last executing test programs: 19.708888351s ago: executing program 3 (id=1572): socket$kcm(0x11, 0x3, 0x0) syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$DRM_IOCTL_SET_VERSION(0xffffffffffffffff, 0xc0106407, &(0x7f0000000000)={0xffffffff, 0x3, 0xe90, 0x19}) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x8, 0xfffffffd, 0x3, 0x2f4a, 0x40000000005, 0x8000000000, 0x52e, 0x10000}, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x20040800) io_uring_setup(0x5bde, &(0x7f0000000380)={0x0, 0x5f41, 0x10, 0x0, 0x160}) pipe2$watch_queue(&(0x7f0000000280)={0xffffffffffffffff}, 0x80) r3 = add_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r2, 0x0) keyctl$revoke(0x3, r3) syz_open_procfs(0x0, &(0x7f00000000c0)='cmdline\x00') socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000200)={{0x200, 0x0, 0x0, 0x2}, 'syz0\x00', 0x3}) ioctl$UI_SET_KEYBIT(r4, 0x40045565, 0xee) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x3e8, 0x1d8, 0x111, 0x4b4, 0x0, 0xd4feffff, 0x330, 0x20a, 0x278, 0x330, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [0x0, 0x0, 0x0, 0xff], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6, 0x0, 0x3}, 0x7a, 0x198, 0x1c0, 0x0, {}, [@common=@unspec=@limit={{}, {0x7fffffff, 0x8, 0x80000001, 0x10f, 0x2, 0x4, 0x7}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "6d93eb04697dfa395e046d7c8e944613a407abbf4ed3e800000000000000082a850e79009e2905d2f98ba18f91f3c93686e9bee067f4e77d9ad6623805004100d7ee97ec7646259d90edece6e9787a97bc956c01754c34c5c9528c46178ed5f9192dae000e579c80eca35a58dc47d1d5e4ff6e216c724e88c70244858700", 0x28, 0x2}}]}, @common=@unspec=@MARK={0x0, 'MARK\x00', 0x2, {0x6, 0x8}}}, {{@uncond, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x5, 0x0, 0x0, 'snmp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0xdf) ioctl$UI_DEV_CREATE(r4, 0x5501) syz_open_dev$tty1(0xc, 0x4, 0x2) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) r6 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) ioctl$DRM_IOCTL_VERSION(r6, 0xc0406400, &(0x7f0000000480)={0x8, 0x4, 0x4, 0x1000, &(0x7f0000001280)=""/4096, 0x0, 0x0, 0x0, 0x0}) 16.368602275s ago: executing program 3 (id=1578): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, 0x0}, 0x94) r0 = socket(0x11, 0xa, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000140)={&(0x7f0000000000), 0x10, &(0x7f0000000080)={0x0}, 0x8}, 0x0) 15.936056543s ago: executing program 3 (id=1581): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x0, 0x90, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x458, 0x5016, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0x40, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x0, 0x1, {0x22, 0xa0}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=@newlink={0x20, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2000000}}, 0x20}}, 0x0) r2 = openat2(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)={0x149842}, 0x68) syz_usb_control_io(r1, &(0x7f00000000c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYRESHEX=r1], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$hiddev(0x0, 0x0, 0xd80c2) poll(0x0, 0x0, 0xffffffff) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@bridge_newneigh={0x28, 0x1c, 0x401, 0x70bd29, 0x25dfdbff, {0x7, 0x0, 0x0, r4, 0x2, 0x15, 0x5}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x8010) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f00000000c0)="10") 15.44468669s ago: executing program 4 (id=1584): syz_open_dev$video4linux(&(0x7f0000000380), 0x2, 0x20) socket$inet6_tcp(0xa, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/vlan/vlan0\x00') r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r0, 0x8923, &(0x7f0000000040)={'vlan0\x00', 0x40}) dup(0xffffffffffffffff) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0xfffffffffffffff1, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15.31788343s ago: executing program 4 (id=1585): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000880)={@local, @link_local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x30, 0x0, 0x0, @local, @local, {[@dstopts={0x89}], "d6eaf5e9114aa92d6ef4c971edf1f3f32acdb1339557d47f451df212f2ec084f845725165a4bdce8"}}}}}, 0x0) r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$binfmt_aout(r2, 0x0, 0x6b1) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='auxv\x00') pread64(r3, &(0x7f0000000000)=""/17, 0x11, 0x3) pread64(0xffffffffffffffff, 0x0, 0x0, 0xc2a) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000000140)={0x0, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000000040)={0x7, {{0xa, 0x4e24, 0x2, @mcast1, 0x1}}}, 0x88) r5 = socket$netlink(0x10, 0x3, 0x4) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r5, 0x10e, 0x1, &(0x7f0000000240)=0x1, 0x4) bind$inet6(r4, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x7d) socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000400)=@overlay={0x7, 0x2, 0x4, 0x70000, 0x8000, {0x0, 0xea60}, {0x1, 0x2, 0xfc, 0x10, 0x40, 0x3, "bacdc584"}, 0x9, 0x3, {}, 0x8, 0x0, r3}) sendmsg$IPCTNL_MSG_CT_GET(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x30, 0x1, 0x1, 0x301, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x10, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x808}]}]}, 0x30}}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a700000000000905", @ANYRES32], 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r7, r7, 0x0, 0x200000) 14.534193132s ago: executing program 1 (id=1588): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f00000001c0)={0x1d, r1}, 0x10) recvmmsg(r0, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0xfffffff7}, {{0x0, 0x0, &(0x7f0000000880)=[{0x0}, {&(0x7f0000000b00)=""/71, 0x47}], 0x2, &(0x7f0000000900)=""/168, 0xa8}, 0x81}], 0x2, 0x40000002, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, &(0x7f00000003c0)=0x1, 0x4) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$can_raw(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@can={{}, 0x0, 0x1, 0x0, 0x0, "0000000000000003"}, 0x10}}, 0x20000000) 14.335629109s ago: executing program 1 (id=1590): sendmsg$can_j1939(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x48084) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b00000000002010400000000000000000700000608000940ffffffff08000440000000810800084000000003200001"], 0xb0}, 0x1, 0x0, 0x0, 0x8004}, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002801c000b8018"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00"/11], 0x50) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000c80)={0x34, &(0x7f0000000480)={0x40, 0xb, 0x1, "e4"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000180)={0x40, 0x12, 0x1, "b4"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'vxcan1\x00'}) syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x800) 14.108871171s ago: executing program 0 (id=1592): inotify_init() r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r2 = epoll_create1(0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) migrate_pages(0x0, 0x9, &(0x7f0000000040)=0x9, &(0x7f0000000380)=0x102) fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mremap(&(0x7f00004d6000/0x4000)=nil, 0x4000, 0x4000, 0x2, &(0x7f00001e2000/0x4000)=nil) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={0x0, 0xffffffffffffffff, 0x0, 0xb7a}, 0x18) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, 0x0, &(0x7f0000000100)={0x80000001, 0x8000001, [0x997, 0x8bf, 0xe4b, 0xc70]}) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) dup(r3) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r5, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f00000003c0)={0x48, 0xc, r1, 0x0, 0x0, 0x200000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000000)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, r2, 0x0) fanotify_init(0x200, 0x40800) unshare(0xa020480) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 14.106677705s ago: executing program 2 (id=1593): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r0, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)="5c5eafd3ae55a73702d6befaee97f47f4be65587e1fca708cee084691e4587d887a5eaab43ac5edc4886496910cd7a153cd84b93208c7b1a625b3ea990092389b19dab4f61e30ee60a4d7e51ffc9a5accbe20844356dd0ce19", 0x59}, {&(0x7f0000000800)="104b0b7073fbd7f77a846bdbfdf6da474f700bf113b18d16d8380f42e296b49f1326c7d0d97be798e205654b8a885df6ee57ec7b690491c55ca484b54170549c7a72b8a579005ffcb0b309dae34571b17126534a763ca881f12d750072abc05a7cb8f0e32fc3ec3ed14c", 0x6a}, {&(0x7f0000000cc0)="91ebffffff7f7d8625547e6fdcfb96c1d9b461ad7581ce705ad7203fb9e00e70512c27e5d5980dbbdb9d8dd381060e0f5bd279f6b8d9109f8e5b1ad6402331e7e4ba5a0300ee40f4ed347c7997c0c822b355f310b659f42003566ffc26878858a5f20373da0b75bed8465da60f840979b6b18d0cbeb297ce3e1e34d46e9e28b416e60e9f9dceb059bd608a506d563315b1a9c536f6ca7ec68acd35c32cdace2471dce1452c62550a9bf975bb6adf889077c111c77030761c0f5d6baccf58dd38bdc0889b55669170d9", 0xc9}, {&(0x7f0000000340)="195ca1e84c12829160283de4f634ba203fee4d872e86c3dd408dbae7edffb39f301f8a933a640bd2581f26fde59de5869a945b960d6d87a4706b64ec96592d5ea5e105bd583c18cd854dc50ce949f490816d2288b71f1384d3db8dd0c7a17cd6a21e8bb8da0e70d1def896758b6e0ec3cd1b9e78a6fac968a75f559657b3ad63d17d13c5f1a162443df8cf3f630949cfcbc2f54adbc26f6f7f68", 0x9a}], 0x4}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000005c0)="33ca667d023ea8f11964db8dba", 0xd}, {&(0x7f0000000b40)="5604b1f93280601007f1bfc8446f785300fcfc78c557b8e530dc9f84187a0dd96c1488a0a665ec777782588791c4fd3b0443cd5bde128419bfe468ef760112d01b2746540dc8a0e9087bde26b530a321fd36ffcbeddbc482d96b9f47e195afe70b764b941e9590c8cfb377d923eaffee045993ff1eb3757b9ec29b8416714cab", 0x80}, {&(0x7f0000001a80)="d61f2c7a6ddbff16a09972b62284a63c170b9a6ec5cd29dfa047b76a9a0eeb4055c9dd2244e47c59e557c459c397cd02eb261fc7d521b1f2e95c3ce17726db0d3236a6d3b52d3f066554d84292329c8a6f034ff8d85d61dcf7ae508c5925903fb1feb7d07fe481313ad476131cf19514d6c77835e9cf82df2f153d9b82985da3e260fc6942d18345ac61b2958886a77e2a2726097d1888a25bee0fdec661520a057f8559f17e462bdf938f7f2303447bfaa744d3891372a825c63e83ff21650af922eaac39ab491cec071d31eebd6526d7a8ddd052d30beb962aeca814ad530c1413e502b92f3e51eaf75ec5b595b19e4945a1a821a8c47f804465f9e04d0ec9aff13036fe4f3a56b324e9ea795cc89d0f30433f3fa8aa7cc4dd93197840d644c6e48329c266316227ea917708cde40163a6b092d3c722a71e9f21255315cb87a74916d56da0479e7e8865b289fc8095a847", 0x152}], 0x3}}], 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 11.679074929s ago: executing program 2 (id=1594): r0 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="2f00000000ca"}, 0x14) r1 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r1, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="933c547ecfa7"}, 0x14) openat$sysfs(0xffffff9c, &(0x7f0000000240)='/sys/power/image_size', 0x40042, 0x252) socket$inet(0x2, 0x1, 0x0) r2 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7737, 0x80, 0x2, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r5, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r5, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2e, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x47bc, 0x0, 0x0, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010400000000000000000500fffe0900010073797a30000000002c000000030a01020000000000000000050000000900010073797a30000000000900030073797a3200000000e4040000060a010400000000000000000500000008000b40000000000900010073797a300000000008000940000000020c0005800800014000000000c40007"], 0x558}, 0x1, 0x0, 0x0, 0x4040000}, 0x40) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)={0x18, r8, 0x1, 0x0, 0x25dfdbfc, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x18}}, 0x2000c050) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0xffffffffffffffff, 0x4) syz_emit_ethernet(0x52, &(0x7f0000000000)={@local, @multicast, @void, {@ipv4={0x800, @tcp={{0xc, 0x4, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp={0x44, 0x14, 0x5, 0x3, 0x0, [0x0, 0x4, 0x10, 0x10]}, @cipso={0x86, 0x6}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x80}}}}}}, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000800)={@local, @empty, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x2, 0x3e, 0x58, 0x68, 0x0, 0x99, 0x2f, 0x0, @multicast2, @remote}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x0, 0x1, 0x9, 0x1, 0x0, 0x1, 0x5, 0x29}, 0x1, {0x7}}}, {0x8, 0x22eb, 0x1, {{0x0, 0x2, 0x34, 0x0, 0x0, 0x0, 0x3, 0xe8}, 0x2, {0xa0000000, 0x4211, 0x2, 0x1f, 0x0, 0x1, 0x3, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}, 0x0) 11.553209167s ago: executing program 4 (id=1595): syz_open_dev$video4linux(&(0x7f0000000380), 0x2, 0x20) socket$inet6_tcp(0xa, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/vlan/vlan0\x00') r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r0, 0x8923, &(0x7f0000000040)={'vlan0\x00', 0x40}) dup(0xffffffffffffffff) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0xfffffffffffffff1, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 10.088320422s ago: executing program 1 (id=1596): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r0, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)="5c5eafd3ae55a73702d6befaee97f47f4be65587e1fca708cee084691e4587d887a5eaab43ac5edc4886496910cd7a153cd84b93208c7b1a625b3ea990092389b19dab4f61e30ee60a4d7e51ffc9a5accbe20844356dd0ce19", 0x59}, {&(0x7f0000000800)="104b0b7073fbd7f77a846bdbfdf6da474f700bf113b18d16d8380f42e296b49f1326c7d0d97be798e205654b8a885df6ee57ec7b690491c55ca484b54170549c7a72b8a579005ffcb0b309dae34571b17126534a763ca881f12d750072abc05a7cb8f0e32fc3ec3ed14c", 0x6a}, {&(0x7f0000000cc0)="91ebffffff7f7d8625547e6fdcfb96c1d9b461ad7581ce705ad7203fb9e00e70512c27e5d5980dbbdb9d8dd381060e0f5bd279f6b8d9109f8e5b1ad6402331e7e4ba5a0300ee40f4ed347c7997c0c822b355f310b659f42003566ffc26878858a5f20373da0b75bed8465da60f840979b6b18d0cbeb297ce3e1e34d46e9e28b416e60e9f9dceb059bd608a506d563315b1a9c536f6ca7ec68acd35c32cdace2471dce1452c62550a9bf975bb6adf889077c111c77030761c0f5d6baccf58dd38bdc0889b55669170d9", 0xc9}], 0x3}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000005c0)="33ca667d023ea8f11964db8dba", 0xd}, {&(0x7f0000000b40)="5604b1f93280601007f1bfc8446f785300fcfc78c557b8e530dc9f84187a0dd96c1488a0a665ec777782588791c4fd3b0443cd5bde128419bfe468ef760112d01b2746540dc8a0e9087bde26b530a321fd36ffcbeddbc482d96b9f47e195afe70b764b941e9590c8cfb377d923eaffee045993ff1eb3757b9ec29b8416714cab", 0x80}, {&(0x7f0000001a80)="d61f2c7a6ddbff16a09972b62284a63c170b9a6ec5cd29dfa047b76a9a0eeb4055c9dd2244e47c59e557c459c397cd02eb261fc7d521b1f2e95c3ce17726db0d3236a6d3b52d3f066554d84292329c8a6f034ff8d85d61dcf7ae508c5925903fb1feb7d07fe481313ad476131cf19514d6c77835e9cf82df2f153d9b82985da3e260fc6942d18345ac61b2958886a77e2a2726097d1888a25bee0fdec661520a057f8559f17e462bdf938f7f2303447bfaa744d3891372a825c63e83ff21650af922eaac39ab491cec071d31eebd6526d7a8ddd052d30beb962aeca814ad530c1413e502b92f3e51eaf75ec5b595b19e4945a1a821a8c47f804465f9e04d0ec9aff13036fe4f3a56b324e9ea795cc89d0f30433f3fa8aa7cc4dd93197840d644c6e48329c266316227ea917708cde40163a6b092d3c722a71e9f21255315cb87a74916d56da0479e7e8865b289fc8095a8477e7fee5eda0c55ec6d53c7aac85f6171717935832962f6db7889683497f3f5a4aa6c6af16908cc4c853536c4f624a75cae053c053f8490c028c15bf043adf4729306a4069324be546a83f71c16a15b86f1d6cb5505808acf055c982dfb14eaaa45b139ccc18952", 0x1b9}], 0x3}}], 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 9.868966287s ago: executing program 3 (id=1597): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) add_key(0x0, 0x0, &(0x7f00000000c0)="01000000010000000000006b", 0xc, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r3, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x0) r4 = socket(0x10, 0x803, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x434, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0xfff, 0x9, 0x3, 0x8, 0xa6, 0x7ff, 0x3, 0x4, 0x6, 0x5d01, 0x9, 0x9, 0x6, 0x1ff, 0x8000, 0x9, 0xfffffffa, 0x200, 0xfff, 0x1, 0x4, 0x6, 0x3, 0xb, 0x4, 0x5fe, 0x4, 0x9, 0x5, 0x7, 0x3, 0x4, 0xffffffff, 0x84, 0x400, 0x8000, 0x9, 0x2ff5, 0xffff, 0x7, 0x4, 0xd5, 0x4, 0x5, 0x8, 0x3ff, 0x4, 0x1, 0x8001, 0x8, 0xa85, 0x4, 0x7, 0x7, 0x1, 0x0, 0x8, 0xffff7fff, 0x1, 0xff, 0x7, 0x1, 0x4, 0x4, 0x0, 0xe6, 0x4, 0x1a, 0x1ff, 0xe, 0x55, 0x7, 0x6, 0x8000008, 0x400, 0x6, 0xffffffff, 0xfffffffe, 0x7, 0x0, 0x80000001, 0x400000, 0x6, 0x401, 0x3, 0x200, 0x1, 0x0, 0x6852, 0x10001, 0x0, 0x3, 0x4, 0xcb, 0xb0, 0xae, 0x8, 0x1, 0x80000000, 0x4, 0x0, 0x6, 0x8, 0x245, 0xfc, 0x8b, 0x80000000, 0x0, 0x5, 0x80000000, 0x5, 0x80000000, 0xa976362a, 0x9, 0x9, 0x8, 0xff, 0x80000000, 0x9, 0x8, 0xc869, 0xffff8001, 0xf7, 0x8, 0x40, 0x8, 0x1, 0xf1, 0x6, 0x7, 0x200, 0x2, 0x200, 0x8, 0x5, 0x8, 0x5, 0x7, 0x1, 0x9, 0x918, 0xc035, 0xe, 0x2, 0x3, 0x4, 0x5, 0x5, 0x7a60, 0x9d, 0xfffffffb, 0x1, 0x0, 0x5, 0x5, 0x1, 0x9, 0x8, 0x4, 0x6, 0xc93, 0x13e, 0xff, 0x4, 0x2, 0x7, 0xcd3, 0x6, 0x4, 0xe, 0xffffa776, 0x401, 0x4, 0x8000, 0x3, 0xdbf, 0x10001, 0x0, 0x4, 0x5683e473, 0x13, 0x81, 0xa187, 0x4, 0x1ff, 0x66c, 0x7ff, 0x3610, 0xfffffffd, 0x5, 0x0, 0x9, 0x5, 0xfffff801, 0x0, 0x81, 0xfffffffb, 0x401, 0x6, 0x6, 0xe, 0x101, 0x4, 0x9, 0x4, 0x97c, 0xdb, 0x1, 0x8, 0x7, 0x8, 0x4fbf, 0x160, 0x2, 0x1, 0x5, 0x3, 0x3, 0xfffffff9, 0x7, 0x8, 0x3, 0x4, 0xa, 0x4, 0x6, 0x400, 0x0, 0x9, 0x2d29, 0x1, 0xffffffff, 0x8001, 0x5, 0x7, 0x9, 0xa, 0xec, 0x5, 0x9, 0xffff8acb, 0x4, 0x9, 0x4, 0x2, 0xffffff35, 0x9, 0x8, 0x5, 0x9, 0x7fff, 0x1, 0x6b, 0x81, 0x1, 0x5]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x24000040}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="500000001000010000000000ecffffff00000000", @ANYRES32=r7, @ANYBLOB="0000000000000000300012800e0001006970366772657461700000001c00028006000f000000000006000e"], 0x50}}, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x5c, 0x2c, 0xd27, 0x30bd29, 0x2, {0x0, 0x0, 0x0, r8, {0x0, 0xc}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x4}, [@TCA_EM_META_HDR={0x4, 0x1, {{0x4, 0x81, 0x1}, {0x2, 0xa5, 0x2}}}]}}]}]}]}}]}, 0x5c}}, 0x0) r9 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r9, 0xc0845657, &(0x7f00000007c0)={0x0, @bt={0x4000a8c, 0x870, 0x0, 0x3, 0xd59f82, 0x2019f5, 0x4, 0xb, 0x0, 0x3, 0x27fd, 0x2800, 0x440, 0x1, 0xd, 0x0, {0x45, 0x80}, 0xcd, 0x3}}) 9.681857639s ago: executing program 0 (id=1598): r0 = syz_open_dev$video(&(0x7f0000000000), 0x7ff, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000001280)={0x1, @pix={0xe, 0x3, 0x3136564e, 0x7, 0x596, 0x9000, 0x6, 0x4, 0x0, 0x6, 0x1}}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="25390000200003"], 0x33fe0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='pagemap\x00') mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000440)={0x0, 0x1328000, 0x800}, 0x20) syz_clone(0x0, 0x0, 0x24, 0x0, 0x0, 0x0) pread64(r6, &(0x7f0000000200)=""/102400, 0x19000, 0x1000000000) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) socket$inet(0xa, 0x801, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f000001de80)=[{{&(0x7f0000000140)=@phonet, 0x80, &(0x7f0000019980)=[{&(0x7f0000019200)=""/179, 0xb3}, {&(0x7f00000192c0)=""/117, 0x75}, {&(0x7f0000019340)=""/157, 0x9d}, {&(0x7f0000019400)=""/195, 0xc3}, {&(0x7f0000019500)=""/197, 0xc5}, {&(0x7f0000019600)=""/225, 0xe1}, {&(0x7f00000000c0)=""/59, 0x3b}, {&(0x7f0000019700)=""/189, 0xbd}, {&(0x7f00000197c0)=""/187, 0xbb}, {&(0x7f0000019880)=""/214, 0xd6}], 0xa, &(0x7f0000019a40)=""/249, 0xf9}, 0x2}, {{&(0x7f000001e000)=@nl=@proc, 0x80, &(0x7f0000019cc0)=[{&(0x7f0000019bc0)=""/30, 0x1e}, {&(0x7f0000019c00)=""/139, 0x8b}], 0x2, &(0x7f0000019d00)=""/38, 0x26}, 0x7}, {{&(0x7f0000019d40)=@qipcrtr, 0x80, &(0x7f0000019fc0)=[{&(0x7f0000019dc0)=""/246, 0xf6}, {&(0x7f0000019ec0)=""/254, 0xfe}], 0x2, &(0x7f000001a000)=""/246, 0xf6}}, {{&(0x7f000001a100)=@un=@abs, 0x80, &(0x7f000001a280)=[{&(0x7f000001a180)=""/200, 0xc8}], 0x1, &(0x7f000001a2c0)=""/27, 0x1b}, 0x7}, {{&(0x7f000001a300)=@alg, 0x80, &(0x7f000001c880)=[{&(0x7f000001a380)=""/97, 0x61}, {&(0x7f000001a400)=""/73, 0x49}, {&(0x7f000001a480)=""/4096, 0x1000}, {&(0x7f000001b480)=""/235, 0xeb}, {&(0x7f000001b580)=""/145, 0x91}, {&(0x7f000001b640)=""/59, 0x3b}, {&(0x7f000001b680)=""/174, 0xae}, {&(0x7f000001b740)=""/4096, 0x1000}, {&(0x7f000001c740)=""/2, 0x2}, {&(0x7f000001c780)=""/213, 0xd5}], 0xa, &(0x7f000001c940)=""/7, 0x7}, 0x9}, {{&(0x7f000001c980)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f000001ce00)=[{&(0x7f000001ca00)=""/104, 0x68}, {&(0x7f000001ca80)=""/208, 0xd0}, {&(0x7f000001cb80)=""/102, 0x66}, {&(0x7f000001cc00)=""/218, 0xda}, {&(0x7f000001cd00)=""/150, 0x96}, {&(0x7f000001cdc0)=""/60, 0x3c}], 0x6, &(0x7f000001ce80)=""/4096, 0x1000}, 0x80000001}], 0x6, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, 0x0, 0x0) r9 = openat$kvm(0xffffffffffffff9c, 0x0, 0x965343, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r10, 0xae60) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) 9.679527178s ago: executing program 4 (id=1599): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000740)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = syz_io_uring_setup(0x487, &(0x7f00000000c0)={0x0, 0x900f, 0x800, 0x2004, 0x165}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x1000065, 0x81, 0x1ff, 0x7, 0x1}, 0x1c) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)) socket(0x11, 0xa, 0x0) socket$xdp(0x2c, 0x3, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x7fffffff, 0x7, 0x4, 0x1000000, 0x800, 0x8, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x1, 0x8, 0x3f9a, 0x0, 0x8000000010001, 0x3}, 0x0, 0x0) recvmmsg$unix(r6, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000200)=""/141, 0x8d}], 0x1}}], 0x1, 0x40000000, 0x0) sendmmsg(r6, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r2, 0x0, 0x0, 0x0, 0x60, 0x1, {0x1}}) io_uring_enter(r3, 0x3517, 0x173d, 0x47, 0x0, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r7, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r7, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 8.567828204s ago: executing program 1 (id=1600): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) r1 = io_uring_setup(0x6ca9, &(0x7f0000000140)={0x0, 0xa99f, 0x2, 0x0, 0x3d9}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r2, r4, 0x2, 0x0) r5 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r5, &(0x7f00000045c0)=[{{&(0x7f0000000040)={0x2, 0x5e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000180)="fd", 0x1}], 0x1}}, {{&(0x7f0000001180)={0x2, 0x4e24, @rand_addr=0x64010100}, 0x10, &(0x7f00000011c0)=[{&(0x7f0000004d00)='f', 0x1}], 0x1}}, {{&(0x7f0000001dc0)={0x2, 0x4e24, @local}, 0x10, &(0x7f0000004200)=[{&(0x7f0000001e80)='<', 0x1}], 0x1}}], 0x3, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000000)={r7, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000001c0)={r7, @in={{0x2, 0x4e24, @loopback}}, 0x9, 0x8, 0x2, 0x91a, 0x28, 0x34b5feca, 0x5}, 0x9c) close_range(r1, 0xffffffffffffffff, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r9, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x27) setsockopt$inet_sctp6_SCTP_MAX_BURST(r8, 0x84, 0x14, &(0x7f0000000040)=@assoc_value={r10, 0x7}, 0x8) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f00000000c0)={r10, 0x7f}, 0x8) r11 = socket(0x1d, 0x2, 0x6) bind$can_j1939(r11, &(0x7f00000000c0)={0x1d, 0x0, 0x2000000000000001, {0x0, 0x0, 0x3}, 0xfe}, 0x18) r12 = accept$alg(r0, 0x0, 0x0) recvmmsg(r12, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000980)=""/87, 0x57}], 0x1}, 0xffffff0b}], 0x1, 0x2101, 0x0) writev(r12, &(0x7f0000000400)=[{&(0x7f0000000000)="2670e400a7cd2502df7986430458f68b124c93cfde5e8611861d74a5572162658ecb1f0717e5b2f49b6d2f60797d2975a524be5f71a43b3dadfa6e06f319bf57fb379cf068a0920ef790b0a8c7288632220046ce2922bc20", 0x58}, {0x0}], 0x2) 7.560140969s ago: executing program 0 (id=1601): r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x9) bind$l2tp6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x65) connect$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0xb}, 0x20) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4c0c4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) r4 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r4, &(0x7f00000000c0)={0x2, 0x4e22, @broadcast}, 0x10) r5 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x10) syz_emit_ethernet(0x8e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa1acd1f78800d86dd608a37f200587300fe8000000000000000000000000000bbfe8000000000000000000000000000aa00000000", @ANYRES8], 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x5, 0x218800) 6.772755804s ago: executing program 1 (id=1602): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x0) ioctl$CEC_RECEIVE(0xffffffffffffffff, 0xc0386106, &(0x7f0000000180)={0x1, 0x1, 0x0, 0x6, 0x0, 0x0, "5debca561a5fbf61048955f6f876b2ff"}) shmdt(0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x1d, 0x1, 0x0, "020000000050000000f13ab2871f6f9ecbc053ffff02361e97000000001b0200", 0x30364d54}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'rmd160\x00'}, 0x58) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_clone(0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000100)={{{@in=@dev={0xac, 0x14, 0x14, 0x39}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4e21, 0x4, 0x4e22, 0x7000, 0x2}, {0x9, 0x5, 0x2, 0x8, 0x0, 0x4d2, 0x4, 0x40}, {0x8, 0x0, 0x89, 0x4}, 0x7e, 0x0, 0x0, 0x1}, {{@in=@broadcast, 0x4d3, 0x2b}, 0x2, @in=@local, 0x34ff, 0x1, 0x1, 0x4, 0x3, 0x5, 0x5cb}}, 0xe8) sendmsg$AUDIT_USER_TTY(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x10, 0x464, 0x1, 0x70bd2a, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x4000}, 0xc054) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x10c4, 0xea90, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io(r4, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0x8, {0x8, 0x0, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x20, 0x1, 0x3, '\x00\x00M'}, 0x0}) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000540)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="20010e"], 0x0}) syz_usb_control_io(r4, 0x0, 0x0) r5 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r5, 0x707, &(0x7f0000000440)={&(0x7f00000001c0)=[{0x8, 0x1001, 0x0, 0x0}, {0x4, 0x4b00, 0x0, 0x0}], 0x2}) 5.668495805s ago: executing program 3 (id=1603): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, 0x0}, 0x94) r0 = socket(0x11, 0xa, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000140)={&(0x7f0000000000), 0x10, &(0x7f0000000080)={0x0}, 0x8}, 0x0) 5.619046677s ago: executing program 2 (id=1604): socket$netlink(0x10, 0x3, 0x10) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @multicast2}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x78020000, 0xffffffffffffffff, {0x2, 0x0, @multicast1}, 0x2, 0x2}}, 0x26) close_range(r1, 0xffffffffffffffff, 0x0) 5.281644038s ago: executing program 4 (id=1605): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) futex(0x0, 0xc, 0x1, 0x0, 0x0, 0x0) 4.91863305s ago: executing program 2 (id=1606): set_mempolicy(0x2, &(0x7f0000000140)=0x8001, 0x2) r0 = userfaultfd(0x801) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000600)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0xfeffffff}) 4.82942471s ago: executing program 0 (id=1607): r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x8) (async) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) (async) r3 = gettid() (async) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8, 0x9f, 0xfb, 0x20, 0x584, 0xb020, 0x4990, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x7f, 0x0, 0x4, [{{0x9, 0x4, 0x1d, 0x1, 0x0, 0x66, 0x73, 0xeb, 0x85}}]}}]}}, 0x0) (async) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') ioctl$UI_DEV_CREATE(r4, 0x5501) (async) timer_create(0x5, &(0x7f0000000140)={0x0, 0x25, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) (async) setsockopt$SO_J1939_ERRQUEUE(r2, 0x6b, 0x4, &(0x7f0000000280)=0x1, 0x4) r5 = socket$inet_sctp(0x2, 0x1, 0x84) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x7}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) (async) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00000002c0)={0x0, 0x795}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000340)=@assoc_value={r7, 0x47}, 0x8) (async) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000000200), &(0x7f0000000240)=0x4) (async) move_pages(r3, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x4) (async) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="26000000000000000005"], 0x26) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002880)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) (async) splice(r1, 0x0, r8, 0x0, 0x26, 0x0) 4.657680119s ago: executing program 3 (id=1608): r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x40, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x3, 0x0, 0xffff1000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, 0x0, 0x0) sendmsg$AUDIT_MAKE_EQUIV(r3, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0x25, &(0x7f0000000100)={&(0x7f0000000140)={0x28, 0x3f7, 0x4, 0x70bd26, 0x25dfdbfd, {0x7, 0x7, './file0', './file0'}, ["", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000040}, 0x8000) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2, 0x11, 0xffffffffffffffff, 0x0) syz_usb_connect(0x4, 0x36, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r6, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x40000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000000)={'macsec0\x00', 0x300}) socket(0x0, 0x80000, 0x3) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000000050005000200000c12000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(r8, &(0x7f0000000280)={0x0, 0x224e, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000ffff00000000020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0500070084000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) 4.382907562s ago: executing program 2 (id=1609): r0 = eventfd2(0x0, 0x0) timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000000080)=0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000005c0)=[{0x16}]}) timer_gettime(0x0, 0x0) timer_gettime(r1, &(0x7f0000000140)) writev(r0, 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r3, 0x11c, 0x1, &(0x7f0000000000)=""/203, &(0x7f0000000100)=0xcb) syz_usb_control_io(r2, 0x0, &(0x7f00000000c0)={0x84, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'sit0\x00'}) ioctl$FS_IOC_GETVERSION(r4, 0xc0145b0e, &(0x7f0000000040)) 4.238404508s ago: executing program 4 (id=1610): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xc3490000) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000001d40)={'broute\x00', 0x0, 0x3, 0x0, [], 0x0, 0x0, 0x0}, &(0x7f0000001dc0)=0xa8) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000000)={'filter\x00', 0x0, 0x0, 0x0, [0x0, 0x7, 0x2, 0x8a0f, 0x7fff, 0x200]}, &(0x7f0000000080)=0x78) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f00000000c0)={'nat\x00', 0x0, 0x0, 0x0, [0xf1, 0xfffffffa, 0x7, 0xfee, 0x3, 0x3], 0x0, 0x1e010000}, &(0x7f0000000340)=0x78) 3.814497108s ago: executing program 0 (id=1611): socket$pppl2tp(0x18, 0x1, 0x1) io_uring_setup(0x25b4, &(0x7f00000002c0)={0x0, 0x8f5f, 0x400, 0x2, 0x3d3}) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, 0x0, 0x0) syz_usb_connect$hid(0x3, 0x0, 0x0, 0x0) ioctl$TCSETSW2(r0, 0x5425, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 356.78338ms ago: executing program 0 (id=1612): unshare(0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = io_uring_setup(0x1f9, &(0x7f0000002280)={0x0, 0x11ab, 0x40, 0x0, 0xa2}) io_uring_setup(0x2ad3, &(0x7f0000002300)={0x0, 0xd4a6, 0x80, 0x0, 0x39f, 0x0, r2}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r3 = add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r3, 0xfffffffffffffffd, 0xfffffffffffffffe, 0x1) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r5, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r5, 0x0, 0xffffffffffffffff, 0x1}) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c) setsockopt$packet_int(r7, 0x107, 0xa, &(0x7f0000000040)=0x2, 0x4) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r6, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r6, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x3d3b4e}) ioctl$IOMMU_IOAS_UNMAP$ALL(r4, 0x3b86, &(0x7f0000000240)={0x18, r5}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x3, 0x0, 0xb49, 0xb, 0x8, 0x0, 0x100006}, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='net/igmp\x00') socket$pppl2tp(0x18, 0x1, 0x1) r8 = syz_open_dev$video(&(0x7f0000000040), 0x0, 0x0) ioctl$VIDIOC_S_FMT(r8, 0xc0d05640, &(0x7f0000000180)={0xe, @raw_data="818c696481b16841b23c1a9a0ebce3ac69030f0565b364db23bcf7c7d8d113edbbc0ab6190dee70c860fb914c6d208771320d39c2da9765390146b9961969fe1d9c9b0c85c0b26ba3c3d1bac1076c1201551523fb5ab8d8301c487d279dd17d7410fab00df7efb052e09a40cdb609432789b81a14794c71146183501a8d4f7bfdeba8100960386a5d943f8fba7c96cfc952325120fd58f89084e2ed5da560c158da978a3af8e58550a2dd044aae1ba75874e29dddadb8590498159924e0cc6c8c291ca2bf4da14d5"}) 169.443588ms ago: executing program 2 (id=1613): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r0, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)="5c5eafd3ae55a73702d6befaee97f47f4be65587e1fca708cee084691e4587d887a5eaab43ac5edc4886496910cd7a153cd84b93208c7b1a625b3ea990092389b19dab4f61e30ee60a4d7e51ffc9a5accbe20844356dd0ce19", 0x59}, {&(0x7f0000000800)="104b0b7073fbd7f77a846bdbfdf6da474f700bf113b18d16d8380f42e296b49f1326c7d0d97be798e205654b8a885df6ee57ec7b690491c55ca484b54170549c7a72b8a579005ffcb0b309dae34571b17126534a763ca881f12d750072abc05a7cb8f0e32fc3ec3ed14c", 0x6a}, {&(0x7f0000000cc0)="91ebffffff7f7d8625547e6fdcfb96c1d9b461ad7581ce705ad7203fb9e00e70512c27e5d5980dbbdb9d8dd381060e0f5bd279f6b8d9109f8e5b1ad6402331e7e4ba5a0300ee40f4ed347c7997c0c822b355f310b659f42003566ffc26878858a5f20373da0b75bed8465da60f840979b6b18d0cbeb297ce3e1e34d46e9e28b416e60e9f9dceb059bd608a506d563315b1a9c536f6ca7ec68acd35c32cdace2471dce1452c62550a9bf975bb6adf889077c111c77030761c0f5d6baccf58dd38bdc0889b55669170d9", 0xc9}], 0x3}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000005c0)="33ca667d023ea8f11964db8dba", 0xd}, {&(0x7f0000000b40)="5604b1f93280601007f1bfc8446f785300fcfc78c557b8e530dc9f84187a0dd96c1488a0a665ec777782588791c4fd3b0443cd5bde128419bfe468ef760112d01b2746540dc8a0e9087bde26b530a321fd36ffcbeddbc482d96b9f47e195afe70b764b941e9590c8cfb377d923eaffee045993ff1eb3757b9ec29b8416714cab", 0x80}, {&(0x7f0000001a80)="d61f2c7a6ddbff16a09972b62284a63c170b9a6ec5cd29dfa047b76a9a0eeb4055c9dd2244e47c59e557c459c397cd02eb261fc7d521b1f2e95c3ce17726db0d3236a6d3b52d3f066554d84292329c8a6f034ff8d85d61dcf7ae508c5925903fb1feb7d07fe481313ad476131cf19514d6c77835e9cf82df2f153d9b82985da3e260fc6942d18345ac61b2958886a77e2a2726097d1888a25bee0fdec661520a057f8559f17e462bdf938f7f2303447bfaa744d3891372a825c63e83ff21650af922eaac39ab491cec071d31eebd6526d7a8ddd052d30beb962aeca814ad530c1413e502b92f3e51eaf75ec5b595b19e4945a1a821a8c47f804465f9e04d0ec9aff13036fe4f3a56b324e9ea795cc89d0f30433f3fa8aa7cc4dd93197840d644c6e48329c266316227ea917708cde40163a6b092d3c722a71e9f21255315cb87a74916d56da0479e7e8865b289fc8095a8477e7fee5eda0c55ec6d53c7aac85f6171717935832962f6db7889683497f3f5a4aa6c6af16908cc4c853536c4f624a75cae053c053f8490c028c15bf043adf4729306a4069324be546a83f71c16a15b86f1d6cb5505808acf055c982dfb14eaaa45b139ccc18952", 0x1b9}], 0x3}}], 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 0s ago: executing program 1 (id=1614): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="d8000000140081044e81f782db44b9040a87080211000000040000a118000200e000000000000e1208000f01c92011148ed08734843cb12b00000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c01000000fdffffffcb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x8d0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet(0x2, 0x3, 0xd) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x7, 0x0, 0x0, 0xfffffffb}]}) getsockopt$inet_mreqsrc(r2, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, &(0x7f0000005fc0), &(0x7f0000006000)=0xc) getsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000000040), &(0x7f00000001c0)=0x4) kernel console output (not intermixed with test programs): r -71 [ 343.528037][ T30] audit: type=1326 audit(1753539392.939:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9672 comm="syz.1.1045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f053a98e9a9 code=0x7ffc0000 [ 343.553889][ T5916] usb 2-1: USB disconnect, device number 41 [ 343.569450][ T30] audit: type=1326 audit(1753539393.029:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9672 comm="syz.1.1045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f053a98e9a9 code=0x7ffc0000 [ 343.593988][ T30] audit: type=1326 audit(1753539393.029:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9672 comm="syz.1.1045" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f053a98e9a9 code=0x7ffc0000 [ 343.626778][ T3091] usb 4-1: device descriptor read/64, error -71 [ 343.715437][ T1206] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 343.785572][ T5944] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 343.816239][ T5944] usb 3-1: device descriptor read/8, error -71 [ 343.875500][ T1206] usb 1-1: Using ep0 maxpacket: 8 [ 343.875837][ T3091] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 343.882534][ T1206] usb 1-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 343.903733][ T1206] usb 1-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 343.924093][ T1206] usb 1-1: config 0 interface 0 has no altsetting 0 [ 343.932008][ T5944] usb usb3-port1: unable to enumerate USB device [ 343.940884][ T1206] usb 1-1: New USB device found, idVendor=5543, idProduct=0045, bcdDevice= 0.00 [ 343.961017][ T1206] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 343.985281][ T1206] usb 1-1: config 0 descriptor?? [ 344.015345][ T3091] usb 4-1: device descriptor read/64, error -71 [ 344.067733][ T9694] program syz.4.1054 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 344.125827][ T3091] usb usb4-port1: attempt power cycle [ 344.536032][ T3091] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 344.612197][ T3091] usb 4-1: device descriptor read/8, error -71 [ 344.694034][ T1206] usb 1-1: string descriptor 0 read error: -71 [ 344.734094][ T1206] uclogic 0003:5543:0045.000D: failed retrieving string descriptor #200: -71 [ 344.809526][ T1206] uclogic 0003:5543:0045.000D: failed retrieving pen parameters: -71 [ 344.860648][ T3091] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 344.892164][ T1206] uclogic 0003:5543:0045.000D: failed probing pen v2 parameters: -71 [ 344.911570][ T3091] usb 4-1: device descriptor read/8, error -71 [ 344.934986][ T1206] uclogic 0003:5543:0045.000D: failed probing parameters: -71 [ 345.009339][ T1206] uclogic 0003:5543:0045.000D: probe with driver uclogic failed with error -71 [ 345.031860][ T3091] usb usb4-port1: unable to enumerate USB device [ 345.129449][ T1206] usb 1-1: USB disconnect, device number 43 [ 345.145320][ T5944] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 345.315463][ T5944] usb 5-1: Using ep0 maxpacket: 32 [ 345.361470][ T5944] usb 5-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 345.375500][ T5944] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.389095][ T5944] usb 5-1: Product: syz [ 345.393299][ T5944] usb 5-1: Manufacturer: syz [ 345.399605][ T5944] usb 5-1: SerialNumber: syz [ 345.405359][ T24] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 345.424242][ T5944] usb 5-1: config 0 descriptor?? [ 345.443959][ T5944] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 345.546028][ T24] usb 3-1: device descriptor read/64, error -71 [ 345.795771][ T24] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 345.920065][ T9717] ptrace attach of "./syz-executor exec"[5860] was attempted by "./syz-executor exec"[9717] [ 345.935584][ T9717] xt_cgroup: invalid path, errno=-2 [ 345.945316][ T24] usb 3-1: device descriptor read/64, error -71 [ 346.064464][ T24] usb usb3-port1: attempt power cycle [ 346.182219][ T9719] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1062'. [ 346.459195][ T24] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 346.547031][ T24] usb 3-1: device descriptor read/8, error -71 [ 346.850701][ T24] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 346.889226][ T24] usb 3-1: device descriptor read/8, error -71 [ 346.990950][ T9726] trusted_key: syz.3.1065 sent an empty control message without MSG_MORE. [ 347.004602][ T9728] binder: 9725:9728 unknown command 0 [ 347.012694][ T9728] binder: 9725:9728 ioctl c0306201 2000000002c0 returned -22 [ 347.021913][ T24] usb usb3-port1: unable to enumerate USB device [ 347.086846][ T5944] gspca_ov534_9: reg_r err -71 [ 347.345761][ T5944] gspca_ov534_9: Unknown sensor 0000 [ 347.345866][ T5944] ov534_9 5-1:0.0: probe with driver ov534_9 failed with error -22 [ 347.363939][ T5944] usb 5-1: USB disconnect, device number 41 [ 348.136417][ T5892] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 348.316676][ T5892] usb 1-1: Using ep0 maxpacket: 32 [ 348.328013][ T5892] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 348.339730][ T5892] usb 1-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 348.355846][ T5892] usb 1-1: config 0 interface 0 has no altsetting 0 [ 348.365418][ T5892] usb 1-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 348.376643][ T5892] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.406346][ T5892] usb 1-1: config 0 descriptor?? [ 348.435967][ T24] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 348.525322][ T5944] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 348.596043][ T9762] ptrace attach of "./syz-executor exec"[5861] was attempted by "./syz-executor exec"[9762] [ 348.607249][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 348.616006][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 348.628234][ T24] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 348.643419][ T9762] xt_cgroup: invalid path, errno=-2 [ 348.661819][ T24] usb 3-1: New USB device found, idVendor=0c12, idProduct=0030, bcdDevice= 0.00 [ 348.672747][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.688143][ T5944] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 348.700887][ T24] usb 3-1: config 0 descriptor?? [ 348.733541][ T5944] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 348.769635][ T5944] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 348.798778][ T5944] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 348.849949][ T5892] corsair-cpro 0003:1B1C:0C10.000E: item fetching failed at offset 2/5 [ 348.872044][ T5944] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 348.881020][ T5892] corsair-cpro 0003:1B1C:0C10.000E: probe with driver corsair-cpro failed with error -22 [ 348.913770][ T5944] usb 2-1: New USB device found, idVendor=a9cd, idProduct=cdee, bcdDevice= 5.b9 [ 348.933237][ T5944] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.957655][ T9766] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1079'. [ 348.969050][ T5944] usb 2-1: config 0 descriptor?? [ 348.975837][ T9755] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 348.997859][ T5944] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 349.013908][ T5944] usb 2-1: MIDIStreaming interface descriptor not found [ 349.535868][ T5892] usb 4-1: new full-speed USB device number 41 using dummy_hcd [ 349.717722][ T5892] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 349.730938][ T5892] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 349.747894][ T5892] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 349.762541][ T5892] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 349.780777][ T5892] usb 4-1: config 0 descriptor?? [ 349.800787][ T5892] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 349.813768][ T5892] dvb-usb: bulk message failed: -22 (3/0) [ 349.839418][ T5892] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 349.856757][ T5892] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 349.870019][ T5892] usb 4-1: media controller created [ 349.881288][ T5892] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 349.919326][ T5892] dvb-usb: bulk message failed: -22 (6/0) [ 349.930297][ T5892] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 349.947621][ T5892] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input56 [ 349.969055][ T5892] dvb-usb: schedule remote query interval to 150 msecs. [ 349.977752][ T5892] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 350.004242][ T9771] dvb-usb: bulk message failed: -22 (2/0) [ 350.035789][ T5916] usb 4-1: USB disconnect, device number 41 [ 350.140182][ T5916] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 350.909867][ T5916] usb 1-1: USB disconnect, device number 44 [ 351.095935][ T24] usb 2-1: USB disconnect, device number 42 [ 351.392367][ T5944] usb 3-1: USB disconnect, device number 68 [ 352.484936][ T5944] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 352.669940][ T5944] usb 1-1: config 0 has no interfaces? [ 352.680427][ T5944] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 352.690382][ T5944] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.727436][ T5944] usb 1-1: Product: syz [ 352.742524][ T5944] usb 1-1: Manufacturer: syz [ 352.751946][ T5944] usb 1-1: SerialNumber: syz [ 352.776409][ T5944] usb 1-1: config 0 descriptor?? [ 353.055027][ T9806] pimreg: entered allmulticast mode [ 353.065556][ T9806] pimreg: left allmulticast mode [ 353.123382][ T9824] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1096'. [ 354.891581][ T9844] @: renamed from vlan0 (while UP) [ 354.995852][ T5944] usb 2-1: new full-speed USB device number 43 using dummy_hcd [ 355.042828][ T5916] usb 1-1: USB disconnect, device number 45 [ 355.169424][ T30] kauditd_printk_skb: 44 callbacks suppressed [ 355.169441][ T30] audit: type=1326 audit(1753539405.109:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9846 comm="syz.0.1104" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff209b8e9a9 code=0x0 [ 355.200471][ T5944] usb 2-1: config 5 has an invalid interface number: 123 but max is 0 [ 355.221089][ T5944] usb 2-1: config 5 has no interface number 0 [ 355.247927][ T5944] usb 2-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 355.305635][ T5944] usb 2-1: config 5 interface 123 altsetting 7 endpoint 0x4 has invalid wMaxPacketSize 0 [ 355.320554][ T5944] usb 2-1: config 5 interface 123 has no altsetting 0 [ 355.357852][ T5944] usb 2-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 355.367872][ T5944] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 355.377860][ T5944] usb 2-1: Product: syz [ 355.382118][ T5944] usb 2-1: Manufacturer: syz [ 355.397495][ T5944] usb 2-1: SerialNumber: syz [ 355.698550][ T9843] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 355.749262][ T9843] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 355.817968][ T5944] ni6501 2-1:5.123: driver 'ni6501' failed to auto-configure device. [ 355.865143][ T5944] usb 2-1: USB disconnect, device number 43 [ 356.375862][ T5892] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 356.632101][ T5892] usb 1-1: Using ep0 maxpacket: 32 [ 356.651882][ T5892] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 356.663882][ T5892] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.697622][ T5892] usb 1-1: config 0 descriptor?? [ 356.991991][ T24] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 357.176637][ T24] usb 2-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 357.188095][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 357.337424][ T24] usb 2-1: config 0 descriptor?? [ 357.389827][ T24] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 357.708880][ T9895] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1115'. [ 357.736355][ T9895] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1115'. [ 359.149779][ T5892] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 359.161219][ T9911] netlink: 112 bytes leftover after parsing attributes in process `syz.2.1117'. [ 359.178122][ T9911] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1117'. [ 359.256754][ T5892] usb 1-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 359.271741][ T5892] usb 1-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 359.407172][ T9915] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1120'. [ 359.644111][ T24] gspca_stv06xx: I2C: Read error writing address: -71 [ 359.674743][ T24] usb 2-1: USB disconnect, device number 44 [ 359.781139][ T9920] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1121'. [ 360.276287][ T9908] ptrace attach of "./syz-executor exec"[5859] was attempted by "./syz-executor exec"[9908] [ 360.433560][ T9908] xt_cgroup: invalid path, errno=-2 [ 360.956054][ T24] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 361.147540][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 361.201788][ T24] usb 2-1: New USB device found, idVendor=0644, idProduct=8021, bcdDevice=38.b7 [ 361.248181][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.288091][ T24] usb 2-1: Product: syz [ 361.302414][ T24] usb 2-1: Manufacturer: syz [ 361.319818][ T24] usb 2-1: SerialNumber: syz [ 361.350699][ T24] usb 2-1: config 0 descriptor?? [ 361.420985][ T24] hub 2-1:0.0: bad descriptor, ignoring hub [ 361.452022][ T24] hub 2-1:0.0: probe with driver hub failed with error -5 [ 362.605908][ T3091] usb 4-1: new full-speed USB device number 42 using dummy_hcd [ 362.828736][ T3091] usb 4-1: not running at top speed; connect to a high speed hub [ 362.840731][ T3091] usb 4-1: config 1 interface 0 altsetting 64 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 362.859833][ T3091] usb 4-1: config 1 interface 0 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 362.879286][ T3091] usb 4-1: config 1 interface 0 has no altsetting 0 [ 362.953776][ T3091] usb 4-1: New USB device found, idVendor=0c70, idProduct=f014, bcdDevice= 0.40 [ 362.964784][ T3091] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.972797][ T3091] usb 4-1: Product: ጠ[ 362.983047][ T3091] usb 4-1: Manufacturer: 䎥ࣅ膤 [ 362.990485][ T3091] usb 4-1: SerialNumber: ŕ   [ 363.205234][ T9961] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 363.518068][ T3091] usbhid 4-1:1.0: can't add hid device: -71 [ 363.598486][ T3091] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 363.871900][ T3091] usb 4-1: USB disconnect, device number 42 [ 363.927633][ T5916] usb 2-1: USB disconnect, device number 45 [ 364.245444][ T5916] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 364.416853][ T5916] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 364.430894][ T5916] usb 2-1: config 0 has no interfaces? [ 364.438921][ T5916] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 364.450806][ T5916] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.476913][ T5916] usb 2-1: Product: syz [ 364.482985][ T5916] usb 2-1: Manufacturer: syz [ 364.491406][ T5916] usb 2-1: SerialNumber: syz [ 364.519752][ T5916] usb 2-1: config 0 descriptor?? [ 364.738405][ T9977] FAULT_INJECTION: forcing a failure. [ 364.738405][ T9977] name failslab, interval 1, probability 0, space 0, times 0 [ 364.764442][ T9977] CPU: 1 UID: 0 PID: 9977 Comm: syz.1.1137 Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full) [ 364.764467][ T9977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 364.764478][ T9977] Call Trace: [ 364.764485][ T9977] [ 364.764492][ T9977] dump_stack_lvl+0x189/0x250 [ 364.764517][ T9977] ? __pfx____ratelimit+0x10/0x10 [ 364.764535][ T9977] ? __pfx_dump_stack_lvl+0x10/0x10 [ 364.764552][ T9977] ? __pfx__printk+0x10/0x10 [ 364.764579][ T9977] ? __pfx___might_resched+0x10/0x10 [ 364.764595][ T9977] ? fs_reclaim_acquire+0x7d/0x100 [ 364.764616][ T9977] should_fail_ex+0x414/0x560 [ 364.764639][ T9977] ? rhashtable_init_noprof+0x4ee/0xbb0 [ 364.764657][ T9977] should_failslab+0xa8/0x100 [ 364.764682][ T9977] __kvmalloc_node_noprof+0x161/0x5f0 [ 364.764705][ T9977] ? rhashtable_init_noprof+0x4ee/0xbb0 [ 364.764732][ T9977] rhashtable_init_noprof+0x4ee/0xbb0 [ 364.764760][ T9977] rhltable_init_noprof+0x1e/0x60 [ 364.764790][ T9977] nf_tables_newtable+0x68f/0x1890 [ 364.764837][ T9977] nfnetlink_rcv+0x112f/0x2520 [ 364.764890][ T9977] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 364.764928][ T9977] ? ref_tracker_free+0x63a/0x7d0 [ 364.764979][ T9977] ? __netlink_deliver_tap+0x807/0x850 [ 364.765012][ T9977] ? netlink_deliver_tap+0x2e/0x1b0 [ 364.765029][ T9977] ? netlink_deliver_tap+0x2e/0x1b0 [ 364.765058][ T9977] netlink_unicast+0x75c/0x8e0 [ 364.765091][ T9977] netlink_sendmsg+0x805/0xb30 [ 364.765124][ T9977] ? __pfx_netlink_sendmsg+0x10/0x10 [ 364.765149][ T9977] ? aa_sock_msg_perm+0x94/0x160 [ 364.765170][ T9977] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 364.765188][ T9977] ? __pfx_netlink_sendmsg+0x10/0x10 [ 364.765211][ T9977] __sock_sendmsg+0x21c/0x270 [ 364.765235][ T9977] ____sys_sendmsg+0x505/0x830 [ 364.765258][ T9977] ? __pfx_____sys_sendmsg+0x10/0x10 [ 364.765284][ T9977] ? import_iovec+0x74/0xa0 [ 364.765312][ T9977] ___sys_sendmsg+0x21f/0x2a0 [ 364.765331][ T9977] ? __pfx____sys_sendmsg+0x10/0x10 [ 364.765387][ T9977] ? __fget_files+0x2a/0x420 [ 364.765401][ T9977] ? __fget_files+0x3a0/0x420 [ 364.765428][ T9977] __x64_sys_sendmsg+0x19b/0x260 [ 364.765448][ T9977] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 364.765475][ T9977] ? __pfx_ksys_write+0x10/0x10 [ 364.765494][ T9977] ? rcu_is_watching+0x15/0xb0 [ 364.765519][ T9977] ? do_syscall_64+0xbe/0x3b0 [ 364.765543][ T9977] do_syscall_64+0xfa/0x3b0 [ 364.765560][ T9977] ? lockdep_hardirqs_on+0x9c/0x150 [ 364.765578][ T9977] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.765592][ T9977] ? clear_bhb_loop+0x60/0xb0 [ 364.765609][ T9977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.765623][ T9977] RIP: 0033:0x7f053a98e9a9 [ 364.765638][ T9977] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 364.765653][ T9977] RSP: 002b:00007f053b8de038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 364.765670][ T9977] RAX: ffffffffffffffda RBX: 00007f053abb5fa0 RCX: 00007f053a98e9a9 [ 364.765682][ T9977] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000011 [ 364.765693][ T9977] RBP: 00007f053b8de090 R08: 0000000000000000 R09: 0000000000000000 [ 364.765704][ T9977] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 364.765714][ T9977] R13: 0000000000000000 R14: 00007f053abb5fa0 R15: 00007f053acdfa28 [ 364.765742][ T9977] [ 364.771752][ T3091] usb 2-1: USB disconnect, device number 46 [ 365.815867][ T3091] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 365.975543][ T3091] usb 3-1: Using ep0 maxpacket: 32 [ 365.982906][ T3091] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 365.994066][ T3091] usb 3-1: config 0 has no interface number 0 [ 366.030703][ T3091] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 366.040713][ T3091] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.054812][ T3091] usb 3-1: Product: syz [ 366.063572][ T3091] usb 3-1: Manufacturer: syz [ 366.075661][T10014] x_tables: duplicate underflow at hook 2 [ 366.163663][ T3091] usb 3-1: SerialNumber: syz [ 366.220736][ T3091] usb 3-1: config 0 descriptor?? [ 366.248168][ T3091] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 366.469642][ T3091] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 366.557004][ T3091] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 366.695814][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 49 [ 366.906300][ T9997] bond_slave_0: entered promiscuous mode [ 366.912291][ T9997] bond_slave_1: entered promiscuous mode [ 366.959251][ T9997] 8021q: adding VLAN 0 to HW filter on device macvtap0 [ 367.000464][T10027] ptrace attach of "./syz-executor exec"[5858] was attempted by "./syz-executor exec"[10027] [ 367.042963][T10027] xt_cgroup: invalid path, errno=-2 [ 367.073256][ T9997] bond_slave_0: left promiscuous mode [ 367.078763][ T9997] bond_slave_1: left promiscuous mode [ 367.325872][ C1] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 367.327170][ T10] usb 3-1: USB disconnect, device number 69 [ 367.399958][ T10] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 367.478478][ T10] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 367.529620][ T10] quatech2 3-1:0.51: device disconnected [ 367.758321][T10038] netlink: 5128 bytes leftover after parsing attributes in process `syz.3.1159'. [ 367.768203][T10038] netlink: 5128 bytes leftover after parsing attributes in process `syz.3.1159'. [ 367.778986][T10038] netlink: 584 bytes leftover after parsing attributes in process `syz.3.1159'. [ 368.045063][ T10] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 368.207402][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 368.235292][ T10] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 368.256185][ T10] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 368.338087][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 368.368349][ T10] usb 4-1: SerialNumber: syz [ 369.598716][T10076] binder: 10073:10076 unknown command 2 [ 369.628895][T10076] binder: 10073:10076 ioctl c0306201 200000000540 returned -22 [ 369.770331][T10080] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1174'. [ 370.200872][T10099] binder: 10098:10099 ioctl c018620b 200000000000 returned -14 [ 370.224013][T10100] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 370.246921][T10099] binder: 10098:10099 ioctl ae01 0 returned -22 [ 370.253875][T10099] binder: 10098:10099 ioctl 81f8943c 2000000001c0 returned -22 [ 370.270185][T10099] binder: 10098:10099 ioctl c0709411 2000000003c0 returned -22 [ 370.751042][ T10] usb 4-1: 0:2 : does not exist [ 370.852744][ T10] usb 4-1: USB disconnect, device number 43 [ 371.705635][ T10] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 372.504246][ T10] usb 3-1: config 0 has an invalid interface number: 69 but max is 0 [ 372.533013][ T10] usb 3-1: config 0 has no interface number 0 [ 372.546369][ T10] usb 3-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 372.656835][ T10] usb 3-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 372.677809][ T10] usb 3-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 372.687320][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 372.725328][ T10] usb 3-1: Product: syz [ 372.740101][ T10] usb 3-1: Manufacturer: syz [ 372.753354][ T10] usb 3-1: SerialNumber: syz [ 372.785391][ T10] usb 3-1: config 0 descriptor?? [ 372.816140][T10123] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 372.826345][ T10] cyberjack 3-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 372.876479][ T10] usb 3-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 373.230153][T10122] netlink: 'syz.2.1186': attribute type 29 has an invalid length. [ 373.239257][T10122] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1186'. [ 373.310471][ T10] usb 3-1: USB disconnect, device number 70 [ 373.341616][ T10] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 373.442623][ T10] cyberjack 3-1:0.69: device disconnected [ 373.489179][T10139] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1190'. [ 376.375178][ T24] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 376.454868][ T5916] usb 3-1: new full-speed USB device number 71 using dummy_hcd [ 376.588068][ T24] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 376.612150][ T24] usb 2-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 376.638393][ T5916] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 376.652358][ T5916] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 376.665762][ T24] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 376.683330][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 376.727513][ T5916] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 376.738225][ T5916] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 376.749712][ T24] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 376.768868][ T5916] usb 3-1: Product: syz [ 376.780930][ T5916] usb 3-1: Manufacturer: syz [ 377.014172][ T5916] hub 3-1:4.0: USB hub found [ 377.021931][ T24] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 377.026369][T10209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 377.097031][T10209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 377.145044][ T5916] hub 3-1:4.0: 6 ports detected [ 377.150571][ T5916] hub 3-1:4.0: insufficient power available to use all downstream ports [ 377.915591][ T24] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 378.044064][T10229] gre1: entered promiscuous mode [ 378.050568][T10229] gre1: entered allmulticast mode [ 378.076809][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 378.208356][ T5916] hub 3-1:4.0: hub_hub_status failed (err = -32) [ 378.246945][ T5916] hub 3-1:4.0: config failed, can't get hub status (err -32) [ 378.528779][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.537532][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.117458][ T6805] usb 2-1: USB disconnect, device number 47 [ 379.146271][T10204] delete_channel: no stack [ 379.217616][ T3091] usb 3-1: USB disconnect, device number 71 [ 380.715343][ T24] usb 5-1: unable to get BOS descriptor or descriptor too short [ 380.743910][ T24] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 380.808848][ T24] usb 5-1: can't read configurations, error -71 [ 381.738229][T10279] Invalid logical block size (18) [ 381.911002][T10275] loop9: detected capacity change from 0 to 7 [ 381.929777][T10275] Buffer I/O error on dev loop9, logical block 0, async page read [ 381.938755][T10275] Buffer I/O error on dev loop9, logical block 0, async page read [ 381.989946][T10275] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.007244][T10275] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.197831][T10275] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.212241][T10275] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.223868][T10275] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.235098][T10275] ldm_validate_partition_table(): Disk read failed. [ 382.243344][T10275] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.255034][T10275] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.265613][T10275] Buffer I/O error on dev loop9, logical block 0, async page read [ 382.275568][T10275] Dev loop9: unable to read RDB block 0 [ 382.285522][T10275] loop9: unable to read partition table [ 382.402955][T10275] loop9: partition table beyond EOD, truncated [ 382.410270][T10275] loop_reread_partitions: partition scan of loop9 (ţ被xüźŃř éÚ¬§˝dG¤´ŕ–ݡŻ ťâ·ű [ 382.410270][T10275] ) failed (rc=-5) [ 382.689106][T10291] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1237'. [ 383.939665][T10301] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 384.935340][ T10] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 384.965268][ T5916] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 385.126908][ T10] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 385.173102][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 385.225926][ T5916] usb 2-1: device descriptor read/64, error -71 [ 385.239712][ T10] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 385.307503][ T10] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 385.316727][ T10] usb 5-1: Manufacturer: syz [ 385.324028][ T10] usb 5-1: config 0 descriptor?? [ 385.527126][ T5916] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 385.641139][ T10] rc_core: IR keymap rc-hauppauge not found [ 385.647646][ T10] Registered IR keymap rc-empty [ 385.653166][ T10] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 385.667457][ T10] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input57 [ 385.703659][ T5916] usb 2-1: device descriptor read/64, error -71 [ 385.735462][ C0] igorplugusb 5-1:0.0: Error: urb status = -32 [ 385.816901][ T5916] usb usb2-port1: attempt power cycle [ 386.171297][ T10] usb 5-1: USB disconnect, device number 44 [ 386.237203][ T5916] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 386.266219][ T5916] usb 2-1: device descriptor read/8, error -71 [ 386.509146][ T5916] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 386.697865][ T5916] usb 2-1: device descriptor read/8, error -71 [ 386.805827][ T5916] usb usb2-port1: unable to enumerate USB device [ 388.508590][ T43] usb 3-1: new full-speed USB device number 72 using dummy_hcd [ 388.753876][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 388.769699][ T43] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 388.801082][ T43] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 388.854150][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 388.900371][ T43] usb 3-1: config 0 descriptor?? [ 389.687751][ T43] usbhid 3-1:0.0: can't add hid device: -71 [ 389.710538][ T43] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 389.740072][ T43] usb 3-1: USB disconnect, device number 72 [ 390.171079][T10396] netlink: 'syz.1.1267': attribute type 10 has an invalid length. [ 390.181762][T10396] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1267'. [ 390.915763][T10403] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1270'. [ 391.516471][T10419] FAULT_INJECTION: forcing a failure. [ 391.516471][T10419] name failslab, interval 1, probability 0, space 0, times 0 [ 391.540101][T10419] CPU: 0 UID: 0 PID: 10419 Comm: syz.1.1275 Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full) [ 391.540126][T10419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 391.540138][T10419] Call Trace: [ 391.540144][T10419] [ 391.540151][T10419] dump_stack_lvl+0x189/0x250 [ 391.540174][T10419] ? __pfx____ratelimit+0x10/0x10 [ 391.540190][T10419] ? __pfx_dump_stack_lvl+0x10/0x10 [ 391.540206][T10419] ? __pfx__printk+0x10/0x10 [ 391.540226][T10419] ? __pfx___might_resched+0x10/0x10 [ 391.540243][T10419] ? fs_reclaim_acquire+0x7d/0x100 [ 391.540261][T10419] should_fail_ex+0x414/0x560 [ 391.540280][T10419] should_failslab+0xa8/0x100 [ 391.540300][T10419] __kmalloc_noprof+0xcb/0x4f0 [ 391.540318][T10419] ? tomoyo_encode+0x28b/0x550 [ 391.540338][T10419] tomoyo_encode+0x28b/0x550 [ 391.540359][T10419] tomoyo_realpath_from_path+0x58d/0x5d0 [ 391.540377][T10419] ? tomoyo_domain+0xd9/0x130 [ 391.540398][T10419] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 391.540420][T10419] tomoyo_path_number_perm+0x1e8/0x5a0 [ 391.540437][T10419] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 391.540466][T10419] ? __lock_acquire+0xab9/0xd20 [ 391.540499][T10419] ? __fget_files+0x2a/0x420 [ 391.540515][T10419] ? __fget_files+0x2a/0x420 [ 391.540525][T10419] ? __fget_files+0x3a0/0x420 [ 391.540536][T10419] ? __fget_files+0x2a/0x420 [ 391.540552][T10419] security_file_ioctl+0xcb/0x2d0 [ 391.540574][T10419] __se_sys_ioctl+0x47/0x170 [ 391.540594][T10419] do_syscall_64+0xfa/0x3b0 [ 391.540610][T10419] ? lockdep_hardirqs_on+0x9c/0x150 [ 391.540624][T10419] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.540639][T10419] ? clear_bhb_loop+0x60/0xb0 [ 391.540655][T10419] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.540674][T10419] RIP: 0033:0x7f053a98e9a9 [ 391.540688][T10419] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 391.540701][T10419] RSP: 002b:00007f053b8de038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 391.540716][T10419] RAX: ffffffffffffffda RBX: 00007f053abb5fa0 RCX: 00007f053a98e9a9 [ 391.540726][T10419] RDX: 0000200000000000 RSI: 000000004188aea7 RDI: 0000000000000005 [ 391.540735][T10419] RBP: 00007f053b8de090 R08: 0000000000000000 R09: 0000000000000000 [ 391.540744][T10419] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 391.540752][T10419] R13: 0000000000000000 R14: 00007f053abb5fa0 R15: 00007f053acdfa28 [ 391.540776][T10419] [ 391.540796][T10419] ERROR: Out of memory at tomoyo_realpath_from_path. [ 391.749108][T10426] FAULT_INJECTION: forcing a failure. [ 391.749108][T10426] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 391.749182][T10426] CPU: 1 UID: 0 PID: 10426 Comm: syz.2.1276 Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full) [ 391.749204][T10426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 391.749215][T10426] Call Trace: [ 391.749223][T10426] [ 391.749230][T10426] dump_stack_lvl+0x189/0x250 [ 391.749255][T10426] ? __pfx____ratelimit+0x10/0x10 [ 391.749274][T10426] ? __pfx_dump_stack_lvl+0x10/0x10 [ 391.749295][T10426] ? __pfx__printk+0x10/0x10 [ 391.749318][T10426] ? __might_fault+0xb0/0x130 [ 391.749348][T10426] should_fail_ex+0x414/0x560 [ 391.749370][T10426] _copy_from_iter+0x1db/0x16f0 [ 391.749404][T10426] ? __pfx__copy_from_iter+0x10/0x10 [ 391.749429][T10426] ? rcu_is_watching+0x15/0xb0 [ 391.749450][T10426] ? trace_kmalloc+0x1f/0xd0 [ 391.749470][T10426] ? kernfs_fop_write_iter+0x158/0x4f0 [ 391.749496][T10426] kernfs_fop_write_iter+0x19f/0x4f0 [ 391.749524][T10426] vfs_write+0x54b/0xa90 [ 391.749551][T10426] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 391.749573][T10426] ? __pfx_vfs_write+0x10/0x10 [ 391.749608][T10426] ? do_sys_openat2+0x154/0x1c0 [ 391.749624][T10426] ? kmem_cache_free+0x18f/0x400 [ 391.749663][T10426] ksys_write+0x145/0x250 [ 391.749688][T10426] ? __pfx_ksys_write+0x10/0x10 [ 391.749707][T10426] ? rcu_is_watching+0x15/0xb0 [ 391.749732][T10426] ? do_syscall_64+0xbe/0x3b0 [ 391.749755][T10426] do_syscall_64+0xfa/0x3b0 [ 391.749773][T10426] ? lockdep_hardirqs_on+0x9c/0x150 [ 391.749791][T10426] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.749809][T10426] ? clear_bhb_loop+0x60/0xb0 [ 391.749830][T10426] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.749846][T10426] RIP: 0033:0x7f98f8f8e9a9 [ 391.749865][T10426] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 391.749880][T10426] RSP: 002b:00007f98f9e18038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 391.749899][T10426] RAX: ffffffffffffffda RBX: 00007f98f91b5fa0 RCX: 00007f98f8f8e9a9 [ 391.749912][T10426] RDX: 0000000000000012 RSI: 0000200000000040 RDI: 0000000000000004 [ 391.749923][T10426] RBP: 00007f98f9e18090 R08: 0000000000000000 R09: 0000000000000000 [ 391.749933][T10426] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 391.749942][T10426] R13: 0000000000000000 R14: 00007f98f91b5fa0 R15: 00007f98f92dfa28 [ 391.749967][T10426] [ 392.022500][ C0] vkms_vblank_simulate: vblank timer overrun [ 392.408098][T10439] "syz.1.1280" (10439) uses obsolete ecb(arc4) skcipher [ 392.625489][T10448] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 392.765997][ T43] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 392.892761][T10447] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 392.905822][ T24] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 392.935672][ T43] usb 4-1: Using ep0 maxpacket: 16 [ 392.947276][ T43] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 392.958392][ T43] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 392.971928][ T43] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 392.982035][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.029065][ T43] usb 4-1: Product: syz [ 393.037676][ T43] usb 4-1: Manufacturer: syz [ 393.045449][ T43] usb 4-1: SerialNumber: syz [ 393.099409][ T24] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 393.110984][ T24] usb 5-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 393.125163][ T24] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 393.134726][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 393.155336][ T5916] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 393.342880][ T5916] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 393.380109][ T5916] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 393.403377][ T5916] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 393.438559][ T5916] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 393.448982][ T5916] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.463746][ T5916] usb 2-1: Product: syz [ 393.539412][ T5916] usb 2-1: Manufacturer: syz [ 393.551540][ T43] usb 4-1: cannot find UAC_HEADER [ 393.583018][ T5916] usb 2-1: SerialNumber: syz [ 393.633263][ T5916] hub 2-1:1.0: bad descriptor, ignoring hub [ 393.665965][ T5916] hub 2-1:1.0: probe with driver hub failed with error -5 [ 393.671089][T10459] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1285'. [ 393.705908][ T6805] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 393.762797][ T24] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 393.771503][ T43] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 393.853347][ T5916] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 52 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 393.866320][ T6805] usb 3-1: Using ep0 maxpacket: 16 [ 393.883917][ T43] usb 4-1: USB disconnect, device number 44 [ 393.978576][ T24] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 394.001498][ T5895] udevd[5895]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 394.047335][ T5895] udevd[5895]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 394.505576][T10471] @: renamed from vlan0 (while UP) [ 395.577568][ T5955] usb 5-1: USB disconnect, device number 45 [ 395.665035][ T24] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 395.849357][ T24] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 395.874180][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.887221][ T24] usb 4-1: Product: syz [ 395.891558][ T24] usb 4-1: Manufacturer: syz [ 395.898387][ T24] usb 4-1: SerialNumber: syz [ 395.956525][ T24] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 395.998332][ T5955] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 396.245943][ T24] usb 4-1: USB disconnect, device number 45 [ 396.408010][ T6805] usb 3-1: unable to get BOS descriptor or descriptor too short [ 396.422449][ T6805] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 396.550558][ T6805] usb 3-1: can't read configurations, error -71 [ 396.585574][ T5916] usb 2-1: USB disconnect, device number 52 [ 396.599418][ T5916] usblp0: removed [ 397.013103][T10507] input: syz0 as /devices/virtual/input/input58 [ 397.180486][ T5955] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 397.199226][ T5955] ath9k_htc: Failed to initialize the device [ 397.225739][ T24] usb 4-1: ath9k_htc: USB layer deinitialized [ 398.655257][ T5916] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 398.986878][ T5916] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 399.006866][ T5916] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 399.066939][ T5916] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 399.100397][ T5916] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 399.169102][ T5916] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 399.190342][ T5916] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 399.211733][T10542] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 399.213450][ T5916] usb 3-1: config 0 descriptor?? [ 399.741293][ T5916] plantronics 0003:047F:FFFF.000F: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 401.167298][ T10] usb 3-1: reset high-speed USB device number 75 using dummy_hcd [ 401.445473][ T10] usb 3-1: device descriptor read/64, error -32 [ 402.065429][ T10] usb 3-1: reset high-speed USB device number 75 using dummy_hcd [ 402.492572][ T10] usb 3-1: device descriptor read/64, error -32 [ 402.707196][T10578] program syz.3.1322 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 402.766300][ T10] usb 3-1: reset high-speed USB device number 75 using dummy_hcd [ 402.806811][ T10] usb 3-1: device firmware changed [ 402.825524][ T5916] usb 3-1: USB disconnect, device number 75 [ 402.891980][T10582] netlink: 80 bytes leftover after parsing attributes in process `syz.4.1323'. [ 402.985870][ T5916] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 402.985898][ T6805] usb 2-1: new full-speed USB device number 53 using dummy_hcd [ 403.025151][ T5944] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 403.148130][ T6805] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 403.159541][ T6805] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 403.172158][ T6805] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 403.184110][ T6805] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 403.195992][ T6805] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 403.211289][ T6805] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 403.215415][ T5944] usb 4-1: Using ep0 maxpacket: 16 [ 403.222151][ T6805] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 403.232834][ T5944] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 403.236371][ T6805] usb 2-1: Product: syz [ 403.246063][ T5916] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 403.248940][ T6805] usb 2-1: Manufacturer: syz [ 403.268508][ T6805] usb 2-1: SerialNumber: syz [ 403.269049][ T5916] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 403.284160][ T5944] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 403.290255][ T6805] usb 2-1: config 0 descriptor?? [ 403.298710][ T5944] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 403.310275][ T5916] usb 3-1: New USB device found, idVendor=18d1, idProduct=9400, bcdDevice= 0.00 [ 403.323327][ T5916] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 403.335619][ T5944] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 403.335815][ T5955] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 403.345812][ T5944] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.364152][ T5916] usb 3-1: config 0 descriptor?? [ 403.381664][ T5944] usb 4-1: Product: syz [ 403.388061][ T5944] usb 4-1: Manufacturer: syz [ 403.392679][ T5944] usb 4-1: SerialNumber: syz [ 403.505871][ T5955] usb 5-1: Using ep0 maxpacket: 32 [ 403.513004][ T5955] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 403.526276][ T6805] radio-si470x 2-1:0.0: DeviceID=0xd318 ChipID=0x30a9 [ 403.533189][ T5955] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 403.545743][ T5955] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 403.556899][ T5955] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 403.569594][ T5955] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 403.581820][ T5955] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 403.599917][ T5955] usb 5-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 403.610353][ T5955] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.620147][ T5955] usb 5-1: Product: syz [ 403.625912][ T5955] usb 5-1: Manufacturer: syz [ 403.627407][ T5944] usb 4-1: 0:2 : does not exist [ 403.630538][ T5955] usb 5-1: SerialNumber: syz [ 403.633596][ T5955] usb 5-1: config 0 descriptor?? [ 403.688296][ T5944] usb 4-1: USB disconnect, device number 46 [ 403.737445][ T5988] udevd[5988]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 403.769008][ T6805] radio-si470x 2-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 403.795280][ T6805] radio-si470x 2-1:0.0: si470x_get_scratch: si470x_get_report returned -71 [ 403.810267][ T6805] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -5 [ 403.827973][ T6805] usb 2-1: USB disconnect, device number 53 [ 404.675365][ T6805] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 404.683040][ T43] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 404.835807][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 404.843037][ T6805] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 404.856426][ T43] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 404.869118][ T6805] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 404.880374][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 404.892219][ T6805] usb 2-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 404.902157][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 404.912857][ T6805] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.921770][ T43] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 404.937686][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 404.950013][ T6805] usb 2-1: config 0 descriptor?? [ 404.956836][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 404.974657][ T43] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 404.991635][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.000726][ T43] usb 4-1: Product: syz [ 405.005827][ T43] usb 4-1: Manufacturer: syz [ 405.010452][ T43] usb 4-1: SerialNumber: syz [ 405.018202][ T43] usb 4-1: config 0 descriptor?? [ 405.208989][T10598] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1328'. [ 405.339568][ T43] usb 3-1: USB disconnect, device number 76 [ 405.409842][ T6805] hid-steam 0003:28DE:1142.0010: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 405.535949][ T6805] hid-steam 0003:28DE:1142.0010: Steam wireless receiver connected [ 405.734501][ T6805] hid-steam 0003:28DE:1142.0011: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 405.983605][ T5916] usb 5-1: USB disconnect, device number 46 [ 406.061793][T10614] FAULT_INJECTION: forcing a failure. [ 406.061793][T10614] name failslab, interval 1, probability 0, space 0, times 0 [ 406.107479][T10614] CPU: 0 UID: 0 PID: 10614 Comm: syz.4.1332 Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full) [ 406.107506][T10614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 406.107513][T10614] Call Trace: [ 406.107518][T10614] [ 406.107523][T10614] dump_stack_lvl+0x189/0x250 [ 406.107540][T10614] ? __pfx____ratelimit+0x10/0x10 [ 406.107551][T10614] ? __pfx_dump_stack_lvl+0x10/0x10 [ 406.107562][T10614] ? __pfx__printk+0x10/0x10 [ 406.107578][T10614] ? ref_tracker_alloc+0x318/0x460 [ 406.107591][T10614] should_fail_ex+0x414/0x560 [ 406.107603][T10614] should_failslab+0xa8/0x100 [ 406.107618][T10614] kmem_cache_alloc_noprof+0x73/0x3c0 [ 406.107630][T10614] ? skb_clone+0x212/0x3a0 [ 406.107642][T10614] skb_clone+0x212/0x3a0 [ 406.107653][T10614] __netlink_deliver_tap+0x404/0x850 [ 406.107673][T10614] ? netlink_deliver_tap+0x2e/0x1b0 [ 406.107686][T10614] netlink_deliver_tap+0x19c/0x1b0 [ 406.107702][T10614] netlink_unicast+0x730/0x8e0 [ 406.107720][T10614] netlink_sendmsg+0x805/0xb30 [ 406.107738][T10614] ? __pfx_netlink_sendmsg+0x10/0x10 [ 406.107751][T10614] ? aa_sock_msg_perm+0x94/0x160 [ 406.107763][T10614] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 406.107773][T10614] ? __pfx_netlink_sendmsg+0x10/0x10 [ 406.107786][T10614] __sock_sendmsg+0x21c/0x270 [ 406.107799][T10614] ____sys_sendmsg+0x505/0x830 [ 406.107811][T10614] ? __pfx_____sys_sendmsg+0x10/0x10 [ 406.107825][T10614] ? import_iovec+0x74/0xa0 [ 406.107840][T10614] ___sys_sendmsg+0x21f/0x2a0 [ 406.107850][T10614] ? __pfx____sys_sendmsg+0x10/0x10 [ 406.107878][T10614] ? __fget_files+0x2a/0x420 [ 406.107886][T10614] ? __fget_files+0x3a0/0x420 [ 406.107900][T10614] __x64_sys_sendmsg+0x19b/0x260 [ 406.107911][T10614] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 406.107925][T10614] ? __pfx_ksys_write+0x10/0x10 [ 406.107936][T10614] ? rcu_is_watching+0x15/0xb0 [ 406.107951][T10614] ? do_syscall_64+0xbe/0x3b0 [ 406.107964][T10614] do_syscall_64+0xfa/0x3b0 [ 406.107974][T10614] ? lockdep_hardirqs_on+0x9c/0x150 [ 406.107984][T10614] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.107993][T10614] ? clear_bhb_loop+0x60/0xb0 [ 406.108004][T10614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.108014][T10614] RIP: 0033:0x7feda198e9a9 [ 406.108023][T10614] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 406.108031][T10614] RSP: 002b:00007feda281f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 406.108042][T10614] RAX: ffffffffffffffda RBX: 00007feda1bb5fa0 RCX: 00007feda198e9a9 [ 406.108049][T10614] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 406.108055][T10614] RBP: 00007feda281f090 R08: 0000000000000000 R09: 0000000000000000 [ 406.108060][T10614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 406.108066][T10614] R13: 0000000000000000 R14: 00007feda1bb5fa0 R15: 00007feda1cdfa28 [ 406.108081][T10614] [ 406.410246][ T6805] usb 2-1: USB disconnect, device number 54 [ 406.431448][ T6805] hid-steam 0003:28DE:1142.0010: Steam wireless receiver disconnected [ 407.272050][T10624] FAULT_INJECTION: forcing a failure. [ 407.272050][T10624] name failslab, interval 1, probability 0, space 0, times 0 [ 407.311353][T10624] CPU: 1 UID: 0 PID: 10624 Comm: syz.1.1335 Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full) [ 407.311379][T10624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 407.311388][T10624] Call Trace: [ 407.311396][T10624] [ 407.311403][T10624] dump_stack_lvl+0x189/0x250 [ 407.311427][T10624] ? __pfx____ratelimit+0x10/0x10 [ 407.311446][T10624] ? __pfx_dump_stack_lvl+0x10/0x10 [ 407.311465][T10624] ? __pfx__printk+0x10/0x10 [ 407.311496][T10624] ? __pfx___might_resched+0x10/0x10 [ 407.311515][T10624] ? fs_reclaim_acquire+0x7d/0x100 [ 407.311537][T10624] should_fail_ex+0x414/0x560 [ 407.311559][T10624] should_failslab+0xa8/0x100 [ 407.311585][T10624] kmem_cache_alloc_noprof+0x73/0x3c0 [ 407.311606][T10624] ? alloc_vfsmnt+0x23/0x4e0 [ 407.311629][T10624] alloc_vfsmnt+0x23/0x4e0 [ 407.311652][T10624] vfs_create_mount+0x6c/0x3d0 [ 407.311676][T10624] __se_sys_fsmount+0x448/0x880 [ 407.311699][T10624] ? __pfx___se_sys_fsmount+0x10/0x10 [ 407.311713][T10624] ? rcu_is_watching+0x15/0xb0 [ 407.311737][T10624] ? do_syscall_64+0xbe/0x3b0 [ 407.311760][T10624] do_syscall_64+0xfa/0x3b0 [ 407.311777][T10624] ? lockdep_hardirqs_on+0x9c/0x150 [ 407.311795][T10624] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.311811][T10624] ? clear_bhb_loop+0x60/0xb0 [ 407.311831][T10624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.311846][T10624] RIP: 0033:0x7f053a98e9a9 [ 407.311862][T10624] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 407.311884][T10624] RSP: 002b:00007f053b8de038 EFLAGS: 00000246 ORIG_RAX: 00000000000001b0 [ 407.311902][T10624] RAX: ffffffffffffffda RBX: 00007f053abb5fa0 RCX: 00007f053a98e9a9 [ 407.311915][T10624] RDX: 0000000000000003 RSI: 0000000000000001 RDI: 0000000000000003 [ 407.311924][T10624] RBP: 00007f053b8de090 R08: 0000000000000000 R09: 0000000000000000 [ 407.311935][T10624] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 407.311945][T10624] R13: 0000000000000000 R14: 00007f053abb5fa0 R15: 00007f053acdfa28 [ 407.311974][T10624] [ 407.577188][ T6805] usb 4-1: USB disconnect, device number 47 [ 408.156124][T10637] ip6erspan0: entered allmulticast mode [ 408.267620][T10645] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1343'. [ 408.498418][T10656] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 408.705702][ T43] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 408.755785][ T5916] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 408.885886][ T43] usb 2-1: Using ep0 maxpacket: 8 [ 408.893365][ T43] usb 2-1: unable to get BOS descriptor or descriptor too short [ 408.904152][ T43] usb 2-1: config 5 has an invalid interface number: 215 but max is 0 [ 408.928801][ T43] usb 2-1: config 5 has no interface number 0 [ 408.937538][ T43] usb 2-1: config 5 interface 215 has no altsetting 0 [ 408.943094][ T5916] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 408.959999][ T5916] usb 5-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 408.974033][ T10] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 408.974230][ T43] usb 2-1: New USB device found, idVendor=1163, idProduct=0100, bcdDevice=dc.ba [ 408.998023][ T5916] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 409.008229][ T5916] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 409.050508][ T5916] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 409.118072][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.128998][ T5916] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 409.145940][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 409.161901][ T43] usb 2-1: Product: syz [ 409.171925][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 409.172545][ T43] usb 2-1: Manufacturer: syz [ 409.183221][ T10] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 2 [ 409.220061][ T43] usb 2-1: SerialNumber: syz [ 409.282719][ T6805] usb 5-1: USB disconnect, device number 47 [ 409.762251][ T43] cypress_m8 2-1:5.215: DeLorme Earthmate USB converter detected [ 409.801648][ T43] usb 2-1: DeLorme Earthmate USB converter now attached to ttyUSB0 [ 409.881290][ T43] usb 2-1: USB disconnect, device number 55 [ 409.950821][ T43] earthmate ttyUSB0: DeLorme Earthmate USB converter now disconnected from ttyUSB0 [ 410.008489][ T43] cypress_m8 2-1:5.215: device disconnected [ 410.218030][ T24] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 410.383230][ T24] usb 5-1: config 0 has no interfaces? [ 410.389785][ T24] usb 5-1: New USB device found, idVendor=05ac, idProduct=1290, bcdDevice=dc.1b [ 410.404057][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.485067][ T24] apple-mfi-fastcharge 5-1: config 0 descriptor?? [ 410.736731][T10678] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1353'. [ 411.298670][ T1206] apple-mfi-fastcharge 5-1: USB disconnect, device number 48 [ 412.118114][ T30] audit: type=1326 audit(1753539462.049:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10691 comm="syz.0.1358" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff209b8e9a9 code=0x0 [ 412.478534][ T10] usb 4-1: string descriptor 0 read error: -71 [ 412.498018][ T10] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice=fa.40 [ 412.532485][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.581103][ T10] usb 4-1: can't set config #1, error -71 [ 412.599986][ T10] usb 4-1: USB disconnect, device number 48 [ 412.611250][T10701] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1362'. [ 412.621496][ T24] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 412.775647][ T24] usb 5-1: device descriptor read/64, error -71 [ 412.895688][ T43] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 412.935756][ T6805] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 412.977687][T10704] netlink: 'syz.0.1363': attribute type 4 has an invalid length. [ 412.989023][T10704] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1363'. [ 413.010786][T10704] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.020439][T10704] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.029844][T10704] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.035783][ T24] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 413.039578][T10704] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.071663][ T43] usb 2-1: Using ep0 maxpacket: 32 [ 413.071715][T10704] geneve2: entered promiscuous mode [ 413.078806][ T6805] usb 3-1: device descriptor read/64, error -71 [ 413.083310][T10704] geneve2: entered allmulticast mode [ 413.095457][ T43] usb 2-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice=3d.42 [ 413.126652][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.153609][ T43] usb 2-1: Product: syz [ 413.165849][ T43] usb 2-1: Manufacturer: syz [ 413.169886][T10704] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.170468][ T43] usb 2-1: SerialNumber: syz [ 413.186200][ T24] usb 5-1: device descriptor read/64, error -71 [ 413.221730][ T43] usb 2-1: config 0 descriptor?? [ 413.231508][T10704] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.231990][T10704] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.232237][T10704] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 413.238477][ T43] ttusb_dec_send_command: command bulk message failed: error -22 [ 413.242282][ T43] ttusb-dec 2-1:0.0: probe with driver ttusb-dec failed with error -22 [ 413.296782][ T24] usb usb5-port1: attempt power cycle [ 413.345861][ T6805] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 413.506011][ T6805] usb 3-1: device descriptor read/64, error -71 [ 413.630007][ T6805] usb usb3-port1: attempt power cycle [ 413.636905][ T24] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 413.668929][ T24] usb 5-1: device descriptor read/8, error -71 [ 413.915383][ T24] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 413.967097][ T24] usb 5-1: device descriptor read/8, error -71 [ 413.985843][ T6805] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 414.006951][ T6805] usb 3-1: device descriptor read/8, error -71 [ 414.095311][ T24] usb usb5-port1: unable to enumerate USB device [ 414.244873][ T6805] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 414.289991][ T6805] usb 3-1: device descriptor read/8, error -71 [ 414.425987][ T6805] usb usb3-port1: unable to enumerate USB device [ 415.115678][ T6805] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 415.284331][ T6805] usb 4-1: Using ep0 maxpacket: 8 [ 415.307994][ T6805] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 415.362114][ T6805] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 415.405921][ T6805] usb 4-1: New USB device strings: Mfr=241, Product=1, SerialNumber=3 [ 415.414142][ T6805] usb 4-1: Product: syz [ 415.460873][ T6805] usb 4-1: Manufacturer: syz [ 415.479933][ T6805] usb 4-1: SerialNumber: syz [ 415.517854][T10733] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1373'. [ 415.536764][ T6805] usb 4-1: config 0 descriptor?? [ 415.558431][ T6805] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 415.576727][T10733] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 415.583268][T10733] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 415.650662][T10733] vhci_hcd vhci_hcd.0: Device attached [ 415.691781][T10734] vhci_hcd: connection closed [ 415.699277][ T3474] vhci_hcd: stop threads [ 415.702361][ T3091] usb 2-1: USB disconnect, device number 56 [ 415.717930][ T3474] vhci_hcd: release socket [ 415.746104][ T3474] vhci_hcd: disconnect device [ 415.758331][T10727] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.781757][T10727] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.821340][ T6805] gspca_zc3xx: reg_w_i err -71 [ 415.886104][T10741] FAULT_INJECTION: forcing a failure. [ 415.886104][T10741] name failslab, interval 1, probability 0, space 0, times 0 [ 415.905422][T10741] CPU: 0 UID: 0 PID: 10741 Comm: syz.1.1375 Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full) [ 415.905447][T10741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 415.905458][T10741] Call Trace: [ 415.905465][T10741] [ 415.905472][T10741] dump_stack_lvl+0x189/0x250 [ 415.905497][T10741] ? __pfx____ratelimit+0x10/0x10 [ 415.905516][T10741] ? __pfx_dump_stack_lvl+0x10/0x10 [ 415.905535][T10741] ? __pfx__printk+0x10/0x10 [ 415.905563][T10741] ? __pfx___might_resched+0x10/0x10 [ 415.905587][T10741] should_fail_ex+0x414/0x560 [ 415.905611][T10741] should_failslab+0xa8/0x100 [ 415.905637][T10741] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 415.905660][T10741] ? __alloc_skb+0x112/0x2d0 [ 415.905686][T10741] __alloc_skb+0x112/0x2d0 [ 415.905711][T10741] netlink_sendmsg+0x5c6/0xb30 [ 415.905742][T10741] ? __pfx_netlink_sendmsg+0x10/0x10 [ 415.905768][T10741] ? aa_sock_msg_perm+0x94/0x160 [ 415.905787][T10741] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 415.905804][T10741] ? __pfx_netlink_sendmsg+0x10/0x10 [ 415.905827][T10741] __sock_sendmsg+0x21c/0x270 [ 415.905848][T10741] ____sys_sendmsg+0x505/0x830 [ 415.905870][T10741] ? __pfx_____sys_sendmsg+0x10/0x10 [ 415.905895][T10741] ? import_iovec+0x74/0xa0 [ 415.905921][T10741] ___sys_sendmsg+0x21f/0x2a0 [ 415.905940][T10741] ? __pfx____sys_sendmsg+0x10/0x10 [ 415.905990][T10741] ? __fget_files+0x2a/0x420 [ 415.906004][T10741] ? __fget_files+0x3a0/0x420 [ 415.906029][T10741] __x64_sys_sendmsg+0x19b/0x260 [ 415.906048][T10741] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 415.906078][T10741] ? __pfx_ksys_write+0x10/0x10 [ 415.906095][T10741] ? rcu_is_watching+0x15/0xb0 [ 415.906117][T10741] ? do_syscall_64+0xbe/0x3b0 [ 415.906137][T10741] do_syscall_64+0xfa/0x3b0 [ 415.906153][T10741] ? lockdep_hardirqs_on+0x9c/0x150 [ 415.906169][T10741] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.906184][T10741] ? clear_bhb_loop+0x60/0xb0 [ 415.906203][T10741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.906217][T10741] RIP: 0033:0x7f053a98e9a9 [ 415.906231][T10741] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 415.906243][T10741] RSP: 002b:00007f053b8de038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 415.906261][T10741] RAX: ffffffffffffffda RBX: 00007f053abb5fa0 RCX: 00007f053a98e9a9 [ 415.906273][T10741] RDX: 0000000000000090 RSI: 00002000000002c0 RDI: 0000000000000003 [ 415.906284][T10741] RBP: 00007f053b8de090 R08: 0000000000000000 R09: 0000000000000000 [ 415.906293][T10741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 415.906302][T10741] R13: 0000000000000000 R14: 00007f053abb5fa0 R15: 00007f053acdfa28 [ 415.906328][T10741] [ 416.181324][ C0] vkms_vblank_simulate: vblank timer overrun [ 416.535619][ T6805] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 416.561100][ T6805] gspca_zc3xx 4-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 416.582693][ T6805] usb 4-1: USB disconnect, device number 49 [ 417.635377][ T1206] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 417.870073][ T1206] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 417.902385][ T1206] usb 4-1: config 0 has no interfaces? [ 418.158441][ T1206] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 418.296337][ T1206] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 418.330346][ T1206] usb 4-1: Product: syz [ 418.337832][ T1206] usb 4-1: Manufacturer: syz [ 418.345797][ T1206] usb 4-1: config 0 descriptor?? [ 419.488009][ T5892] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 419.516596][ T10] usb 4-1: USB disconnect, device number 50 [ 419.523031][ T5892] dvb_usb_az6027 1-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 419.561643][ T5892] usb 1-1: USB disconnect, device number 46 [ 420.023296][T10796] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1389'. [ 420.281890][T10807] netlink: 'syz.4.1391': attribute type 28 has an invalid length. [ 420.445791][ T5892] usb 4-1: new low-speed USB device number 51 using dummy_hcd [ 420.607636][ T5892] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 420.617608][ T5892] usb 4-1: config 0 has no interface number 0 [ 420.643172][ T5892] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 420.762210][T10817] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 420.826683][T10821] FAULT_INJECTION: forcing a failure. [ 420.826683][T10821] name failslab, interval 1, probability 0, space 0, times 0 [ 420.841477][ T5892] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 420.981410][T10821] CPU: 1 UID: 0 PID: 10821 Comm: syz.0.1396 Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full) [ 420.981435][T10821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 420.981445][T10821] Call Trace: [ 420.981453][T10821] [ 420.981461][T10821] dump_stack_lvl+0x189/0x250 [ 420.981486][T10821] ? __pfx____ratelimit+0x10/0x10 [ 420.981505][T10821] ? __pfx_dump_stack_lvl+0x10/0x10 [ 420.981523][T10821] ? __pfx__printk+0x10/0x10 [ 420.981549][T10821] ? __pfx___might_resched+0x10/0x10 [ 420.981569][T10821] ? fs_reclaim_acquire+0x7d/0x100 [ 420.981589][T10821] should_fail_ex+0x414/0x560 [ 420.981611][T10821] should_failslab+0xa8/0x100 [ 420.981634][T10821] kmem_cache_alloc_noprof+0x73/0x3c0 [ 420.981655][T10821] ? skb_clone+0x212/0x3a0 [ 420.981676][T10821] skb_clone+0x212/0x3a0 [ 420.981691][T10821] ? nfnetlink_rcv+0x486/0x2520 [ 420.981713][T10821] nfnetlink_rcv+0x4b4/0x2520 [ 420.981734][T10821] ? unwind_get_return_address+0x4d/0x90 [ 420.981753][T10821] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 420.981790][T10821] ? stack_trace_save+0x9c/0xe0 [ 420.981814][T10821] ? stack_depot_save_flags+0x40/0x900 [ 420.981836][T10821] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 420.981872][T10821] ? __lock_acquire+0xab9/0xd20 [ 420.981910][T10821] ? __lock_acquire+0xab9/0xd20 [ 420.981936][T10821] ? netlink_deliver_tap+0x2e/0x1b0 [ 420.981965][T10821] ? netlink_deliver_tap+0x2e/0x1b0 [ 420.981987][T10821] ? netlink_deliver_tap+0x2e/0x1b0 [ 420.982015][T10821] netlink_unicast+0x75c/0x8e0 [ 420.982047][T10821] netlink_sendmsg+0x805/0xb30 [ 420.982080][T10821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 420.982106][T10821] ? aa_sock_msg_perm+0x94/0x160 [ 420.982126][T10821] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 420.982144][T10821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 420.982167][T10821] __sock_sendmsg+0x21c/0x270 [ 420.982190][T10821] ____sys_sendmsg+0x505/0x830 [ 420.982211][T10821] ? __pfx_____sys_sendmsg+0x10/0x10 [ 420.982236][T10821] ? import_iovec+0x74/0xa0 [ 420.982262][T10821] ___sys_sendmsg+0x21f/0x2a0 [ 420.982280][T10821] ? __pfx____sys_sendmsg+0x10/0x10 [ 420.982332][T10821] ? __fget_files+0x2a/0x420 [ 420.982347][T10821] ? __fget_files+0x3a0/0x420 [ 420.982372][T10821] __x64_sys_sendmsg+0x19b/0x260 [ 420.982391][T10821] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 420.982417][T10821] ? __pfx_ksys_write+0x10/0x10 [ 420.982444][T10821] ? do_syscall_64+0xbe/0x3b0 [ 420.982465][T10821] do_syscall_64+0xfa/0x3b0 [ 420.982481][T10821] ? lockdep_hardirqs_on+0x9c/0x150 [ 420.982499][T10821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.982515][T10821] ? clear_bhb_loop+0x60/0xb0 [ 420.982536][T10821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.982551][T10821] RIP: 0033:0x7ff209b8e9a9 [ 420.982567][T10821] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 420.982581][T10821] RSP: 002b:00007ff20a96f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 420.982598][T10821] RAX: ffffffffffffffda RBX: 00007ff209db5fa0 RCX: 00007ff209b8e9a9 [ 420.982611][T10821] RDX: 0000000024000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 420.982621][T10821] RBP: 00007ff20a96f090 R08: 0000000000000000 R09: 0000000000000000 [ 420.982632][T10821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 420.982641][T10821] R13: 0000000000000000 R14: 00007ff209db5fa0 R15: 00007ff209edfa28 [ 420.982669][T10821] [ 420.983822][ T5892] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 421.586957][ T5892] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 421.600688][ T5892] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 421.673967][ T5892] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 421.821991][ T5892] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 421.876097][ T5892] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.916534][ T5892] usb 4-1: config 0 descriptor?? [ 421.935769][T10802] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 421.943157][T10802] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 421.987802][ T5892] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 422.347601][T10802] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 422.405099][T10802] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 422.477266][ T10] usb 4-1: USB disconnect, device number 51 [ 422.511154][ T10] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 423.005040][ T10] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 423.106678][ T6805] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 423.166819][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 423.175064][ T10] usb 2-1: New USB device found, idVendor=0458, idProduct=5017, bcdDevice= 0.00 [ 423.185268][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.202596][ T10] usb 2-1: config 0 descriptor?? [ 423.292475][T10854] Unknown options in mask 5 [ 423.355907][ T6805] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 423.373705][ T6805] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 423.407446][ T6805] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 423.488732][ T6805] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 423.513172][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 423.521409][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 423.552100][ T6805] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 423.594039][ T6805] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.600043][ T10] usb 2-1: USB disconnect, device number 57 [ 423.683464][T10859] bridge0: port 4(gretap0) entered blocking state [ 423.735525][T10859] bridge0: port 4(gretap0) entered disabled state [ 423.742277][T10859] gretap0: entered allmulticast mode [ 423.752565][T10859] gretap0: entered promiscuous mode [ 423.758946][T10859] bridge0: port 4(gretap0) entered blocking state [ 423.765675][T10859] bridge0: port 4(gretap0) entered forwarding state [ 423.852899][ T6805] usb 3-1: config 0 descriptor?? [ 424.040002][T10866] @: renamed from vlan0 (while UP) [ 424.516974][T10870] bridge0: entered promiscuous mode [ 424.528621][ T6805] usbhid 3-1:0.0: can't add hid device: -71 [ 424.536405][ T6805] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 424.541494][T10870] batman_adv: batadv0: Adding interface: macsec1 [ 424.553590][T10870] batman_adv: batadv0: The MTU of interface macsec1 is too small (1430) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 424.582604][ T6805] usb 3-1: USB disconnect, device number 81 [ 424.603783][T10870] batman_adv: batadv0: Interface activated: macsec1 [ 424.961088][T10881] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1417'. [ 425.004368][T10881] FAULT_INJECTION: forcing a failure. [ 425.004368][T10881] name failslab, interval 1, probability 0, space 0, times 0 [ 425.081150][T10881] CPU: 1 UID: 0 PID: 10881 Comm: syz.0.1417 Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full) [ 425.081167][T10881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 425.081174][T10881] Call Trace: [ 425.081178][T10881] [ 425.081183][T10881] dump_stack_lvl+0x189/0x250 [ 425.081200][T10881] ? __pfx____ratelimit+0x10/0x10 [ 425.081211][T10881] ? __pfx_dump_stack_lvl+0x10/0x10 [ 425.081222][T10881] ? __pfx__printk+0x10/0x10 [ 425.081237][T10881] ? __pfx___might_resched+0x10/0x10 [ 425.081251][T10881] should_fail_ex+0x414/0x560 [ 425.081265][T10881] should_failslab+0xa8/0x100 [ 425.081282][T10881] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 425.081296][T10881] ? __alloc_skb+0x112/0x2d0 [ 425.081307][T10881] ? __pfx___mutex_trylock_common+0x10/0x10 [ 425.081321][T10881] __alloc_skb+0x112/0x2d0 [ 425.081336][T10881] netlink_dump+0x1b1/0xe60 [ 425.081350][T10881] ? __netlink_lookup+0xbd/0x810 [ 425.081366][T10881] ? __pfx_netlink_dump+0x10/0x10 [ 425.081385][T10881] ? netlink_lookup+0x30/0x200 [ 425.081395][T10881] ? netlink_lookup+0x30/0x200 [ 425.081405][T10881] ? netlink_lookup+0x30/0x200 [ 425.081419][T10881] __netlink_dump_start+0x5cb/0x7e0 [ 425.081436][T10881] nfnl_acct_get+0x1b6/0x4a0 [ 425.081450][T10881] ? __pfx_nfnl_acct_get+0x10/0x10 [ 425.081460][T10881] ? __pfx_nfnl_acct_start+0x10/0x10 [ 425.081469][T10881] ? __pfx_nfnl_acct_dump+0x10/0x10 [ 425.081477][T10881] ? __pfx_nfnl_acct_done+0x10/0x10 [ 425.081495][T10881] nfnetlink_rcv_msg+0xb4d/0x1130 [ 425.081506][T10881] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 425.081533][T10881] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 425.081542][T10881] ? __lock_acquire+0xab9/0xd20 [ 425.081568][T10881] ? __lock_acquire+0xab9/0xd20 [ 425.081585][T10881] netlink_rcv_skb+0x205/0x470 [ 425.081598][T10881] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 425.081609][T10881] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 425.081627][T10881] ? bpf_lsm_capable+0x9/0x20 [ 425.081639][T10881] ? security_capable+0x7e/0x2e0 [ 425.081653][T10881] nfnetlink_rcv+0x26a/0x2520 [ 425.081664][T10881] ? unwind_get_return_address+0x4d/0x90 [ 425.081674][T10881] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 425.081687][T10881] ? arch_stack_walk+0xfc/0x150 [ 425.081705][T10881] ? stack_trace_save+0x9c/0xe0 [ 425.081718][T10881] ? stack_depot_save_flags+0x40/0x900 [ 425.081730][T10881] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 425.081742][T10881] ? kasan_save_track+0x4f/0x80 [ 425.081752][T10881] ? kasan_save_track+0x3e/0x80 [ 425.081766][T10881] ? __lock_acquire+0xab9/0xd20 [ 425.081788][T10881] ? __lock_acquire+0xab9/0xd20 [ 425.081803][T10881] ? netlink_deliver_tap+0x2e/0x1b0 [ 425.081819][T10881] ? netlink_deliver_tap+0x2e/0x1b0 [ 425.081830][T10881] ? netlink_deliver_tap+0x2e/0x1b0 [ 425.081845][T10881] netlink_unicast+0x75c/0x8e0 [ 425.081863][T10881] netlink_sendmsg+0x805/0xb30 [ 425.081881][T10881] ? __pfx_netlink_sendmsg+0x10/0x10 [ 425.081895][T10881] ? aa_sock_msg_perm+0x94/0x160 [ 425.081906][T10881] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 425.081916][T10881] ? __pfx_netlink_sendmsg+0x10/0x10 [ 425.081929][T10881] __sock_sendmsg+0x21c/0x270 [ 425.081942][T10881] ____sys_sendmsg+0x505/0x830 [ 425.081955][T10881] ? __pfx_____sys_sendmsg+0x10/0x10 [ 425.081969][T10881] ? import_iovec+0x74/0xa0 [ 425.081983][T10881] ___sys_sendmsg+0x21f/0x2a0 [ 425.081994][T10881] ? __pfx____sys_sendmsg+0x10/0x10 [ 425.082035][T10881] ? __fget_files+0x2a/0x420 [ 425.082049][T10881] ? __fget_files+0x3a0/0x420 [ 425.082074][T10881] __x64_sys_sendmsg+0x19b/0x260 [ 425.082093][T10881] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 425.082111][T10881] ? __pfx_ksys_write+0x10/0x10 [ 425.082126][T10881] ? do_syscall_64+0xbe/0x3b0 [ 425.082139][T10881] do_syscall_64+0xfa/0x3b0 [ 425.082148][T10881] ? lockdep_hardirqs_on+0x9c/0x150 [ 425.082158][T10881] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.082167][T10881] ? clear_bhb_loop+0x60/0xb0 [ 425.082183][T10881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.082192][T10881] RIP: 0033:0x7ff209b8e9a9 [ 425.082201][T10881] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 425.082210][T10881] RSP: 002b:00007ff20a96f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 425.082221][T10881] RAX: ffffffffffffffda RBX: 00007ff209db5fa0 RCX: 00007ff209b8e9a9 [ 425.082228][T10881] RDX: 0000000000000090 RSI: 0000200000000080 RDI: 0000000000000004 [ 425.082234][T10881] RBP: 00007ff20a96f090 R08: 0000000000000000 R09: 0000000000000000 [ 425.082239][T10881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 425.082245][T10881] R13: 0000000000000000 R14: 00007ff209db5fa0 R15: 00007ff209edfa28 [ 425.082260][T10881] [ 425.111442][T10884] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 425.876685][T10891] tipc: Enabled bearer , priority 0 [ 426.116030][T10892] syzkaller0: entered promiscuous mode [ 426.123069][T10892] syzkaller0: entered allmulticast mode [ 426.332989][T10890] tipc: Resetting bearer [ 426.360761][T10890] tipc: Disabling bearer [ 426.805371][ T6805] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 426.985621][ T6805] usb 4-1: Using ep0 maxpacket: 16 [ 427.032132][T10902] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1421'. [ 427.721956][T10902] team0 (unregistering): Port device team_slave_0 removed [ 427.758885][T10902] team0 (unregistering): Port device team_slave_1 removed [ 428.199597][T10913] netlink: 996 bytes leftover after parsing attributes in process `syz.0.1426'. [ 428.255683][T10914] FAULT_INJECTION: forcing a failure. [ 428.255683][T10914] name failslab, interval 1, probability 0, space 0, times 0 [ 428.305360][T10914] CPU: 0 UID: 0 PID: 10914 Comm: syz.2.1425 Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full) [ 428.305388][T10914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 428.305399][T10914] Call Trace: [ 428.305407][T10914] [ 428.305414][T10914] dump_stack_lvl+0x189/0x250 [ 428.305439][T10914] ? __pfx____ratelimit+0x10/0x10 [ 428.305458][T10914] ? __pfx_dump_stack_lvl+0x10/0x10 [ 428.305478][T10914] ? __pfx__printk+0x10/0x10 [ 428.305507][T10914] ? __pfx___might_resched+0x10/0x10 [ 428.305531][T10914] should_fail_ex+0x414/0x560 [ 428.305556][T10914] should_failslab+0xa8/0x100 [ 428.305581][T10914] __kmalloc_cache_noprof+0x70/0x3d0 [ 428.305604][T10914] ? sctp_association_new+0x89/0x25f0 [ 428.305626][T10914] ? __asan_memcpy+0x40/0x70 [ 428.305650][T10914] sctp_association_new+0x89/0x25f0 [ 428.305673][T10914] ? sctp_do_bind+0x657/0x940 [ 428.305699][T10914] ? __ipv6_addr_type+0x10c/0x2f0 [ 428.305720][T10914] sctp_connect_new_asoc+0x2c5/0x690 [ 428.305745][T10914] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 428.305764][T10914] ? __local_bh_enable_ip+0x12d/0x1c0 [ 428.305787][T10914] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 428.305804][T10914] ? security_sctp_bind_connect+0x7e/0x2e0 [ 428.305829][T10914] sctp_sendmsg+0x155c/0x2810 [ 428.305861][T10914] ? __pfx_sctp_sendmsg+0x10/0x10 [ 428.305886][T10914] ? aa_sk_perm+0x81e/0x950 [ 428.305905][T10914] ? __pfx_aa_sk_perm+0x10/0x10 [ 428.305924][T10914] ? sock_rps_record_flow+0x19/0x410 [ 428.305945][T10914] ? inet_sendmsg+0x2f4/0x370 [ 428.305973][T10914] __sock_sendmsg+0x19c/0x270 [ 428.305995][T10914] ____sys_sendmsg+0x52d/0x830 [ 428.306016][T10914] ? __pfx_____sys_sendmsg+0x10/0x10 [ 428.306042][T10914] ? import_iovec+0x74/0xa0 [ 428.306066][T10914] ___sys_sendmsg+0x21f/0x2a0 [ 428.306084][T10914] ? __pfx____sys_sendmsg+0x10/0x10 [ 428.306134][T10914] ? __fget_files+0x2a/0x420 [ 428.306148][T10914] ? __fget_files+0x3a0/0x420 [ 428.306172][T10914] __sys_sendmmsg+0x227/0x430 [ 428.306193][T10914] ? __pfx___sys_sendmmsg+0x10/0x10 [ 428.306206][T10914] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 428.306251][T10914] ? ksys_write+0x22a/0x250 [ 428.306274][T10914] ? __pfx_ksys_write+0x10/0x10 [ 428.306292][T10914] ? rcu_is_watching+0x15/0xb0 [ 428.306317][T10914] __x64_sys_sendmmsg+0xa0/0xc0 [ 428.306335][T10914] do_syscall_64+0xfa/0x3b0 [ 428.306353][T10914] ? lockdep_hardirqs_on+0x9c/0x150 [ 428.306371][T10914] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.306386][T10914] ? clear_bhb_loop+0x60/0xb0 [ 428.306407][T10914] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 428.306426][T10914] RIP: 0033:0x7f98f8f8e9a9 [ 428.306440][T10914] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 428.306454][T10914] RSP: 002b:00007f98f9e18038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 428.306472][T10914] RAX: ffffffffffffffda RBX: 00007f98f91b5fa0 RCX: 00007f98f8f8e9a9 [ 428.306484][T10914] RDX: 0000000000000002 RSI: 0000200000000540 RDI: 0000000000000003 [ 428.306495][T10914] RBP: 00007f98f9e18090 R08: 0000000000000000 R09: 0000000000000000 [ 428.306505][T10914] R10: 00000000000c88c5 R11: 0000000000000246 R12: 0000000000000001 [ 428.306515][T10914] R13: 0000000000000000 R14: 00007f98f91b5fa0 R15: 00007f98f92dfa28 [ 428.306543][T10914] [ 429.081676][T10925] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 429.177515][T10925] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1430'. [ 429.225503][ T10] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 429.387692][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 429.400157][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 429.497538][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 429.523650][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 429.563027][ T10] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 429.599455][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.657467][ T10] usb 3-1: config 0 descriptor?? [ 430.085737][ T6805] usb 4-1: unable to get BOS descriptor or descriptor too short [ 430.108808][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.120703][ T6805] usb 4-1: no configurations [ 430.160546][ T6805] usb 4-1: can't read configurations, error -22 [ 430.194243][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.202615][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.273155][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.337174][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.355589][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.384081][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.413725][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.445689][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.470012][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.512907][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.551899][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.578797][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.608876][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.629562][ T10] plantronics 0003:047F:FFFF.0012: unknown main item tag 0x0 [ 430.696071][T10942] netlink: 448 bytes leftover after parsing attributes in process `syz.3.1436'. [ 430.716666][ T10] plantronics 0003:047F:FFFF.0012: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 430.727770][T10943] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1435'. [ 430.879709][ T10] usb 3-1: USB disconnect, device number 82 [ 431.217450][T10956] netlink: 'syz.1.1434': attribute type 28 has an invalid length. [ 431.246529][T10945] fido_id[10945]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 431.310327][ T10] IPVS: starting estimator thread 0... [ 431.405639][T10961] IPVS: using max 32 ests per chain, 76800 per kthread [ 431.415427][ T5916] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 431.588394][ T5916] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 431.600217][ T5916] usb 4-1: config 0 interface 0 has no altsetting 0 [ 431.680970][ T5916] usb 4-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 431.690433][ T10] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 431.701644][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.721864][ T5916] usb 4-1: Product: syz [ 431.732276][ T5916] usb 4-1: Manufacturer: syz [ 431.746739][ T5916] usb 4-1: SerialNumber: syz [ 431.760122][ T5916] usb 4-1: config 0 descriptor?? [ 431.787735][ T5916] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 431.822222][ T5916] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 431.855610][ T5916] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 431.866577][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 431.873759][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 431.881398][ T10] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 431.901372][ T5916] usb 4-1: media controller created [ 431.910728][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.972006][ T10] usb 2-1: config 0 descriptor?? [ 432.069433][ T5916] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 432.207984][ T5916] DVB: Unable to find symbol tda10046_attach() [ 432.217407][ T5916] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 432.236445][ T5916] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 432.475444][ T10] corsair-cpro 0003:1B1C:0C10.0013: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.1-1/input0 [ 432.783831][ T30] audit: type=1400 audit(1753539482.719:165): apparmor="DENIED" operation="setprocattr" info="exec" error=-22 profile="unconfined" pid=10974 comm="syz.4.1443" [ 432.921259][ T10] corsair-cpro 0003:1B1C:0C10.0013: probe with driver corsair-cpro failed with error -71 [ 432.971633][ T10] usb 2-1: USB disconnect, device number 58 [ 433.083021][T10982] @: renamed from vlan0 (while UP) [ 433.252308][T10989] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1448'. [ 433.595678][ T6805] usb 1-1: new full-speed USB device number 47 using dummy_hcd [ 433.656161][T10996] usb usb8: usbfs: process 10996 (syz.1.1450) did not claim interface 0 before use [ 433.780168][ T5916] dvb_usb_m920x 4-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 433.801147][ T6805] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 433.801250][ T5916] usb 4-1: USB disconnect, device number 54 [ 433.814245][ T6805] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 434.853793][ T6805] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 434.924348][ T6805] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.939318][T10998] FAULT_INJECTION: forcing a failure. [ 434.939318][T10998] name failslab, interval 1, probability 0, space 0, times 0 [ 434.955631][T10998] CPU: 0 UID: 0 PID: 10998 Comm: syz.3.1451 Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full) [ 434.955654][T10998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 434.955666][T10998] Call Trace: [ 434.955673][T10998] [ 434.955680][T10998] dump_stack_lvl+0x189/0x250 [ 434.955706][T10998] ? __pfx____ratelimit+0x10/0x10 [ 434.955726][T10998] ? __pfx_dump_stack_lvl+0x10/0x10 [ 434.955745][T10998] ? __pfx__printk+0x10/0x10 [ 434.955772][T10998] ? ref_tracker_alloc+0x318/0x460 [ 434.955794][T10998] should_fail_ex+0x414/0x560 [ 434.955817][T10998] should_failslab+0xa8/0x100 [ 434.955840][T10998] kmem_cache_alloc_noprof+0x73/0x3c0 [ 434.955860][T10998] ? skb_clone+0x212/0x3a0 [ 434.955882][T10998] skb_clone+0x212/0x3a0 [ 434.955902][T10998] __netlink_deliver_tap+0x404/0x850 [ 434.955936][T10998] ? netlink_deliver_tap+0x2e/0x1b0 [ 434.955962][T10998] netlink_deliver_tap+0x19c/0x1b0 [ 434.955987][T10998] netlink_unicast+0x730/0x8e0 [ 434.956021][T10998] netlink_sendmsg+0x805/0xb30 [ 434.956054][T10998] ? __pfx_netlink_sendmsg+0x10/0x10 [ 434.956081][T10998] ? aa_sock_msg_perm+0x94/0x160 [ 434.956103][T10998] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 434.956121][T10998] ? __pfx_netlink_sendmsg+0x10/0x10 [ 434.956146][T10998] __sock_sendmsg+0x21c/0x270 [ 434.956171][T10998] ____sys_sendmsg+0x505/0x830 [ 434.956194][T10998] ? __pfx_____sys_sendmsg+0x10/0x10 [ 434.956221][T10998] ? import_iovec+0x74/0xa0 [ 434.956249][T10998] ___sys_sendmsg+0x21f/0x2a0 [ 434.956269][T10998] ? __pfx____sys_sendmsg+0x10/0x10 [ 434.956323][T10998] ? __fget_files+0x2a/0x420 [ 434.956339][T10998] ? __fget_files+0x3a0/0x420 [ 434.956365][T10998] __x64_sys_sendmsg+0x19b/0x260 [ 434.956385][T10998] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 434.956412][T10998] ? __pfx_ksys_write+0x10/0x10 [ 434.956432][T10998] ? rcu_is_watching+0x15/0xb0 [ 434.956457][T10998] ? do_syscall_64+0xbe/0x3b0 [ 434.956481][T10998] do_syscall_64+0xfa/0x3b0 [ 434.956498][T10998] ? lockdep_hardirqs_on+0x9c/0x150 [ 434.956517][T10998] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.956541][T10998] ? clear_bhb_loop+0x60/0xb0 [ 434.956562][T10998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.956579][T10998] RIP: 0033:0x7fdf0118e9a9 [ 434.956596][T10998] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 434.956611][T10998] RSP: 002b:00007fdf0202b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 434.956630][T10998] RAX: ffffffffffffffda RBX: 00007fdf013b5fa0 RCX: 00007fdf0118e9a9 [ 434.956643][T10998] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000008 [ 434.956655][T10998] RBP: 00007fdf0202b090 R08: 0000000000000000 R09: 0000000000000000 [ 434.956666][T10998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 434.956676][T10998] R13: 0000000000000000 R14: 00007fdf013b5fa0 R15: 00007fdf014dfa28 [ 434.956706][T10998] [ 434.963927][ T6805] usb 1-1: Product: syz [ 435.295710][ T6805] usb 1-1: Manufacturer: syz [ 435.396143][ T6805] usb 1-1: SerialNumber: syz [ 435.640346][T11025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 435.806779][T11025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.068339][ T6805] usb 1-1: 0:2 : does not exist [ 436.123821][ T6805] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 436.197305][T11033] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1459'. [ 436.221146][ T6805] usb 1-1: USB disconnect, device number 47 [ 436.309927][T11033] Invalid logical block size (8) [ 436.381782][ T5895] udevd[5895]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 436.840294][T11053] FAULT_INJECTION: forcing a failure. [ 436.840294][T11053] name failslab, interval 1, probability 0, space 0, times 0 [ 436.880811][T11055] fuse: Unknown parameter 'group_i' [ 436.887538][T11053] CPU: 0 UID: 0 PID: 11053 Comm: syz.1.1469 Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(full) [ 436.887561][T11053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 436.887572][T11053] Call Trace: [ 436.887580][T11053] [ 436.887587][T11053] dump_stack_lvl+0x189/0x250 [ 436.887613][T11053] ? __pfx____ratelimit+0x10/0x10 [ 436.887633][T11053] ? __pfx_dump_stack_lvl+0x10/0x10 [ 436.887653][T11053] ? __pfx__printk+0x10/0x10 [ 436.887680][T11053] ? __pfx___might_resched+0x10/0x10 [ 436.887704][T11053] should_fail_ex+0x414/0x560 [ 436.887728][T11053] should_failslab+0xa8/0x100 [ 436.887753][T11053] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 436.887777][T11053] ? __alloc_skb+0x112/0x2d0 [ 436.887804][T11053] __alloc_skb+0x112/0x2d0 [ 436.887831][T11053] netlink_sendmsg+0x5c6/0xb30 [ 436.887864][T11053] ? __pfx_netlink_sendmsg+0x10/0x10 [ 436.887891][T11053] ? aa_sock_msg_perm+0x94/0x160 [ 436.887911][T11053] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 436.887930][T11053] ? __pfx_netlink_sendmsg+0x10/0x10 [ 436.887953][T11053] __sock_sendmsg+0x21c/0x270 [ 436.887977][T11053] ____sys_sendmsg+0x52d/0x830 [ 436.887999][T11053] ? __pfx_____sys_sendmsg+0x10/0x10 [ 436.888024][T11053] ? import_iovec+0x74/0xa0 [ 436.888049][T11053] ___sys_sendmsg+0x21f/0x2a0 [ 436.888064][T11053] ? __pfx____sys_sendmsg+0x10/0x10 [ 436.888092][T11053] ? __fget_files+0x2a/0x420 [ 436.888101][T11053] ? __fget_files+0x3a0/0x420 [ 436.888114][T11053] __sys_sendmmsg+0x227/0x430 [ 436.888128][T11053] ? __pfx___sys_sendmmsg+0x10/0x10 [ 436.888137][T11053] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 436.888162][T11053] ? ksys_write+0x22a/0x250 [ 436.888176][T11053] ? __pfx_ksys_write+0x10/0x10 [ 436.888186][T11053] ? rcu_is_watching+0x15/0xb0 [ 436.888201][T11053] __x64_sys_sendmmsg+0xa0/0xc0 [ 436.888211][T11053] do_syscall_64+0xfa/0x3b0 [ 436.888221][T11053] ? lockdep_hardirqs_on+0x9c/0x150 [ 436.888231][T11053] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.888240][T11053] ? clear_bhb_loop+0x60/0xb0 [ 436.888252][T11053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.888261][T11053] RIP: 0033:0x7f053a98e9a9 [ 436.888271][T11053] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 436.888279][T11053] RSP: 002b:00007f053b8de038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 436.888290][T11053] RAX: ffffffffffffffda RBX: 00007f053abb5fa0 RCX: 00007f053a98e9a9 [ 436.888297][T11053] RDX: 0000000000000001 RSI: 0000200000000380 RDI: 0000000000000003 [ 436.888303][T11053] RBP: 00007f053b8de090 R08: 0000000000000000 R09: 0000000000000000 [ 436.888309][T11053] R10: 0000000000008004 R11: 0000000000000246 R12: 0000000000000001 [ 436.888315][T11053] R13: 0000000000000000 R14: 00007f053abb5fa0 R15: 00007f053acdfa28 [ 436.888330][T11053] [ 437.170630][ C0] vkms_vblank_simulate: vblank timer overrun [ 437.788125][T11059] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 438.070067][T11073] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 438.685832][ T5892] usb 1-1: new full-speed USB device number 48 using dummy_hcd [ 438.902206][ T5892] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 438.945786][ T5892] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 438.989481][ T5892] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 439.021001][ T5892] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 439.093614][ T5892] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 439.124347][ T5892] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 439.135880][ T5916] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 439.161153][ T5892] usb 1-1: Manufacturer: syz [ 439.307010][ T5916] usb 2-1: Using ep0 maxpacket: 32 [ 439.308102][ T5892] usb 1-1: config 0 descriptor?? [ 439.317395][ T5916] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 439.317421][ T5916] usb 2-1: config 0 has no interfaces? [ 439.319920][ T5916] usb 2-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 439.399451][ T5916] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.429419][ T5916] usb 2-1: Product: syz [ 439.439139][ T5916] usb 2-1: Manufacturer: syz [ 439.443779][ T5916] usb 2-1: SerialNumber: syz [ 439.469050][ T5916] usb 2-1: config 0 descriptor?? [ 439.535165][ T10] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 439.586131][T11076] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1476'. [ 439.602531][T11076] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1476'. [ 439.634323][T11076] netlink: 'syz.0.1476': attribute type 6 has an invalid length. [ 439.702629][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 439.729724][ T5916] usb 2-1: USB disconnect, device number 59 [ 439.751185][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 439.771631][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 439.787732][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 439.798824][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 439.812577][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 439.825951][ T5892] rc_core: IR keymap rc-hauppauge not found [ 439.829843][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 439.832089][ T5892] Registered IR keymap rc-empty [ 439.852364][ T10] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 439.863134][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.870900][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 439.880943][ T10] usb 3-1: Product: syz [ 439.887749][ T10] usb 3-1: Manufacturer: syz [ 439.892518][ T10] usb 3-1: SerialNumber: syz [ 439.906959][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 439.908376][ T10] usb 3-1: config 0 descriptor?? [ 439.932316][ T5892] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 439.967713][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.974081][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.986586][ T5892] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input60 [ 440.025877][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 440.055905][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 440.075881][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 440.095750][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 440.115940][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 440.140920][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 440.185932][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 440.210708][T11102] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1476'. [ 440.225939][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 440.255426][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 440.275209][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 440.299681][ T5892] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 440.346904][ T5892] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 440.357296][ T5892] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 440.419324][ T5892] usb 1-1: USB disconnect, device number 48 [ 440.666103][ T10] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 440.826379][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 440.839797][ T10] usb 2-1: config 2 has an invalid interface number: 177 but max is 3 [ 440.853872][ T10] usb 2-1: config 2 contains an unexpected descriptor of type 0x2, skipping [ 440.878759][ T10] usb 2-1: config 2 has an invalid interface number: 208 but max is 3 [ 440.901638][ T10] usb 2-1: config 2 has an invalid interface number: 22 but max is 3 [ 440.925636][ T10] usb 2-1: config 2 has an invalid interface number: 54 but max is 3 [ 440.946776][ T10] usb 2-1: config 2 contains an unexpected descriptor of type 0x1, skipping [ 440.971612][ T10] usb 2-1: config 2 has no interface number 0 [ 440.990452][ T10] usb 2-1: config 2 has no interface number 1 [ 441.011427][ T10] usb 2-1: config 2 has no interface number 2 [ 441.031088][ T10] usb 2-1: config 2 has no interface number 3 [ 441.050959][ T10] usb 2-1: config 2 interface 177 altsetting 8 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 441.077930][ T10] usb 2-1: config 2 interface 208 altsetting 3 has a duplicate endpoint with address 0xA, skipping [ 441.110868][ T10] usb 2-1: config 2 interface 208 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 441.145343][ T10] usb 2-1: config 2 interface 208 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 441.167631][ T10] usb 2-1: config 2 interface 208 altsetting 3 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 441.187270][ T10] usb 2-1: config 2 interface 208 altsetting 3 endpoint 0x4 has invalid maxpacket 1024, setting to 64 [ 441.200458][ T10] usb 2-1: config 2 interface 208 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 441.213148][ T10] usb 2-1: config 2 interface 208 altsetting 3 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 441.242132][ T10] usb 2-1: config 2 interface 208 altsetting 3 endpoint 0x5 has an invalid bInterval 27, changing to 8 [ 441.265059][ T10] usb 2-1: config 2 interface 208 altsetting 3 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 441.285092][ T10] usb 2-1: config 2 interface 208 altsetting 3 has a duplicate endpoint with address 0x6, skipping [ 441.307531][ T10] usb 2-1: config 2 interface 208 altsetting 3 endpoint 0xF has invalid maxpacket 1023, setting to 64 [ 441.333090][ T10] usb 2-1: config 2 interface 208 altsetting 3 has a duplicate endpoint with address 0xA, skipping [ 441.346031][ T10] usb 2-1: config 2 interface 208 altsetting 3 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 441.358340][ T10] usb 2-1: config 2 interface 22 altsetting 7 has a duplicate endpoint with address 0x5, skipping [ 441.370458][ T10] usb 2-1: config 2 interface 22 altsetting 7 has a duplicate endpoint with address 0xF, skipping [ 441.382627][ T10] usb 2-1: config 2 interface 22 altsetting 7 has a duplicate endpoint with address 0x7, skipping [ 441.659204][ T10] usb 2-1: config 2 interface 22 altsetting 7 has a duplicate endpoint with address 0x5, skipping [ 441.671587][ T10] usb 2-1: config 2 interface 54 altsetting 3 has a duplicate endpoint with address 0xA, skipping [ 441.683876][ T10] usb 2-1: config 2 interface 54 altsetting 3 has a duplicate endpoint with address 0x8, skipping [ 441.696071][ T10] usb 2-1: config 2 interface 54 altsetting 3 has a duplicate endpoint with address 0xB, skipping [ 441.715044][ T5916] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 441.723055][ T10] usb 2-1: config 2 interface 54 altsetting 3 has a duplicate endpoint with address 0xA, skipping [ 441.736566][ T10] usb 2-1: config 2 interface 54 altsetting 3 has a duplicate endpoint with address 0xA, skipping [ 441.753296][ T10] usb 2-1: config 2 interface 54 altsetting 3 has a duplicate endpoint with address 0x3, skipping [ 441.771259][ T10] usb 2-1: config 2 interface 54 altsetting 3 has a duplicate endpoint with address 0xF, skipping [ 441.885390][ T5916] usb 4-1: Using ep0 maxpacket: 8 [ 441.902290][ T10] usb 2-1: config 2 interface 54 altsetting 3 has a duplicate endpoint with address 0x5, skipping [ 441.920532][ T10] usb 2-1: config 2 interface 177 has no altsetting 0 [ 441.929176][ T5916] usb 4-1: unable to get BOS descriptor or descriptor too short [ 441.938092][ T10] usb 2-1: config 2 interface 208 has no altsetting 0 [ 441.947020][ T5916] usb 4-1: config 4 interface 0 has no altsetting 0 [ 441.955571][ T10] usb 2-1: config 2 interface 22 has no altsetting 0 [ 441.963364][ T10] usb 2-1: config 2 interface 54 has no altsetting 0 [ 441.972093][ T5916] usb 4-1: string descriptor 0 read error: -22 [ 441.978932][ T5916] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 441.989459][ T5916] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 442.009498][ T10] usb 2-1: New USB device found, idVendor=1645, idProduct=0008, bcdDevice=20.05 [ 442.019074][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.037299][ T10] usb 2-1: Product: syz [ 442.053551][ T5916] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 442.070922][ T10] usb 2-1: Manufacturer: syz [ 442.106320][ T5944] usb 3-1: USB disconnect, device number 83 [ 442.113477][ T10] usb 2-1: SerialNumber: syz [ 442.150445][ T5916] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 442.192489][ T5916] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 442.222711][T11118] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 442.320758][ T5916] usb 4-1: media controller created [ 442.450177][ T10] kaweth 2-1:2.177: Firmware present in device. [ 442.478851][ T10] kaweth 2-1:2.177: Error reading configuration (-71), no net device created [ 442.598672][ T10] kaweth 2-1:2.177: probe with driver kaweth failed with error -5 [ 442.627454][ T5916] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 442.663175][ T10] kaweth 2-1:2.208: Firmware present in device. [ 442.690916][ T5916] zl10353_read_register: readreg error (reg=127, ret==0) [ 442.708471][ T10] kaweth 2-1:2.208: Error reading configuration (-71), no net device created [ 442.728783][ T10] kaweth 2-1:2.208: probe with driver kaweth failed with error -5 [ 442.787890][ T5916] usb 4-1: USB disconnect, device number 55 [ 442.808879][ T10] kaweth 2-1:2.22: Firmware present in device. [ 442.836173][ T10] kaweth 2-1:2.22: Error reading configuration (-71), no net device created [ 442.866261][ T10] kaweth 2-1:2.22: probe with driver kaweth failed with error -5 [ 442.898229][ T10] kaweth 2-1:2.54: Firmware present in device. [ 442.951099][ T10] kaweth 2-1:2.54: Error reading configuration (-71), no net device created [ 443.625174][ T10] kaweth 2-1:2.54: probe with driver kaweth failed with error -5 [ 443.685705][ T10] usb 2-1: USB disconnect, device number 60 [ 444.011972][ T30] audit: type=1326 audit(1753539493.949:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11135 comm="syz.3.1496" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdf0118e9a9 code=0x0 [ 444.492714][T11151] tipc: Enabled bearer , priority 0 [ 444.510456][T11151] syzkaller0: entered promiscuous mode [ 444.519871][T11151] syzkaller0: entered allmulticast mode [ 444.563199][T11151] tipc: Resetting bearer [ 444.679864][T11150] tipc: Resetting bearer [ 444.700815][T11150] tipc: Disabling bearer [ 444.718655][T11154] ptrace attach of "./syz-executor exec"[5862] was attempted by "./syz-executor exec"[11154] [ 445.281171][ T30] audit: type=1326 audit(1753539495.219:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11157 comm="syz.1.1501" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f053a98e9a9 code=0x7bff0000 [ 445.623983][T11164] ALSA: mixer_oss: invalid OSS volume '˙˙˙˙blkio.bfq.io_merged_recursi' [ 445.660936][T11164] ALSA: mixer_oss: invalid OSS volume '' [ 446.422924][ T30] audit: type=1326 audit(1753539496.359:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11185 comm="syz.4.1511" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7feda198e9a9 code=0x0 [ 446.860712][T11203] syz.2.1514: attempt to access beyond end of device [ 446.860712][T11203] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 448.973841][T11240] all: renamed from bridge_slave_0 (while UP) [ 449.776086][ T5916] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 450.045446][ T5916] usb 3-1: Using ep0 maxpacket: 32 [ 450.182894][T11264] vti0: entered promiscuous mode [ 450.189355][T11264] vti0: entered allmulticast mode [ 450.452636][ T5916] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 450.528073][ T5916] usb 3-1: config 0 has no interface number 0 [ 450.579009][ T5916] usb 3-1: config 0 interface 184 has no altsetting 0 [ 450.912087][ T5916] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 450.928225][ T5916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.940081][ T5916] usb 3-1: Product: syz [ 450.956733][ T5916] usb 3-1: Manufacturer: syz [ 450.961642][ T5916] usb 3-1: SerialNumber: syz [ 450.999248][ T5916] usb 3-1: config 0 descriptor?? [ 451.046637][ T5916] smsc75xx v1.0.0 [ 451.050495][ T5916] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 451.069976][ T5916] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -22 [ 451.259174][T11251] netlink: 1030 bytes leftover after parsing attributes in process `syz.2.1531'. [ 451.276905][T11275] usb usb8: usbfs: process 11275 (syz.1.1540) did not claim interface 0 before use [ 451.357967][T11279] netlink: 'syz.3.1541': attribute type 21 has an invalid length. [ 451.408443][T11279] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1541'. [ 451.430743][T11278] sctp: [Deprecated]: syz.3.1541 (pid 11278) Use of struct sctp_assoc_value in delayed_ack socket option. [ 451.430743][T11278] Use struct sctp_sack_info instead [ 451.457849][T11279] netlink: 'syz.3.1541': attribute type 6 has an invalid length. [ 451.467938][T11279] netlink: 3 bytes leftover after parsing attributes in process `syz.3.1541'. [ 451.963339][T11287] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1545'. [ 452.126818][T11292] bond0: option arp_validate: invalid value (18446744073491447809) [ 452.127085][ T3581] bond0: (slave bond_slave_0): interface is now down [ 452.199539][ T3581] bond0: (slave bond_slave_1): interface is now down [ 452.220304][ T3581] bond0: (slave vxlan0): interface is now down [ 452.285321][ T3581] bond0: now running without any active interface! [ 452.637196][T11307] vlan0: entered promiscuous mode [ 452.642287][T11307] bridge0: entered promiscuous mode [ 452.754058][T11315] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1556'. [ 453.064005][ T10] usb 3-1: USB disconnect, device number 84 [ 453.106131][ T5892] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 453.305660][ T30] audit: type=1326 audit(1753539503.229:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11317 comm="syz.4.1557" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7feda198e9a9 code=0x0 [ 453.405612][ T5892] usb 4-1: Using ep0 maxpacket: 8 [ 453.415948][ T5892] usb 4-1: unable to get BOS descriptor or descriptor too short [ 453.433826][ T5892] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 113, changing to 10 [ 453.452254][ T5892] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 1040, setting to 1024 [ 453.516840][ T5892] usb 4-1: config 1 interface 0 has no altsetting 0 [ 453.591717][ T5892] usb 4-1: New USB device found, idVendor=05ac, idProduct=0237, bcdDevice= 0.40 [ 453.607622][ T5892] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.640116][ T5892] usb 4-1: Product: syz [ 453.651072][ T5892] usb 4-1: Manufacturer: syz [ 453.691505][ T5892] usb 4-1: SerialNumber: syz [ 453.803771][T11319] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 454.056461][ T5892] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input61 [ 454.138071][ T5203] bcm5974 4-1:1.0: could not read from device [ 454.182189][ T5203] bcm5974 4-1:1.0: could not read from device [ 454.239148][ T5892] usb 4-1: USB disconnect, device number 56 [ 454.291521][ T5203] bcm5974 4-1:1.0: could not read from device [ 454.291966][T11342] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1563'. [ 454.710078][T11347] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1564'. [ 454.975438][ T10] usb 5-1: new full-speed USB device number 53 using dummy_hcd [ 455.189822][ T10] usb 5-1: config 8 has an invalid interface number: 223 but max is 0 [ 455.201430][ T10] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 455.393722][ T5945] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 455.416850][ T10] usb 5-1: config 8 has no interface number 0 [ 455.433691][ T10] usb 5-1: config 8 interface 223 altsetting 0 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 455.434230][T11368] input: syz0 as /devices/virtual/input/input62 [ 455.483273][ T10] usb 5-1: config 8 interface 223 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 455.534187][ T10] usb 5-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 455.561021][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.578195][ T5945] usb 2-1: Using ep0 maxpacket: 16 [ 455.592940][ T5945] usb 2-1: config 0 has an invalid interface number: 145 but max is 0 [ 455.607312][ T10] usb 5-1: Product: syz [ 455.620989][ T10] usb 5-1: Manufacturer: syz [ 455.628128][ T5945] usb 2-1: config 0 has no interface number 0 [ 455.691747][ T10] usb 5-1: SerialNumber: syz [ 455.733621][ T5945] usb 2-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 455.793512][ T5945] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.818707][ T5945] usb 2-1: Product: syz [ 456.509718][ T5945] usb 2-1: Manufacturer: syz [ 456.547730][ T5945] usb 2-1: SerialNumber: syz [ 456.603129][ T5945] usb 2-1: config 0 descriptor?? [ 456.666175][ T5945] hub 2-1:0.145: bad descriptor, ignoring hub [ 456.672297][ T5945] hub 2-1:0.145: probe with driver hub failed with error -5 [ 456.869197][T11362] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 456.882287][T11362] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 456.907019][ T5945] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.145/input/input63 [ 457.510437][ T5945] input: failed to attach handler mousedev to device input63, error: -2 [ 458.121699][T11377] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1573'. [ 458.232941][T11375] dvmrp1: entered allmulticast mode [ 458.622597][T11373] delete_channel: no stack [ 458.741955][ T10] usb 5-1: USB disconnect, device number 53 [ 458.842148][ T5945] usb 2-1: USB disconnect, device number 61 [ 458.941756][T11400] netlink: 'syz.2.1580': attribute type 10 has an invalid length. [ 458.950094][T11400] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1580'. [ 458.966940][T11400] team0: Device geneve0 is up. Set it down before adding it as a team port [ 459.018441][T11400] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 459.142597][T11404] IPv6: sit1: Disabled Multicast RS [ 459.166003][ T6805] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 459.349608][ T6805] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 459.380077][ T6805] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 459.398292][ T6805] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 459.430984][ T6805] usb 4-1: config 0 descriptor?? [ 459.661027][ T6805] usbhid 4-1:0.0: can't add hid device: -71 [ 459.675771][ T6805] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 459.700114][ T6805] usb 4-1: USB disconnect, device number 57 [ 459.916039][ T3091] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 460.075734][ T3091] usb 5-1: Using ep0 maxpacket: 32 [ 460.100365][ T3091] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 460.126543][ T3091] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 460.149320][ T3091] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 460.195703][ T6805] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 460.203544][ T3091] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 460.230909][ T3091] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 460.244190][ T3091] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 460.270796][ T3091] usb 5-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 460.285865][ T3091] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.294053][ T3091] usb 5-1: Product: syz [ 460.300651][ T3091] usb 5-1: Manufacturer: syz [ 460.305955][ T3091] usb 5-1: SerialNumber: syz [ 460.326499][ T3091] usb 5-1: config 0 descriptor?? [ 460.376232][ T6805] usb 4-1: Using ep0 maxpacket: 16 [ 460.388301][ T6805] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 460.410950][ T6805] usb 4-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 460.442640][ T6805] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 460.462046][T11425] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 460.476457][ T6805] usb 4-1: config 0 descriptor?? [ 460.845666][ T5945] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 461.568073][ T5945] usb 2-1: Using ep0 maxpacket: 32 [ 461.607041][T11434] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 461.754066][T11434] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 461.802073][ T5945] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 461.827909][ T5945] usb 2-1: config 0 has no interface number 0 [ 461.852477][ T5945] usb 2-1: config 0 interface 12 has no altsetting 0 [ 462.753301][T11436] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 463.000561][ T5945] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 463.027152][ T5945] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.058702][ T3091] usb 5-1: USB disconnect, device number 54 [ 463.122848][ T5945] usb 2-1: Product: syz [ 463.214648][ T5945] usb 2-1: Manufacturer: syz [ 463.219304][ T5945] usb 2-1: SerialNumber: syz [ 463.240653][ T5945] usb 2-1: config 0 descriptor?? [ 464.659366][ T6805] usbhid 4-1:0.0: can't add hid device: -71 [ 464.761363][ T6805] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 464.869690][ T6805] usb 4-1: USB disconnect, device number 58 [ 465.021580][ T5945] f81534 2-1:0.12: f81534_set_register: reg: 1002 data: 3 failed: -71 [ 465.195660][ T5945] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 465.217545][T11448] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1597'. [ 465.305593][ T5945] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 465.313528][ T5945] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 465.900439][ T5945] usb 2-1: USB disconnect, device number 62 [ 470.506161][ T30] audit: type=1326 audit(1753539520.429:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11482 comm="syz.2.1609" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f98f8f8e9a9 code=0x0 [ 470.825188][ T6805] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 471.075883][ T6805] usb 3-1: Using ep0 maxpacket: 8 [ 471.195982][ T6805] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 471.617971][ T6805] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 471.656342][ T6805] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 472.095896][ T6805] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 472.384111][ T6805] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 472.463881][ T6805] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.915823][ T6805] usb 3-1: GET_CAPABILITIES returned 0 [ 473.080258][ T6805] usbtmc 3-1:16.0: can't read capabilities [ 473.330803][ T5916] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 474.512060][ T24] usb 3-1: USB disconnect, device number 85 [ 481.012977][ C0] sched: DL replenish lagged too much [ 502.345002][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 503.420899][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 611.494232][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 611.501252][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5512/1:b..l [ 611.509752][ C0] rcu: (detected by 0, t=10502 jiffies, g=55061, q=1056635 ncpus=2) [ 611.518715][ C0] task:dhcpcd state:R running task stack:25080 pid:5512 tgid:5512 ppid:1 task_flags:0x400140 flags:0x00004002 [ 611.533480][ C0] Call Trace: [ 611.536880][ C0] [ 611.539833][ C0] __schedule+0x16fd/0x4cf0 [ 611.544552][ C0] ? preempt_schedule_irq+0xb5/0x150 [ 611.550059][ C0] ? __pfx___schedule+0x10/0x10 [ 611.554959][ C0] ? stack_depot_save_flags+0x40/0x900 [ 611.560683][ C0] ? preempt_schedule_irq+0xaa/0x150 [ 611.565987][ C0] preempt_schedule_irq+0xb5/0x150 [ 611.571135][ C0] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 611.577329][ C0] ? rcu_irq_exit_check_preempt+0xdf/0x210 [ 611.583203][ C0] irqentry_exit+0x6f/0x90 [ 611.587623][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 611.593631][ C0] RIP: 0010:lock_release+0x5/0x3e0 [ 611.598758][ C0] Code: 03 48 8b 3c 24 e9 08 fa ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <41> 57 41 56 41 55 41 54 53 48 83 ec 30 49 89 f5 49 89 fe 65 48 8b [ 611.618979][ C0] RSP: 0018:ffffc90003347548 EFLAGS: 00000202 [ 611.625179][ C0] RAX: 0000000000000001 RBX: ffffffff903e9b01 RCX: 44a99782ed965e00 [ 611.633174][ C0] RDX: ffffc90003347601 RSI: ffffffff8172aae5 RDI: ffffffff8e13f0e0 [ 611.641811][ C0] RBP: dffffc0000000000 R08: ffffc90003347af8 R09: 0000000000000000 [ 611.649893][ C0] R10: ffffc90003347678 R11: fffff52000668ed1 R12: ffffc90003347b08 [ 611.657889][ C0] R13: ffffc90003340000 R14: ffffc90003347628 R15: ffffffff8172aae5 [ 611.665880][ C0] ? unwind_next_frame+0xa5/0x2390 [ 611.671124][ C0] ? unwind_next_frame+0xa5/0x2390 [ 611.677153][ C0] unwind_next_frame+0x19a9/0x2390 [ 611.682422][ C0] ? unwind_next_frame+0xa5/0x2390 [ 611.687656][ C0] ? __kasan_kmalloc+0x22/0xb0 [ 611.692913][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 611.699110][ C0] arch_stack_walk+0x11c/0x150 [ 611.703912][ C0] ? __kmalloc_noprof+0x27a/0x4f0 [ 611.708989][ C0] stack_trace_save+0x9c/0xe0 [ 611.713716][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 611.719130][ C0] save_stack+0xf5/0x1f0 [ 611.723435][ C0] ? __pfx_save_stack+0x10/0x10 [ 611.728449][ C0] ? __free_frozen_pages+0xc71/0xe70 [ 611.733796][ C0] ? __put_partials+0x161/0x1c0 [ 611.738669][ C0] ? put_cpu_partial+0x17c/0x250 [ 611.743631][ C0] ? __slab_free+0x2f7/0x400 [ 611.748236][ C0] ? qlist_free_all+0x97/0x140 [ 611.753012][ C0] ? kasan_quarantine_reduce+0x148/0x160 [ 611.758861][ C0] ? __kasan_kmalloc+0x22/0xb0 [ 611.763642][ C0] ? page_ext_put+0x97/0xc0 [ 611.768336][ C0] __reset_page_owner+0x71/0x1f0 [ 611.773536][ C0] __free_frozen_pages+0xc71/0xe70 [ 611.778917][ C0] __put_partials+0x161/0x1c0 [ 611.783881][ C0] put_cpu_partial+0x17c/0x250 [ 611.788740][ C0] ? put_cpu_partial+0x6d/0x250 [ 611.793597][ C0] __slab_free+0x2f7/0x400 [ 611.798060][ C0] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 611.803965][ C0] ? __phys_addr+0xd3/0x180 [ 611.808475][ C0] qlist_free_all+0x97/0x140 [ 611.813057][ C0] kasan_quarantine_reduce+0x148/0x160 [ 611.818529][ C0] __kasan_kmalloc+0x22/0xb0 [ 611.823141][ C0] __kmalloc_noprof+0x27a/0x4f0 [ 611.828092][ C0] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 611.833824][ C0] tomoyo_realpath_from_path+0xe3/0x5d0 [ 611.839544][ C0] ? tomoyo_domain+0xd9/0x130 [ 611.844246][ C0] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 611.850009][ C0] tomoyo_path_number_perm+0x1e8/0x5a0 [ 611.855741][ C0] ? clear_bhb_loop+0x60/0xb0 [ 611.860408][ C0] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 611.866392][ C0] ? __seccomp_filter+0x765/0x1a40 [ 611.871491][ C0] ? __pfx___seccomp_filter+0x10/0x10 [ 611.876879][ C0] security_file_ioctl+0xcb/0x2d0 [ 611.882072][ C0] __se_sys_ioctl+0x47/0x170 [ 611.886647][ C0] do_syscall_64+0xfa/0x3b0 [ 611.891183][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 611.897331][ C0] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 611.902942][ C0] ? clear_bhb_loop+0x60/0xb0 [ 611.907709][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 611.913608][ C0] RIP: 0033:0x7f409d5c8378 [ 611.918033][ C0] RSP: 002b:00007ffd9220da88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 611.926531][ C0] RAX: ffffffffffffffda RBX: 000055d9a4985e50 RCX: 00007f409d5c8378 [ 611.934489][ C0] RDX: 00007ffd9220da90 RSI: 0000000000008921 RDI: 000000000000000f [ 611.942637][ C0] RBP: 00007ffd9220da90 R08: 0000000000000000 R09: 0000000000000000 [ 611.950629][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 000055d9a49870a0 [ 611.958701][ C0] R13: 000055d9a4985e50 R14: 000055d9a49870a0 R15: 00007ffd9220dce0 [ 611.966727][ C0] [ 612.933552][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 612.982643][ T1299] ieee802154 phy1 wpan1: encryption failed: -22