last executing test programs: 16.894468159s ago: executing program 4 (id=1685): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3b, &(0x7f0000000000)='/proc/sys/net/ipv4\x00\x00s/sync_\x00le\xf44.\xab%\xf8\xff\xff\xff\xff\xff\xff\xff?\x11\xc8\xdd\x15\xcc\xd2\xf1\xff\'%\xa0\x00\x00\x00,'}, 0x30) write$tun(r0, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b000100001000090455070103490200090582030004"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00N\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0x40, &(0x7f0000000000)=ANY=[@ANYRESOCT=r1]) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$vimc1(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) shutdown(0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x16, 0x0, 0x0, 0x0, 0x1004, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x2a, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbd"], 0x0}, 0x94) socket$kcm(0x11, 0x2, 0x300) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000080)={0x2, 0x4e1f, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xf}, @multicast2}}}], 0x20}, 0x0) unshare(0x42000000) r4 = gettid() timer_create(0xb, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = socket$kcm(0x29, 0x5, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0xf3e, 0x0) 12.756047387s ago: executing program 4 (id=1701): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = socket$unix(0x1, 0x3, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x5e22, 0x0, @empty}, 0x1c) bind$unix(r0, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x52) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/unix\x00') pread64(r1, &(0x7f0000000480)=""/177, 0xb1, 0xe0) syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) syz_usb_connect(0x5, 0x51, &(0x7f0000000140)=ANY=[@ANYBLOB="120101024cf1c50863070210845f0102030109023f0001000000000904000005ff87e7000905ee63000000000009050300000000000009050cf2000002060209050f0000004000000905"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) 9.641784425s ago: executing program 3 (id=1712): r0 = syz_open_dev$video(&(0x7f0000000280), 0x7ffffffe, 0x129680) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f0000000040)={0x2, "61a383835e7449d3f751591538e5fe23a81bcf9c307319290bd82a046f9c1290", 0x2, 0x0, 0x0, 0x0, 0x0, 0x8}) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e23, 0x800, @mcast2, 0x4}}, [0x5000000000, 0x0, 0x0, 0x800, 0x3, 0x5, 0x0, 0x81, 0x9, 0x101, 0x5, 0xf, 0x86bb, 0x9, 0x7]}, &(0x7f0000000100)=0x100) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'veth0_to_team\x00'}) sendmsg$nl_route(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@ipv6_newrule={0x38, 0x20, 0x1, 0x0, 0x25dfdbfe, {0xa, 0x14, 0x40, 0x4, 0x0, 0x0, 0x0, 0x7}, [@FIB_RULE_POLICY=@FRA_TABLE={0x8, 0xf, 0x3}, @FIB_RULE_POLICY=@FRA_IIFNAME={0x14, 0x3, 'veth0_to_batadv\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x4c011}, 0x40000) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x5c, 0x10, 0x439, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @private2}]}}}]}, 0x5c}}, 0x0) 9.595998335s ago: executing program 3 (id=1713): socket$nl_route(0x10, 0x3, 0x0) r0 = socket(0x15, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000040)=0x3, 0x4) (async) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000040)=0x3, 0x4) r1 = syz_io_uring_setup(0x279, &(0x7f0000000200)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) r4 = gettid() timer_create(0x3, &(0x7f0000533fa0)={0x0, 0xe, 0x0, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) (async) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r5, &(0x7f0000000000)="10", 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0xfffffffe, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000040)={0x7, 0xe, 0x9, 0x0, 0x1, 0x8, 0xa7, 0x4, 0x5, 0xf1, 0xb, 0x7, 0x0, 0x6}, 0xe) poll(&(0x7f0000000080)=[{r5, 0x46a8}], 0x1, 0x400) shutdown(r5, 0x1) unshare(0x22020600) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3) getpid() (async) r6 = getpid() socket$key(0xf, 0x3, 0x2) (async) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x2, 0x18, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}, @sadb_address={0x3, 0x6, 0x6c, 0x20, 0x0, @in={0x2, 0x4e23, @rand_addr=0x64010100}}]}, 0x50}}, 0x810) (async) sendmsg$key(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x2, 0x18, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}, @sadb_address={0x3, 0x6, 0x6c, 0x20, 0x0, @in={0x2, 0x4e23, @rand_addr=0x64010100}}]}, 0x50}}, 0x810) r8 = syz_pidfd_open(r6, 0x0) setns(r8, 0x8020000) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x32, 0xfc, 0x45, 0x40, 0x27c6, 0x5395, 0xebbb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x50, 0x0, [{{0x9, 0x4, 0x17, 0x0, 0x0, 0xac, 0xe0, 0x8f}}]}}]}}, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0) ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) r9 = syz_open_dev$dmmidi(&(0x7f00000000c0), 0x4, 0x24002) io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) (async) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x5, 0x10, r1, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="180000006800010002000010a21f2300149b3542d405fcffff7f0006000000000000"], 0x18}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) (async) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="180000006800010002000010a21f2300149b3542d405fcffff7f0006000000000000"], 0x18}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r8, 0x0, {0x0, r9}, 0x8001, 0xa, 0x1, {0x0, r10, r0}}) (async) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_SPLICE={0x1e, 0x2, 0x0, @fd=r8, 0x0, {0x0, r9}, 0x8001, 0xa, 0x1, {0x0, r10, r0}}) io_uring_enter(r1, 0x1ffe, 0x0, 0x0, 0x0, 0x0) (async) io_uring_enter(r1, 0x1ffe, 0x0, 0x0, 0x0, 0x0) 9.313067211s ago: executing program 3 (id=1715): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=ANY=[@ANYBLOB="4000000040000900fffffffffddbdf250200000018003880144b1b00000000000400c780040077800400c7800800018004001f80090004804141a68a7b000000"], 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x3c, 0x2, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000890}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000edff0000000000000000850000000f00000018010000646c012500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000800000850000000600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) r4 = io_uring_setup(0x5f8e, &(0x7f0000000280)={0x0, 0xffffffff, 0x1, 0x10000, 0x90}) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) sendfile(r5, r5, 0x0, 0x40000f63c) ioprio_set$uid(0x3, 0x0, 0x0) close(r4) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000180)=r6, 0x4) syz_emit_ethernet(0x46, &(0x7f0000000200)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @val={@void, {0x8100, 0x0, 0x0, 0x3}}, {@ipv6={0x86dd, @udp={0x0, 0x6, "2e5cea", 0xc, 0x3c, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2, {[], {0x0, 0x0, 0xc, 0x0, @gue={{0x1, 0x0, 0x2, 0x4, 0x0, @void}}}}}}}}, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') r8 = syz_usb_connect(0x5, 0x4f, &(0x7f0000001840)={{0x12, 0x1, 0x0, 0x13, 0xc8, 0x2f, 0x20, 0x6cd, 0x104, 0xc86a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3d, 0x2, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x91, 0xec, 0x1, 0x68, 0x83, 0xb6, 0x9, [], [{{0x9, 0x5, 0x2, 0x10, 0x40, 0x3, 0x5, 0x5}}]}}, {{0x9, 0x4, 0x2b, 0xfa, 0x2, 0x93, 0x5c, 0x95, 0x1, [], [{{0x9, 0x5, 0xf, 0x2, 0x3ff, 0x8, 0x40, 0x9}}, {{0x9, 0x5, 0x2, 0x0, 0x8, 0x9, 0x1a, 0x6, [@generic={0x7, 0x5, "ce37064ab4"}]}}]}}]}}]}}, 0x0) ppoll(&(0x7f0000000000)=[{r7}, {r7, 0x400}], 0x2, 0x0, 0x0, 0x0) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_mount_image$fuse(&(0x7f00000000c0), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRESHEX=r9, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRES32=r8, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) 9.285963899s ago: executing program 4 (id=1716): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xcf, 0x8b, 0xed, 0x20, 0xfd9, 0x25, 0x2940, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xca, 0xfb, 0x1a}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="2072dc"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0xfffffffffffffffe, 0x40000) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000002580)={&(0x7f0000000080)=[{0xd0, 0x0, 0x0, 0x0}, {0xc, 0x4a00, 0x0, 0x0}], 0x2}) 7.793633213s ago: executing program 4 (id=1718): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000080), 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCDELRT(r2, 0x890b, &(0x7f0000000080)={@loopback={0xfec0ffff00000000}, @private1, @local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x280}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) socket(0x10, 0x2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x1, 0x9) socket$unix(0x1, 0x1, 0x0) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000040)={0xbe4, {{0x2, 0x4e23, @multicast2}}, {{0x2, 0x4e21, @remote}}}, 0x108) socketpair$unix(0x1, 0x3, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x7, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r6, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 6.1334218s ago: executing program 2 (id=1723): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f00000001c0)={0xfe}, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x81, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = eventfd(0x5) r5 = eventfd2(0x10, 0x80000) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000001c0)={r4, 0x2, 0x0, r4}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000000)={r4, 0x17, 0x2, r5}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000600)={'pimreg0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="4400000010000104fcffffff8000000000000000", @ANYRES32=0x0, @ANYBLOB="0344020000000000140012800b0001006d616373656300000400028008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r6], 0x44}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000000)=@fragment={0x5c, 0x0, 0x1, 0x0, 0x0, 0xd, 0x65}, 0x8) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x2c, &(0x7f0000000000)=0x21, 0x4) setsockopt$sock_attach_bpf(r7, 0x1, 0x34, &(0x7f00000000c0), 0x4) sendto$inet6(r0, &(0x7f0000000240)="8a", 0x1, 0x51, &(0x7f0000000080)={0xa, 0x3, 0x2, @local, 0x9}, 0x1c) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000180)=ANY=[], 0x8) listen(r0, 0x100101) accept4(r0, 0x0, 0x0, 0x80800) readlinkat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000540)=""/76, 0x4c) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000040)={0x0, 0x800}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000100)={r8, @in6={{0xa, 0x4e24, 0x7, @private1, 0xff}}, 0xfffb}, 0x90) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000200)={0x0, 0x9, 0x10}, &(0x7f0000000280)=0xc) 6.037738488s ago: executing program 1 (id=1724): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) connect$can_bcm(r1, &(0x7f0000000300)={0x1d, r2}, 0x10) socket$inet6_sctp(0xa, 0x801, 0x84) sendmsg$can_bcm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f0000000d00)=ANY=[@ANYBLOB="0200e738900000000000000000", @ANYRES16=r3, @ANYBLOB="020027bd7000fbdbdf25090000000c0007800800020008000000540009800800020000000100080001006b790000080001009409000008000200ccdf744c08000200080000000800010000000100080002000800000008000100521700000800010002000000080002000500000008000680040002003800058034000280080002000104000008000200040000000800020008000000080003000100008008000300faffffff080003004e0000000c00058008000100756470001400038008000300000000000800020010780000980004800c00078008000300fdffffff24000780080003007f000000080001000f0000000800040001000000080002005d0000002c00078008000100110000000800040002000000080001001b000000080001000a000000080001000e0000000900010073797a31000000002c0007800800020008000000080004000900000008000300000000000800030005000000080001001a00000014000380080003000700000008000200870000009c0006800400020008000100924c00003f00040067636d2861657329000000000000000000000000000000000000000000000000170000009b0797417746ccae4ff689d0fe1b6759a9b1bf720168df004900040067636d2861657329000000000000000000000000000000000000000000000000210000008288eb83fff1ee4fc0761ecbac83e4737c2019b970ba3709506663c66b5583a3c7000000"], 0x21c}, 0x1, 0x0, 0x0, 0x810}, 0x8000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f000000ddc0)={0x2020}, 0x2020) r5 = openat$cgroup_freezer_state(r4, &(0x7f00000002c0), 0x2, 0x0) sendfile(r5, r5, 0x0, 0x8000002) r6 = socket$kcm(0x29, 0x2, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x4, 0x5, &(0x7f0000001000)=ANY=[@ANYRES64=r3], &(0x7f0000000140)='GPL\x00'}, 0x94) r8 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r8, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e0, &(0x7f0000000040)={r8, r7}) sendmsg$kcm(r6, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f0000000880)="1a", 0x100000}], 0x1}, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, 0x0, 0x0) sendmsg$can_bcm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="0500"/12, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0104000001"], 0x48}, 0x1, 0x0, 0x0, 0x8040}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r10, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r11, {0x1}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) close(0x4) 6.030177428s ago: executing program 3 (id=1725): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000140)=ANY=[@ANYBLOB="12013301020000082505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f0100000000000000000006241a000008090511ee40000000000904010000020d000009040101"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000000)={0x40, 0x7, 0x6c, {0x6c, 0x22, "7ac07aa2338a236ea2703cfa974a87ef424397167db1b35a72d3e5f6af7142093de4bb3adbd3518d168a60295171675d8530664c4331863b6d327ac4a974c7eb3fc6d9e9d7871ead3881fa803afcd6ae67c58be60aec073395d9ab816a33e97d04e4965af3daf03bcdbb"}}, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x402}}, &(0x7f0000000240)={0x0, 0xf, 0x5a, {0x5, 0xf, 0x5a, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x0, 0xa, 0x2, 0x5}, @ss_container_id={0x14, 0x10, 0x4, 0xa, "7a07701d8cdc7e6a69821e169f48c2c8"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xc, 0x75, 0x2, 0x9}, @generic={0x30, 0x10, 0xb, "3808232512cc20406f04db2c5b28143f9026be80fa8e418373044c2e594bfe09e6b39f15e73241593080d9d3e4"}]}}, &(0x7f00000001c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf8, 0x10, 0x3, 0x81, "a729b9ea", "ff03a8bd"}}, &(0x7f00000002c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x0, 0xf, 0x2, 0x3, 0xf, 0x5}}}, &(0x7f00000007c0)={0x84, &(0x7f0000000340)={0x0, 0x13, 0x9a, "d04362c87bea61c090ba4735aea4f470671ac343e0d6fa3f027c66eef0cea8afd3748d1bd637ad314c74b47b17bb74006325934336f914b36bfc6f397888813e563df2c8db0a263a4fba015dd57154dd975f1fdc33e463c1d7a93899396a221061f7b628e43f6bb89e39806f8e28b83228621494e1de90bff98e502e6da18ccdc48d7380e57156077240fd337d32a155db969882d6a363ab74bd"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0xfe}, &(0x7f0000000440)={0x0, 0x8, 0x1}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x1}}, &(0x7f00000004c0)={0x20, 0x0, 0x4, {0xc0, 0x8}}, &(0x7f0000000500)={0x40, 0x7, 0x2, 0xab}, &(0x7f0000000540)={0x40, 0x9, 0x1, 0x2}, &(0x7f0000000580)={0x40, 0xb, 0x2, "4ab4"}, &(0x7f00000005c0)={0x40, 0xf, 0x2, 0x81}, &(0x7f0000000600)={0x40, 0x13, 0x6, @remote}, &(0x7f0000000640)={0x40, 0x17, 0x6}, &(0x7f0000000680)={0x40, 0x19, 0x2, "17b0"}, &(0x7f00000006c0)={0x40, 0x1a, 0x2, 0x6}, &(0x7f0000000700)={0x40, 0x1c, 0x1, 0x7}, &(0x7f0000000740)={0x40, 0x1e, 0x1}, &(0x7f0000000780)={0x40, 0x21, 0x1, 0x5}}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000000c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x1000, 0x0, 0x4000, 0x0, 0xfffc, 0x0, 0x800, 0x0, 0x3d3, 0x7}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 5.734292614s ago: executing program 1 (id=1727): r0 = socket$key(0xf, 0x3, 0x2) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x8040) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) (async) syz_open_dev$dri(0x0, 0xd21, 0x4000) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) (async, rerun: 32) syz_open_dev$usbmon(0x0, 0x0, 0x0) (rerun: 32) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) (async) r4 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000080)={0x40000002}) write$P9_RSTATu(r3, &(0x7f0000000580)=ANY=[], 0x21e) syz_open_dev$vbi(0x0, 0x0, 0x2) (async) r5 = openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r5, 0x4004510d, &(0x7f0000000000)) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) gettid() (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r6, &(0x7f0000002c00)=[{{0x0, 0x0, 0x0}, 0x200001}, {{0x0, 0x0, 0x0}, 0x200}, {{0x0, 0x0, 0x0}, 0x401}, {{0x0, 0x0, 0x0}, 0xff}, {{0x0, 0x0, 0x0}, 0x40}, {{0x0, 0x0, 0x0}, 0x40c}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000540)=""/130, 0x82}, {&(0x7f0000001a00)=""/4109, 0x100d}, {&(0x7f0000006080)=""/4085, 0xff5}, {0x0}, {0x0}, {&(0x7f0000000100)=""/98, 0x62}, {&(0x7f00000003c0)=""/100, 0x64}, {&(0x7f00000006c0)=""/200, 0xc8}, {&(0x7f0000000440)=""/67, 0x43}], 0x9}, 0x4db}, {{0x0, 0x0, 0x0}, 0x8}], 0x8, 0x0, 0x0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) (async, rerun: 64) r8 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) (rerun: 64) timer_create(0x2, 0x0, 0x0) (async) sendfile(r8, r7, &(0x7f0000002080)=0x64, 0x21c) sendmsg$key(r0, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="021800001c000000000000000000000005000600000000000a00000000000000000000000000000000000000000000000000000000000000020012000000000000000000fcffffff0600ff0000000000000000000000000000000000000000000000000001000000fe8000000000002100000000000000bb050005002b0000000a00000000000000fc010000000200000002000000000000000000000000000008001900000000000a00000000000000fe8000000000000000000000000000bb000000000a"], 0xe0}}, 0x0) 5.698568272s ago: executing program 2 (id=1728): syz_open_dev$evdev(0x0, 0x2, 0x903d01) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = syz_io_uring_setup(0x495, &(0x7f0000000400)={0x0, 0x7079, 0x0, 0x7, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)=0x3, 0x4) r6 = syz_io_uring_setup(0x239, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000440)=0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x77359400}}) io_uring_enter(r6, 0x2def, 0x0, 0x0, 0x0, 0x0) r9 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000003c0)=@newqdisc={0x78, 0x24, 0x50b, 0x8, 0x0, {0x60, 0x0, 0x0, r11, {0x0, 0x8}, {0xffff, 0xffff}, {0x1, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x18, 0x2, {{0x200, 0x5, 0x0, 0x0, 0xf407}, 0xfffffffb, 0x1, 0x0, 0x4, 0x7, 0x4, 0x40, 0x9, 0x0, 0x1ff, {0x0, 0x0, 0x0, 0x4}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_io_uring_submit(r7, r8, &(0x7f00000012c0)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x9, &(0x7f0000001380)={0x0, 0x3938700}, 0x1, 0x20}) r12 = socket$alg(0x26, 0x5, 0x0) bind$alg(r12, &(0x7f0000000a40)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r12, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r13 = accept4$alg(r12, 0x0, 0x0, 0x80800) sendmmsg$alg(r13, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4000050}], 0x1, 0x85) sendmsg$alg(r13, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000000c0)="ba88186615528c22a5149ece2b56a7f2", 0x10}], 0x1, 0x0, 0x0, 0x840}, 0xc440) io_setup(0x4, &(0x7f0000000100)=0x0) io_submit(r14, 0x2000000000000225, &(0x7f0000001440)=[&(0x7f0000000200)={0x1000000, 0x0, 0x700000000000000, 0x0, 0xfffb, r13, &(0x7f0000000340), 0x2d}]) io_uring_enter(r6, 0x4866, 0x0, 0xb, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r2, 0x4, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) 5.145237158s ago: executing program 0 (id=1730): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x21f6, 0x4) sendmmsg$inet(r0, &(0x7f0000003240)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0x1}], 0x1}}], 0x1, 0x4000800) recvfrom(r0, &(0x7f0000000200)=""/131, 0x83, 0x2000, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x65) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x1c, 0x0, 0x1, 0x0, 0x0, {{}, {0x0, 0x6}}}, 0x49}, 0x1, 0x0, 0x0, 0x4}, 0x0) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) setsockopt$inet_mreqsrc(r3, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) 4.971417429s ago: executing program 0 (id=1731): r0 = landlock_create_ruleset(&(0x7f0000000080)={0x220, 0x0, 0x1}, 0x18, 0x0) landlock_restrict_self(r0, 0x4) unshare(0x22020600) (async, rerun: 64) unshare(0x26020480) (rerun: 64) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x2012, r1, 0x0) (async) syz_open_procfs(0x0, &(0x7f0000000080)='net/kcm\x00') ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000000)=0x19) (async) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000dc0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 4.873550878s ago: executing program 0 (id=1732): r0 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x30400) ioctl$NBD_SET_BLKSIZE(r0, 0xab01, 0x1) ioctl$BLKROTATIONAL(r0, 0x127e, &(0x7f0000000080)) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x3b, 0x6b, 0xc0, 0x40, 0xb95, 0x772b, 0xa24c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x81, 0x38, 0x7f}}]}}]}}, 0x0) 4.477365349s ago: executing program 1 (id=1733): socket$netlink(0x10, 0x3, 0x8) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x183822, 0x0) write$6lowpan_enable(r0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x22000, 0x0) timerfd_create(0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) socket(0x2, 0x1, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x58}}, 0x0) r3 = syz_io_uring_setup(0x2e94, &(0x7f0000000180)={0x0, 0x100, 0x13090, 0x4, 0x1c4}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000200)=[{0x30, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r3, 0x497c, 0x0, 0x0, 0x0, 0x0) 4.372647832s ago: executing program 1 (id=1734): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x21f6, 0x4) sendmmsg$inet(r0, &(0x7f0000003240)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0x1}], 0x1}}], 0x1, 0x4000800) recvfrom(r0, &(0x7f0000000200)=""/131, 0x83, 0x2000, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x65) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x1c, 0x0, 0x1, 0x0, 0x0, {{}, {0x0, 0x6}}}, 0x49}, 0x1, 0x0, 0x0, 0x4}, 0x0) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) setsockopt$inet_mreqsrc(r3, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) (fail_nth: 2) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) 4.317676932s ago: executing program 1 (id=1735): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0x35, 0xff, 0xaa, 0x20, 0xccd, 0x10af, 0x384e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x59, 0x2, 0x1, 0x9b, 0x1e, 0x2a, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000180)={0x14, &(0x7f0000000000)={0x40, 0x30, 0x102, {0x102, 0x9, "a87b1b9306af95cd27d61774e2b6e57b465e549b17fdfdfd4e9ad17016e6046fc2afb72f9b5730b8094a83e7e55b384370cdc344b3972f5e90ab84f14bb4bd0ba1e3c0b48d10a69922e68be56d7543000171d2dabfb3476ce9f135420f75eb8a1b2b57aea7058a9418d1b8376f48989ee35ed755f0a8be981d87a09e6f44b1d71285a6816b7bbd896e845a05e9bec1eb35037fbd7e2e1fe666262839337e7f20f8451760656a9a6f9fd900f768cf93e56a79224a5453c29e07b65f669cff9f5ac8311bbc30261541a9b25d00603f57c7936604cd33eed5632c0ffa2bc474160bcfe12627f3deba66fec99322107aa455984d8d5622fa911074768cb1bd452f58"}}, &(0x7f0000000380)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000440)={0x44, &(0x7f0000000240)={0x20, 0x5, 0x41, "86c97d95249817b4044d6f2b59aca5ee5e585ba439a297bde585fb73f542b02ec58e345636d3fca75d281c37fda0258742c938d7131c90e890eccc6705ab0f8d8f"}, &(0x7f00000001c0)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0xb}, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x3, 0x4, 0x2, 0x6, 0x9, 0x9, 0x4, 0x6, 0x0, 0xc8, 0x5, 0xd0c4}}, &(0x7f0000000340)={0x20, 0x85, 0x4, 0xe}, &(0x7f00000004c0)={0x20, 0x83, 0x2}, &(0x7f00000003c0)={0x20, 0x87, 0x2, 0x3}, &(0x7f0000000400)={0x20, 0x89, 0x2}}) syz_usb_control_io$uac1(r0, &(0x7f0000000140)={0x14, &(0x7f0000000680)={0x0, 0x24, 0xcb, {0xcb, 0x27, "3500de1dbd66d218e77de855457c599b8a389728e947658e3c9933df2ec8261838fed6f20101f930af00cf51f30db627ec7bc8cdd2ce2043fd0a1303c6a4e2017825d472a53c198d1f1c50384c25e7c64adcff5b182f934740d7182ee7c00c03318d5c597b216529b27d264eaa8bba35bd1b6518d093b7a8bcb4f260e0ed3c93d095c38885c037f74f4ea6add8d7980328afe61ff9780e19d0e13ed0d802f091dbb3b37b8f2163826df0c6dbcaa5d91592e4679679084f11fb096dfc4f7e5ba8133010e64d1f37b685"}}, &(0x7f0000000500)={0x0, 0x3, 0x5c, @string={0x5c, 0x3, "35aceafda164efa07ada288df94e70637cff137d870752f0e2e6d9359ec40c9cdf81da61a6bf7756ddba3ebada61260aa5937019638557a29950c3f5884a975f694e244b4288d01b6733583f457bbc4a4a8c89609cc437e4732a"}}}, &(0x7f0000000a00)={0x44, &(0x7f0000000780)={0x0, 0x16, 0xbd, "952309aa5456689e8064d9217e8c3c435f80dd882c62cfbb51e1682aaee862532dfca2a4a5e6cece70beff7a4f296f8772dc39359f2f74d22063a3c1161357cc70641557780c5ba4e15eb7dd1b43824fcd34dd2fff7d2a38f309cd7b618290f08a6b4785df1fb1019873df345cf1fe3e5e02ffb6b76aa941c43680f1e6930370a2eddb3af8ec9966640bc4c2a16b77663c6acbbfec1c97f42eb7c10e0b0a4c2df9bac8519112537c1fb93efae7108e8d9bfb1718f7f42a65438be745a5"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000880)={0x0, 0x8, 0x1, 0x9}, &(0x7f00000008c0)={0x20, 0x81, 0x2, "09f6"}, &(0x7f0000000900)={0x20, 0x82, 0x3, "8957ab"}, &(0x7f0000000940)={0x20, 0x83, 0x2, "160b"}, &(0x7f0000000980)={0x20, 0x84, 0x4, "9ee406b6"}, &(0x7f00000009c0)={0x20, 0x85, 0x3, "d8cea9"}}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000200000000000070000002800018014000400fc020000000000000000000000000001060001"], 0x3c}}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000200)={0x20, 0x8}, 0x0, 0x0, 0x0, 0x0}) 4.197277239s ago: executing program 2 (id=1736): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) syz_open_dev$video(&(0x7f0000000140), 0xd, 0x1d1402) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x24500, 0x0) ioctl$TUNGETFEATURES(r3, 0x800454cf, 0x0) r4 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = syz_io_uring_setup(0x4a3, &(0x7f00000003c0)={0x0, 0x79ac, 0x800, 0x1, 0xfe, 0x0, r2}, &(0x7f0000000240)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000080)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd=r4, 0x7, &(0x7f00000000c0)=""/207, 0xcf, 0x10, 0x1}) io_uring_enter(r5, 0xfd0, 0x4c1, 0x43, 0x0, 0x0) 3.133182123s ago: executing program 0 (id=1737): socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pipe(0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000340)={0x385d, 0x1, "41c0537f19690cd7945060f524cdb875af5413d65b5f6f342a71406b0f796cc1191e1ecd916f54350f5cbfd5896a119fd1d5137dcdbb6a497f35099c1dd374e82b44205929de6f5a3d34c6a4de4d7fc1ed8475df44d91b190113bb920c0bf5c89c13e219ab37ae309b0100dc743f0f72109379dedc37a8bfa1b3c9c71bf823d8a5b7cca690b1d8e57080dfc1add8e83dbe05186101ff8ff3be2931f2b34c53942890c18707702679f77ed8a45f24646f47cfd378c215093d708a8c53f656993df90974147953df95bf23c9cb2caa4a5e30f10a0fffc410151f15fbcffb19002c635a7539de507c89478209e870201702c9e56ef23457a96269196f5cdd404b76"}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = memfd_secret(0x0) r4 = fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\xf6\xff\xff\xff\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000000)='test_dummy_encryption', &(0x7f0000000080)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x2c, 0x3e, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x11, 0xeb, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @generic="12444b588d"]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'veth0_virt_wifi\x00', 0x1000}) socket$nl_netfilter(0x10, 0x3, 0xc) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) socket$inet6(0xa, 0x3, 0x3a) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mq_notify(r3, &(0x7f0000000000)={0x110c230000, 0x10003, 0x2, @tid=0xffffffffffffffff}) r5 = gettid() tkill(r5, 0x12) r6 = syz_io_uring_setup(0x6148, &(0x7f0000000340)={0x0, 0x13ea, 0x2, 0x2, 0x3c6}, &(0x7f0000000040), &(0x7f0000000140)) io_uring_enter(r6, 0x2241, 0x1b86, 0x1, &(0x7f00000001c0), 0x8) socket$kcm(0x10, 0x2, 0x10) 3.109417833s ago: executing program 2 (id=1738): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000300)={0x1d, r1}, 0x10) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f000000ddc0)={0x2020}, 0x2020) r4 = openat$cgroup_freezer_state(r3, &(0x7f00000002c0), 0x2, 0x0) sendfile(r4, r4, 0x0, 0x8000002) getsockopt$IP_VS_SO_GET_SERVICE(r2, 0x0, 0x483, &(0x7f0000000200), &(0x7f0000000040)=0x68) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, 0x0, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="0500"/12, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0104000001"], 0x48}, 0x1, 0x0, 0x0, 0x8040}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r7, {0x1}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) close(0x4) 2.897622326s ago: executing program 3 (id=1739): openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = syz_open_dev$video(0x0, 0xf, 0x0) ioctl$VIDIOC_S_FMT(r2, 0xc0d05605, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x2}, 0x90) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) setsockopt$SO_TIMESTAMP(r5, 0x1, 0x3f, &(0x7f0000000280)=0x7, 0x4) sendmsg$inet(r5, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000001600)=[{&(0x7f0000000140)="be38", 0xffdf}], 0x1, &(0x7f0000001100)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001c0000000000000000000000070000004404730001000000e736f53aa500a029b4fff380b1208d2517faab10d57912ea57285a512c15273dd90873706db2ce3f1fd2709c8fca22cf77f29736f1e80045368c6d61cfefe19acae96300000000000000022fa79f00000000d114c4e16cb59c3b813222b23474ebab0566f62853"], 0x40}, 0x0) read$char_usb(r5, &(0x7f0000000080)=""/139, 0xfdef) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(0xffffffffffffffff, 0x3b89, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r7, 0x1, 0x48, &(0x7f0000000000), 0x4) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000100)={0x28, 0x4, r6, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x5}) r8 = io_uring_setup(0x2c23, &(0x7f0000000000)={0x0, 0xf0e6, 0x2, 0x4, 0xf0}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r8, 0x13, &(0x7f0000000400)=[0xe758, 0x8], 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1f, 0xe, &(0x7f0000000900)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r9 = memfd_create(&(0x7f0000000080)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1br\x14\xdb\xd3\xcd\xfd\xbdnC\xec)\x86\x14\x13\xeb\xb5\n-\xfeha\xfef\xecUO(\x91\x8d\x14\xec\x02u\xd9_FT\xaa\xda\x0e \xa0;\x10', 0x4) execveat(r9, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 2.693206237s ago: executing program 2 (id=1740): r0 = syz_usb_connect(0x2, 0x41, &(0x7f0000000200)={{0x12, 0x1, 0x0, 0xd1, 0x25, 0x3c, 0x40, 0x12d1, 0xed56, 0x46dd, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2f, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xcf, 0x0, 0x0, 0xff, 0x1, 0x37, 0x0, [@cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0xc957}, {0xd, 0x24, 0xf, 0x1, 0xe, 0x7, 0x5}, {0x6, 0x24, 0x1a, 0x8001, 0x9}}]}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) io_setup(0x81, &(0x7f0000001440)=0x0) r3 = syz_io_uring_setup(0x2af8, &(0x7f0000000980)={0x0, 0x0, 0x13090}, &(0x7f0000000340), &(0x7f0000000080)) io_submit(r2, 0x1, &(0x7f00000008c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}]) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f00000004c0)={'syzkaller0\x00', @link_local}) write$tun(r4, &(0x7f0000000280)=ANY=[], 0xc2) write$cgroup_devices(r5, &(0x7f0000000280)=ANY=[], 0xffdd) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000680)={0x2c, &(0x7f0000000400)={0x20, 0x1, 0x11, "def90deeaaed04b4ba4c6cd83cc5319741"}, 0x0, 0x0, 0x0, 0x0}) r7 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x3) syz_clone3(&(0x7f0000000340)={0x201800000, 0x0, 0x0, 0x0, {0x1f}, 0x0, 0x0, 0x0, 0x0, 0x0, {r8}}, 0x58) r9 = eventfd(0x8) r10 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x88040, 0x0) fcntl$setlease(r10, 0x400, 0x0) fcntl$getflags(r10, 0x401) ioctl$sock_SIOCGIFCONF(r8, 0x8912, &(0x7f0000000840)=@req={0x28, &(0x7f0000000800)={'geneve1\x00', @ifru_flags=0x2000}}) r11 = eventfd2(0x64b, 0x80001) r12 = eventfd2(0x80000000, 0x80000) io_submit(r2, 0x6, &(0x7f00000007c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6, 0x0, r3, &(0x7f0000000000)="5d50d951357c8da604e595abe38466", 0xf, 0x4, 0x0, 0x1, r8}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x3, 0x3, r3, &(0x7f0000000140)="15f070584060a86447555a82fcd501b74d7642ee2300edbe18eb26576d74b8e373865b5e11111a4ec083eacbe0ff1679e3d3e950d1f8c92a41f3ed6bcaf496207e6f948b3126d46c4ebc642185f58f4b2c4d877e8b77724b37d0a0cb6ff21fd435c42df861b3dcef4f99a1b34cdc95df8b1511b917b41c3328643580f52218a65dcb531762d92fc62b97d2c60b", 0x8d, 0xfffffffffffffeff, 0x0, 0x1, r9}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x8, 0xfffd, r3, &(0x7f0000000440)="6a57ebad7018a896fdc90b096309aa2ea9df5bcf40caebbb53ee0d2a8ad10ecc87cb75a920f32b1a20ce6188593e6d75b257a1bafed00fd9b4a0f2e939bc73ecf961c139fe70a2c12da2d3418fca1dda35611cf3da11319ab60c2f96aad492075138dbf6fede3678b3c97c4789a807ac45aa3f56e57f17a2db4cf37646da5d6af7a5e32930b4ec2c6ed394bbf3e7a5f8f30f239e9298b54934ea1729c5ac697af9b9", 0xa2, 0x8, 0x0, 0x3, r10}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2, 0xffff, r3, &(0x7f00000005c0)="e2ff93c0cd773690b1cdd9d3be602c96b79ac4efcb77ac9ab80d48b7fabbd7fd618c79cc2053cc1c2fe84d76385804107d943163561d1aa9a21d259317df4be4a920d5155004c824584a024c0fa3965fe7430dceb47def825e860517c3f00d0a5821f0ec433bf415d688ec8d1ee2fbbc9fe8973523776d7b2a2c7ce454ca283a7f4000d01618b081db2c222513dc17c36fa58b091c990ad299570e40ba26c1b2494cf8f4ecac7e6b41", 0xa9, 0x726, 0x0, 0x2}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x3, 0x4, r3, &(0x7f00000006c0)="84710e04344d849a2828203ef9f49b4159425dc30e817e806f8fa178342734e4c6f525ee845256fc27bcf55f1f996bfc2a993096fb68226aad3911d7cd53c8017cc925fc707abff388d73e656ee62d5bf1fe4a3cf64229bad09e12ec8a86a8d0dcdf7b99951ac694d4dbc35c6a5e1276edf9a5cc5d0d3a9879a8e42fb8e91319794652101262", 0x86, 0xf8, 0x0, 0x2, r11}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x6, 0x6, r3, &(0x7f0000000500)="0439b672e3014b239d4539e8c2e82bf24346d527decc9c0bea44bda203836932f39332a79d987ac3bc8163bb607304d63a707b2412fb0f54263856e9f19687d2249e556cac27c795ff15f2ede8631459d228534c4bb51b73a19be235662f43d7288f6cbcae351309647a8cee7e86fa30f12c1ad8c4e3a20b", 0x78, 0x80, 0x0, 0x4, r12}]) 1.890423393s ago: executing program 0 (id=1741): r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), 0xffffffffffffffff) semop(0xffffffffffffffff, &(0x7f0000000040)=[{0x2, 0x2}, {0x0, 0x60, 0x800}, {0x1, 0x6}, {0x2, 0x6, 0x1000}], 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c020000", @ANYRES16=r0, @ANYBLOB="01000000000000000000010000001400020077673100000000000000000000000000f40108807000008048000980280000f8060001000a00000014000200fe8000000000000000000000000000aa05000300000004001c000080060001000200000908000200e0000001050003000000000024000100000000000000000000000000000000000000000000000000000000000000000080010080200004000a004e2000000005200100000000000000000000000000000800000006000500b01f00000800030006000000060005000500000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff200004000a034e200000040100000000000000000000ffffac14142a06000000240001000000000000000000000000000000000000000000000000000000000000000000d4000980"], 0x21c}, 0x1, 0x0, 0x0, 0x20040010}, 0x4008804) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) syz_mount_image$fuse(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', 0x48000, &(0x7f0000000240)={{}, 0x2c, {'rootmode', 0x3d, 0xd000}}, 0x1, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r1) 1.694572984s ago: executing program 3 (id=1742): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x80) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x4002, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='syscall\x00') pread64(r4, &(0x7f0000000380)=""/140, 0x8c, 0x200000000000000) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000300)={0x2, r4}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xffff, 0xffff}, {0x0, 0xf}}}, 0x24}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32], 0x3c}}, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x4}}}, @IFLA_MASTER={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x4c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8}, @IFLA_MASTER={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x600}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x12) 1.645185044s ago: executing program 0 (id=1743): openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000000000001ae, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x4e21, 0xb744, @private2, 0xfffffffd}, 0x1c) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CAP_SPLIT_IRQCHIP(r7, 0x4068aea3, &(0x7f00000001c0)) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) ioctl$KVM_SET_VCPU_EVENTS(r8, 0x4138ae84, &(0x7f0000000080)=@x86={0x6, 0xa, 0x7, 0x0, 0x3, 0x8d, 0xce, 0x1c, 0x89, 0xa0, 0x7, 0x8, 0x0, 0x8000, 0xb, 0x2, 0x8, 0x2, 0x1, '\x00', 0x9, 0x3fb}) r9 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x8, 0x80, 0x0, '\x00', 0x5c8d}) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = landlock_create_ruleset(&(0x7f0000000000)={0x0, 0x1}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r10, 0x2, &(0x7f00000000c0)={0x3}, 0x0) syz_usb_connect(0x4, 0x81c, &(0x7f0000000480)=ANY=[], &(0x7f0000000e00)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x10, 0x0, 0x5, 0x66, 0x40, 0x8b}, 0x19, &(0x7f0000000340)=ANY=[], 0x4, [{0x0, 0x0}, {0x27, &(0x7f0000000e80)=ANY=[@ANYRES8=r3]}, {0x7f, &(0x7f0000000ec0)=ANY=[@ANYBLOB="7f039811916e11b45c33212fbd5e5df6395154736cb0a1dd20331bf488eec9cdbbb55ffd429bd18a295b26cfcfa1293f80607100384d032c4ff2ed22d8f15f8a212adc33223804f9fee285c00a13ae40d67a9e6712566e390dd50300000057fd2b04bc9ddfe0cc4e0246af824b72fb0ddf48d83daa2299ecfe21af62ffe1f55f30d21cfdb600c6acc9156a2c0d7c01f05dc4d5c930b317ea25b3bfe1192f324d9e7613d26b9b31a1c2cdf0b6fc3cdb7fc1009c2cafc79e0e0b16fa8322df3c6a5cc5e9aad0266554e76e9640bdbc"]}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x82c}}]}) openat$full(0xffffffffffffff9c, 0x0, 0x2fb71da98128d4bd, 0x0) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r0, 0xc040aed4, &(0x7f0000000240)={0x400200009fe0002, 0x3}) close_range(r11, 0xffffffffffffffff, 0x0) 1.373564748s ago: executing program 4 (id=1744): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000200)={0x1, 0x3, 0x0, 0x1000, &(0x7f0000fe6000/0x1000)=nil}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) ppoll(&(0x7f0000000700)=[{r2, 0x229d}], 0x1, 0x0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2010}, 0x4001) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xe, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x5a, 0x9e, 0xa, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000000180)={0x2, 0x4e27, @empty}, 0x10, 0x0, 0x64}}], 0x1, 0x20004840) symlinkat(&(0x7f00000000c0)='./file0\x00', r2, &(0x7f0000000140)='./file0\x00') ioctl$KVM_RUN(r5, 0xae80, 0x0) 509.287416ms ago: executing program 4 (id=1745): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x21f6, 0x4) sendmmsg$inet(r0, &(0x7f0000003240)=[{{0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0x1}], 0x1}}], 0x1, 0x4000800) recvfrom(r0, &(0x7f0000000200)=""/131, 0x83, 0x2000, 0x0, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x65) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x1c, 0x0, 0x1, 0x0, 0x0, {{}, {0x0, 0x6}}}, 0x49}, 0x1, 0x0, 0x0, 0x4}, 0x0) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) setsockopt$inet_mreqsrc(r3, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) (fail_nth: 3) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) 237.409725ms ago: executing program 2 (id=1746): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r1 = dup(0xffffffffffffffff) ioctl$SOUND_PCM_READ_CHANNELS(r1, 0x80045006, 0x0) open(&(0x7f0000000140)='./file1\x00', 0x10f0c2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x440, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000000000099"]) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ptrace$setregs(0xd, 0x0, 0xfffffffffffffffc, &(0x7f00000003c0)="18607651149d7b10b4024fbbdc08899b8f589df2dbb5d7a8d1b36cfab675cb3976ee8100e2878c9cfa178cac130eb046eda93df39ed4b41924dc225ad4028dd63def") ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) io_setup(0x6, &(0x7f0000001380)) r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) ftruncate(0xffffffffffffffff, 0xffff) close(0x3) ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f00000001c0)={0xffffffffffffffff, 0x1, 0x0, 0x8000}) 0s ago: executing program 1 (id=1747): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffb) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x4, 0xffffffff, 0xfffffff8, 0xfffffffc}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, 0x0, 0x0, 0x7, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) poll(&(0x7f0000000040), 0x55, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x20004080) write$binfmt_misc(r4, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f00000002c0)={r4, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd00b94e3d500007000000e0ff00000018000500", [0x0, 0x2000000000001]}}) sendmsg$NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x14) r5 = socket(0x2b, 0x1, 0x0) r6 = syz_io_uring_setup(0x859, &(0x7f0000001280)={0x0, 0xfad3, 0x800, 0xfffffffc, 0x2}, &(0x7f0000000240)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f00000000c0)=0x10001, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r5}) io_uring_enter(r6, 0xdb4, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r6, 0x18, &(0x7f0000000000)={0xfeffffff, r5, 0x3, {0x3b4, 0x9}, 0x6}, 0x1) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000006c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x5, {[@global=@item_012={0x1, 0x1, 0x3, "8d"}, @global=@item_012={0x2, 0x1, 0x4, "b314"}]}}, 0x0}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000280)={0x2c, &(0x7f0000000500)={0x40, 0xf, 0xf2, {0xf2, 0x31, "b2105c5a6095f2c30f0219a5697ed1e6d717012b26149cbbc05e3cfaa56aca72474438e15a10922cc9e985fa41a76d12e33443168a47b0bb807c5f11cc4e09d31e57cb8712a85d2a4312bb083f503c13d8ceb887f87043388094c1bed38c512af365124ede9acbe99fa618e1b4cc2c377410fb8db516976cc751a7d9d04bd0ff127a1ac083ddbe1f5853db9c5e4f0f5083171b3f9719858ed7ab323ae4150143be453004d63eaa830bebc2df6c3aa1e03dfd512318610bfa8e18f2369c3ddc22d01ed154f924454f5bc7e66e98accd0e448b52c3c2c9c2791bc1be31e9673a67203df9eda90697a5a3a952c2d39257f7"}}, &(0x7f0000000140)={0x0, 0x3, 0x18, @string={0x18, 0x3, "5ceca11f6ee4b3fe656cf72df6792e871b4849928b3d"}}, &(0x7f0000000600)={0x0, 0xf, 0xa6, {0x5, 0xf, 0xa6, 0x2, [@generic={0x96, 0x10, 0x1, "ad16fed8a906810af7efeb798e5243caf9ed41299e2be7249299edd1c04c2550b93c43d8d4d05aeefb596dfe28aad9dd2eeb887b9cb81c82ffb9f502c92dcbc9c9475890a607f94cf8663e4bc05bcb2581aa2266cf2f5286d504271c96d1a54804667990cbc35a57d5f04fa9b21a54b3fc5715caf9b0c29ab95b8f2445626bc4940f58b640ffb0120e11147ea1c6ace5c95bf3"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x4e, 0x0, 0x6, 0xfffd, 0x5}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xfb, 0x2, 0x0, 0x8, "79fe6806", 'NB\nl'}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xf8, 0x1, 0x6, 0x9, 0x6, 0x7}}}, &(0x7f0000000ac0)={0x84, &(0x7f0000000400)={0x40, 0x11, 0x28, "33c3840ec3727f7921e1e3b1e903e5fea8ec65d117152d72be63b63f6ce0666b065f238d60bb8c57"}, &(0x7f0000000700)={0x0, 0xa, 0x1, 0xdf}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000780)={0x20, 0x0, 0x4, {0x3, 0x3}}, &(0x7f00000007c0)={0x20, 0x0, 0x4, {0x0, 0x10}}, &(0x7f0000000800)={0x40, 0x7, 0x2, 0x6}, &(0x7f0000000840)={0x40, 0x9, 0x1, 0x4}, &(0x7f0000000880)={0x40, 0xb, 0x2, "2901"}, &(0x7f00000008c0)={0x40, 0xf, 0x2, 0x81}, &(0x7f0000000900)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000940)={0x40, 0x17, 0x6, @remote}, &(0x7f0000000980)={0x40, 0x19, 0x2, "0f48"}, &(0x7f00000009c0)={0x40, 0x1a, 0x2, 0x3}, &(0x7f0000000a00)={0x40, 0x1c, 0x1, 0x9}, &(0x7f0000000a40)={0x40, 0x1e, 0x1, 0x3}, &(0x7f0000000a80)={0x40, 0x21, 0x1, 0x3}}) kernel console output (not intermixed with test programs): [ T5929] usb 5-1: USB disconnect, device number 63 [ 398.944071][ T30] audit: type=1326 audit(1758781362.110:362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13767 comm="syz.1.1320" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f539e98eec9 code=0x7ffc0000 [ 398.966462][ C1] vkms_vblank_simulate: vblank timer overrun [ 399.035055][ T5985] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 399.214822][ T5985] usb 3-1: Using ep0 maxpacket: 8 [ 399.230546][ T5985] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 399.248129][ T5985] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 399.259905][ T5985] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 399.275299][ T5985] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.287168][ T5985] usb 3-1: Product: syz [ 399.291367][ T5985] usb 3-1: Manufacturer: syz [ 399.296125][ T5985] usb 3-1: SerialNumber: syz [ 399.521333][ T5985] usb 3-1: 0:2 : does not exist [ 399.549839][ T5985] usb 3-1: USB disconnect, device number 83 [ 399.880846][ T3213] usb 4-1: USB disconnect, device number 76 [ 399.938270][T13779] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1324'. [ 399.950335][T13779] openvswitch: netlink: Flow actions attr not present in new flow. [ 400.198355][T13789] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1326'. [ 400.590884][ T3213] usb 1-1: USB disconnect, device number 78 [ 401.023416][T13804] vxcan0: entered allmulticast mode [ 401.380729][T13813] kvm: pic: non byte write [ 401.387609][T13813] kvm: pic: non byte write [ 401.392290][T13813] kvm: pic: single mode not supported [ 401.392301][T13813] kvm: pic: level sensitive irq not supported [ 401.400639][T13813] kvm: pic: single mode not supported [ 401.406838][T13813] kvm: pic: level sensitive irq not supported [ 401.655678][ T5985] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 401.819323][ T5985] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 401.840074][ T5985] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 401.850842][ T5985] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 401.862894][ T5985] usb 1-1: SerialNumber: syz [ 402.626206][ T30] audit: type=1326 audit(1758781366.340:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13820 comm="syz.4.1333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 402.651104][ T30] audit: type=1326 audit(1758781366.360:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13820 comm="syz.4.1333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 402.702004][ T30] audit: type=1326 audit(1758781366.410:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13820 comm="syz.4.1333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 402.726827][ T5985] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -71 [ 402.746046][ T5985] usb 1-1: USB disconnect, device number 79 [ 402.772705][ T30] audit: type=1326 audit(1758781366.480:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13820 comm="syz.4.1333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 402.800900][ T30] audit: type=1326 audit(1758781366.510:367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13820 comm="syz.4.1333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=245 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 402.824380][ T3213] usb 2-1: new full-speed USB device number 80 using dummy_hcd [ 402.843297][ T30] audit: type=1326 audit(1758781366.530:368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13820 comm="syz.4.1333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 403.000122][ T3213] usb 2-1: unable to get BOS descriptor or descriptor too short [ 403.008317][ T3213] usb 2-1: not running at top speed; connect to a high speed hub [ 403.038209][ T3213] usb 2-1: config 129 has an invalid interface number: 28 but max is 8 [ 403.073387][ T3213] usb 2-1: config 129 has an invalid descriptor of length 218, skipping remainder of the config [ 403.088679][ T3213] usb 2-1: config 129 has 1 interface, different from the descriptor's value: 9 [ 403.100051][ T3213] usb 2-1: config 129 has no interface number 0 [ 403.110225][ T3213] usb 2-1: config 129 interface 28 altsetting 250 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 403.364155][T13840] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1338'. [ 403.383399][ T3213] usb 2-1: config 129 interface 28 has no altsetting 0 [ 403.406624][ T3213] usb 2-1: New USB device found, idVendor=108c, idProduct=0159, bcdDevice=db.57 [ 403.438336][ T3213] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.455453][ T3213] usb 2-1: Product: syz [ 403.469233][ T3213] usb 2-1: Manufacturer: syz [ 403.484109][ T3213] usb 2-1: SerialNumber: syz [ 403.725157][ T3213] etas_es58x 2-1:129.28: Starting syz syz (Serial Number syz) [ 403.747923][ T3213] usb 2-1: USB disconnect, device number 80 [ 403.798666][T13837] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1337'. [ 403.975759][ T5916] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 404.137305][ T5916] usb 3-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 404.174278][ T5916] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 404.205816][ T5916] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.484735][ T1229] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 404.487614][ T5916] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 404.520399][ T5916] snd-usb-audio 3-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 404.567193][ T5961] udevd[5961]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 404.646041][ T1229] usb 4-1: Using ep0 maxpacket: 16 [ 404.659703][ T1229] usb 4-1: unable to get BOS descriptor or descriptor too short [ 404.676856][ T1229] usb 4-1: config 13 has an invalid interface number: 50 but max is 0 [ 404.728331][ T1229] usb 4-1: config 13 has an invalid descriptor of length 0, skipping remainder of the config [ 404.752863][ T1229] usb 4-1: config 13 has no interface number 0 [ 404.759264][ T1229] usb 4-1: config 13 interface 50 altsetting 167 bulk endpoint 0x88 has invalid maxpacket 16 [ 404.769884][ T1229] usb 4-1: config 13 interface 50 altsetting 167 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 404.784660][ T1229] usb 4-1: config 13 interface 50 has no altsetting 0 [ 404.798831][ T1229] usb 4-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 404.808063][ T1229] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.816381][ T1229] usb 4-1: Product: syz [ 404.820731][ T1229] usb 4-1: Manufacturer: syz [ 404.838643][ T1229] usb 4-1: SerialNumber: syz [ 404.858622][T13855] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 404.984981][ T5929] usb 1-1: new full-speed USB device number 80 using dummy_hcd [ 405.089336][ T1229] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 405.100221][ T1229] usb 4-1: MIDIStreaming interface descriptor not found [ 405.144828][ T5929] usb 1-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 405.151075][T13867] netlink: 'syz.1.1345': attribute type 4 has an invalid length. [ 405.162004][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.196639][ T5929] usb 1-1: Product: syz [ 405.215183][ T5929] usb 1-1: Manufacturer: syz [ 405.223279][ T1229] usb 4-1: USB disconnect, device number 77 [ 405.238368][ T5929] usb 1-1: SerialNumber: syz [ 405.345186][ T5929] usb 1-1: config 0 descriptor?? [ 405.348996][ T5914] udevd[5914]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:13.50/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 405.372991][ T5929] gspca_main: sq930x-2.14.0 probing 2770:930c [ 406.150612][T13883] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1347'. [ 406.338923][T13870] delete_channel: no stack [ 406.390686][ T43] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 406.535215][ T43] usb 4-1: Using ep0 maxpacket: 8 [ 406.550938][T13890] netlink: 'syz.3.1352': attribute type 13 has an invalid length. [ 406.550971][T13890] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1352'. [ 406.550993][T13890] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 406.605344][ T5929] gspca_sq930x: ucbus_write failed -110 [ 406.683460][T13845] delete_channel: no stack [ 406.689486][ T5916] usb 3-1: USB disconnect, device number 84 [ 406.824777][ T5929] gspca_sq930x: Sensor ov9630 not yet treated [ 406.824860][ T5929] sq930x 1-1:0.0: probe with driver sq930x failed with error -22 [ 406.838158][T13898] netlink: 'syz.2.1356': attribute type 4 has an invalid length. [ 408.018754][ T1229] usb 1-1: USB disconnect, device number 80 [ 408.763274][T13960] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1365'. [ 408.763394][T13960] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1365'. [ 408.763411][T13960] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1365'. [ 408.867089][T13964] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1364'. [ 409.009770][ T43] usb 4-1: unable to get BOS descriptor or descriptor too short [ 409.024544][ T43] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 409.034291][ T43] usb 4-1: can't read configurations, error -71 [ 409.060195][T13966] netlink: 'syz.3.1367': attribute type 4 has an invalid length. [ 409.114824][ T5916] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 409.145229][ T1229] usb 2-1: new full-speed USB device number 81 using dummy_hcd [ 409.275085][ T5916] usb 5-1: Using ep0 maxpacket: 32 [ 409.314750][ T1229] usb 2-1: device descriptor read/64, error -71 [ 409.357289][ T5916] usb 5-1: config 0 has an invalid descriptor of length 13, skipping remainder of the config [ 409.374144][ T5916] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 409.513246][ T5916] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 409.522992][ T5916] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.536887][ T5916] usb 5-1: Product: syz [ 409.542292][ T5916] usb 5-1: Manufacturer: syz [ 409.549002][ T5916] usb 5-1: SerialNumber: syz [ 409.563913][ T5916] usb 5-1: config 0 descriptor?? [ 409.664785][ T1229] usb 2-1: new full-speed USB device number 82 using dummy_hcd [ 409.678153][T13984] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1372'. [ 409.687689][T13985] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1372'. [ 409.844850][ T1229] usb 2-1: device descriptor read/64, error -71 [ 409.955084][ T1229] usb usb2-port1: attempt power cycle [ 409.985051][ T5916] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 410.149365][ T5916] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 410.193898][ T5916] usb 1-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=60.d9 [ 410.209236][ T5916] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.217695][ T5916] usb 1-1: Product: syz [ 410.221866][ T5916] usb 1-1: Manufacturer: syz [ 410.231320][ T5916] usb 1-1: SerialNumber: syz [ 410.240332][ T5916] usb 1-1: config 0 descriptor?? [ 410.314706][ T1229] usb 2-1: new full-speed USB device number 83 using dummy_hcd [ 410.345617][ T1229] usb 2-1: device descriptor read/8, error -71 [ 410.454521][T13985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 410.474516][T13985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.501751][T13985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 410.525440][T13985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.545609][T13985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 410.558177][T13991] tipc: Started in network mode [ 410.563054][T13991] tipc: Node identity b287dba22474, cluster identity 4711 [ 410.570773][T13985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.585207][T13985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 410.593907][T13991] tipc: Enabled bearer , priority 0 [ 410.601068][T13985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.616161][T13985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 410.630919][T13985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.653325][ T1229] usb 2-1: new full-speed USB device number 84 using dummy_hcd [ 410.654878][T13991] syzkaller0: entered promiscuous mode [ 410.674473][T13991] syzkaller0: entered allmulticast mode [ 410.686294][ T1229] usb 2-1: device descriptor read/8, error -71 [ 410.739658][ T5916] usb 1-1: probing VID:PID(2201:012C) [ 410.756412][ T5916] usb 1-1: Could not find two sets of bulk-in/out endpoint pairs [ 410.764520][ T5916] vub300 1-1:0.0: probe with driver vub300 failed with error -22 [ 410.781757][ T5916] usb 1-1: USB disconnect, device number 81 [ 410.806953][T13991] tipc: Resetting bearer [ 410.825561][ T1229] usb usb2-port1: unable to enumerate USB device [ 410.838496][T13990] tipc: Resetting bearer [ 411.417881][T13990] tipc: Disabling bearer [ 411.703027][T14001] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1375'. [ 411.877055][ T5916] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 411.952398][T14007] netlink: 'syz.3.1378': attribute type 4 has an invalid length. [ 412.095089][ T5916] usb 3-1: Using ep0 maxpacket: 32 [ 412.155111][ T5916] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 412.163300][ T5916] usb 3-1: config 0 has no interface number 0 [ 412.214476][ T5916] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 412.233734][ T5916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.242046][ T5916] usb 3-1: Product: syz [ 412.254935][ T5916] usb 3-1: Manufacturer: syz [ 412.269647][ T5916] usb 3-1: SerialNumber: syz [ 412.335791][ T5916] usb 3-1: config 0 descriptor?? [ 412.342738][ T5916] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 412.351906][ T5916] usb 3-1: selecting invalid altsetting 1 [ 412.409010][ T5916] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 412.430118][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 412.430128][ T30] audit: type=1326 audit(1758781376.140:391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14014 comm="syz.0.1380" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 412.605523][ T5916] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 412.717321][ T5916] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 412.735585][ T30] audit: type=1326 audit(1758781376.140:392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14014 comm="syz.0.1380" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 412.767211][ T5916] usb 3-1: media controller created [ 412.799325][ T5916] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 412.808003][ T30] audit: type=1326 audit(1758781376.140:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14014 comm="syz.0.1380" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 412.830308][ C1] vkms_vblank_simulate: vblank timer overrun [ 412.854998][ T30] audit: type=1326 audit(1758781376.140:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14014 comm="syz.0.1380" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 412.877392][ C1] vkms_vblank_simulate: vblank timer overrun [ 412.884088][ T5916] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 412.891608][ T5916] zl10353_read_register: readreg error (reg=127, ret==-71) [ 412.899570][ T30] audit: type=1326 audit(1758781376.140:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14014 comm="syz.0.1380" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 412.922512][ T5916] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 412.954804][ T1229] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 412.970215][ T30] audit: type=1326 audit(1758781376.140:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14014 comm="syz.0.1380" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f89f5d8d710 code=0x7ffc0000 [ 413.100029][ T5916] usb 3-1: USB disconnect, device number 85 [ 413.149883][ T30] audit: type=1326 audit(1758781376.140:397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14014 comm="syz.0.1380" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 413.208551][ T30] audit: type=1326 audit(1758781376.140:398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14014 comm="syz.0.1380" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 413.230901][ C1] vkms_vblank_simulate: vblank timer overrun [ 413.252443][ T1229] usb 4-1: Using ep0 maxpacket: 16 [ 413.280739][ T1229] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 413.302031][ T1229] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 413.319743][ T1229] usb 4-1: New USB device found, idVendor=17ef, idProduct=6009, bcdDevice= 0.00 [ 413.342402][ T1229] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.419934][ T1229] usb 4-1: config 0 descriptor?? [ 413.638930][ T30] audit: type=1326 audit(1758781376.170:399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14014 comm="syz.0.1380" exe="/root/syz-executor" sig=0 arch=c000003e syscall=291 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 413.661478][ C1] vkms_vblank_simulate: vblank timer overrun [ 413.674856][ T5959] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 413.768304][ T30] audit: type=1326 audit(1758781376.170:400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14014 comm="syz.0.1380" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 413.844771][ T5959] usb 3-1: Using ep0 maxpacket: 8 [ 413.853591][ T5959] usb 3-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 413.863002][ T5959] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.879849][ T5959] usb 3-1: Product: syz [ 414.137800][ T5959] usb 3-1: Manufacturer: syz [ 414.139522][T14013] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 414.154144][ T5959] usb 3-1: SerialNumber: syz [ 414.192702][ T5959] usb 3-1: config 0 descriptor?? [ 414.209960][ T5959] gspca_main: se401-2.14.0 probing 047d:5003 [ 415.068791][ T5959] input: se401 as /devices/platform/dummy_hcd.2/usb3/3-1/input/input28 [ 415.265014][ T5959] usb 3-1: USB disconnect, device number 86 [ 416.016688][ T1229] usbhid 4-1:0.0: can't add hid device: -71 [ 416.022704][ T1229] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 416.045434][ T1229] usb 4-1: USB disconnect, device number 80 [ 416.066346][ T43] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 416.143111][ T5916] usb 5-1: USB disconnect, device number 64 [ 416.167311][T14046] netlink: 'syz.2.1389': attribute type 4 has an invalid length. [ 416.239255][ T43] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 416.251564][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.299882][ T43] usb 1-1: Product: syz [ 416.310940][ T43] usb 1-1: Manufacturer: syz [ 416.325277][ T43] usb 1-1: SerialNumber: syz [ 416.625329][ T5916] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 416.764888][ T43] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 416.787892][ T43] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 416.813046][ T5916] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 416.823979][ T5916] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 416.838670][ T5916] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 416.847982][ T5916] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 416.861035][ T43] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 416.870728][ T5916] usb 2-1: Manufacturer: syz [ 416.883753][ T5916] usb 2-1: config 0 descriptor?? [ 416.901212][ T43] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -32 [ 416.928469][T14063] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 416.935860][T14063] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 416.964919][T14063] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 416.973573][T14063] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 416.980410][ T5916] rc_core: IR keymap rc-hauppauge not found [ 416.986630][ T5916] Registered IR keymap rc-empty [ 417.003743][ T5916] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 417.033916][ T5916] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input29 [ 417.118554][ C1] igorplugusb 2-1:0.0: Error: urb status = -32 [ 417.156931][ T43] usb 2-1: USB disconnect, device number 85 [ 417.384716][ T5916] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 417.536438][ T5916] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 417.619223][ T5916] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 417.641672][ T5916] usb 5-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 417.651830][ T5916] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.670909][ T5916] usb 5-1: config 0 descriptor?? [ 418.095087][ T43] usb 2-1: new full-speed USB device number 86 using dummy_hcd [ 418.133784][T14084] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1398'. [ 418.223656][T14086] netlink: 'syz.2.1399': attribute type 4 has an invalid length. [ 418.231848][ T43] usb 2-1: device descriptor read/64, error -71 [ 418.244756][ T5985] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 418.410465][ T5985] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 418.421017][ T5985] usb 4-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 418.433541][ T5985] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.498271][ T43] usb 2-1: new full-speed USB device number 87 using dummy_hcd [ 418.644801][ T43] usb 2-1: device descriptor read/64, error -71 [ 418.730921][ T3213] usb 1-1: USB disconnect, device number 82 [ 418.755584][ T43] usb usb2-port1: attempt power cycle [ 418.802955][ T5985] usb 4-1: config 0 descriptor?? [ 418.871921][ T5985] usb 4-1: bad CDC descriptors [ 418.984842][ T5873] Bluetooth: hci4: command 0x0406 tx timeout [ 418.990990][ T7977] Bluetooth: hci3: command 0x0406 tx timeout [ 418.991031][ T5869] Bluetooth: hci1: command 0x0406 tx timeout [ 418.997175][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 419.074859][ T3213] usb 1-1: new low-speed USB device number 83 using dummy_hcd [ 419.124737][ T43] usb 2-1: new full-speed USB device number 88 using dummy_hcd [ 419.148685][ T43] usb 2-1: device descriptor read/8, error -71 [ 419.236693][ T3213] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 419.260849][ T3213] usb 1-1: config 0 has no interface number 0 [ 419.286434][ T5916] usbhid 5-1:0.0: can't add hid device: -71 [ 419.292653][ T3213] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 419.303756][ T5916] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 419.313948][ T3213] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 419.341552][ T5916] usb 5-1: USB disconnect, device number 65 [ 419.371950][ T3213] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 419.394702][ T43] usb 2-1: new full-speed USB device number 89 using dummy_hcd [ 419.412160][ T3213] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.445516][ T43] usb 2-1: device descriptor read/8, error -71 [ 419.460329][ T3213] usb 1-1: config 0 descriptor?? [ 419.472988][T14092] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 419.496992][ T3213] iowarrior 1-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 419.578735][ T43] usb usb2-port1: unable to enumerate USB device [ 419.804698][ T1229] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 419.954863][ T1229] usb 3-1: Using ep0 maxpacket: 16 [ 419.962423][ T1229] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 419.978173][ T1229] usb 3-1: config 0 has no interface number 0 [ 420.019255][ T1229] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 420.187411][ T1229] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 59378, setting to 1024 [ 420.253887][ T1229] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 420.263164][ T1229] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 420.278987][ T1229] usb 3-1: Product: syz [ 420.283340][ T1229] usb 3-1: SerialNumber: syz [ 420.296698][ T1229] usb 3-1: config 0 descriptor?? [ 420.312628][T14097] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 420.326367][ T1229] cm109 3-1:0.8: invalid payload size 1024, expected 4 [ 420.337934][ T1229] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input30 [ 420.399817][T14105] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1404'. [ 420.419548][T14105] A link change request failed with some changes committed already. Interface veth0_virt_wifi may have been left with an inconsistent configuration, please check. [ 420.834937][ T1229] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 421.002543][ T1229] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 421.019419][ T1229] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.027577][ T1229] usb 5-1: Product: syz [ 421.031774][ T1229] usb 5-1: Manufacturer: syz [ 421.040545][ T1229] usb 5-1: SerialNumber: syz [ 421.071259][ T1229] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 421.096341][T14118] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1408'. [ 421.186955][T14118] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1408'. [ 421.233910][T14118] batadv0: entered promiscuous mode [ 421.236394][ T5985] usb 4-1: USB disconnect, device number 81 [ 421.275410][T14118] batadv0: left promiscuous mode [ 421.390020][T14121] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1409'. [ 421.450639][ T5959] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 422.051637][ T1229] usb 1-1: USB disconnect, device number 83 [ 422.111195][T14133] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1410'. [ 422.541832][T14141] lo: Caught tx_queue_len zero misconfig [ 422.634458][ T5959] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 422.643104][ T5959] ath9k_htc: Failed to initialize the device [ 422.750206][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 422.752656][ T43] usb 3-1: USB disconnect, device number 87 [ 422.757184][ C0] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 422.771952][ T5959] usb 5-1: ath9k_htc: USB layer deinitialized [ 422.818490][ T43] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 423.155406][T14148] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1414'. [ 423.174998][T14149] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1414'. [ 423.322621][T14148] 8021q: adding VLAN 0 to HW filter on device bond2 [ 423.441744][T14108] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1405'. [ 423.469727][T14149] 8021q: adding VLAN 0 to HW filter on device bond3 [ 423.567862][T14149] fuse: Bad value for 'group_id' [ 423.572825][T14149] fuse: Bad value for 'group_id' [ 423.782872][T14153] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1405'. [ 424.428416][T14177] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1421'. [ 425.147015][ T1229] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 425.334406][ T1229] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 425.382258][ T1229] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 425.463781][ T1229] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 425.473223][ T1229] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.505471][ T1229] usb 2-1: config 0 descriptor?? [ 425.562871][ T5929] usb 5-1: USB disconnect, device number 66 [ 425.930953][ T1229] cm6533_jd 0003:0D8C:0022.000E: unknown main item tag 0x0 [ 425.960108][ T1229] cm6533_jd 0003:0D8C:0022.000E: unknown main item tag 0x0 [ 426.071975][T14189] syz.0.1423 (14189): drop_caches: 2 [ 426.104962][ T1229] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0D8C:0022.000E/input/input31 [ 426.205404][ T1229] cm6533_jd 0003:0D8C:0022.000E: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.1-1/input0 [ 426.243416][ T1229] usb 2-1: USB disconnect, device number 90 [ 426.314273][T14197] fido_id[14197]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 426.594760][ T5959] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 426.768229][ T5959] usb 1-1: Using ep0 maxpacket: 32 [ 426.783204][ T5959] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 426.806996][ T5959] usb 1-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 426.821034][ T5959] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.834009][ T5959] usb 1-1: Product: syz [ 426.844133][ T5959] usb 1-1: Manufacturer: syz [ 426.854261][ T5959] usb 1-1: SerialNumber: syz [ 426.876358][ T5959] usb 1-1: config 0 descriptor?? [ 426.900139][ T5959] cdc_ether 1-1:0.0: skipping garbage [ 426.924693][ T5959] usb 1-1: bad CDC descriptors [ 426.950542][ T5959] usb 1-1: unsupported MDLM descriptors [ 427.101559][T14200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 427.114697][ T3213] usb 2-1: new full-speed USB device number 91 using dummy_hcd [ 427.125336][T14200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 427.147452][ T43] usb 1-1: USB disconnect, device number 84 [ 427.194245][T14198] syz.3.1427 (14198): drop_caches: 2 [ 427.292652][ T3213] usb 2-1: config 0 has an invalid interface number: 113 but max is 0 [ 427.301073][ T3213] usb 2-1: config 0 has no interface number 0 [ 427.308155][ T3213] usb 2-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0xE7, changing to 0x87 [ 427.320050][ T3213] usb 2-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 427.331301][ T3213] usb 2-1: config 0 interface 113 has no altsetting 0 [ 427.341567][ T3213] usb 2-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 427.351763][ T3213] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.360548][ T3213] usb 2-1: Product: syz [ 427.364963][ T3213] usb 2-1: Manufacturer: syz [ 427.369535][ T3213] usb 2-1: SerialNumber: syz [ 427.376009][ T3213] usb 2-1: config 0 descriptor?? [ 427.382911][ T3213] pn533_usb 2-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 427.408579][T14218] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1432'. [ 427.598914][ T5959] usb 2-1: USB disconnect, device number 91 [ 428.185035][T14240] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.188547][T14223] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1425'. [ 428.206123][T14240] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.387819][ T5959] usb 1-1: new full-speed USB device number 85 using dummy_hcd [ 428.420490][ T5929] usb 2-1: new full-speed USB device number 92 using dummy_hcd [ 428.597809][T14250] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.613041][T14250] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.621807][ T5929] usb 2-1: too many endpoints for config 253 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 428.631580][T14250] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 428.643754][T14250] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.645029][ T5959] usb 1-1: unable to get BOS descriptor or descriptor too short [ 428.659411][ T5929] usb 2-1: config 253 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 428.672315][ T5929] usb 2-1: config 253 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 428.686162][ T5959] usb 1-1: not running at top speed; connect to a high speed hub [ 428.695146][ T5959] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 428.710431][ T5929] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 428.720225][ T5959] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 428.729354][ T5929] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 428.738249][ T5929] usb 2-1: SerialNumber: syz [ 428.745199][ T5959] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 428.758179][ T5959] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.766434][ T5959] usb 1-1: Product: syz [ 428.770593][ T5959] usb 1-1: Manufacturer: syz [ 428.775583][ T5959] usb 1-1: SerialNumber: syz [ 428.826586][ T43] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 428.964116][ T5929] rndis_host 2-1:253.0: RNDIS init failed, -71 [ 428.982501][ T5929] rndis_host 2-1:253.0: probe with driver rndis_host failed with error -71 [ 429.024712][ T5929] usb 2-1: USB disconnect, device number 92 [ 429.045682][T14264] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1444'. [ 429.065584][ T5959] usb 1-1: 0:2 : does not exist [ 429.070566][ T5959] usb 1-1: unit 4 not found! [ 429.099407][ T5959] usb 1-1: 5:0: cannot get min/max values for control 2 (id 5) [ 429.119119][ T5959] usb 1-1: 5:0: cannot get min/max values for control 3 (id 5) [ 429.173243][ T5959] usb 1-1: 5:0: cannot get min/max values for control 3 (id 5) [ 429.204295][ T5959] usb 1-1: USB disconnect, device number 85 [ 429.404890][ T5916] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 429.554784][ T5959] usb 1-1: new full-speed USB device number 86 using dummy_hcd [ 429.584812][ T5916] usb 4-1: Using ep0 maxpacket: 16 [ 429.591941][ T5916] usb 4-1: unable to get BOS descriptor or descriptor too short [ 429.602076][ T5916] usb 4-1: config 1 interface 0 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 429.616128][ T5916] usb 4-1: config 1 interface 0 has no altsetting 0 [ 429.625199][ T5916] usb 4-1: New USB device found, idVendor=05ac, idProduct=0236, bcdDevice= 0.40 [ 429.634308][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.645839][ T5916] usb 4-1: Product: syz [ 429.650010][ T5916] usb 4-1: Manufacturer: syz [ 429.655257][ T5916] usb 4-1: SerialNumber: syz [ 429.716614][ T5959] usb 1-1: config 0 has an invalid interface number: 235 but max is 0 [ 429.725205][ T5959] usb 1-1: config 0 has no interface number 0 [ 429.731340][ T5959] usb 1-1: config 0 interface 235 has no altsetting 0 [ 429.743123][ T5959] usb 1-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=3e.18 [ 429.754286][ T5959] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.767176][ T5959] usb 1-1: Product: syz [ 429.771330][ T5959] usb 1-1: Manufacturer: syz [ 429.783211][ T5959] usb 1-1: SerialNumber: syz [ 429.793916][ T5959] usb 1-1: config 0 descriptor?? [ 429.809845][ T5959] keyspan 1-1:0.235: Keyspan 1 port adapter converter detected [ 429.819255][ T5959] keyspan 1-1:0.235: found no endpoint descriptor for endpoint 87 [ 429.830216][ T5959] keyspan 1-1:0.235: found no endpoint descriptor for endpoint 7 [ 429.850066][ T5959] keyspan 1-1:0.235: found no endpoint descriptor for endpoint 81 [ 429.859038][ T5959] keyspan 1-1:0.235: found no endpoint descriptor for endpoint 1 [ 429.878416][T14278] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 429.933649][T14282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 429.947449][ T5959] keyspan 1-1:0.235: found no endpoint descriptor for endpoint 85 [ 429.965519][ T5959] usb 1-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 429.966033][T14282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.022573][ T5959] usb 1-1: USB disconnect, device number 86 [ 430.049301][ T5959] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 430.063160][ T5959] keyspan 1-1:0.235: device disconnected [ 430.069330][ T5916] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input32 [ 430.110800][ T5222] bcm5974 4-1:1.0: could not read from device [ 430.119727][ T5222] bcm5974 4-1:1.0: could not read from device [ 430.142516][ T5222] bcm5974 4-1:1.0: could not read from device [ 430.175579][ T5222] bcm5974 4-1:1.0: could not read from device [ 430.241983][ T5916] usb 4-1: USB disconnect, device number 82 [ 430.368815][ T3213] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 430.538775][ T6364] udevd[6364]: Error opening device "/dev/input/event4": No such file or directory [ 430.550508][ T6364] udevd[6364]: Unable to EVIOCGABS device "/dev/input/event4" [ 430.558444][ T6364] udevd[6364]: Unable to EVIOCGABS device "/dev/input/event4" [ 430.595887][ T6364] udevd[6364]: Unable to EVIOCGABS device "/dev/input/event4" [ 430.603486][ T6364] udevd[6364]: Unable to EVIOCGABS device "/dev/input/event4" [ 430.650266][ T3213] usb 2-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 430.660512][ T3213] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.690191][ T3213] usb 2-1: config 0 descriptor?? [ 430.733434][ T3213] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 430.917795][ T5953] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 431.064851][ T5953] usb 1-1: device descriptor read/64, error -71 [ 431.348210][ T3213] gspca_stv06xx: vv6410 sensor detected [ 431.356476][ T5953] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 431.449551][T14304] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1457'. [ 431.495354][ T5953] usb 1-1: device descriptor read/64, error -71 [ 431.615512][ T5953] usb usb1-port1: attempt power cycle [ 431.638980][ T3213] STV06xx 2-1:0.0: probe with driver STV06xx failed with error -71 [ 431.652270][ T3213] usb 2-1: USB disconnect, device number 93 [ 431.964953][ T5953] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 432.008839][ T5953] usb 1-1: device descriptor read/8, error -71 [ 432.284727][ T5953] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 432.352536][ T5953] usb 1-1: device descriptor read/8, error -71 [ 432.405060][T14313] 8021q: adding VLAN 0 to HW filter on device bond2 [ 432.475144][ T5953] usb usb1-port1: unable to enumerate USB device [ 432.524388][T14315] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 432.754180][T14334] netlink: 209588 bytes leftover after parsing attributes in process `syz.2.1464'. [ 432.763968][T14334] openvswitch: netlink: ufid size 3068 bytes exceeds the range (1, 16) [ 432.772598][T14334] openvswitch: netlink: Key 0 has unexpected len 5 expected 0 [ 433.014734][ T5953] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 433.096399][ T3213] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 433.188115][ T5953] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 433.198301][ T5953] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.213017][ T5953] usb 3-1: config 0 descriptor?? [ 433.228910][ T5953] cp210x 3-1:0.0: cp210x converter detected [ 433.265536][ T3213] usb 4-1: no configurations [ 433.270325][ T3213] usb 4-1: can't read configurations, error -22 [ 433.409623][ T3213] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 433.588730][ T3213] usb 4-1: no configurations [ 433.595034][ T3213] usb 4-1: can't read configurations, error -22 [ 433.635281][ T5953] cp210x 3-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 433.651027][ T3213] usb usb4-port1: attempt power cycle [ 433.875764][ T5953] usb 3-1: cp210x converter now attached to ttyUSB0 [ 433.995300][ T3213] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 434.121817][ T3213] usb 4-1: no configurations [ 434.168746][ T3213] usb 4-1: can't read configurations, error -22 [ 434.219373][T14357] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1470'. [ 434.527797][ T3213] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 434.570852][ T3213] usb 4-1: no configurations [ 434.575659][ T3213] usb 4-1: can't read configurations, error -22 [ 434.582313][ T3213] usb usb4-port1: unable to enumerate USB device [ 435.037262][T14364] netlink: 'syz.0.1473': attribute type 21 has an invalid length. [ 435.045202][T14364] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1473'. [ 435.077695][T14364] netlink: 'syz.0.1473': attribute type 21 has an invalid length. [ 435.087716][T14364] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1473'. [ 435.318461][T14373] snd_dummy snd_dummy.0: control 3:5:3:syz1:9 is already present [ 435.743361][ T5943] usb 3-1: USB disconnect, device number 89 [ 435.751644][ T5943] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 435.823352][ T5943] cp210x 3-1:0.0: device disconnected [ 436.173840][ T5953] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 436.238316][ T3213] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 436.339576][T14397] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1482'. [ 436.474052][ T5953] usb 2-1: Using ep0 maxpacket: 16 [ 436.510754][ T5953] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 436.525813][ T5953] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 436.535679][ T5953] usb 2-1: New USB device found, idVendor=17ef, idProduct=6009, bcdDevice= 0.00 [ 436.546246][ T5953] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.564715][T14400] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 436.694682][ T3213] usb 4-1: Using ep0 maxpacket: 32 [ 436.837833][ T3213] usb 4-1: New USB device found, idVendor=08ca, idProduct=0111, bcdDevice=6d.c8 [ 436.850370][ T5953] usb 2-1: config 0 descriptor?? [ 436.867456][ T3213] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.880824][ T3213] usb 4-1: config 0 descriptor?? [ 436.929576][T14405] fuse: Bad value for 'rootmode' [ 436.936176][ T3213] gspca_main: mr97310a-2.14.0 probing 08ca:0111 [ 436.946411][ T3213] gspca_mr97310a: reg write [21] error -22 [ 436.953992][T14405] netlink: 'syz.0.1484': attribute type 15 has an invalid length. [ 437.115425][ T3213] mr97310a 4-1:0.0: probe with driver mr97310a failed with error -22 [ 437.204976][ T5985] usb 4-1: USB disconnect, device number 87 [ 437.371913][T14379] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 437.774997][ T5929] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 437.824718][ T5943] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 437.941808][ T5929] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 437.961712][ T5929] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 437.972758][ T5929] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 437.984362][ T5929] usb 5-1: config 0 descriptor?? [ 437.996081][ T5943] usb 1-1: Using ep0 maxpacket: 32 [ 438.004133][ T5943] usb 1-1: unable to get BOS descriptor or descriptor too short [ 438.030678][ T5943] usb 1-1: config 251 has an invalid descriptor of length 0, skipping remainder of the config [ 438.270777][ T5943] usb 1-1: New USB device found, idVendor=0bfd, idProduct=0106, bcdDevice=20.39 [ 438.280149][ T5943] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.559066][ T5943] usb 1-1: Product: syz [ 438.680700][ T5943] usb 1-1: Manufacturer: syz [ 438.743869][ T5929] usbhid 5-1:0.0: can't add hid device: -71 [ 438.750687][ T5929] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 438.778775][ T5943] usb 1-1: SerialNumber: syz [ 438.802733][ T5929] usb 5-1: USB disconnect, device number 67 [ 438.949133][T14428] netlink: 'syz.3.1491': attribute type 2 has an invalid length. [ 439.077220][ T5953] usbhid 2-1:0.0: can't add hid device: -71 [ 439.083241][ T5953] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 439.153097][ T5953] usb 2-1: USB disconnect, device number 94 [ 439.540164][T14448] openvswitch: netlink: Flow key attr not present in new flow. [ 439.691786][ T5943] kvaser_usb 1-1:251.0: error -ENODEV: Cannot get usb endpoint(s) [ 439.694769][ T5929] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 439.714594][ T5943] usb 1-1: USB disconnect, device number 91 [ 440.063312][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.069736][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.081788][ T5929] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 440.151365][ T5929] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 440.170078][ T5929] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.235882][ T5929] usb 5-1: config 0 descriptor?? [ 440.452842][T14459] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 441.350298][ T5916] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 441.385456][ T5929] usbhid 5-1:0.0: can't add hid device: -71 [ 441.391485][ T5929] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 441.417604][ T5929] usb 5-1: USB disconnect, device number 68 [ 441.457636][T14481] fuse: Unknown parameter 'fd00000000000000000000016' [ 441.474711][ T5943] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 441.508272][ T5916] usb 1-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.00 [ 441.531411][ T5916] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.620062][ T5943] usb 2-1: device descriptor read/64, error -71 [ 441.634065][ T5916] usb 1-1: config 0 descriptor?? [ 441.860863][ T5916] usbhid 1-1:0.0: can't add hid device: -71 [ 441.871616][ T5916] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 441.880802][ T5943] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 441.945063][ T5916] usb 1-1: USB disconnect, device number 92 [ 442.893981][T14497] tipc: Enabled bearer , priority 10 [ 443.045774][T14485] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1506'. [ 444.015422][ T3213] tipc: Node number set to 2532563874 [ 444.044233][T14485] team1: entered promiscuous mode [ 444.049475][T14485] team1: entered allmulticast mode [ 444.082716][T14511] loop8: detected capacity change from 0 to 1 [ 444.748457][ T5929] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 444.904909][ T5929] usb 1-1: Using ep0 maxpacket: 8 [ 444.911775][ T5929] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 444.921016][ T5929] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.931701][ T5929] usb 1-1: config 0 descriptor?? [ 445.122086][T14545] netlink: 9 bytes leftover after parsing attributes in process `syz.3.1523'. [ 445.124748][ T5959] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 445.142325][ T5929] asix 1-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 445.158873][T14545] gretap0: entered promiscuous mode [ 445.274845][ T5959] usb 2-1: device descriptor read/64, error -71 [ 445.475573][ T5985] usb 4-1: new full-speed USB device number 88 using dummy_hcd [ 445.534892][ T5959] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 445.615467][ T5985] usb 4-1: device descriptor read/64, error -71 [ 445.674879][ T5959] usb 2-1: device descriptor read/64, error -71 [ 445.791149][ T5959] usb usb2-port1: attempt power cycle [ 445.854734][ T5985] usb 4-1: new full-speed USB device number 89 using dummy_hcd [ 445.988013][ T5985] usb 4-1: device descriptor read/64, error -71 [ 446.095181][ T5985] usb usb4-port1: attempt power cycle [ 446.142059][ T5959] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 446.185670][ T5959] usb 2-1: device descriptor read/8, error -71 [ 446.564715][ T5959] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 446.594815][ T5985] usb 4-1: new full-speed USB device number 90 using dummy_hcd [ 446.604177][ T5959] usb 2-1: device descriptor read/8, error -71 [ 446.625827][ T5985] usb 4-1: device descriptor read/8, error -71 [ 446.689282][ T30] kauditd_printk_skb: 17 callbacks suppressed [ 446.689299][ T30] audit: type=1326 audit(1758781410.400:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 446.722443][ T30] audit: type=1326 audit(1758781410.430:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 446.760038][ T30] audit: type=1326 audit(1758781410.430:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 446.782800][ T5959] usb usb2-port1: unable to enumerate USB device [ 446.791161][ T30] audit: type=1326 audit(1758781410.470:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 446.814364][ T30] audit: type=1326 audit(1758781410.470:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 446.864866][ T30] audit: type=1326 audit(1758781410.470:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 446.897587][ T30] audit: type=1326 audit(1758781410.510:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 446.923673][T14530] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1518'. [ 446.934879][ T5985] usb 4-1: new full-speed USB device number 91 using dummy_hcd [ 446.939931][T14530] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1518'. [ 446.955147][ T30] audit: type=1326 audit(1758781410.510:425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 446.955737][ T5985] usb 4-1: device descriptor read/8, error -71 [ 447.035413][ T30] audit: type=1326 audit(1758781410.510:426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 447.061188][ T5929] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 447.076531][ T30] audit: type=1326 audit(1758781410.510:427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14565 comm="syz.4.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22c358eec9 code=0x7ffc0000 [ 447.086543][ T5929] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0088: ffffffb9 [ 447.134176][ T5929] asix 1-1:0.0: probe with driver asix failed with error -71 [ 447.163476][ T5985] usb usb4-port1: unable to enumerate USB device [ 447.176039][ T5929] usb 1-1: USB disconnect, device number 93 [ 447.440954][T14572] loop2: detected capacity change from 0 to 7 [ 447.451375][ T5961] Dev loop2: unable to read RDB block 7 [ 447.458139][ T5961] loop2: unable to read partition table [ 447.463914][ T5961] loop2: partition table beyond EOD, truncated [ 447.569821][T14572] Dev loop2: unable to read RDB block 7 [ 447.627084][T14572] loop2: unable to read partition table [ 447.643251][T14572] loop2: partition table beyond EOD, truncated [ 447.852857][T14582] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1532'. [ 447.879869][T14572] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 447.976348][T14582] kvm: kvm [14581]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 447.995537][T14582] kvm: kvm [14581]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 448.029927][T14586] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1532'. [ 448.965204][ T5916] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 449.046988][T14607] netlink: 'syz.0.1536': attribute type 16 has an invalid length. [ 449.079182][T14607] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1536'. [ 449.665251][ T5916] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 449.772758][ T5916] usb 2-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 449.825543][ T5916] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.925665][ T5916] usb 2-1: config 0 descriptor?? [ 451.493340][ T5916] usbhid 2-1:0.0: can't add hid device: -71 [ 451.499514][ T5916] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 451.534246][ T5916] usb 2-1: USB disconnect, device number 101 [ 451.715999][T14637] mac80211_hwsim hwsim10 wlan1: entered allmulticast mode [ 451.964820][ T5929] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 452.005890][ T3213] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 452.108877][T14648] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 452.117630][ T5929] usb 1-1: Using ep0 maxpacket: 32 [ 452.124344][ T5929] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 452.133341][ T5929] usb 1-1: config 0 has no interface number 0 [ 452.142284][ T5929] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 452.161607][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.170862][ T5929] usb 1-1: Product: syz [ 452.175400][ T5929] usb 1-1: Manufacturer: syz [ 452.180042][ T5929] usb 1-1: SerialNumber: syz [ 452.185331][ T3213] usb 3-1: Using ep0 maxpacket: 16 [ 452.191761][ T5929] usb 1-1: config 0 descriptor?? [ 452.200708][ T3213] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 452.203106][ T5929] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 452.215357][ T3213] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 452.230670][ T3213] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 452.243793][ T3213] usb 3-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 452.256628][ T3213] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 452.269372][ T3213] usb 3-1: config 0 descriptor?? [ 452.291260][ T3213] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input33 [ 452.307697][ T5222] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 452.328455][ T5222] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 452.341406][ T5222] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 452.359104][ T5222] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 452.373695][ T5972] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 452.384964][ T5985] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 452.395767][ T5222] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 452.415790][ T5222] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 452.423962][ T5222] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 452.444941][ T5929] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 452.468668][ T5929] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 452.481888][T14641] pxrc 3-1:0.0: pxrc_open - usb_submit_urb failed, error: -90 [ 452.495147][ T3213] usb 3-1: USB disconnect, device number 90 [ 452.555301][ T5985] usb 4-1: Using ep0 maxpacket: 32 [ 452.572327][ T5985] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 452.587114][T14660] bond3: entered promiscuous mode [ 452.592750][T14660] 8021q: adding VLAN 0 to HW filter on device bond3 [ 452.620291][ T5985] usb 4-1: config 0 has no interface number 0 [ 452.629096][ T5985] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 452.661034][ T5985] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 452.681173][T14639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 452.705362][T14639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 452.712138][ T5985] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.729017][T14639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 452.741625][ T5985] usb 4-1: Product: syz [ 452.748170][T14639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 452.750121][ T5985] usb 4-1: Manufacturer: syz [ 452.771406][ T5985] usb 4-1: SerialNumber: syz [ 452.791122][ T5985] usb 4-1: config 0 descriptor?? [ 452.813572][ T5985] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 452.823624][ T5985] em28xx 4-1:0.132: Video interface 132 found: [ 452.988556][ C0] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 452.989023][ T3213] usb 1-1: USB disconnect, device number 94 [ 453.010320][ T3213] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 453.062183][ T3213] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 453.106374][ T3213] quatech2 1-1:0.51: device disconnected [ 453.243439][T14648] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 453.252857][T14648] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 453.277413][ T5985] em28xx 4-1:0.132: unknown em28xx chip ID (39) [ 453.534733][ T5959] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 453.697997][ T5959] usb 3-1: Using ep0 maxpacket: 32 [ 453.713402][ T5959] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 453.732679][ T5959] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 453.752731][ T5959] usb 3-1: New USB device found, idVendor=05ac, idProduct=0265, bcdDevice= 0.00 [ 453.774734][ T5959] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.944896][ T3213] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 454.130966][ T3213] usb 2-1: Using ep0 maxpacket: 32 [ 454.148196][ T3213] usb 2-1: New USB device found, idVendor=093a, idProduct=050f, bcdDevice=56.a5 [ 454.161164][ T3213] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.179931][ T3213] usb 2-1: Product: syz [ 454.189263][ T3213] usb 2-1: Manufacturer: syz [ 454.202293][ T3213] usb 2-1: SerialNumber: syz [ 454.228380][ T3213] usb 2-1: config 0 descriptor?? [ 454.247250][ T3213] gspca_main: mars-2.14.0 probing 093a:050f [ 454.340100][ T5959] usb 3-1: config 0 descriptor?? [ 454.656330][ T3213] usb 2-1: USB disconnect, device number 102 [ 454.682456][ T5985] em28xx 4-1:0.132: failed to get i2c transfer status from bridge register (error=-5) [ 454.753327][ T5985] em28xx 4-1:0.132: failed to read eeprom (err=-5) [ 454.772403][ T5985] em28xx 4-1:0.132: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-5] [ 454.857586][T14694] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1561'. [ 454.868952][ T5985] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 454.890262][ T5985] em28xx 4-1:0.132: analog set to bulk mode. [ 454.908886][ T1229] em28xx 4-1:0.132: Registering V4L2 extension [ 454.934524][ T5985] usb 4-1: USB disconnect, device number 92 [ 454.948209][ T5985] em28xx 4-1:0.132: Disconnecting em28xx [ 454.966945][ T5959] magicmouse 0003:05AC:0265.000F: unknown main item tag 0x0 [ 454.976128][ T5959] magicmouse 0003:05AC:0265.000F: unknown main item tag 0x0 [ 454.988475][ T5959] magicmouse 0003:05AC:0265.000F: unknown main item tag 0x0 [ 455.004702][ T5959] magicmouse 0003:05AC:0265.000F: unknown main item tag 0x0 [ 455.022283][ T5959] magicmouse 0003:05AC:0265.000F: unknown main item tag 0x0 [ 455.034860][ T5959] magicmouse 0003:05AC:0265.000F: unknown main item tag 0x0 [ 455.050927][ T5959] magicmouse 0003:05AC:0265.000F: unknown main item tag 0x0 [ 455.064207][ T5959] magicmouse 0003:05AC:0265.000F: hidraw0: USB HID v0.00 Device [HID 05ac:0265] on usb-dummy_hcd.2-1/input0 [ 455.084964][ T5959] magicmouse 0003:05AC:0265.000F: magicmouse input not registered [ 455.111570][ T5959] magicmouse 0003:05AC:0265.000F: probe with driver magicmouse failed with error -12 [ 455.127497][T14704] ptrace attach of "./syz-executor exec"[5880] was attempted by ""[14704] [ 455.143286][T14704] netlink: 324 bytes leftover after parsing attributes in process `syz.0.1563'. [ 455.194721][T14704] ptrace attach of "./syz-executor exec"[5880] was attempted by ""[14704] [ 455.213592][T14706] netlink: 324 bytes leftover after parsing attributes in process `syz.0.1563'. [ 455.254404][ T1229] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 455.264790][ T1229] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 455.271917][ T1229] em28xx 4-1:0.132: No AC97 audio processor [ 455.342115][T14714] netlink: 'syz.0.1565': attribute type 1 has an invalid length. [ 455.403349][T14711] openvswitch: netlink: Flow key attr not present in new flow. [ 455.430919][ T1229] usb 4-1: Decoder not found [ 455.448393][ T1229] em28xx 4-1:0.132: failed to create media graph [ 455.455219][ T1229] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 455.468742][ T1229] em28xx 4-1:0.132: Remote control support is not available for this card. [ 455.477519][ T5985] em28xx 4-1:0.132: Closing input extension [ 455.519396][ T5985] em28xx 4-1:0.132: Freeing device [ 455.764793][ T5943] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 455.864765][ T5985] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 455.925027][ T5943] usb 1-1: Using ep0 maxpacket: 32 [ 455.934389][ T5943] usb 1-1: New USB device found, idVendor=08ca, idProduct=0111, bcdDevice=6d.c8 [ 455.944277][ T5943] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 455.959783][ T5943] usb 1-1: config 0 descriptor?? [ 455.970696][ T5943] gspca_main: mr97310a-2.14.0 probing 08ca:0111 [ 455.977178][ T5943] gspca_mr97310a: reg write [21] error -22 [ 455.983074][ T5943] mr97310a 1-1:0.0: probe with driver mr97310a failed with error -22 [ 456.016439][ T5985] usb 4-1: config 0 has an invalid interface number: 46 but max is 0 [ 456.025411][ T5985] usb 4-1: config 0 has no interface number 0 [ 456.033790][ T5985] usb 4-1: New USB device found, idVendor=04e2, idProduct=1420, bcdDevice=9e.b9 [ 456.047337][ T5985] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.064218][ T5985] usb 4-1: Product: syz [ 456.073455][ T5985] usb 4-1: Manufacturer: syz [ 456.081131][ T5985] usb 4-1: SerialNumber: syz [ 456.106835][ T5985] usb 4-1: config 0 descriptor?? [ 456.130634][ T5985] xr_serial 4-1:0.46: More than one union descriptor, skipping ... [ 456.160187][T14724] GUP no longer grows the stack in syz.1.1568 (14724): 200000005000-200000008000 (200000004000) [ 456.180700][T14724] CPU: 0 UID: 0 PID: 14724 Comm: syz.1.1568 Not tainted syzkaller #0 PREEMPT(full) [ 456.180725][T14724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 456.180740][T14724] Call Trace: [ 456.180747][T14724] [ 456.180756][T14724] dump_stack_lvl+0x189/0x250 [ 456.180785][T14724] ? __pfx_dump_stack_lvl+0x10/0x10 [ 456.180805][T14724] ? __pfx__printk+0x10/0x10 [ 456.180825][T14724] ? find_vma+0xe7/0x160 [ 456.180859][T14724] fixup_user_fault+0x661/0x720 [ 456.180886][T14724] fault_in_user_writeable+0x72/0xe0 [ 456.180908][T14724] futex_lock_pi+0x773/0xa90 [ 456.180940][T14724] ? __pfx_futex_lock_pi+0x10/0x10 [ 456.180992][T14724] ? __pfx_futex_wake_mark+0x10/0x10 [ 456.181041][T14724] do_futex+0x292/0x420 [ 456.181068][T14724] ? __pfx_do_futex+0x10/0x10 [ 456.181087][T14724] ? up_write+0x1c4/0x420 [ 456.181111][T14724] __se_sys_futex+0x36f/0x400 [ 456.181137][T14724] ? __pfx___se_sys_futex+0x10/0x10 [ 456.181159][T14724] ? rcu_is_watching+0x15/0xb0 [ 456.181182][T14724] ? __x64_sys_futex+0x21/0xf0 [ 456.181205][T14724] do_syscall_64+0xfa/0x3b0 [ 456.181224][T14724] ? lockdep_hardirqs_on+0x9c/0x150 [ 456.181242][T14724] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.181259][T14724] ? clear_bhb_loop+0x60/0xb0 [ 456.181280][T14724] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.181301][T14724] RIP: 0033:0x7f539e98eec9 [ 456.181317][T14724] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 456.181332][T14724] RSP: 002b:00007f539f83d038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 456.181350][T14724] RAX: ffffffffffffffda RBX: 00007f539ebe6090 RCX: 00007f539e98eec9 [ 456.181363][T14724] RDX: 00000000fffffffd RSI: 000000000000008d RDI: 0000200000004000 [ 456.181374][T14724] RBP: 00007f539ea11f91 R08: 0000000000000000 R09: 0000000000000000 [ 456.181385][T14724] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 456.181395][T14724] R13: 00007f539ebe6128 R14: 00007f539ebe6090 R15: 00007f539ed0fa28 [ 456.181423][T14724] [ 456.398386][T14719] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 456.406981][T14719] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 456.416201][ T1229] usb 4-1: USB disconnect, device number 93 [ 456.497164][ T5985] usb 1-1: USB disconnect, device number 95 [ 456.515382][ T5916] usb 3-1: USB disconnect, device number 91 [ 456.944837][ T5916] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 457.156104][ T5916] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 457.401469][T14754] loop2: detected capacity change from 0 to 7 [ 457.423336][ T5916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.428186][T14754] Dev loop2: unable to read RDB block 7 [ 457.437347][ T5916] usb 3-1: Product: syz [ 457.441768][T14754] loop2: unable to read partition table [ 457.448322][T14754] loop2: partition table beyond EOD, truncated [ 457.469835][T14754] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 457.628188][ T5916] usb 3-1: Manufacturer: syz [ 457.633127][ T5916] usb 3-1: SerialNumber: syz [ 457.954033][ T5916] usb 3-1: config 0 descriptor?? [ 458.029708][ T5916] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 458.664896][ T5929] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 458.773002][ T5985] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 458.844846][ T5929] usb 2-1: Using ep0 maxpacket: 32 [ 458.858147][ T5929] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 458.876943][ T5929] usb 2-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 458.895619][ T5929] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=15 [ 458.905412][ T5929] usb 2-1: Product: syz [ 458.915037][ T5929] usb 2-1: Manufacturer: syz [ 458.919651][ T5929] usb 2-1: SerialNumber: syz [ 458.927567][ T5929] usb 2-1: config 0 descriptor?? [ 458.954709][ T5985] usb 1-1: device descriptor read/64, error -71 [ 458.983234][ T5929] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 459.024972][ T5916] gspca_sunplus: reg_r err -110 [ 459.029917][ T5916] sunplus 3-1:0.0: probe with driver sunplus failed with error -110 [ 459.035921][ T5929] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 459.116465][ T6364] udevd[6364]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 459.208449][ T5929] usb 2-1: USB disconnect, device number 103 [ 459.224735][ T5985] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 459.354814][ T5985] usb 1-1: device descriptor read/64, error -71 [ 459.465239][ T5985] usb usb1-port1: attempt power cycle [ 459.488165][T14779] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1580'. [ 459.502055][T14779] openvswitch: netlink: Flow key attr not present in new flow. [ 459.745632][T14782] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1581'. [ 459.804950][ T5985] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 459.846024][ T5985] usb 1-1: device descriptor read/8, error -71 [ 460.095011][ T5985] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 460.126081][ T5985] usb 1-1: device descriptor read/8, error -71 [ 460.235121][ T5985] usb usb1-port1: unable to enumerate USB device [ 460.632147][T14809] delete_channel: no stack [ 460.802653][ T5943] usb 3-1: USB disconnect, device number 92 [ 460.808679][ T3213] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 460.868758][T14820] openvswitch: netlink: Actions may not be safe on all matching packets [ 460.934505][T14822] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1591'. [ 461.133130][ T3213] usb 5-1: config 0 has an invalid descriptor of length 196, skipping remainder of the config [ 461.148988][ T3213] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 461.167648][ T3213] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 89, changing to 10 [ 461.185014][ T1229] usb 4-1: new full-speed USB device number 94 using dummy_hcd [ 461.185012][ T3213] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 461.313967][ T3213] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 461.323191][ T3213] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.332742][ T3213] usb 5-1: Product: syz [ 461.337377][ T3213] usb 5-1: Manufacturer: syz [ 461.342340][ T3213] usb 5-1: SerialNumber: syz [ 461.368886][ T3213] usb 5-1: config 0 descriptor?? [ 461.382284][ T3213] garmin_gps 5-1:0.0: Garmin GPS usb/tty converter detected [ 461.396590][ T3213] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 461.407644][ T3213] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 463.374041][T14841] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1597'. [ 463.479807][T14843] openvswitch: netlink: Flow key attr not present in new flow. [ 463.868395][ T1229] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 463.891516][ T1229] usb 4-1: can't read configurations, error -71 [ 464.336388][ T5985] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 464.473348][ T1229] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 464.742239][ T5985] usb 2-1: Using ep0 maxpacket: 32 [ 464.824582][ T5985] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 464.854729][ T1229] usb 4-1: Using ep0 maxpacket: 8 [ 464.860024][ T5985] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 464.871385][ T1229] usb 4-1: config 0 has an invalid interface number: 175 but max is 0 [ 464.952391][ T1229] usb 4-1: config 0 has no interface number 0 [ 464.962527][ T5985] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 464.971713][ T5985] usb 2-1: config 1 has no interface number 0 [ 464.985450][ T5985] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 464.996595][ T1229] usb 4-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice=bc.ed [ 465.005665][ T5985] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 465.018661][ T1229] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.026801][ T1229] usb 4-1: Product: syz [ 465.030996][ T1229] usb 4-1: Manufacturer: syz [ 465.035713][ T5985] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 465.044814][ T1229] usb 4-1: SerialNumber: syz [ 465.049493][ T5985] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.075811][ T1229] usb 4-1: config 0 descriptor?? [ 465.122887][ T5985] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 465.326315][T14856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.336886][T14856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 465.379572][ T5985] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now attached [ 465.555173][T14867] fuse: Unknown parameter 'føÿdÒ>Æù' [ 465.827132][ T5916] usb 2-1: USB disconnect, device number 104 [ 465.836758][ T5916] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 466.174726][ T5929] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 466.367131][ T5929] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 466.380960][ T5929] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 466.401469][ T5929] usb 3-1: New USB device found, idVendor=0499, idProduct=5ae2, bcdDevice= 9.0f [ 466.415236][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=7 [ 466.430588][ T5929] usb 3-1: Product: syz [ 466.474805][ T5985] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 466.483868][ T5929] usb 3-1: Manufacturer: syz [ 466.493396][ T5929] usb 3-1: SerialNumber: syz [ 466.509907][ T5929] usb 3-1: config 0 descriptor?? [ 466.724746][ T5985] usb 1-1: Using ep0 maxpacket: 32 [ 466.731545][ T5985] usb 1-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 466.742432][ T5985] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.803778][ T5985] usb 1-1: config 0 descriptor?? [ 466.856822][T14874] fuse: Bad value for 'group_id' [ 466.861831][T14874] fuse: Bad value for 'group_id' [ 466.870118][ T5985] gspca_main: sq930x-2.14.0 probing 041e:403c [ 466.915155][ T5959] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 467.094881][ T5959] usb 2-1: Using ep0 maxpacket: 16 [ 467.272059][ T5959] usb 2-1: New USB device found, idVendor=0403, idProduct=b8d8, bcdDevice=30.bb [ 467.281265][ T5959] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.292238][ T5959] usb 2-1: Product: syz [ 467.299690][ T5959] usb 2-1: Manufacturer: syz [ 467.304391][ T5959] usb 2-1: SerialNumber: syz [ 467.353694][ T1229] usbserial_generic 4-1:0.175: The "generic" usb-serial driver is only for testing and one-off prototypes. [ 467.370144][ T1229] usbserial_generic 4-1:0.175: Tell linux-usb@vger.kernel.org to add your device to a proper driver. [ 467.478428][ T1229] usbserial_generic 4-1:0.175: device has no bulk endpoints [ 467.499678][ T1229] safe_serial 4-1:0.175: safe_serial converter detected [ 467.538987][T14881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 467.547948][ T1229] safe_serial 4-1:0.175: probe with driver safe_serial failed with error -22 [ 467.549301][T14881] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 467.605930][ T1229] usb 4-1: USB disconnect, device number 95 [ 467.908458][ T5985] gspca_sq930x: ucbus_write failed -71 [ 467.915057][ T5985] sq930x 1-1:0.0: probe with driver sq930x failed with error -71 [ 467.926873][ T5985] usb 1-1: USB disconnect, device number 100 [ 468.046145][ T5929] usb 3-1: USB disconnect, device number 93 [ 468.115076][ T5961] udevd[5961]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 468.117316][ T5985] usb 5-1: USB disconnect, device number 69 [ 468.167723][ T5985] garmin_gps 5-1:0.0: device disconnected [ 468.310093][T14890] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1609'. [ 468.585334][ T5985] usb 5-1: new full-speed USB device number 70 using dummy_hcd [ 468.756279][ T5985] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 468.790095][ T5985] usb 5-1: config 0 has no interface number 0 [ 468.803753][ T5985] usb 5-1: New USB device found, idVendor=0644, idProduct=800f, bcdDevice=c5.77 [ 468.821716][ T5985] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.850985][ T5985] usb 5-1: Product: syz [ 468.860901][ T5985] usb 5-1: Manufacturer: syz [ 468.869761][ T5985] usb 5-1: SerialNumber: syz [ 468.879998][ T5985] usb 5-1: config 0 descriptor?? [ 468.911325][ T5985] snd-usb-us122l 5-1:0.1: usb_set_interface error [ 468.920589][ T5985] snd-usb-us122l 5-1:0.1: probe with driver snd-usb-us122l failed with error -22 [ 469.106884][ T3213] usb 5-1: USB disconnect, device number 70 [ 469.195426][ T5916] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 469.348883][ T5916] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 469.358788][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.372525][ T5916] usb 4-1: Product: syz [ 469.383013][ T5916] usb 4-1: Manufacturer: syz [ 469.389410][ T5916] usb 4-1: SerialNumber: syz [ 469.405762][ T5916] usb 4-1: config 0 descriptor?? [ 469.443771][ T5959] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 469.519933][ T5959] snd-usb-audio 2-1:222.0: probe with driver snd-usb-audio failed with error -71 [ 469.553957][ T5959] usb 2-1: USB disconnect, device number 105 [ 469.592181][ T6364] udevd[6364]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:222.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 469.636450][ T5916] usb 4-1: Firmware version (0.0) predates our first public release. [ 469.664417][ T5916] usb 4-1: Please update to version 0.2 or newer [ 469.827063][ T5916] usb 4-1: USB disconnect, device number 96 [ 470.009734][T14933] netlink: 'syz.0.1620': attribute type 21 has an invalid length. [ 470.018546][T14933] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1620'. [ 470.034723][ T5959] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 470.173381][T14934] openvswitch: netlink: Flow key attr not present in new flow. [ 470.191002][T14933] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1620'. [ 470.214986][ T5959] usb 2-1: Using ep0 maxpacket: 16 [ 470.236800][ T5959] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 470.252282][ T5959] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 470.264145][ T5959] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 470.281538][ T5959] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 470.296863][ T5959] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 470.346645][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 470.346661][ T30] audit: type=1326 audit(1758781434.040:442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14924 comm="syz.0.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 470.406408][ T5985] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 470.441545][ T30] audit: type=1326 audit(1758781434.040:443): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14924 comm="syz.0.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 470.468488][ T5959] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 470.489435][ T5959] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 470.499921][ T5959] usb 2-1: Manufacturer: syz [ 470.509399][ T30] audit: type=1326 audit(1758781434.040:444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14924 comm="syz.0.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 470.539239][ T5959] usb 2-1: config 0 descriptor?? [ 470.555243][ T30] audit: type=1326 audit(1758781434.040:445): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14924 comm="syz.0.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 470.586487][ T30] audit: type=1326 audit(1758781434.040:446): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14924 comm="syz.0.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 470.609015][ T5985] usb 3-1: Using ep0 maxpacket: 16 [ 470.617071][ T5985] usb 3-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 470.628163][ T5985] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 470.643264][ T5985] usb 3-1: config 0 descriptor?? [ 470.652815][ T30] audit: type=1326 audit(1758781434.100:447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14924 comm="syz.0.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 470.689665][ T30] audit: type=1326 audit(1758781434.100:448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14924 comm="syz.0.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 470.691264][ T5985] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 470.724753][ T30] audit: type=1326 audit(1758781434.150:449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14924 comm="syz.0.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 470.754521][ T30] audit: type=1326 audit(1758781434.150:450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14924 comm="syz.0.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 470.801692][ T30] audit: type=1326 audit(1758781434.150:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14924 comm="syz.0.1620" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89f5d8eec9 code=0x7ffc0000 [ 471.144813][ T5959] rc_core: IR keymap rc-hauppauge not found [ 471.150829][ T5959] Registered IR keymap rc-empty [ 471.156228][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.175676][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.216273][ T5959] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 471.243958][ T5959] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input34 [ 471.262635][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.284904][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.305355][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.324916][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.335521][T14950] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 471.344204][T14950] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 471.344911][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.366376][ T5916] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 471.385719][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.405139][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.424983][ T5929] usb 1-1: new full-speed USB device number 101 using dummy_hcd [ 471.434141][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.454908][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.477330][ T5959] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 471.511991][ T5959] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 471.520552][ T5959] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 471.553137][ T5959] usb 2-1: USB disconnect, device number 106 [ 471.566851][ T5916] usb 5-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 471.576726][ T5929] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 471.587726][ T5916] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 471.587753][ T5916] usb 5-1: Product: syz [ 471.587766][ T5916] usb 5-1: Manufacturer: syz [ 471.587779][ T5916] usb 5-1: SerialNumber: syz [ 471.615403][ T5916] usb 5-1: config 0 descriptor?? [ 471.615570][ T5929] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 471.642440][ T5929] usb 1-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 471.668045][ T5929] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.708113][ T5929] usb 1-1: config 0 descriptor?? [ 471.713843][T14946] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 471.834179][ T5916] usb 5-1: ignoring: probably an ADSL modem [ 471.945524][ T5929] glorious 0003:22D4:1503.0010: hidraw0: USB HID v0.00 Device [Glorious Model I] on usb-dummy_hcd.0-1/input0 [ 472.061845][T14944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 472.073274][T14944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 472.084748][ T5916] cxacru 5-1:0.0: usbatm_usb_probe: bind failed: -19! [ 472.137088][ T5929] usb 1-1: USB disconnect, device number 101 [ 472.286917][ T5916] usb 5-1: USB disconnect, device number 71 [ 472.352139][T14979] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1634'. [ 472.361408][T14979] openvswitch: netlink: Flow key attr not present in new flow. [ 473.004739][ T5985] gspca_sonixj: i2c_w8 err -71 [ 473.016553][ T5985] sonixj 3-1:0.0: probe with driver sonixj failed with error -71 [ 473.137799][ T5985] usb 3-1: USB disconnect, device number 94 [ 473.166713][ T5929] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 473.365217][T14994] netlink: 'syz.1.1638': attribute type 4 has an invalid length. [ 473.391663][ T5929] usb 4-1: Using ep0 maxpacket: 16 [ 473.403819][ T5929] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 473.416973][ T5929] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 473.427098][ T5929] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 473.440449][ T5929] usb 4-1: New USB device found, idVendor=045e, idProduct=fc40, bcdDevice=72.a8 [ 473.450633][ T5929] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 473.473171][ T5929] usb 4-1: config 0 descriptor?? [ 473.545793][T14996] FAULT_INJECTION: forcing a failure. [ 473.545793][T14996] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 473.565803][T14996] CPU: 0 UID: 0 PID: 14996 Comm: syz.1.1639 Not tainted syzkaller #0 PREEMPT(full) [ 473.565833][T14996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 473.565845][T14996] Call Trace: [ 473.565853][T14996] [ 473.565862][T14996] dump_stack_lvl+0x189/0x250 [ 473.565888][T14996] ? __pfx____ratelimit+0x10/0x10 [ 473.565908][T14996] ? __pfx_dump_stack_lvl+0x10/0x10 [ 473.565928][T14996] ? __pfx__printk+0x10/0x10 [ 473.565950][T14996] ? __might_fault+0xb0/0x130 [ 473.565990][T14996] should_fail_ex+0x414/0x560 [ 473.566020][T14996] _copy_from_iter+0x1de/0x1790 [ 473.566038][T14996] ? __lock_acquire+0xab9/0xd20 [ 473.566063][T14996] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 473.566090][T14996] ? policy_nodemask+0x27c/0x720 [ 473.566110][T14996] ? __pfx__copy_from_iter+0x10/0x10 [ 473.566137][T14996] ? set_page_refcounted+0xa0/0x1e0 [ 473.566159][T14996] ? page_copy_sane+0x4e/0x280 [ 473.566181][T14996] copy_page_from_iter+0xdd/0x170 [ 473.566205][T14996] tun_get_user+0x1d7b/0x3e20 [ 473.566233][T14996] ? tun_get_user+0x6f6/0x3e20 [ 473.566260][T14996] ? aa_file_perm+0x44d/0x1550 [ 473.566280][T14996] ? __pfx_tun_get_user+0x10/0x10 [ 473.566298][T14996] ? _parse_integer_limit+0x1ae/0x1f0 [ 473.566325][T14996] ? __lock_acquire+0xab9/0xd20 [ 473.566351][T14996] ? ref_tracker_alloc+0x318/0x460 [ 473.566367][T14996] ? __lock_acquire+0xab9/0xd20 [ 473.566391][T14996] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 473.566414][T14996] ? tun_get+0x1c/0x2f0 [ 473.566438][T14996] ? tun_get+0x1c/0x2f0 [ 473.566456][T14996] ? tun_get+0x1c/0x2f0 [ 473.566480][T14996] tun_chr_write_iter+0x113/0x200 [ 473.566503][T14996] vfs_write+0x5c9/0xb30 [ 473.566530][T14996] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 473.566551][T14996] ? __pfx_vfs_write+0x10/0x10 [ 473.566582][T14996] ? __fget_files+0x2a/0x420 [ 473.566607][T14996] ksys_write+0x145/0x250 [ 473.566631][T14996] ? __pfx_ksys_write+0x10/0x10 [ 473.566650][T14996] ? rcu_is_watching+0x15/0xb0 [ 473.566672][T14996] ? do_syscall_64+0xbe/0x3b0 [ 473.566695][T14996] do_syscall_64+0xfa/0x3b0 [ 473.566712][T14996] ? lockdep_hardirqs_on+0x9c/0x150 [ 473.566730][T14996] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.566747][T14996] ? clear_bhb_loop+0x60/0xb0 [ 473.566767][T14996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.566785][T14996] RIP: 0033:0x7f539e98d97f [ 473.566802][T14996] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 473.566817][T14996] RSP: 002b:00007f539f85e000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 473.566836][T14996] RAX: ffffffffffffffda RBX: 00007f539ebe5fa0 RCX: 00007f539e98d97f [ 473.566849][T14996] RDX: 0000000000000036 RSI: 0000200000000080 RDI: 00000000000000c8 [ 473.566860][T14996] RBP: 00007f539f85e090 R08: 0000000000000000 R09: 0000000000000000 [ 473.566872][T14996] R10: 0000000000000036 R11: 0000000000000293 R12: 0000000000000001 [ 473.566882][T14996] R13: 00007f539ebe6038 R14: 00007f539ebe5fa0 R15: 00007f539ed0fa28 [ 473.566911][T14996] [ 473.870731][ C0] vkms_vblank_simulate: vblank timer overrun [ 474.139749][ T5929] hid-generic 0003:045E:FC40.0011: hidraw0: USB HID v0.00 Device [HID 045e:fc40] on usb-dummy_hcd.3-1/input0 [ 474.239680][T15012] openvswitch: netlink: Flow key attr not present in new flow. [ 475.363523][ T5916] usb 4-1: USB disconnect, device number 97 [ 475.676240][T15020] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 475.888098][T15025] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1645'. [ 476.428249][T15038] netlink: 'syz.1.1649': attribute type 4 has an invalid length. [ 476.579766][T15040] macsec1: entered promiscuous mode [ 476.650340][T15040] syz_tun: entered promiscuous mode [ 476.750163][T15040] syz_tun: left promiscuous mode [ 477.174264][T15051] netlink: 'syz.1.1656': attribute type 1 has an invalid length. [ 477.228904][T15058] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1656'. [ 477.316403][T15051] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 477.327415][T15060] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1652'. [ 477.345101][T15062] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1652'. [ 477.642347][T15069] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 478.344721][ T5985] usb 3-1: new full-speed USB device number 95 using dummy_hcd [ 478.456137][T15078] netlink: 'syz.3.1661': attribute type 4 has an invalid length. [ 478.524808][ T5985] usb 3-1: device descriptor read/64, error -71 [ 478.691299][T15083] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 478.707637][T15084] loop2: detected capacity change from 0 to 7 [ 478.719909][T15083] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 478.744532][T15084] Dev loop2: unable to read RDB block 7 [ 478.908553][ T3213] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 478.978682][ T5985] usb 3-1: new full-speed USB device number 96 using dummy_hcd [ 479.016412][T15084] loop2: unable to read partition table [ 479.062306][T15084] loop2: partition table beyond EOD, truncated [ 479.069105][T15084] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 479.404772][ T5985] usb 3-1: device descriptor read/64, error -71 [ 479.525137][ T5985] usb usb3-port1: attempt power cycle [ 479.534841][ T3213] usb 4-1: new full-speed USB device number 99 using dummy_hcd [ 479.686418][ T3213] usb 4-1: config 0 has an invalid interface number: 120 but max is 0 [ 479.700490][ T3213] usb 4-1: config 0 has no interface number 0 [ 479.708384][ T3213] usb 4-1: config 0 interface 120 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 479.731611][ T3213] usb 4-1: New USB device found, idVendor=16e3, idProduct=f9e9, bcdDevice= 0.58 [ 479.750766][ T3213] usb 4-1: New USB device strings: Mfr=32, Product=0, SerialNumber=0 [ 479.761498][ T3213] usb 4-1: Manufacturer: syz [ 479.782664][ T3213] usb 4-1: config 0 descriptor?? [ 479.802535][ T3213] input: syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.120/input/input35 [ 479.877190][ T3213] input: failed to attach handler mousedev to device input35, error: -5 [ 479.891846][ T5985] usb 3-1: new full-speed USB device number 97 using dummy_hcd [ 479.928564][ T5985] usb 3-1: device descriptor read/8, error -71 [ 479.999342][ T3213] usb 4-1: USB disconnect, device number 99 [ 480.186227][ T5985] usb 3-1: new full-speed USB device number 98 using dummy_hcd [ 480.225924][ T5985] usb 3-1: device descriptor read/8, error -71 [ 480.348232][ T5985] usb usb3-port1: unable to enumerate USB device [ 480.687379][ T5985] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 480.876661][ T5985] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 480.902300][ T5985] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 480.923800][ T5985] usb 5-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 480.944794][ T5943] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 480.953171][ T5985] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.001357][ T5985] usb 5-1: config 0 descriptor?? [ 481.032809][T15123] netlink: 'syz.3.1672': attribute type 4 has an invalid length. [ 481.094978][ T5943] usb 1-1: Using ep0 maxpacket: 8 [ 481.108556][ T5943] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0099, bcdDevice=95.0d [ 481.119596][ T5943] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.137014][ T5943] usb 1-1: Product: syz [ 481.149646][ T5943] usb 1-1: Manufacturer: syz [ 481.159738][ T5943] usb 1-1: SerialNumber: syz [ 481.185817][ T5943] usb 1-1: config 0 descriptor?? [ 481.303491][T15109] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 481.433180][ T5943] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 481.439238][T15109] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 481.443365][ T5943] dvb_usb_af9015 1-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 481.484802][T15134] openvswitch: netlink: Flow key attr not present in new flow. [ 481.552479][ T5943] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 481.560103][ T5943] dvb_usb_af9035 1-1:0.0: probe with driver dvb_usb_af9035 failed with error -22 [ 481.718727][ T5943] usb 1-1: USB disconnect, device number 102 [ 482.988462][ T5985] hid-led 0003:0FC5:B080.0012: probe with driver hid-led failed with error -71 [ 483.067767][ T5985] usb 5-1: USB disconnect, device number 72 [ 485.488047][T15179] netlink: 'syz.1.1688': attribute type 11 has an invalid length. [ 485.516620][T15179] netlink: 'syz.1.1688': attribute type 5 has an invalid length. [ 485.536141][T15179] netlink: 4112 bytes leftover after parsing attributes in process `syz.1.1688'. [ 485.721661][T15189] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 485.728595][T15189] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 485.759736][T15189] vhci_hcd vhci_hcd.0: Device attached [ 485.774075][T15191] vhci_hcd: connection closed [ 485.795059][ T1130] vhci_hcd: stop threads [ 485.823658][ T1130] vhci_hcd: release socket [ 485.828681][ T1130] vhci_hcd: disconnect device [ 486.035068][ T5929] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 486.063588][T15200] openvswitch: netlink: Flow key attr not present in new flow. [ 486.184985][ T5929] usb 5-1: device descriptor read/64, error -71 [ 486.304810][ T5985] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 486.435517][ T5929] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 486.476526][ T5985] usb 1-1: config 0 has an invalid interface number: 64 but max is 0 [ 486.486737][ T5985] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 486.498515][ T5985] usb 1-1: config 0 has no interface number 0 [ 486.512163][ T5985] usb 1-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 486.521676][ T5985] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.524938][ T43] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 486.538078][ T5985] usb 1-1: Product: syz [ 486.565995][ T5985] usb 1-1: Manufacturer: syz [ 486.573108][ T5985] usb 1-1: SerialNumber: syz [ 486.615485][ T5929] usb 5-1: device descriptor read/64, error -71 [ 486.639106][ T5985] usb 1-1: config 0 descriptor?? [ 486.659932][ T5985] usb 1-1: Found UVC 0.00 device syz (046d:0823) [ 486.675283][ T5985] usb 1-1: No valid video chain found. [ 486.694815][ T43] usb 2-1: Using ep0 maxpacket: 8 [ 486.708550][ T43] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 129, changing to 11 [ 486.719850][ T43] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 16 [ 486.730224][ T43] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 32 [ 486.735575][ T5929] usb usb5-port1: attempt power cycle [ 486.805326][T15204] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1694'. [ 486.814329][T15204] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1694'. [ 486.824359][T15204] netlink: 'syz.1.1694': attribute type 1 has an invalid length. [ 486.853601][ T5916] usb 1-1: USB disconnect, device number 103 [ 487.105063][ T5929] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 487.182696][ T5929] usb 5-1: device descriptor read/8, error -71 [ 487.424730][ T5929] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 487.434881][ T5985] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 487.447566][ T5929] usb 5-1: device descriptor read/8, error -71 [ 487.567106][ T5929] usb usb5-port1: unable to enumerate USB device [ 487.597535][ T5985] usb 3-1: config 1 has an invalid interface number: 63 but max is 0 [ 487.605841][ T5985] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 487.642626][ T5985] usb 3-1: config 1 has no interface number 0 [ 487.659540][ T5985] usb 3-1: config 1 interface 63 altsetting 252 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 487.726039][ T5985] usb 3-1: config 1 interface 63 has no altsetting 0 [ 487.782435][ T5985] usb 3-1: New USB device found, idVendor=17ef, idProduct=aeab, bcdDevice=fa.34 [ 487.851591][ T5985] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.084914][ T5929] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 488.169475][T15226] netlink: 'syz.3.1699': attribute type 1 has an invalid length. [ 488.256630][T15226] gretap1: entered promiscuous mode [ 488.280344][T15226] bond4: (slave gretap1): making interface the new active one [ 488.297930][T15226] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 488.319524][T15226] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1699'. [ 488.422886][ T5929] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 488.443268][ T5929] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 488.474413][ T5929] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 488.498470][ T5929] usb 1-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e1.c5 [ 488.564178][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.620663][ T5929] usb 1-1: Product: syz [ 488.632118][ T5929] usb 1-1: Manufacturer: syz [ 488.691524][ T5929] usb 1-1: SerialNumber: syz [ 488.742649][ T5929] usb 1-1: config 0 descriptor?? [ 488.752339][ T5929] usb 1-1: Found UVC 34.00 device syz (8086:0b5b) [ 488.758965][ T5929] usb 1-1: No valid video chain found. [ 489.321040][ T43] usb 2-1: string descriptor 0 read error: -71 [ 489.338977][ T43] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 489.372745][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.389685][ T43] usb 2-1: rejected 1 configuration due to insufficient available bus power [ 489.398167][T15235] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1702'. [ 489.442957][ T43] usb 2-1: no configuration chosen from 1 choice [ 489.463312][ T43] usb 2-1: USB disconnect, device number 107 [ 489.614743][ T5916] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 489.794915][ T5929] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 489.824787][ T5916] usb 4-1: Using ep0 maxpacket: 16 [ 489.831726][ T5916] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 489.847099][ T5916] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 489.859309][ T5916] usb 4-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 489.870597][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.886644][ T5916] usb 4-1: Product: syz [ 489.891105][ T5916] usb 4-1: Manufacturer: syz [ 489.899489][ T5916] usb 4-1: SerialNumber: syz [ 489.912441][ T5916] usb 4-1: config 0 descriptor?? [ 489.964910][ T5929] usb 5-1: Using ep0 maxpacket: 8 [ 489.975317][ T5929] usb 5-1: unable to get BOS descriptor or descriptor too short [ 489.993588][ T5929] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 490.012248][ T5929] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 490.030430][ T5929] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 490.044014][ T5929] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 490.054299][ T5929] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 490.077890][ T5929] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 0 [ 490.096645][ T5929] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 490.117104][ T5929] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x61, changing to 0x1 [ 490.142290][T15231] netlink: 'syz.3.1700': attribute type 5 has an invalid length. [ 490.167338][ T5929] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 9060, setting to 1024 [ 490.213281][ T5929] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 490.237643][ T5929] usb 5-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 490.247123][ T5929] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.262568][ T5929] usb 5-1: Product: syz [ 490.272017][ T5929] usb 5-1: Manufacturer: syz [ 490.277002][ T5929] usb 5-1: SerialNumber: syz [ 490.346249][ T5985] usb 3-1: string descriptor 0 read error: -71 [ 490.389070][ T5929] usb 5-1: config 0 descriptor?? [ 490.404057][ T5985] usb 3-1: USB disconnect, device number 99 [ 490.451490][T15233] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 490.556763][ T5929] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 490.611151][ T5958] usb 1-1: USB disconnect, device number 104 [ 490.650111][ T5929] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -12 [ 490.749188][T14925] udevd[14925]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 491.054676][T15261] openvswitch: netlink: Flow key attr not present in new flow. [ 491.734865][ T5959] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 491.827943][ T5943] usb 5-1: USB disconnect, device number 77 [ 491.989748][ T5959] usb 3-1: config 0 has an invalid interface number: 47 but max is 0 [ 492.008976][ T5959] usb 3-1: config 0 has no interface number 0 [ 492.018541][ T5959] usb 3-1: config 0 interface 47 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 492.039029][ T5959] usb 3-1: New USB device found, idVendor=1519, idProduct=0443, bcdDevice=15.97 [ 492.049798][ T5959] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.064003][ T5959] usb 3-1: Product: syz [ 492.068603][ T5959] usb 3-1: Manufacturer: syz [ 492.073271][ T5959] usb 3-1: SerialNumber: syz [ 492.080914][ T5959] usb 3-1: config 0 descriptor?? [ 492.089264][ T5959] cdc_ncm 3-1:0.47: CDC Union missing and no IAD found [ 492.098609][ T5959] cdc_ncm 3-1:0.47: bind() failure [ 492.155082][ T5929] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 492.199239][T15274] fuse: Invalid gid '000000000000000000004' [ 492.286036][ T5929] usb 1-1: device descriptor read/64, error -71 [ 492.326871][ T5916] usb 4-1: USB disconnect, device number 101 [ 492.381395][ T30] kauditd_printk_skb: 21 callbacks suppressed [ 492.381408][ T30] audit: type=1326 audit(1758781456.090:473): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.3.1711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc8b458eec9 code=0x7ffc0000 [ 492.473139][ T30] audit: type=1326 audit(1758781456.130:474): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.3.1711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fc8b458eec9 code=0x7ffc0000 [ 492.512969][ T30] audit: type=1326 audit(1758781456.130:475): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.3.1711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc8b458eec9 code=0x7ffc0000 [ 492.542108][ T30] audit: type=1326 audit(1758781456.130:476): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.3.1711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc8b458eec9 code=0x7ffc0000 [ 492.542636][ T5943] usb 3-1: USB disconnect, device number 100 [ 492.569645][ T5929] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 492.580805][ T30] audit: type=1326 audit(1758781456.130:477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.3.1711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fc8b458eec9 code=0x7ffc0000 [ 492.623839][ T30] audit: type=1326 audit(1758781456.130:478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.3.1711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc8b458eec9 code=0x7ffc0000 [ 492.654284][ T30] audit: type=1326 audit(1758781456.130:479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.3.1711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc8b458eec9 code=0x7ffc0000 [ 492.681440][ T30] audit: type=1326 audit(1758781456.130:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.3.1711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fc8b458eec9 code=0x7ffc0000 [ 492.704466][ T30] audit: type=1326 audit(1758781456.130:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.3.1711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc8b458eec9 code=0x7ffc0000 [ 492.730972][ T30] audit: type=1326 audit(1758781456.130:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.3.1711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc8b458eec9 code=0x7ffc0000 [ 492.735803][ T5929] usb 1-1: device descriptor read/64, error -71 [ 492.795322][T15290] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1715'. [ 492.865228][ T5929] usb usb1-port1: attempt power cycle [ 493.036156][ T5943] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 493.054732][ T5958] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 493.124875][ T43] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 493.204859][ T5929] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 493.212628][ T5958] usb 5-1: Using ep0 maxpacket: 32 [ 493.212782][ T5943] usb 3-1: New USB device found, idVendor=1943, idProduct=2250, bcdDevice= 0.01 [ 493.219793][ T5958] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 493.231307][ T5943] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.236975][ T5958] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.245265][ T5943] usb 3-1: Product: syz [ 493.252257][ T5929] usb 1-1: device descriptor read/8, error -71 [ 493.261520][ T5943] usb 3-1: Manufacturer: syz [ 493.265671][ T5958] usb 5-1: config 0 descriptor?? [ 493.267125][ T5943] usb 3-1: SerialNumber: syz [ 493.280757][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 493.288135][ T43] usb 4-1: config 0 has an invalid interface number: 145 but max is 1 [ 493.301358][ T5943] usb 3-1: config 0 descriptor?? [ 493.309075][ T43] usb 4-1: config 0 has an invalid interface number: 43 but max is 1 [ 493.317946][ T43] usb 4-1: config 0 has no interface number 0 [ 493.326350][ T5943] go7007 3-1:0.0: Sensoray 2250 found [ 493.331864][ T5943] go7007 3-1:0.0: probe with driver go7007 failed with error -12 [ 493.339705][ T43] usb 4-1: config 0 has no interface number 1 [ 493.345960][ T43] usb 4-1: config 0 interface 43 altsetting 250 bulk endpoint 0xF has invalid maxpacket 1023 [ 493.357382][ T43] usb 4-1: config 0 interface 43 altsetting 250 has a duplicate endpoint with address 0x2, skipping [ 493.370159][ T43] usb 4-1: config 0 interface 43 altsetting 250 has an endpoint descriptor with address 0xCE, changing to 0x8E [ 493.382116][ T43] usb 4-1: config 0 interface 43 altsetting 250 endpoint 0x8E has an invalid bInterval 180, changing to 11 [ 493.393614][ T43] usb 4-1: config 0 interface 43 altsetting 250 endpoint 0x8E has invalid maxpacket 16902, setting to 1024 [ 493.405120][ T43] usb 4-1: config 0 interface 43 altsetting 250 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 493.418436][ T43] usb 4-1: config 0 interface 145 has no altsetting 0 [ 493.425439][ T43] usb 4-1: config 0 interface 43 has no altsetting 0 [ 493.436960][ T43] usb 4-1: New USB device found, idVendor=06cd, idProduct=0104, bcdDevice=c8.6a [ 493.446134][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.454123][ T43] usb 4-1: Product: syz [ 493.460115][ T43] usb 4-1: Manufacturer: syz [ 493.465867][ T43] usb 4-1: SerialNumber: syz [ 493.472778][ T43] usb 4-1: config 0 descriptor?? [ 493.487333][ T5958] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 493.495042][ T5929] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 493.511026][ T5958] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 493.521057][ T5929] usb 1-1: device descriptor read/8, error -71 [ 493.528202][ T5958] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 493.536859][ T5958] usb 5-1: media controller created [ 493.544269][ T5943] usb 3-1: USB disconnect, device number 101 [ 493.569494][ T5958] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 493.645092][ T5929] usb usb1-port1: unable to enumerate USB device [ 493.698859][ T5958] az6027: usb out operation failed. (-71) [ 493.706697][ T5958] az6027: usb out operation failed. (-71) [ 493.712445][ T5958] stb0899_attach: Driver disabled by Kconfig [ 493.721858][ T5958] az6027: no front-end attached [ 493.721858][ T5958] [ 493.729421][ T5958] az6027: usb out operation failed. (-71) [ 493.735753][ T5958] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 493.741290][T15293] fuse: Unknown parameter '0x000000000000000a' [ 493.745216][ T5958] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input36 [ 493.762591][ T5958] dvb-usb: schedule remote query interval to 400 msecs. [ 493.769753][ T5958] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 493.781367][ T5958] usb 5-1: USB disconnect, device number 78 [ 493.839685][ T5958] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 494.345030][ T5958] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 494.496596][ T5958] usb 3-1: config 0 has an invalid interface number: 249 but max is 0 [ 494.505035][ T5958] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 494.515234][ T5958] usb 3-1: config 0 has no interface number 0 [ 494.521482][ T5958] usb 3-1: config 0 interface 249 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 494.531870][ T5958] usb 3-1: config 0 interface 249 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 0 [ 494.542113][ T5958] usb 3-1: config 0 interface 249 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 494.555328][ T5958] usb 3-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=be.87 [ 494.564415][ T5958] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.579994][ T5958] usb 3-1: config 0 descriptor?? [ 494.589458][ T5958] port100 3-1:0.249: NFC: Could not find bulk-in or bulk-out endpoint [ 494.791922][ T5943] usb 3-1: USB disconnect, device number 102 [ 495.090097][T15307] openvswitch: netlink: Flow key attr not present in new flow. [ 495.582452][T15317] FAULT_INJECTION: forcing a failure. [ 495.582452][T15317] name failslab, interval 1, probability 0, space 0, times 0 [ 495.602381][T15318] netlink: 'syz.2.1722': attribute type 4 has an invalid length. [ 495.613251][T15318] netlink: 'syz.2.1722': attribute type 4 has an invalid length. [ 495.625832][T15317] CPU: 0 UID: 0 PID: 15317 Comm: syz.1.1721 Not tainted syzkaller #0 PREEMPT(full) [ 495.625854][T15317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 495.625866][T15317] Call Trace: [ 495.625874][T15317] [ 495.625882][T15317] dump_stack_lvl+0x189/0x250 [ 495.625908][T15317] ? __pfx____ratelimit+0x10/0x10 [ 495.625928][T15317] ? __pfx_dump_stack_lvl+0x10/0x10 [ 495.625946][T15317] ? __pfx__printk+0x10/0x10 [ 495.625963][T15317] ? __pfx___might_resched+0x10/0x10 [ 495.625975][T15317] should_fail_ex+0x414/0x560 [ 495.625993][T15317] should_failslab+0xa8/0x100 [ 495.626015][T15317] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 495.626038][T15317] ? __alloc_skb+0x112/0x2d0 [ 495.626061][T15317] __alloc_skb+0x112/0x2d0 [ 495.626084][T15317] netlink_sendmsg+0x5c6/0xb30 [ 495.626105][T15317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 495.626117][T15317] ? aa_sock_msg_perm+0xf1/0x1d0 [ 495.626128][T15317] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 495.626140][T15317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 495.626151][T15317] __sock_sendmsg+0x21c/0x270 [ 495.626177][T15317] sock_write_iter+0x258/0x330 [ 495.626203][T15317] ? __pfx_sock_write_iter+0x10/0x10 [ 495.626246][T15317] do_iter_readv_writev+0x619/0x8b0 [ 495.626264][T15317] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 495.626276][T15317] ? common_file_perm+0x1b5/0x230 [ 495.626288][T15317] ? bpf_lsm_file_permission+0x9/0x20 [ 495.626300][T15317] ? security_file_permission+0x75/0x290 [ 495.626321][T15317] ? rw_verify_area+0x255/0x4d0 [ 495.626345][T15317] vfs_writev+0x31a/0x960 [ 495.626367][T15317] ? __lock_acquire+0xab9/0xd20 [ 495.626395][T15317] ? __pfx_vfs_writev+0x10/0x10 [ 495.626412][T15317] ? __fget_files+0x2a/0x420 [ 495.626423][T15317] ? __fget_files+0x3a0/0x420 [ 495.626431][T15317] ? __fget_files+0x2a/0x420 [ 495.626449][T15317] do_writev+0x14d/0x2d0 [ 495.626468][T15317] ? __pfx_do_writev+0x10/0x10 [ 495.626483][T15317] ? rcu_is_watching+0x15/0xb0 [ 495.626507][T15317] ? do_syscall_64+0xbe/0x3b0 [ 495.626530][T15317] do_syscall_64+0xfa/0x3b0 [ 495.626545][T15317] ? lockdep_hardirqs_on+0x9c/0x150 [ 495.626556][T15317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.626565][T15317] ? clear_bhb_loop+0x60/0xb0 [ 495.626577][T15317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.626586][T15317] RIP: 0033:0x7f539e98eec9 [ 495.626597][T15317] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 495.626611][T15317] RSP: 002b:00007f539f85e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 495.626630][T15317] RAX: ffffffffffffffda RBX: 00007f539ebe5fa0 RCX: 00007f539e98eec9 [ 495.626643][T15317] RDX: 0000000000000001 RSI: 00002000000003c0 RDI: 0000000000000005 [ 495.626655][T15317] RBP: 00007f539f85e090 R08: 0000000000000000 R09: 0000000000000000 [ 495.626667][T15317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 495.626678][T15317] R13: 00007f539ebe6038 R14: 00007f539ebe5fa0 R15: 00007f539ed0fa28 [ 495.626700][T15317] [ 495.627078][T15317] netlink: 'syz.1.1721': attribute type 4 has an invalid length. [ 496.111885][ T43] keyspan_pda 4-1:0.145: required endpoints missing [ 496.113823][T15325] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1724'. [ 496.145216][ T43] keyspan_pda 4-1:0.43: Keyspan PDA converter detected [ 496.290119][ T43] usb 4-1: Keyspan PDA converter now attached to ttyUSB0 [ 496.328449][ T43] usb 4-1: USB disconnect, device number 102 [ 496.415290][ T43] keyspan_pda ttyUSB0: Keyspan PDA converter now disconnected from ttyUSB0 [ 496.456364][ T43] keyspan_pda 4-1:0.43: device disconnected [ 496.750143][T15342] trusted_key: syz.2.1728 sent an empty control message without MSG_MORE. [ 496.854683][ T43] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 496.991956][T15339] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1728'. [ 497.051961][T15344] netlink: 'syz.0.1730': attribute type 4 has an invalid length. [ 497.054892][ T43] usb 4-1: Using ep0 maxpacket: 8 [ 497.057589][T15344] netlink: 'syz.0.1730': attribute type 4 has an invalid length. [ 497.071389][ T43] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 497.071434][ T43] usb 4-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x11, changing to 0x1 [ 497.071448][ T43] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 497.117674][ T43] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 497.117704][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.117724][ T43] usb 4-1: Product: syz [ 497.117738][ T43] usb 4-1: Manufacturer: syz [ 497.117752][ T43] usb 4-1: SerialNumber: syz [ 497.120828][T15326] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 497.546991][ T5943] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 497.722611][T15357] netlink: 'syz.1.1734': attribute type 4 has an invalid length. [ 497.830886][ T5943] usb 1-1: New USB device found, idVendor=0b95, idProduct=772b, bcdDevice=a2.4c [ 497.877017][ T5943] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.885867][ T5943] usb 1-1: Product: syz [ 497.890073][ T5943] usb 1-1: Manufacturer: syz [ 497.912685][ T5943] usb 1-1: SerialNumber: syz [ 497.946403][ T5943] usb 1-1: config 0 descriptor?? [ 498.048693][ T5929] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 498.213340][ T5943] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 498.226548][ T5943] asix 1-1:0.0: probe with driver asix failed with error -71 [ 498.236587][ T5929] usb 2-1: Using ep0 maxpacket: 32 [ 498.253659][ T5943] usb 1-1: USB disconnect, device number 109 [ 498.396826][ T5929] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 498.404985][ T5929] usb 2-1: config 0 has no interface number 0 [ 498.411129][ T5929] usb 2-1: config 0 interface 89 has no altsetting 0 [ 498.428543][ T5929] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 498.474932][ T43] cdc_ncm 4-1:1.0: bind() failure [ 498.628626][ T43] usbtest 4-1:1.1: probe with driver usbtest failed with error -71 [ 498.656368][ T43] usb 4-1: USB disconnect, device number 103 [ 498.842234][ T5929] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.939264][ T5929] usb 2-1: Product: syz [ 498.984736][ T5929] usb 2-1: Manufacturer: syz [ 498.989395][ T5929] usb 2-1: SerialNumber: syz [ 499.046377][T15369] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1738'. [ 499.186220][ T5929] usb 2-1: config 0 descriptor?? [ 499.249665][ T5929] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 499.265781][T15373] openvswitch: netlink: Flow key attr not present in new flow. [ 499.303254][ T5929] em28xx 2-1:0.89: Video interface 89 found: bulk [ 500.004731][ T5985] usb 3-1: new full-speed USB device number 103 using dummy_hcd [ 500.233880][ T5929] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 500.256793][ T5985] usb 3-1: config 0 has an invalid interface number: 207 but max is 0 [ 500.279361][ T5985] usb 3-1: config 0 has no interface number 0 [ 500.316561][ T5985] usb 3-1: New USB device found, idVendor=12d1, idProduct=ed56, bcdDevice=46.dd [ 500.340459][ T5985] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.349064][ T5985] usb 3-1: Product: syz [ 500.353320][ T5985] usb 3-1: Manufacturer: syz [ 500.394677][ T5985] usb 3-1: SerialNumber: syz [ 500.404542][ T5985] usb 3-1: config 0 descriptor?? [ 500.418296][ T5985] qmi_wwan 3-1:0.207: bogus CDC Union: master=0, slave=1 [ 500.624196][ T5985] qmi_wwan 3-1:0.207: probe with driver qmi_wwan failed with error -22 [ 500.675755][T15395] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1742'. [ 500.840664][T15380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.875101][T15380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 501.075494][T15359] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1735'. [ 501.084542][T15359] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1735'. [ 501.487407][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.493761][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.502086][ T5929] em28xx 2-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 501.515341][ T5929] em28xx 2-1:0.89: board has no eeprom [ 501.629393][ T5929] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 501.664228][ T5929] em28xx 2-1:0.89: analog set to bulk mode. [ 501.695634][ T5985] em28xx 2-1:0.89: Registering V4L2 extension [ 501.743764][ T5929] usb 2-1: USB disconnect, device number 108 [ 501.750250][ T5985] em28xx 2-1:0.89: reading from i2c device at 0x4a failed (error=-19) [ 501.800743][ T5929] em28xx 2-1:0.89: Disconnecting em28xx [ 501.828159][ T5985] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 501.854669][ T5985] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 501.877192][ T5985] em28xx 2-1:0.89: No AC97 audio processor [ 501.941854][ T5985] usb 2-1: Decoder not found [ 502.059592][ T5985] em28xx 2-1:0.89: failed to create media graph [ 502.079965][ T5985] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 502.113445][T15406] ================================================================== [ 502.121538][T15406] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 502.128894][T15406] Read of size 8 at addr ffff88807d7a8740 by task v4l_id/15406 [ 502.136423][T15406] [ 502.138738][T15406] CPU: 1 UID: 0 PID: 15406 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 502.138752][T15406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 502.138759][T15406] Call Trace: [ 502.138765][T15406] [ 502.138770][T15406] dump_stack_lvl+0x189/0x250 [ 502.138786][T15406] ? rcu_is_watching+0x15/0xb0 [ 502.138805][T15406] ? __kasan_check_byte+0x12/0x40 [ 502.138828][T15406] ? __pfx_dump_stack_lvl+0x10/0x10 [ 502.138845][T15406] ? rcu_is_watching+0x15/0xb0 [ 502.138861][T15406] ? lock_release+0x4b/0x3e0 [ 502.138882][T15406] ? __virt_addr_valid+0x1c8/0x5c0 [ 502.138895][T15406] ? __virt_addr_valid+0x4a5/0x5c0 [ 502.138907][T15406] print_report+0xca/0x240 [ 502.138917][T15406] ? v4l2_fh_open+0xc7/0x430 [ 502.138927][T15406] kasan_report+0x118/0x150 [ 502.138941][T15406] ? v4l2_fh_open+0xc7/0x430 [ 502.138952][T15406] v4l2_fh_open+0xc7/0x430 [ 502.138963][T15406] em28xx_v4l2_open+0x157/0x9a0 [ 502.138980][T15406] v4l2_open+0x20f/0x360 [ 502.138991][T15406] chrdev_open+0x4c9/0x5e0 [ 502.139001][T15406] ? __pfx_chrdev_open+0x10/0x10 [ 502.139010][T15406] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 502.139026][T15406] ? __pfx_chrdev_open+0x10/0x10 [ 502.139034][T15406] do_dentry_open+0x950/0x13f0 [ 502.139050][T15406] vfs_open+0x3b/0x340 [ 502.139058][T15406] ? path_openat+0x2ecd/0x3830 [ 502.139070][T15406] path_openat+0x2ee5/0x3830 [ 502.139081][T15406] ? arch_stack_walk+0xfc/0x150 [ 502.139096][T15406] ? stack_depot_save_flags+0x40/0x860 [ 502.139114][T15406] ? __pfx_path_openat+0x10/0x10 [ 502.139125][T15406] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.139139][T15406] do_filp_open+0x1fa/0x410 [ 502.139149][T15406] ? __lock_acquire+0xab9/0xd20 [ 502.139164][T15406] ? __pfx_do_filp_open+0x10/0x10 [ 502.139179][T15406] ? _raw_spin_unlock+0x28/0x50 [ 502.139194][T15406] ? alloc_fd+0x64c/0x6c0 [ 502.139209][T15406] do_sys_openat2+0x121/0x1c0 [ 502.139220][T15406] ? __pfx_do_sys_openat2+0x10/0x10 [ 502.139231][T15406] ? exc_page_fault+0x76/0xf0 [ 502.139241][T15406] ? do_user_addr_fault+0xc8a/0x1390 [ 502.139256][T15406] __x64_sys_openat+0x138/0x170 [ 502.139268][T15406] do_syscall_64+0xfa/0x3b0 [ 502.139279][T15406] ? lockdep_hardirqs_on+0x9c/0x150 [ 502.139288][T15406] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.139297][T15406] ? clear_bhb_loop+0x60/0xb0 [ 502.139308][T15406] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.139318][T15406] RIP: 0033:0x7fbe208a7407 [ 502.139328][T15406] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 502.139336][T15406] RSP: 002b:00007ffcb4d42920 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 502.139347][T15406] RAX: ffffffffffffffda RBX: 00007fbe21004880 RCX: 00007fbe208a7407 [ 502.139355][T15406] RDX: 0000000000000000 RSI: 00007ffcb4d42f1c RDI: ffffffffffffff9c [ 502.139362][T15406] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 502.139368][T15406] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 502.139374][T15406] R13: 00007ffcb4d42b70 R14: 00007fbe2116b000 R15: 00005614a762e4d8 [ 502.139384][T15406] [ 502.139388][T15406] [ 502.446170][T15406] Allocated by task 5985: [ 502.450475][T15406] kasan_save_track+0x3e/0x80 [ 502.455142][T15406] __kasan_kmalloc+0x93/0xb0 [ 502.459715][T15406] __kmalloc_cache_noprof+0x230/0x3d0 [ 502.465072][T15406] em28xx_v4l2_init+0x10b/0x2e70 [ 502.469996][T15406] em28xx_init_extension+0x120/0x1c0 [ 502.475260][T15406] process_scheduled_works+0xae1/0x17b0 [ 502.480782][T15406] worker_thread+0x8a0/0xda0 [ 502.485349][T15406] kthread+0x70e/0x8a0 [ 502.489395][T15406] ret_from_fork+0x439/0x7d0 [ 502.493961][T15406] ret_from_fork_asm+0x1a/0x30 [ 502.498708][T15406] [ 502.501017][T15406] Freed by task 5985: [ 502.504974][T15406] kasan_save_track+0x3e/0x80 [ 502.509644][T15406] kasan_save_free_info+0x46/0x50 [ 502.514648][T15406] __kasan_slab_free+0x5b/0x80 [ 502.519398][T15406] kfree+0x18e/0x440 [ 502.523286][T15406] em28xx_v4l2_init+0x1683/0x2e70 [ 502.528294][T15406] em28xx_init_extension+0x120/0x1c0 [ 502.533819][T15406] process_scheduled_works+0xae1/0x17b0 [ 502.539347][T15406] worker_thread+0x8a0/0xda0 [ 502.543918][T15406] kthread+0x70e/0x8a0 [ 502.547973][T15406] ret_from_fork+0x439/0x7d0 [ 502.552564][T15406] ret_from_fork_asm+0x1a/0x30 [ 502.557309][T15406] [ 502.559612][T15406] The buggy address belongs to the object at ffff88807d7a8000 [ 502.559612][T15406] which belongs to the cache kmalloc-8k of size 8192 [ 502.573640][T15406] The buggy address is located 1856 bytes inside of [ 502.573640][T15406] freed 8192-byte region [ffff88807d7a8000, ffff88807d7aa000) [ 502.587598][T15406] [ 502.589906][T15406] The buggy address belongs to the physical page: [ 502.596307][T15406] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d7a8 [ 502.605048][T15406] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 502.613519][T15406] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 502.621477][T15406] page_type: f5(slab) [ 502.625435][T15406] raw: 00fff00000000040 ffff88801a442280 ffffea0000caae00 dead000000000005 [ 502.633994][T15406] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 502.642550][T15406] head: 00fff00000000040 ffff88801a442280 ffffea0000caae00 dead000000000005 [ 502.651207][T15406] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 502.659866][T15406] head: 00fff00000000003 ffffea0001f5ea01 00000000ffffffff 00000000ffffffff [ 502.668518][T15406] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 502.677165][T15406] page dumped because: kasan: bad access detected [ 502.683553][T15406] page_owner tracks the page as allocated [ 502.689244][T15406] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5238, tgid 5238 (S10udev), ts 25093884186, free_ts 22245640627 [ 502.709363][T15406] post_alloc_hook+0x240/0x2a0 [ 502.714114][T15406] get_page_from_freelist+0x21e4/0x22c0 [ 502.719636][T15406] __alloc_frozen_pages_noprof+0x181/0x370 [ 502.725419][T15406] alloc_pages_mpol+0x232/0x4a0 [ 502.730509][T15406] allocate_slab+0x8a/0x370 [ 502.734986][T15406] ___slab_alloc+0xbeb/0x1420 [ 502.739643][T15406] __kmalloc_cache_noprof+0x296/0x3d0 [ 502.744991][T15406] tomoyo_init_log+0x111f/0x1f70 [ 502.749918][T15406] tomoyo_supervisor+0x340/0x1480 [ 502.754932][T15406] tomoyo_env_perm+0x149/0x1e0 [ 502.759689][T15406] tomoyo_find_next_domain+0x15cf/0x1aa0 [ 502.765303][T15406] tomoyo_bprm_check_security+0x11c/0x180 [ 502.771006][T15406] security_bprm_check+0x89/0x270 [ 502.776016][T15406] bprm_execve+0x8ee/0x1450 [ 502.780512][T15406] do_execveat_common+0x510/0x6a0 [ 502.785524][T15406] __x64_sys_execve+0x94/0xb0 [ 502.790187][T15406] page last free pid 1 tgid 1 stack trace: [ 502.795966][T15406] __free_frozen_pages+0xbc4/0xd30 [ 502.801059][T15406] free_contig_range+0x1bd/0x4a0 [ 502.805972][T15406] destroy_args+0x69/0x660 [ 502.810365][T15406] debug_vm_pgtable+0x39f/0x3b0 [ 502.815191][T15406] do_one_initcall+0x233/0x820 [ 502.819932][T15406] do_initcall_level+0x104/0x190 [ 502.824844][T15406] do_initcalls+0x59/0xa0 [ 502.829144][T15406] kernel_init_freeable+0x334/0x4b0 [ 502.834312][T15406] kernel_init+0x1d/0x1d0 [ 502.838619][T15406] ret_from_fork+0x439/0x7d0 [ 502.843181][T15406] ret_from_fork_asm+0x1a/0x30 [ 502.847931][T15406] [ 502.850231][T15406] Memory state around the buggy address: [ 502.855840][T15406] ffff88807d7a8600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 502.863876][T15406] ffff88807d7a8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 502.871909][T15406] >ffff88807d7a8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 502.879939][T15406] ^ [ 502.886062][T15406] ffff88807d7a8780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 502.894093][T15406] ffff88807d7a8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 502.902122][T15406] ================================================================== [ 502.941543][ T5985] em28xx 2-1:0.89: Registering snapshot button... [ 502.948629][T15406] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 502.955842][T15406] CPU: 1 UID: 0 PID: 15406 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 502.964859][T15406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 502.974914][T15406] Call Trace: [ 502.978193][T15406] [ 502.981122][T15406] dump_stack_lvl+0x99/0x250 [ 502.985722][T15406] ? __asan_memcpy+0x40/0x70 [ 502.990315][T15406] ? __pfx_dump_stack_lvl+0x10/0x10 [ 502.995518][T15406] ? __pfx__printk+0x10/0x10 [ 503.000117][T15406] vpanic+0x281/0x750 [ 503.004099][T15406] ? preempt_schedule+0xae/0xc0 [ 503.008928][T15406] ? __pfx_vpanic+0x10/0x10 [ 503.013409][T15406] ? preempt_schedule_common+0x83/0xd0 [ 503.018842][T15406] ? preempt_schedule+0xae/0xc0 [ 503.023668][T15406] ? __pfx_preempt_schedule+0x10/0x10 [ 503.029019][T15406] panic+0xb9/0xc0 [ 503.032717][T15406] ? __pfx_panic+0x10/0x10 [ 503.037111][T15406] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 503.042984][T15406] ? v4l2_fh_open+0xc7/0x430 [ 503.047551][T15406] check_panic_on_warn+0x89/0xb0 [ 503.052470][T15406] ? v4l2_fh_open+0xc7/0x430 [ 503.057035][T15406] end_report+0x78/0x160 [ 503.061265][T15406] kasan_report+0x129/0x150 [ 503.065750][T15406] ? v4l2_fh_open+0xc7/0x430 [ 503.070316][T15406] v4l2_fh_open+0xc7/0x430 [ 503.074707][T15406] em28xx_v4l2_open+0x157/0x9a0 [ 503.079540][T15406] v4l2_open+0x20f/0x360 [ 503.083760][T15406] chrdev_open+0x4c9/0x5e0 [ 503.088152][T15406] ? __pfx_chrdev_open+0x10/0x10 [ 503.093080][T15406] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 503.099390][T15406] ? __pfx_chrdev_open+0x10/0x10 [ 503.104325][T15406] do_dentry_open+0x950/0x13f0 [ 503.109067][T15406] vfs_open+0x3b/0x340 [ 503.113112][T15406] ? path_openat+0x2ecd/0x3830 [ 503.117862][T15406] path_openat+0x2ee5/0x3830 [ 503.122433][T15406] ? arch_stack_walk+0xfc/0x150 [ 503.127268][T15406] ? stack_depot_save_flags+0x40/0x860 [ 503.132710][T15406] ? __pfx_path_openat+0x10/0x10 [ 503.137625][T15406] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.143672][T15406] do_filp_open+0x1fa/0x410 [ 503.148158][T15406] ? __lock_acquire+0xab9/0xd20 [ 503.153014][T15406] ? __pfx_do_filp_open+0x10/0x10 [ 503.158021][T15406] ? _raw_spin_unlock+0x28/0x50 [ 503.162871][T15406] ? alloc_fd+0x64c/0x6c0 [ 503.167199][T15406] do_sys_openat2+0x121/0x1c0 [ 503.171857][T15406] ? __pfx_do_sys_openat2+0x10/0x10 [ 503.177049][T15406] ? exc_page_fault+0x76/0xf0 [ 503.181703][T15406] ? do_user_addr_fault+0xc8a/0x1390 [ 503.186969][T15406] __x64_sys_openat+0x138/0x170 [ 503.191802][T15406] do_syscall_64+0xfa/0x3b0 [ 503.196287][T15406] ? lockdep_hardirqs_on+0x9c/0x150 [ 503.201463][T15406] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.207525][T15406] ? clear_bhb_loop+0x60/0xb0 [ 503.212178][T15406] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.218069][T15406] RIP: 0033:0x7fbe208a7407 [ 503.222462][T15406] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 503.242046][T15406] RSP: 002b:00007ffcb4d42920 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 503.250438][T15406] RAX: ffffffffffffffda RBX: 00007fbe21004880 RCX: 00007fbe208a7407 [ 503.258390][T15406] RDX: 0000000000000000 RSI: 00007ffcb4d42f1c RDI: ffffffffffffff9c [ 503.266338][T15406] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 503.274288][T15406] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 503.282235][T15406] R13: 00007ffcb4d42b70 R14: 00007fbe2116b000 R15: 00005614a762e4d8 [ 503.290190][T15406] [ 503.293458][T15406] Kernel Offset: disabled [ 503.297767][T15406] Rebooting in 86400 seconds..