T927] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 205.684060][ T927] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.692090][ T927] usb 5-1: Product: 들Ẽ辛㉡殟㔿䡻ꢉ쯘韵鱗祭붵⍕堃卫䇨ᢼ싆窸施珌痲䃘渗䫂亂䕍禝銮䐬콭鄚刘껛컄詩⯳稔Ӗ섭윌ﶣ➟퍻읪킄⿏ጞ䝥홻굪ꥥ₂餕踀㶊ࣛ콰亰祟㘇鄏楰뙡ᘬ쯜왇㨵叓畴丟䤴輼㙲䯖͘ [ 205.743641][ T927] usb 5-1: Manufacturer: ㉃∈葾䎴ೕ走ﲇ켞䊪Ⲋ㜷஠탻穮墰⺿ﰤ讆楈⽰췗㌭䰒瀩墴늛❒¦袐ㅿ폧⎲늖䩌뵕뱂﹆䘱㻮㎜큥㿸랈蓌㣬팕ఇ네哺程ড়벣捱 [ 205.766862][ T927] usb 5-1: SerialNumber: 魦臝소锧浿㔤㣛宱䘲嶞἟⩶ힰ墿퍮㉩Ш魡釪倥씢씴蘿鶢酔㩰䲫⅚橛꤄θ䣌闡꜌铻欬먊䨧瓤꾥뀁避灀隻ઓ직褯외㫁７﵂훸귻Ꙟ饫᥍名 [ 205.818474][ T8802] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 206.044230][ T5876] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 206.214207][ T5876] usb 2-1: Using ep0 maxpacket: 8 [ 206.222304][ T5876] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 206.241587][ T5876] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 206.252033][ T5876] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 206.265666][ T5876] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 206.280647][ T5876] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 206.291800][ T5876] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.424503][ T10] usb 3-1: USB disconnect, device number 61 [ 206.532578][ T5876] usb 2-1: GET_CAPABILITIES returned 0 [ 206.553959][ T5876] usbtmc 2-1:16.0: can't read capabilities [ 206.751794][ T5980] usb 2-1: USB disconnect, device number 52 [ 206.786126][ T8852] exFAT-fs (rnullb0): invalid boot record signature [ 206.826924][ T8852] exFAT-fs (rnullb0): failed to read boot sector [ 206.881060][ T8852] exFAT-fs (rnullb0): failed to recognize exfat type [ 206.922870][ T8856] loop3: detected capacity change from 0 to 1 [ 206.932452][ T6008] Dev loop3: unable to read RDB block 1 [ 206.941582][ T6008] loop3: unable to read partition table [ 206.948662][ T6008] loop3: partition table beyond EOD, truncated [ 206.985461][ T8856] Dev loop3: unable to read RDB block 1 [ 206.991640][ T8856] loop3: unable to read partition table [ 207.002253][ T8856] loop3: partition table beyond EOD, truncated [ 207.012537][ T8856] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 207.433973][ T5980] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 207.574658][ T5980] usb 3-1: device descriptor read/64, error -71 [ 207.796166][ T8878] netlink: 80 bytes leftover after parsing attributes in process `syz.0.890'. [ 207.806822][ T8879] netlink: 80 bytes leftover after parsing attributes in process `syz.0.890'. [ 207.816426][ T5980] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 207.905957][ T849] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 207.975468][ T5980] usb 3-1: device descriptor read/64, error -71 [ 208.084036][ T849] usb 2-1: Using ep0 maxpacket: 16 [ 208.094264][ T5980] usb usb3-port1: attempt power cycle [ 208.119672][ T849] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 208.129951][ T927] usblp 5-1:1.0: usblp0: USB Bidirectional printer dev 12 if 0 alt 5 proto 2 vid 0x0525 pid 0xA4A8 [ 208.157355][ T849] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.187981][ T849] usb 2-1: Product: syz [ 208.211456][ T927] usb 5-1: USB disconnect, device number 12 [ 208.215333][ T849] usb 2-1: Manufacturer: syz [ 208.221972][ T849] usb 2-1: SerialNumber: syz [ 208.232831][ T927] usblp0: removed [ 208.281138][ T8891] netlink: 'syz.4.891': attribute type 10 has an invalid length. [ 208.310677][ T8891] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 208.444166][ T5980] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 208.471420][ T849] cdc_ncm 2-1:1.0: bind() failure [ 208.476898][ T5980] usb 3-1: device descriptor read/8, error -71 [ 208.496732][ T849] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 208.521155][ T849] cdc_ncm 2-1:1.1: bind() failure [ 208.549572][ T849] usb 2-1: USB disconnect, device number 53 [ 208.745660][ T5980] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 208.768672][ T5980] usb 3-1: device descriptor read/8, error -71 [ 208.890938][ T5980] usb usb3-port1: unable to enumerate USB device [ 209.060959][ T8930] loop3: detected capacity change from 0 to 1 [ 209.069611][ T8930] Dev loop3: unable to read RDB block 1 [ 209.079581][ T8930] loop3: unable to read partition table [ 209.086235][ T8930] loop3: partition table beyond EOD, truncated [ 209.100046][ T8930] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 209.503967][ T5980] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 209.654069][ T5980] usb 5-1: Using ep0 maxpacket: 8 [ 209.660586][ T5980] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 209.670650][ T5980] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 209.680512][ T5980] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 209.690525][ T5980] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 209.704066][ T5980] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 209.713113][ T5980] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.927345][ T5980] usb 5-1: GET_CAPABILITIES returned 0 [ 209.932863][ T5980] usbtmc 5-1:16.0: can't read capabilities [ 209.957467][ T8950] omfs: Invalid superblock (0) [ 210.010969][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.018493][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.026861][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.033003][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.039433][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.045642][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.051743][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.058173][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.064547][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.070724][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.077163][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.083264][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.089744][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.097732][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.103853][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.110707][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.118498][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.125192][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.131602][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.138392][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.146603][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.150717][ T5980] usb 5-1: USB disconnect, device number 13 [ 210.156162][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.168192][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.175927][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.182615][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.193458][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.200775][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.212995][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.220391][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.231272][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.238053][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.248566][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.262377][ T8953] qnx4: no qnx4 filesystem (no root dir). [ 210.654012][ T5980] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 210.692945][ T8968] UDF-fs: warning (device rnullb0): udf_load_vrs: No VRS found [ 210.700854][ T8968] UDF-fs: Scanning with blocksize 4096 failed [ 210.751708][ T8970] 9pnet: p9_errstr2errno: server reported unknown error [ 210.806339][ T5980] usb 3-1: unable to get BOS descriptor or descriptor too short [ 210.815540][ T5980] usb 3-1: config index 0 descriptor too short (expected 4123, got 27) [ 210.823853][ T5980] usb 3-1: config 6 has an invalid interface number: 200 but max is 0 [ 210.832562][ T5980] usb 3-1: config 6 has no interface number 0 [ 210.838794][ T5980] usb 3-1: config 6 interface 200 altsetting 8 endpoint 0x1 has an invalid bInterval 238, changing to 11 [ 210.850430][ T5980] usb 3-1: config 6 interface 200 has no altsetting 0 [ 210.861297][ T5980] usb 3-1: New USB device found, idVendor=05d8, idProduct=810c, bcdDevice=18.5f [ 210.870494][ T5980] usb 3-1: New USB device strings: Mfr=1, Product=6, SerialNumber=3 [ 210.894216][ T5980] usb 3-1: Product: syz [ 210.900024][ T5980] usb 3-1: Manufacturer: syz [ 210.910655][ T5980] usb 3-1: SerialNumber: syz [ 211.004655][ T8975] block nbd4: NBD_DISCONNECT [ 211.011044][ T8975] gfs2: not a GFS2 filesystem [ 211.016273][ T8977] /dev/rnullb0: Can't open blockdev [ 211.354096][ T5973] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 211.507581][ T5973] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 211.516734][ T5973] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.524806][ T5973] usb 2-1: Product: syz [ 211.528998][ T5973] usb 2-1: Manufacturer: syz [ 211.533612][ T5973] usb 2-1: SerialNumber: syz [ 211.534068][ T10] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 211.556951][ T5973] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 211.584934][ T927] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 211.694235][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 211.701079][ T10] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 211.713517][ T10] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 211.724679][ T10] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 211.739336][ T10] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 211.753173][ T10] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 211.768264][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.005259][ T10] usb 5-1: GET_CAPABILITIES returned 0 [ 212.010827][ T10] usbtmc 5-1:16.0: can't read capabilities [ 212.100730][ T8999] netlink: 156 bytes leftover after parsing attributes in process `syz.0.919'. [ 212.111580][ T8999] netlink: 'syz.0.919': attribute type 3 has an invalid length. [ 212.213261][ T5876] usb 5-1: USB disconnect, device number 14 [ 212.559572][ T9000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 212.568556][ T9000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 212.578738][ T9000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 212.588908][ T9000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 212.684140][ T927] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 212.691299][ T927] ath9k_htc: Failed to initialize the device [ 212.737259][ T927] usb 2-1: ath9k_htc: USB layer deinitialized [ 212.776711][ T9002] syzkaller1: entered promiscuous mode [ 212.795298][ T9002] syzkaller1: entered allmulticast mode [ 212.822955][ T9004] hfs: can't find a HFS filesystem on dev rnullb0 [ 212.966989][ T8981] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 212.989017][ T8981] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 213.458966][ T9028] FAULT_INJECTION: forcing a failure. [ 213.458966][ T9028] name failslab, interval 1, probability 0, space 0, times 0 [ 213.465843][ T5980] dvb-usb: found a 'Artec T14 - USB2.0 DVB-T' in warm state. [ 213.472063][ T9028] CPU: 0 UID: 0 PID: 9028 Comm: syz.4.928 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 213.472089][ T9028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 213.472101][ T9028] Call Trace: [ 213.472109][ T9028] [ 213.472116][ T9028] dump_stack_lvl+0x189/0x250 [ 213.472142][ T9028] ? __pfx____ratelimit+0x10/0x10 [ 213.472170][ T9028] ? __pfx_dump_stack_lvl+0x10/0x10 [ 213.472191][ T9028] ? __pfx__printk+0x10/0x10 [ 213.472217][ T9028] ? __pfx___might_resched+0x10/0x10 [ 213.472237][ T9028] ? fs_reclaim_acquire+0x7d/0x100 [ 213.472264][ T9028] should_fail_ex+0x414/0x560 [ 213.472298][ T9028] should_failslab+0xa8/0x100 [ 213.472321][ T9028] __kmalloc_noprof+0xcb/0x4f0 [ 213.472339][ T9028] ? kfree+0x4d/0x440 [ 213.472353][ T9028] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 213.472383][ T9028] tomoyo_realpath_from_path+0xe3/0x5d0 [ 213.472408][ T9028] ? tomoyo_domain+0xd9/0x130 [ 213.472438][ T9028] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 213.472457][ T9028] tomoyo_path_number_perm+0x1e8/0x5a0 [ 213.472479][ T9028] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 213.472515][ T9028] ? __lock_acquire+0xab9/0xd20 [ 213.472562][ T9028] ? __fget_files+0x2a/0x420 [ 213.472589][ T9028] ? __fget_files+0x2a/0x420 [ 213.472611][ T9028] ? __fget_files+0x3a0/0x420 [ 213.472633][ T9028] ? __fget_files+0x2a/0x420 [ 213.472660][ T9028] security_file_ioctl+0xcb/0x2d0 [ 213.472681][ T9028] __se_sys_ioctl+0x47/0x170 [ 213.472702][ T9028] do_syscall_64+0xfa/0x3b0 [ 213.472719][ T9028] ? lockdep_hardirqs_on+0x9c/0x150 [ 213.472746][ T9028] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.472764][ T9028] ? clear_bhb_loop+0x60/0xb0 [ 213.472787][ T9028] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.472811][ T9028] RIP: 0033:0x7f12e6d8e929 [ 213.472826][ T9028] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 213.472843][ T9028] RSP: 002b:00007f12e4bf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 213.472863][ T9028] RAX: ffffffffffffffda RBX: 00007f12e6fb5fa0 RCX: 00007f12e6d8e929 [ 213.472877][ T9028] RDX: 0000200000000240 RSI: 0000000000003b70 RDI: 0000000000000003 [ 213.472889][ T9028] RBP: 00007f12e4bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 213.472901][ T9028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 213.472912][ T9028] R13: 0000000000000000 R14: 00007f12e6fb5fa0 R15: 00007ffee77909b8 [ 213.472941][ T9028] [ 213.472949][ T9028] ERROR: Out of memory at tomoyo_realpath_from_path. [ 213.503258][ T5980] dvb-usb: bulk message failed: -71 (3/0) [ 213.732387][ T9032] FAULT_INJECTION: forcing a failure. [ 213.732387][ T9032] name failslab, interval 1, probability 0, space 0, times 0 [ 213.785148][ T5980] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 213.797535][ T5980] dvbdev: DVB: registering new adapter (Artec T14 - USB2.0 DVB-T) [ 213.805556][ T9032] CPU: 0 UID: 0 PID: 9032 Comm: syz.4.930 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 213.805585][ T9032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 213.805597][ T9032] Call Trace: [ 213.805605][ T9032] [ 213.805613][ T9032] dump_stack_lvl+0x189/0x250 [ 213.805639][ T9032] ? __pfx____ratelimit+0x10/0x10 [ 213.805666][ T9032] ? __pfx_dump_stack_lvl+0x10/0x10 [ 213.805687][ T9032] ? __pfx__printk+0x10/0x10 [ 213.805714][ T9032] ? __pfx___might_resched+0x10/0x10 [ 213.805731][ T9032] ? fs_reclaim_acquire+0x7d/0x100 [ 213.805759][ T9032] should_fail_ex+0x414/0x560 [ 213.805792][ T9032] should_failslab+0xa8/0x100 [ 213.805823][ T9032] kmem_cache_alloc_noprof+0x73/0x3c0 [ 213.805843][ T9032] ? skb_clone+0x212/0x3a0 [ 213.805873][ T9032] skb_clone+0x212/0x3a0 [ 213.805895][ T9032] ? nfnetlink_rcv+0x486/0x2520 [ 213.805923][ T9032] nfnetlink_rcv+0x4b4/0x2520 [ 213.805950][ T9032] ? __dev_queue_xmit+0x1cd7/0x3a70 [ 213.805981][ T9032] ? kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 213.806002][ T9032] ? __dev_queue_xmit+0x27e/0x3a70 [ 213.806029][ T9032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.806054][ T9032] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 213.806095][ T9032] ? ref_tracker_free+0x63a/0x7d0 [ 213.806112][ T9032] ? __copy_skb_header+0xa7/0x550 [ 213.806139][ T9032] ? __pfx_ref_tracker_free+0x10/0x10 [ 213.806157][ T9032] ? __skb_clone+0x63/0x7a0 [ 213.806189][ T9032] ? __skb_clone+0x483/0x7a0 [ 213.806220][ T9032] ? skb_clone+0x246/0x3a0 [ 213.806248][ T9032] ? __netlink_deliver_tap+0x807/0x850 [ 213.806269][ T9032] ? netlink_deliver_tap+0x2e/0x1b0 [ 213.806298][ T9032] ? netlink_deliver_tap+0x2e/0x1b0 [ 213.806318][ T9032] ? netlink_deliver_tap+0x2e/0x1b0 [ 213.806347][ T9032] netlink_unicast+0x75b/0x8d0 [ 213.806376][ T9032] netlink_sendmsg+0x805/0xb30 [ 213.806405][ T9032] ? __pfx_netlink_sendmsg+0x10/0x10 [ 213.806430][ T9032] ? aa_sock_msg_perm+0xf1/0x1d0 [ 213.806454][ T9032] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 213.806480][ T9032] ? __pfx_netlink_sendmsg+0x10/0x10 [ 213.806501][ T9032] __sock_sendmsg+0x219/0x270 [ 213.806523][ T9032] ____sys_sendmsg+0x505/0x830 [ 213.806553][ T9032] ? __pfx_____sys_sendmsg+0x10/0x10 [ 213.806586][ T9032] ? import_iovec+0x74/0xa0 [ 213.806606][ T9032] ___sys_sendmsg+0x21f/0x2a0 [ 213.806634][ T9032] ? __pfx____sys_sendmsg+0x10/0x10 [ 213.806692][ T9032] ? __fget_files+0x2a/0x420 [ 213.806715][ T9032] ? __fget_files+0x3a0/0x420 [ 213.806749][ T9032] __x64_sys_sendmsg+0x19b/0x260 [ 213.806776][ T9032] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 213.806815][ T9032] ? __pfx_ksys_write+0x10/0x10 [ 213.806834][ T9032] ? rcu_is_watching+0x15/0xb0 [ 213.806858][ T9032] ? do_syscall_64+0xbe/0x3b0 [ 213.806879][ T9032] do_syscall_64+0xfa/0x3b0 [ 213.806894][ T9032] ? lockdep_hardirqs_on+0x9c/0x150 [ 213.806921][ T9032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.806938][ T9032] ? clear_bhb_loop+0x60/0xb0 [ 213.806961][ T9032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.806979][ T9032] RIP: 0033:0x7f12e6d8e929 [ 213.806995][ T9032] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 213.807011][ T9032] RSP: 002b:00007f12e4bf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 213.807032][ T9032] RAX: ffffffffffffffda RBX: 00007f12e6fb5fa0 RCX: 00007f12e6d8e929 [ 213.807046][ T9032] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 213.807058][ T9032] RBP: 00007f12e4bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 213.807069][ T9032] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 213.807080][ T9032] R13: 0000000000000000 R14: 00007f12e6fb5fa0 R15: 00007ffee77909b8 [ 213.807111][ T9032] [ 214.174076][ T5980] usb 3-1: media controller created [ 214.199231][ T5980] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 214.208734][ T10] usb 2-1: USB disconnect, device number 54 [ 214.217477][ T9033] syz.0.925 (9033) used greatest stack depth: 17864 bytes left [ 214.293593][ T5980] dvb-usb: bulk message failed: -71 (6/0) [ 214.310369][ T5980] dvb-usb: bulk message failed: -71 (6/0) [ 214.334111][ T5980] dvb-usb: no frontend was attached by 'Artec T14 - USB2.0 DVB-T' [ 214.351687][ T5980] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input15 [ 214.382198][ T5980] dvb-usb: schedule remote query interval to 150 msecs. [ 214.403939][ T5980] dvb-usb: Artec T14 - USB2.0 DVB-T successfully initialized and connected. [ 214.419434][ T5980] usb 3-1: USB disconnect, device number 66 [ 214.514573][ T5980] dvb-usb: Artec T14 - USB2.0 DVB-T successfully deinitialized and disconnected. [ 214.621243][ T9045] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 214.704229][ T5896] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 214.771099][ T9051] exFAT-fs (rnullb0): invalid boot record signature [ 214.783174][ T9051] exFAT-fs (rnullb0): failed to read boot sector [ 214.790764][ T9051] exFAT-fs (rnullb0): failed to recognize exfat type [ 214.854163][ T5980] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 214.866135][ T5896] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 214.884004][ T5896] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 214.892977][ T5896] usb 5-1: config 1 has no interface number 0 [ 214.900583][ T9058] tc_dump_action: action bad kind [ 214.906596][ T5896] usb 5-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 214.920898][ T5896] usb 5-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 214.942032][ T5896] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 214.951422][ T5896] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 214.959929][ T5896] usb 5-1: Product: syz [ 214.965413][ T5896] usb 5-1: Manufacturer: syz [ 214.970022][ T5896] usb 5-1: SerialNumber: syz [ 215.010555][ T9061] FAULT_INJECTION: forcing a failure. [ 215.010555][ T9061] name failslab, interval 1, probability 0, space 0, times 0 [ 215.025486][ T5980] usb 3-1: Using ep0 maxpacket: 8 [ 215.028109][ T9061] CPU: 0 UID: 0 PID: 9061 Comm: syz.1.940 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 215.028139][ T9061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 215.028151][ T9061] Call Trace: [ 215.028159][ T9061] [ 215.028167][ T9061] dump_stack_lvl+0x189/0x250 [ 215.028193][ T9061] ? __pfx____ratelimit+0x10/0x10 [ 215.028220][ T9061] ? __pfx_dump_stack_lvl+0x10/0x10 [ 215.028241][ T9061] ? __pfx__printk+0x10/0x10 [ 215.028268][ T9061] ? __pfx___might_resched+0x10/0x10 [ 215.028287][ T9061] ? fs_reclaim_acquire+0x7d/0x100 [ 215.028315][ T9061] should_fail_ex+0x414/0x560 [ 215.028348][ T9061] should_failslab+0xa8/0x100 [ 215.028371][ T9061] __kmalloc_cache_noprof+0x70/0x3d0 [ 215.028390][ T9061] ? nfnetlink_rcv+0xeff/0x2520 [ 215.028422][ T9061] nfnetlink_rcv+0xeff/0x2520 [ 215.028478][ T9061] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 215.028521][ T9061] ? ref_tracker_free+0x63a/0x7d0 [ 215.028570][ T9061] ? __netlink_deliver_tap+0x807/0x850 [ 215.028600][ T9061] ? netlink_deliver_tap+0x2e/0x1b0 [ 215.028620][ T9061] ? netlink_deliver_tap+0x2e/0x1b0 [ 215.028647][ T9061] netlink_unicast+0x75b/0x8d0 [ 215.028676][ T9061] netlink_sendmsg+0x805/0xb30 [ 215.028706][ T9061] ? __pfx_netlink_sendmsg+0x10/0x10 [ 215.028731][ T9061] ? aa_sock_msg_perm+0xf1/0x1d0 [ 215.028761][ T9061] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 215.028786][ T9061] ? __pfx_netlink_sendmsg+0x10/0x10 [ 215.028808][ T9061] __sock_sendmsg+0x219/0x270 [ 215.028830][ T9061] ____sys_sendmsg+0x505/0x830 [ 215.028861][ T9061] ? __pfx_____sys_sendmsg+0x10/0x10 [ 215.028894][ T9061] ? import_iovec+0x74/0xa0 [ 215.028916][ T9061] ___sys_sendmsg+0x21f/0x2a0 [ 215.028943][ T9061] ? __pfx____sys_sendmsg+0x10/0x10 [ 215.029002][ T9061] ? __fget_files+0x2a/0x420 [ 215.029025][ T9061] ? __fget_files+0x3a0/0x420 [ 215.029059][ T9061] __x64_sys_sendmsg+0x19b/0x260 [ 215.029086][ T9061] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 215.029121][ T9061] ? __pfx_ksys_write+0x10/0x10 [ 215.029146][ T9061] ? do_syscall_64+0xbe/0x3b0 [ 215.029168][ T9061] do_syscall_64+0xfa/0x3b0 [ 215.029183][ T9061] ? lockdep_hardirqs_on+0x9c/0x150 [ 215.029210][ T9061] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.029229][ T9061] ? clear_bhb_loop+0x60/0xb0 [ 215.029251][ T9061] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 215.029269][ T9061] RIP: 0033:0x7f2d5818e929 [ 215.029285][ T9061] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 215.029302][ T9061] RSP: 002b:00007f2d58fc7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 215.029321][ T9061] RAX: ffffffffffffffda RBX: 00007f2d583b5fa0 RCX: 00007f2d5818e929 [ 215.029335][ T9061] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 215.029347][ T9061] RBP: 00007f2d58fc7090 R08: 0000000000000000 R09: 0000000000000000 [ 215.029359][ T9061] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 215.029370][ T9061] R13: 0000000000000000 R14: 00007f2d583b5fa0 R15: 00007ffe3046cde8 [ 215.029398][ T9061] [ 215.335404][ T5980] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 215.345382][ T5980] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 215.355193][ T5980] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 215.365527][ T5980] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 215.378574][ T5980] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 215.388092][ T5980] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.601236][ T5896] cdc_ncm 5-1:1.1: failed GET_NTB_PARAMETERS [ 215.607541][ T5896] cdc_ncm 5-1:1.1: bind() failure [ 215.632870][ T5980] usb 3-1: GET_CAPABILITIES returned 0 [ 215.647595][ T5980] usbtmc 3-1:16.0: can't read capabilities [ 215.841158][ T9031] netlink: 24 bytes leftover after parsing attributes in process `syz.2.929'. [ 215.851410][ T9031] netlink: 68 bytes leftover after parsing attributes in process `syz.2.929'. [ 215.862977][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 215.875276][ T5980] usb 3-1: USB disconnect, device number 67 [ 215.943966][ T927] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 216.104075][ T927] usb 2-1: Using ep0 maxpacket: 16 [ 216.110948][ T927] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 216.119328][ T927] usb 2-1: config 0 has no interface number 0 [ 216.127581][ T927] usb 2-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28 [ 216.136709][ T927] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.144807][ T927] usb 2-1: Product: syz [ 216.148977][ T927] usb 2-1: Manufacturer: syz [ 216.153562][ T927] usb 2-1: SerialNumber: syz [ 216.161382][ T927] usb 2-1: config 0 descriptor?? [ 216.169074][ T927] uvcvideo 2-1:0.105: probe with driver uvcvideo failed with error -22 [ 216.535106][ T849] usb 2-1: USB disconnect, device number 55 [ 216.630787][ T9086] /dev/rnullb0: Can't open blockdev [ 216.683760][ T9088] FAULT_INJECTION: forcing a failure. [ 216.683760][ T9088] name failslab, interval 1, probability 0, space 0, times 0 [ 216.696628][ T9088] CPU: 1 UID: 0 PID: 9088 Comm: syz.2.949 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 216.696645][ T9088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 216.696651][ T9088] Call Trace: [ 216.696657][ T9088] [ 216.696662][ T9088] dump_stack_lvl+0x189/0x250 [ 216.696678][ T9088] ? __pfx____ratelimit+0x10/0x10 [ 216.696694][ T9088] ? __pfx_dump_stack_lvl+0x10/0x10 [ 216.696705][ T9088] ? __pfx__printk+0x10/0x10 [ 216.696719][ T9088] ? __pfx___might_resched+0x10/0x10 [ 216.696730][ T9088] ? fs_reclaim_acquire+0x7d/0x100 [ 216.696746][ T9088] should_fail_ex+0x414/0x560 [ 216.696765][ T9088] should_failslab+0xa8/0x100 [ 216.696785][ T9088] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 216.696796][ T9088] ? __pfx_nf_tables_abort+0x10/0x10 [ 216.696808][ T9088] ? __alloc_skb+0x112/0x2d0 [ 216.696822][ T9088] __alloc_skb+0x112/0x2d0 [ 216.696836][ T9088] netlink_ack+0x146/0xa50 [ 216.696850][ T9088] ? __kasan_kmalloc+0x93/0xb0 [ 216.696865][ T9088] nfnetlink_rcv+0x2290/0x2520 [ 216.696895][ T9088] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 216.696918][ T9088] ? ref_tracker_free+0x63a/0x7d0 [ 216.696943][ T9088] ? __netlink_deliver_tap+0x807/0x850 [ 216.696958][ T9088] ? netlink_deliver_tap+0x2e/0x1b0 [ 216.696969][ T9088] ? netlink_deliver_tap+0x2e/0x1b0 [ 216.696983][ T9088] netlink_unicast+0x75b/0x8d0 [ 216.696998][ T9088] netlink_sendmsg+0x805/0xb30 [ 216.697014][ T9088] ? __pfx_netlink_sendmsg+0x10/0x10 [ 216.697027][ T9088] ? aa_sock_msg_perm+0xf1/0x1d0 [ 216.697041][ T9088] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 216.697055][ T9088] ? __pfx_netlink_sendmsg+0x10/0x10 [ 216.697067][ T9088] __sock_sendmsg+0x219/0x270 [ 216.697079][ T9088] ____sys_sendmsg+0x505/0x830 [ 216.697095][ T9088] ? __pfx_____sys_sendmsg+0x10/0x10 [ 216.697113][ T9088] ? import_iovec+0x74/0xa0 [ 216.697124][ T9088] ___sys_sendmsg+0x21f/0x2a0 [ 216.697139][ T9088] ? __pfx____sys_sendmsg+0x10/0x10 [ 216.697170][ T9088] ? __fget_files+0x2a/0x420 [ 216.697183][ T9088] ? __fget_files+0x3a0/0x420 [ 216.697201][ T9088] __x64_sys_sendmsg+0x19b/0x260 [ 216.697216][ T9088] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 216.697234][ T9088] ? __pfx_ksys_write+0x10/0x10 [ 216.697248][ T9088] ? do_syscall_64+0xbe/0x3b0 [ 216.697260][ T9088] do_syscall_64+0xfa/0x3b0 [ 216.697268][ T9088] ? lockdep_hardirqs_on+0x9c/0x150 [ 216.697283][ T9088] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.697293][ T9088] ? clear_bhb_loop+0x60/0xb0 [ 216.697313][ T9088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 216.697330][ T9088] RIP: 0033:0x7f987318e929 [ 216.697347][ T9088] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 216.697364][ T9088] RSP: 002b:00007f98740aa038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 216.697384][ T9088] RAX: ffffffffffffffda RBX: 00007f98733b5fa0 RCX: 00007f987318e929 [ 216.697393][ T9088] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 216.697399][ T9088] RBP: 00007f98740aa090 R08: 0000000000000000 R09: 0000000000000000 [ 216.697405][ T9088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 216.697411][ T9088] R13: 0000000000000000 R14: 00007f98733b5fa0 R15: 00007fff20fa3ef8 [ 216.697427][ T9088] [ 217.394033][ T5980] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 217.464231][ T5896] usb 5-1: USB disconnect, device number 15 [ 217.543965][ T5980] usb 2-1: Using ep0 maxpacket: 32 [ 217.544527][ T849] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 217.568869][ T5980] usb 2-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 217.587356][ T5980] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 217.590801][ T9103] /dev/loop4: Can't open blockdev [ 217.600778][ T5980] usb 2-1: Product: syz [ 217.607488][ T5980] usb 2-1: Manufacturer: syz [ 217.612092][ T5980] usb 2-1: SerialNumber: syz [ 217.633866][ T5980] usb 2-1: config 0 descriptor?? [ 217.655145][ T5980] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 217.714010][ T849] usb 3-1: Using ep0 maxpacket: 8 [ 217.726550][ T849] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 217.743983][ T849] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 217.753767][ T849] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 217.763756][ T849] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 217.776879][ T849] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 217.785998][ T849] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.848434][ T9105] Mount JFS Failure: -22 [ 217.852737][ T9105] jfs_mount failed w/return code = -22 [ 217.881700][ T9107] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 218.028026][ T849] usb 3-1: GET_CAPABILITIES returned 0 [ 218.033561][ T849] usbtmc 3-1:16.0: can't read capabilities [ 218.050451][ T5980] gspca_stk1135: reg_w 0x0 err -71 [ 218.062184][ T5980] gspca_stk1135: serial bus timeout: status=0x00 [ 218.079811][ T5980] gspca_stk1135: Sensor write failed [ 218.085303][ T5980] gspca_stk1135: serial bus timeout: status=0x00 [ 218.101060][ T5980] gspca_stk1135: Sensor write failed [ 218.114481][ T5980] gspca_stk1135: serial bus timeout: status=0x00 [ 218.124937][ T5980] gspca_stk1135: Sensor read failed [ 218.130211][ T5980] gspca_stk1135: serial bus timeout: status=0x00 [ 218.141218][ T5980] gspca_stk1135: Sensor read failed [ 218.148396][ T5980] gspca_stk1135: Detected sensor type unknown (0x0) [ 218.158841][ T5980] gspca_stk1135: serial bus timeout: status=0x00 [ 218.168248][ T5980] gspca_stk1135: Sensor read failed [ 218.173580][ T5980] gspca_stk1135: serial bus timeout: status=0x00 [ 218.182905][ T5980] gspca_stk1135: Sensor read failed [ 218.188288][ T5980] gspca_stk1135: serial bus timeout: status=0x00 [ 218.197636][ T5980] gspca_stk1135: Sensor write failed [ 218.203448][ T5980] gspca_stk1135: serial bus timeout: status=0x00 [ 218.209941][ T5980] gspca_stk1135: Sensor write failed [ 218.212519][ T9112] hfs: can't find a HFS filesystem on dev rnullb0 [ 218.215524][ T5980] stk1135 2-1:0.0: probe with driver stk1135 failed with error -71 [ 218.218348][ T5980] usb 2-1: USB disconnect, device number 56 [ 218.250209][ T9098] netlink: 24 bytes leftover after parsing attributes in process `syz.2.954'. [ 218.261405][ T9098] netlink: 68 bytes leftover after parsing attributes in process `syz.2.954'. [ 218.281777][ C0] usbtmc 3-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 218.294013][ T849] usb 3-1: USB disconnect, device number 68 [ 218.634049][ T10] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 218.686883][ T9122] qnx4: no qnx4 filesystem (no root dir). [ 218.807120][ T10] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 218.815466][ T10] usb 5-1: config 0 has no interface number 0 [ 218.822500][ T10] usb 5-1: config 0 interface 41 has no altsetting 0 [ 218.843782][ T10] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 218.857090][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.872308][ T10] usb 5-1: Product: syz [ 218.877453][ T10] usb 5-1: Manufacturer: syz [ 218.882185][ T10] usb 5-1: SerialNumber: syz [ 218.896535][ T10] usb 5-1: config 0 descriptor?? [ 218.942869][ T9129] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 218.952342][ T9129] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 218.984011][ T5980] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 219.136017][ T5980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 219.147373][ T5980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 219.157260][ T5980] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 219.166969][ T5980] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.177731][ T5980] usb 2-1: config 0 descriptor?? [ 219.264207][ T5896] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 219.379153][ T9135] FAULT_INJECTION: forcing a failure. [ 219.379153][ T9135] name failslab, interval 1, probability 0, space 0, times 0 [ 219.393477][ T9135] CPU: 0 UID: 0 PID: 9135 Comm: syz.0.969 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 219.393505][ T9135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 219.393516][ T9135] Call Trace: [ 219.393523][ T9135] [ 219.393530][ T9135] dump_stack_lvl+0x189/0x250 [ 219.393555][ T9135] ? __pfx____ratelimit+0x10/0x10 [ 219.393593][ T9135] ? __pfx_dump_stack_lvl+0x10/0x10 [ 219.393614][ T9135] ? __pfx__printk+0x10/0x10 [ 219.393646][ T9135] should_fail_ex+0x414/0x560 [ 219.393682][ T9135] should_failslab+0xa8/0x100 [ 219.393704][ T9135] kmem_cache_alloc_noprof+0x73/0x3c0 [ 219.393721][ T9135] ? skb_clone+0x212/0x3a0 [ 219.393752][ T9135] skb_clone+0x212/0x3a0 [ 219.393780][ T9135] __netlink_deliver_tap+0x404/0x850 [ 219.393815][ T9135] ? netlink_deliver_tap+0x2e/0x1b0 [ 219.393837][ T9135] netlink_deliver_tap+0x19c/0x1b0 [ 219.393851][ T9135] netlink_sendskb+0x68/0x140 [ 219.393861][ T9135] nfnetlink_rcv+0x2290/0x2520 [ 219.393912][ T9135] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 219.393955][ T9135] ? ref_tracker_free+0x63a/0x7d0 [ 219.393997][ T9135] ? __netlink_deliver_tap+0x807/0x850 [ 219.394026][ T9135] ? netlink_deliver_tap+0x2e/0x1b0 [ 219.394046][ T9135] ? netlink_deliver_tap+0x2e/0x1b0 [ 219.394070][ T9135] netlink_unicast+0x75b/0x8d0 [ 219.394098][ T9135] netlink_sendmsg+0x805/0xb30 [ 219.394127][ T9135] ? __pfx_netlink_sendmsg+0x10/0x10 [ 219.394152][ T9135] ? aa_sock_msg_perm+0xf1/0x1d0 [ 219.394177][ T9135] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 219.394202][ T9135] ? __pfx_netlink_sendmsg+0x10/0x10 [ 219.394222][ T9135] __sock_sendmsg+0x219/0x270 [ 219.394244][ T9135] ____sys_sendmsg+0x505/0x830 [ 219.394274][ T9135] ? __pfx_____sys_sendmsg+0x10/0x10 [ 219.394303][ T9135] ? import_iovec+0x74/0xa0 [ 219.394323][ T9135] ___sys_sendmsg+0x21f/0x2a0 [ 219.394348][ T9135] ? __pfx____sys_sendmsg+0x10/0x10 [ 219.394406][ T9135] ? __fget_files+0x2a/0x420 [ 219.394430][ T9135] ? __fget_files+0x3a0/0x420 [ 219.394463][ T9135] __x64_sys_sendmsg+0x19b/0x260 [ 219.394490][ T9135] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 219.394522][ T9135] ? __pfx_ksys_write+0x10/0x10 [ 219.394549][ T9135] ? do_syscall_64+0xbe/0x3b0 [ 219.394580][ T9135] do_syscall_64+0xfa/0x3b0 [ 219.394596][ T9135] ? lockdep_hardirqs_on+0x9c/0x150 [ 219.394623][ T9135] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.394642][ T9135] ? clear_bhb_loop+0x60/0xb0 [ 219.394665][ T9135] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.394683][ T9135] RIP: 0033:0x7f8ddef8e929 [ 219.394700][ T9135] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 219.394718][ T9135] RSP: 002b:00007f8ddfd33038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 219.394739][ T9135] RAX: ffffffffffffffda RBX: 00007f8ddf1b5fa0 RCX: 00007f8ddef8e929 [ 219.394753][ T9135] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 219.394765][ T9135] RBP: 00007f8ddfd33090 R08: 0000000000000000 R09: 0000000000000000 [ 219.394778][ T9135] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 219.394789][ T9135] R13: 0000000000000000 R14: 00007f8ddf1b5fa0 R15: 00007ffe999d8a78 [ 219.394819][ T9135] [ 219.734026][ T5896] usb 3-1: Using ep0 maxpacket: 8 [ 219.744267][ T5896] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 219.753529][ T5896] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.762476][ T5896] usb 3-1: Product: syz [ 219.767059][ T5896] usb 3-1: Manufacturer: syz [ 219.771683][ T5896] usb 3-1: SerialNumber: syz [ 219.779991][ T5896] usb 3-1: config 0 descriptor?? [ 219.919271][ T10] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 219.930126][ T5980] cm6533_jd 0003:0D8C:0022.0015: unknown main item tag 0x0 [ 219.950211][ T5980] cm6533_jd 0003:0D8C:0022.0015: unknown main item tag 0x0 [ 219.963461][ T5980] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0D8C:0022.0015/input/input16 [ 219.983452][ T9142] netlink: 'syz.0.971': attribute type 1 has an invalid length. [ 220.006040][ T5980] cm6533_jd 0003:0D8C:0022.0015: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.1-1/input0 [ 220.019770][ T9142] netlink: 4 bytes leftover after parsing attributes in process `syz.0.971'. [ 220.046680][ T5896] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 220.210282][ T5980] usb 2-1: USB disconnect, device number 57 [ 220.838753][ T9129] block nbd2: NBD_DISCONNECT [ 220.898777][ T9159] ieee802154 phy0 wpan0: encryption failed: -22 [ 220.957255][ T10] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 220.968315][ T10] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): Failed to power up PHY: -71 [ 220.979064][ T10] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -71 [ 220.991495][ T10] usb 5-1: USB disconnect, device number 16 [ 221.109960][ T5889] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 221.280732][ T5889] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 221.293561][ T5889] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 221.306176][ T5889] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 221.316349][ T5889] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 221.332373][ T5889] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 221.341864][ T5889] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.356508][ T5889] usb 2-1: config 0 descriptor?? [ 221.615750][ T849] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 221.646492][ T5896] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 221.766948][ T30] audit: type=1326 audit(1750819181.464:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9157 comm="syz.1.976" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f2d5818e929 code=0x0 [ 221.775578][ T849] usb 5-1: not running at top speed; connect to a high speed hub [ 221.798146][ T849] usb 5-1: config 8 has an invalid interface number: 250 but max is 2 [ 221.806740][ T849] usb 5-1: config 8 has an invalid interface number: 6 but max is 2 [ 221.814918][ T849] usb 5-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 221.823651][ T849] usb 5-1: config 8 has an invalid descriptor of length 1, skipping remainder of the config [ 221.834023][ T849] usb 5-1: config 8 has 2 interfaces, different from the descriptor's value: 3 [ 221.843002][ T849] usb 5-1: config 8 has no interface number 0 [ 221.849269][ T849] usb 5-1: config 8 has no interface number 1 [ 221.855445][ T849] usb 5-1: config 8 interface 250 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 13 [ 221.868694][ T849] usb 5-1: config 8 interface 6 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 221.881678][ T849] usb 5-1: config 8 interface 250 has no altsetting 0 [ 221.890361][ T849] usb 5-1: config 8 interface 6 has no altsetting 0 [ 221.900963][ T849] usb 5-1: New USB device found, idVendor=2cb7, idProduct=010b, bcdDevice=69.29 [ 221.910715][ T849] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.919001][ T849] usb 5-1: Product: syz [ 221.923676][ T849] usb 5-1: Manufacturer: syz [ 221.928779][ T849] usb 5-1: SerialNumber: syz [ 221.999455][ T10] usb 3-1: USB disconnect, device number 69 [ 222.160335][ T849] option 5-1:8.250: GSM modem (1-port) converter detected [ 222.161397][ T9170] program syz.2.980 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 222.187524][ T849] usb 5-1: USB disconnect, device number 17 [ 222.197715][ T849] option 5-1:8.250: device disconnected [ 222.838693][ T9175] hfs: can't find a HFS filesystem on dev rnullb0 [ 223.144091][ T5980] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 223.324004][ T5980] usb 5-1: Using ep0 maxpacket: 16 [ 223.333826][ T5980] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 223.353388][ T5980] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 223.374479][ T5980] usb 5-1: Product: syz [ 223.378677][ T5980] usb 5-1: Manufacturer: syz [ 223.383285][ T5980] usb 5-1: SerialNumber: syz [ 223.458143][ T9182] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 223.604432][ T5980] cdc_ncm 5-1:1.0: bind() failure [ 223.630019][ T5980] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 223.637713][ T5980] cdc_ncm 5-1:1.1: bind() failure [ 223.648389][ T5980] usb 5-1: USB disconnect, device number 18 [ 223.737462][ T9194] overlayfs: conflicting lowerdir path [ 223.771240][ T9194] block nbd2: NBD_DISCONNECT [ 223.829620][ T9196] ieee802154 phy0 wpan0: encryption failed: -22 [ 223.839968][ T9196] ./file0: Can't lookup blockdev [ 223.887103][ T5889] usbhid 2-1:0.0: can't add hid device: -71 [ 223.893723][ T5889] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 223.906219][ T5889] usb 2-1: USB disconnect, device number 58 [ 224.412550][ T9218] exFAT-fs (rnullb0): invalid boot record signature [ 224.426708][ T9218] exFAT-fs (rnullb0): failed to read boot sector [ 224.433075][ T9218] exFAT-fs (rnullb0): failed to recognize exfat type [ 224.671222][ T9226] gfs2: not a GFS2 filesystem [ 225.154414][ T10] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 225.337700][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 225.357727][ T10] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 225.369593][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.378109][ T10] usb 5-1: Product: syz [ 225.382281][ T10] usb 5-1: Manufacturer: syz [ 225.386969][ T10] usb 5-1: SerialNumber: syz [ 225.476252][ T5980] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 225.619932][ T10] cdc_ncm 5-1:1.0: bind() failure [ 225.632477][ T10] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 225.641794][ T10] cdc_ncm 5-1:1.1: bind() failure [ 225.646899][ T5980] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 225.646944][ T5980] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 225.649556][ T5980] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 225.674817][ T10] usb 5-1: USB disconnect, device number 19 [ 225.685555][ T5980] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.693772][ T5980] usb 2-1: Product: syz [ 225.698408][ T5980] usb 2-1: Manufacturer: syz [ 225.703014][ T5980] usb 2-1: SerialNumber: syz [ 225.779284][ T9251] pimreg: entered allmulticast mode [ 225.786390][ T9251] pimreg: left allmulticast mode [ 225.961354][ T9235] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 226.210527][ T5980] cdc_mbim 2-1:1.0: failed GET_NTB_PARAMETERS [ 226.221046][ T5980] cdc_mbim 2-1:1.0: bind() failure [ 226.243243][ T5980] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 226.289374][ T5980] cdc_ncm 2-1:1.1: bind() failure [ 226.328357][ T5980] usb 2-1: USB disconnect, device number 59 [ 226.564356][ T927] usb 3-1: new full-speed USB device number 70 using dummy_hcd [ 226.588300][ T9281] UDF-fs: warning (device rnullb0): udf_load_vrs: No VRS found [ 226.596081][ T9281] UDF-fs: Scanning with blocksize 4096 failed [ 226.717976][ T927] usb 3-1: config 0 has an invalid interface number: 123 but max is 0 [ 226.726294][ T927] usb 3-1: config 0 has no interface number 0 [ 226.736041][ T927] usb 3-1: New USB device found, idVendor=20df, idProduct=0001, bcdDevice=97.6d [ 226.745826][ T927] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.753817][ T927] usb 3-1: Product: syz [ 226.758683][ T927] usb 3-1: Manufacturer: syz [ 226.763288][ T927] usb 3-1: SerialNumber: syz [ 226.768093][ T5980] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 226.784790][ T927] usb 3-1: config 0 descriptor?? [ 226.793083][ T927] cdc_acm 3-1:0.123: More than one union descriptor, skipping ... [ 226.924057][ T5980] usb 2-1: Using ep0 maxpacket: 16 [ 226.938107][ T5980] usb 2-1: unable to get BOS descriptor or descriptor too short [ 226.947307][ T5980] usb 2-1: config 52 has an invalid interface number: 231 but max is 0 [ 226.956437][ T5980] usb 2-1: config 52 has no interface number 0 [ 226.962733][ T5980] usb 2-1: config 52 interface 231 has no altsetting 0 [ 226.972817][ T5980] usb 2-1: New USB device found, idVendor=0572, idProduct=58a1, bcdDevice=e4.89 [ 226.982547][ T5980] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.990886][ T5980] usb 2-1: Product: syz [ 227.005426][ T5980] usb 2-1: Manufacturer: syz [ 227.014262][ T5980] usb 2-1: SerialNumber: syz [ 227.063651][ T9291] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 227.107305][ T9291] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 227.211458][ T9293] tipc: Started in network mode [ 227.217340][ T9293] tipc: Node identity ac14142f, cluster identity 4711 [ 227.225185][ T9293] tipc: New replicast peer: 0.0.0.0 [ 227.231173][ T9293] tipc: Enabled bearer , priority 10 [ 227.258147][ T5980] usbhid 2-1:52.231: couldn't find an input interrupt endpoint [ 227.266048][ T9293] netlink: 'syz.4.1020': attribute type 4 has an invalid length. [ 227.273769][ T9293] netlink: 17 bytes leftover after parsing attributes in process `syz.4.1020'. [ 227.286807][ T5980] usb 2-1: USB disconnect, device number 60 [ 227.333252][ T9293] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00aa [ 227.705712][ T5980] usb 3-1: USB disconnect, device number 70 [ 228.113981][ T5980] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 228.266721][ T5980] usb 2-1: Using ep0 maxpacket: 16 [ 228.282698][ T5980] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 228.295834][ T9305] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 228.303965][ T5980] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 228.315552][ T5980] usb 2-1: config 0 has no interface number 0 [ 228.321670][ T5980] usb 2-1: config 0 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 228.354734][ T5973] tipc: Node number set to 2886997039 [ 228.366385][ T5980] usb 2-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 228.379878][ T5980] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.401987][ T5980] usb 2-1: config 0 descriptor?? [ 228.426129][ T5980] usbhid 2-1:0.1: couldn't find an input interrupt endpoint [ 228.712601][ T9317] ntfs3(rnullb0): Primary boot signature is not NTFS. [ 228.762458][ T9317] ntfs3(rnullb0): Alternative boot signature is not NTFS. [ 229.513535][ T9335] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.544335][ T9335] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 229.642160][ T9341] /dev/rnullb0: Can't open blockdev [ 229.724421][ T5973] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 229.787277][ T9345] /dev/rnullb0: Can't open blockdev [ 229.868948][ T9350] /dev/rnullb0: Can't open blockdev [ 229.874016][ T5973] usb 5-1: Using ep0 maxpacket: 8 [ 229.889903][ T5973] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 229.908563][ T5973] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.926905][ T5973] usb 5-1: Product: syz [ 229.935616][ T5973] usb 5-1: Manufacturer: syz [ 229.945854][ T5973] usb 5-1: SerialNumber: syz [ 229.963377][ T5973] usb 5-1: config 0 descriptor?? [ 230.075493][ T5980] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 230.143131][ T9357] netlink: zone id is out of range [ 230.152304][ T9357] netlink: zone id is out of range [ 230.159880][ T9357] netlink: zone id is out of range [ 230.168837][ T9357] netlink: zone id is out of range [ 230.174976][ T9357] netlink: zone id is out of range [ 230.180258][ T9357] netlink: zone id is out of range [ 230.188773][ T5973] dvb_usb_rtl28xxu 5-1:0.0: chip type detection failed -71 [ 230.200628][ T5973] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 230.215275][ T9357] netlink: zone id is out of range [ 230.220494][ T5980] usb 3-1: device descriptor read/64, error -71 [ 230.227209][ T9357] netlink: zone id is out of range [ 230.232468][ T9357] netlink: zone id is out of range [ 230.238068][ T9357] netlink: zone id is out of range [ 230.261233][ T5973] usb 5-1: USB disconnect, device number 20 [ 230.464138][ T5980] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 230.613989][ T5980] usb 3-1: device descriptor read/64, error -71 [ 230.734274][ T5980] usb usb3-port1: attempt power cycle [ 230.768755][ T9368] hpfs: Bad magic ... probably not HPFS [ 230.782764][ T9368] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1048'. [ 230.882560][ T9370] overlayfs: conflicting lowerdir path [ 230.902841][ T5973] usb 2-1: USB disconnect, device number 61 [ 230.939387][ T9370] block nbd4: NBD_DISCONNECT [ 231.002410][ T9374] ieee802154 phy0 wpan0: encryption failed: -22 [ 231.009463][ T9374] ./file0: Can't lookup blockdev [ 231.015871][ T9374] FAULT_INJECTION: forcing a failure. [ 231.015871][ T9374] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 231.029633][ T9374] CPU: 1 UID: 0 PID: 9374 Comm: syz.4.1049 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 231.029659][ T9374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 231.029672][ T9374] Call Trace: [ 231.029680][ T9374] [ 231.029689][ T9374] dump_stack_lvl+0x189/0x250 [ 231.029715][ T9374] ? __pfx____ratelimit+0x10/0x10 [ 231.029744][ T9374] ? __pfx_dump_stack_lvl+0x10/0x10 [ 231.029766][ T9374] ? __pfx__printk+0x10/0x10 [ 231.029787][ T9374] ? __might_fault+0xb0/0x130 [ 231.029819][ T9374] should_fail_ex+0x414/0x560 [ 231.029854][ T9374] _copy_to_iter+0x575/0x16f0 [ 231.029893][ T9374] ? __pfx__copy_to_iter+0x10/0x10 [ 231.029929][ T9374] ? do_raw_spin_unlock+0x122/0x240 [ 231.029960][ T9374] seq_read_iter+0xbeb/0xe10 [ 231.030000][ T9374] proc_reg_read_iter+0x1b4/0x280 [ 231.030022][ T9374] do_iter_readv_writev+0x56e/0x7f0 [ 231.030048][ T9374] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 231.030082][ T9374] ? rw_verify_area+0x258/0x650 [ 231.030107][ T9374] vfs_readv+0x253/0x850 [ 231.030140][ T9374] ? __pfx_vfs_readv+0x10/0x10 [ 231.030183][ T9374] ? __fget_files+0x2a/0x420 [ 231.030218][ T9374] ? __fget_files+0x3a0/0x420 [ 231.030241][ T9374] ? __fget_files+0x2a/0x420 [ 231.030273][ T9374] __x64_sys_preadv+0x197/0x2a0 [ 231.030298][ T9374] ? __pfx___x64_sys_preadv+0x10/0x10 [ 231.030318][ T9374] ? rcu_is_watching+0x15/0xb0 [ 231.030343][ T9374] ? do_syscall_64+0xbe/0x3b0 [ 231.030366][ T9374] do_syscall_64+0xfa/0x3b0 [ 231.030382][ T9374] ? lockdep_hardirqs_on+0x9c/0x150 [ 231.030410][ T9374] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.030429][ T9374] ? clear_bhb_loop+0x60/0xb0 [ 231.030453][ T9374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.030470][ T9374] RIP: 0033:0x7f12e6d8e929 [ 231.030487][ T9374] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 231.030504][ T9374] RSP: 002b:00007f12e4bd5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 231.030524][ T9374] RAX: ffffffffffffffda RBX: 00007f12e6fb6080 RCX: 00007f12e6d8e929 [ 231.030538][ T9374] RDX: 0000000000000005 RSI: 0000200000001680 RDI: 0000000000000007 [ 231.030550][ T9374] RBP: 00007f12e4bd5090 R08: 00000000ffffffff R09: 0000000000000000 [ 231.030564][ T9374] R10: 0000000000000402 R11: 0000000000000246 R12: 0000000000000001 [ 231.030575][ T9374] R13: 0000000000000000 R14: 00007f12e6fb6080 R15: 00007ffee77909b8 [ 231.030607][ T9374] [ 231.273865][ C1] vkms_vblank_simulate: vblank timer overrun [ 231.384931][ T5980] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 231.534094][ T5980] usb 3-1: device descriptor read/8, error -71 [ 231.774010][ T5980] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 231.806217][ T5980] usb 3-1: device descriptor read/8, error -71 [ 231.929118][ T5980] usb usb3-port1: unable to enumerate USB device [ 232.090496][ T9385] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 232.284121][ T5980] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 232.445556][ T5980] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 232.457255][ T5980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 232.468305][ T5980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 232.478174][ T5980] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 232.491100][ T5980] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 232.500245][ T5980] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.510765][ T5980] usb 2-1: config 0 descriptor?? [ 232.935871][ T9384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.945035][ T9384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.168431][ T5980] usbhid 2-1:0.0: can't add hid device: -71 [ 233.177982][ T5980] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 233.198118][ T5980] usb 2-1: USB disconnect, device number 62 [ 233.298441][ T9393] XFS (rnullb0): Invalid superblock magic number [ 233.316411][ T10] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 233.486807][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 233.500924][ T10] usb 5-1: not running at top speed; connect to a high speed hub [ 233.510472][ T10] usb 5-1: config 11 has an invalid interface number: 16 but max is 1 [ 233.519472][ T10] usb 5-1: config 11 has an invalid interface number: 3 but max is 1 [ 233.528023][ T10] usb 5-1: config 11 has no interface number 0 [ 233.535404][ T10] usb 5-1: config 11 has no interface number 1 [ 233.541819][ T10] usb 5-1: config 11 interface 16 has no altsetting 0 [ 233.548897][ T10] usb 5-1: config 11 interface 3 has no altsetting 0 [ 233.558696][ T10] usb 5-1: New USB device found, idVendor=0582, idProduct=0120, bcdDevice=9c.cd [ 233.569376][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 233.577587][ T10] usb 5-1: Product: syz [ 233.581967][ T10] usb 5-1: Manufacturer: syz [ 233.586809][ T10] usb 5-1: SerialNumber: syz [ 233.706754][ T5889] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 233.844749][ T10] usb 5-1: USB disconnect, device number 21 [ 233.885537][ T5973] ------------[ cut here ]------------ [ 233.891469][ T5973] WARNING: net/ipv6/ip6mr.c:2376 at ip6_mr_output+0xe0b/0x1040, CPU#1: kworker/1:4/5973 [ 233.894578][ T6008] udevd[6008]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:11.16/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 233.901303][ T5973] Modules linked in: [ 233.921449][ T5973] CPU: 1 UID: 0 PID: 5973 Comm: kworker/1:4 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 233.933059][ T5973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 233.942118][ T5889] usb 3-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 233.943202][ T5973] Workqueue: wg-crypt-wg2 wg_packet_tx_worker [ 233.960737][ T5973] RIP: 0010:ip6_mr_output+0xe0b/0x1040 [ 233.966262][ T5973] Code: f7 49 bd 00 00 00 00 00 fc ff df 48 8b 74 24 38 45 31 f6 31 ff ba 02 00 00 00 e8 20 1c 1b ff e9 a7 fd ff ff e8 36 af 86 f7 90 <0f> 0b 90 e9 c7 f3 ff ff e8 28 af 86 f7 90 0f 0b 90 43 80 3c 2e 00 [ 233.985936][ T5973] RSP: 0018:ffffc900045674e0 EFLAGS: 00010293 [ 233.992042][ T5973] RAX: ffffffff8a396b8a RBX: 0000000000000000 RCX: ffff88802f4cbc00 [ 234.000068][ T5973] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 234.008093][ T5973] RBP: ffffc90004567758 R08: ffffc900045676c7 R09: 0000000000000000 [ 234.016096][ T5973] R10: ffffc90004567670 R11: fffff520008aced9 R12: 1ffff920008aceac [ 234.023614][ T849] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 234.024109][ T5973] R13: dffffc0000000000 R14: ffffc90004567670 R15: ffff888074dedc80 [ 234.040974][ T5973] FS: 0000000000000000(0000) GS:ffff888125aed000(0000) knlGS:0000000000000000 [ 234.040997][ T5973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 234.041012][ T5973] CR2: 000000110c4262f8 CR3: 0000000028e6c000 CR4: 00000000003526f0 [ 234.041032][ T5973] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 234.041045][ T5973] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 234.041059][ T5973] Call Trace: [ 234.041068][ T5973] [ 234.041079][ T5973] ? __pfx_ip6t_do_table+0x10/0x10 [ 234.041116][ T5973] ? __pfx_ip6_mr_output+0x10/0x10 [ 234.041145][ T5973] ? __ip6_local_out+0x609/0x870 [ 234.041164][ T5973] ? __ip6_local_out+0x82c/0x870 [ 234.041181][ T5973] ? ip6_dst_lookup_tail+0x2ca/0x1510 [ 234.041214][ T5973] ? __ip6_local_out+0x609/0x870 [ 234.041245][ T5973] ? __lock_acquire+0xab9/0xd20 [ 234.041274][ T5973] ? udp6_set_csum+0x995/0xee0 [ 234.041289][ T5973] ? skb_dst+0x4f/0xd0 [ 234.041308][ T5973] ? dst_output+0x177/0x1c0 [ 234.041329][ T5973] udp_tunnel6_xmit_skb+0x640/0xad0 [ 234.041364][ T5973] send6+0x5ac/0x8d0 [ 234.041399][ T5973] ? send6+0x220/0x8d0 [ 234.041433][ T5973] ? __pfx_send6+0x10/0x10 [ 234.041457][ T5973] ? wg_socket_send_skb_to_peer+0x54/0x1d0 [ 234.041508][ T5973] wg_socket_send_skb_to_peer+0x111/0x1d0 [ 234.041540][ T5973] wg_packet_tx_worker+0x1c8/0x7c0 [ 234.041568][ T5973] ? _raw_spin_unlock_irq+0x23/0x50 [ 234.041597][ T5973] ? process_scheduled_works+0x9ef/0x17b0 [ 234.041621][ T5973] process_scheduled_works+0xade/0x17b0 [ 234.041675][ T5973] ? __pfx_process_scheduled_works+0x10/0x10 [ 234.041716][ T5973] worker_thread+0x8a0/0xda0 [ 234.041742][ T5973] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 234.041779][ T5973] ? __kthread_parkme+0x7b/0x200 [ 234.041813][ T5973] kthread+0x711/0x8a0 [ 234.041841][ T5973] ? __pfx_worker_thread+0x10/0x10 [ 234.041863][ T5973] ? __pfx_kthread+0x10/0x10 [ 234.041891][ T5973] ? _raw_spin_unlock_irq+0x23/0x50 [ 234.041918][ T5973] ? lockdep_hardirqs_on+0x9c/0x150 [ 234.041946][ T5973] ? __pfx_kthread+0x10/0x10 [ 234.041972][ T5973] ret_from_fork+0x3fc/0x770 [ 234.041997][ T5973] ? __pfx_ret_from_fork+0x10/0x10 [ 234.042025][ T5973] ? __switch_to_asm+0x39/0x70 [ 234.042050][ T5973] ? __switch_to_asm+0x33/0x70 [ 234.042072][ T5973] ? __pfx_kthread+0x10/0x10 [ 234.042100][ T5973] ret_from_fork_asm+0x1a/0x30 [ 234.042143][ T5973] [ 234.042155][ T5973] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 234.042171][ T5973] CPU: 1 UID: 0 PID: 5973 Comm: kworker/1:4 Not tainted 6.16.0-rc3-next-20250624-syzkaller #0 PREEMPT(full) [ 234.042202][ T5973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 234.042216][ T5973] Workqueue: wg-crypt-wg2 wg_packet_tx_worker [ 234.042243][ T5973] Call Trace: [ 234.042251][ T5973] [ 234.042260][ T5973] dump_stack_lvl+0x99/0x250 [ 234.042282][ T5973] ? __asan_memcpy+0x40/0x70 [ 234.042311][ T5973] ? __pfx_dump_stack_lvl+0x10/0x10 [ 234.042334][ T5973] ? __pfx__printk+0x10/0x10 [ 234.042371][ T5973] panic+0x2db/0x790 [ 234.042397][ T5973] ? __pfx_panic+0x10/0x10 [ 234.042429][ T5973] ? ret_from_fork_asm+0x1a/0x30 [ 234.042460][ T5973] __warn+0x334/0x4c0 [ 234.042477][ T5973] ? ip6_mr_output+0xe0b/0x1040 [ 234.042505][ T5973] ? ip6_mr_output+0xe0b/0x1040 [ 234.042529][ T5973] report_bug+0x2be/0x4f0 [ 234.042556][ T5973] ? ip6_mr_output+0xe0b/0x1040 [ 234.042581][ T5973] ? ip6_mr_output+0xe0b/0x1040 [ 234.042605][ T5973] ? ip6_mr_output+0xe0d/0x1040 [ 234.042629][ T5973] handle_bug+0x84/0x160 [ 234.042650][ T5973] exc_invalid_op+0x1a/0x50 [ 234.042672][ T5973] asm_exc_invalid_op+0x1a/0x20 [ 234.042690][ T5973] RIP: 0010:ip6_mr_output+0xe0b/0x1040 [ 234.042716][ T5973] Code: f7 49 bd 00 00 00 00 00 fc ff df 48 8b 74 24 38 45 31 f6 31 ff ba 02 00 00 00 e8 20 1c 1b ff e9 a7 fd ff ff e8 36 af 86 f7 90 <0f> 0b 90 e9 c7 f3 ff ff e8 28 af 86 f7 90 0f 0b 90 43 80 3c 2e 00 [ 234.042734][ T5973] RSP: 0018:ffffc900045674e0 EFLAGS: 00010293 [ 234.042751][ T5973] RAX: ffffffff8a396b8a RBX: 0000000000000000 RCX: ffff88802f4cbc00 [ 234.042767][ T5973] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 234.042779][ T5973] RBP: ffffc90004567758 R08: ffffc900045676c7 R09: 0000000000000000 [ 234.042794][ T5973] R10: ffffc90004567670 R11: fffff520008aced9 R12: 1ffff920008aceac [ 234.042808][ T5973] R13: dffffc0000000000 R14: ffffc90004567670 R15: ffff888074dedc80 [ 234.042830][ T5973] ? ip6_mr_output+0xe0a/0x1040 [ 234.042861][ T5973] ? __pfx_ip6t_do_table+0x10/0x10 [ 234.042897][ T5973] ? __pfx_ip6_mr_output+0x10/0x10 [ 234.042930][ T5973] ? __ip6_local_out+0x609/0x870 [ 234.042953][ T5973] ? __ip6_local_out+0x82c/0x870 [ 234.042973][ T5973] ? ip6_dst_lookup_tail+0x2ca/0x1510 [ 234.042999][ T5973] ? __ip6_local_out+0x609/0x870 [ 234.043030][ T5973] ? __lock_acquire+0xab9/0xd20 [ 234.043059][ T5973] ? udp6_set_csum+0x995/0xee0 [ 234.043076][ T5973] ? skb_dst+0x4f/0xd0 [ 234.043097][ T5973] ? dst_output+0x177/0x1c0 [ 234.043120][ T5973] udp_tunnel6_xmit_skb+0x640/0xad0 [ 234.043160][ T5973] send6+0x5ac/0x8d0 [ 234.043192][ T5973] ? send6+0x220/0x8d0 [ 234.043233][ T5973] ? __pfx_send6+0x10/0x10 [ 234.043255][ T5973] ? wg_socket_send_skb_to_peer+0x54/0x1d0 [ 234.043303][ T5973] wg_socket_send_skb_to_peer+0x111/0x1d0 [ 234.043334][ T5973] wg_packet_tx_worker+0x1c8/0x7c0 [ 234.043360][ T5973] ? _raw_spin_unlock_irq+0x23/0x50 [ 234.043388][ T5973] ? process_scheduled_works+0x9ef/0x17b0 [ 234.043411][ T5973] process_scheduled_works+0xade/0x17b0 [ 234.043463][ T5973] ? __pfx_process_scheduled_works+0x10/0x10 [ 234.043502][ T5973] worker_thread+0x8a0/0xda0 [ 234.043526][ T5973] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 234.043563][ T5973] ? __kthread_parkme+0x7b/0x200 [ 234.043596][ T5973] kthread+0x711/0x8a0 [ 234.043625][ T5973] ? __pfx_worker_thread+0x10/0x10 [ 234.043646][ T5973] ? __pfx_kthread+0x10/0x10 [ 234.043673][ T5973] ? _raw_spin_unlock_irq+0x23/0x50 [ 234.043700][ T5973] ? lockdep_hardirqs_on+0x9c/0x150 [ 234.043726][ T5973] ? __pfx_kthread+0x10/0x10 [ 234.043753][ T5973] ret_from_fork+0x3fc/0x770 [ 234.043776][ T5973] ? __pfx_ret_from_fork+0x10/0x10 [ 234.043803][ T5973] ? __switch_to_asm+0x39/0x70 [ 234.043826][ T5973] ? __switch_to_asm+0x33/0x70 [ 234.043849][ T5973] ? __pfx_kthread+0x10/0x10 [ 234.043879][ T5973] ret_from_fork_asm+0x1a/0x30 [ 234.043918][ T5973] [ 234.044169][ T5973] Kernel Offset: disabled