last executing test programs: 2m32.771110156s ago: executing program 1 (id=232): ioprio_set$pid(0x1, 0x0, 0x0) (async) r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x140342, 0x0) sendfile(r0, r0, 0x0, 0x7ffff000) 2m31.86149944s ago: executing program 1 (id=235): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioprio_set$uid(0x3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x400000008000f28, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00010000031401"], 0x100}, 0x1, 0x0, 0x0, 0x4040024}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000080)='cdg\x00', 0x4) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) shutdown(r3, 0x2) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r3, 0x29, 0x41, &(0x7f00000005c0)=ANY=[@ANYBLOB="730001000000000000000000000000b2000000000200000000000000000000004000000000000000a69bd7dcb33600"/60], 0x48) r4 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000001018610f4205ae06d6c010203010902240001010000000904690202ff5aa30009050400"], 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000040)={0x7, 0x6576, 0xd}) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="020000002000ffff00000000040000000000000010000000000000002000000000000000"], 0x24, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000011006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac00400020208001d000300010004000300eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYRES32=r0, @ANYRESDEC=r4, @ANYRES8=r5], 0x54}, 0x1, 0x0, 0x0, 0x44884}, 0x40c4) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_CONNECT(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="00000002e5ff000000000000000008000300", @ANYRES32=r9, @ANYBLOB="0a00340005ac0f0002ac0f000bac0f0008ec0f009ace31cda8de95d05898fbc22218596ed9d5b145233253405bf126f80202868437d04b"], 0x40}}, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r5, 0x100000000) r11 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000640)=ANY=[@ANYBLOB="1201000000000040250988880000000000010902240001cdc30e80ebbadcee40c6b118be23000020000904000f010300013052a533fa6f9eb2b96cd46414cc679f0eec406add777cfe70b66f466c13abb67cffb5ececb3b86df87ce36dbd97a0131fbe42061ea48b6ab259843815e741df9d6d0f2335f9d163d0b3068b6c8258e3f4b26f1355a2bdc32ac17d055b5420bf32a7f03207d8c1b9b42467129945be726b78f11f8db96e1d6d5670aa36f0975c8b134ceffa33d6c6c1966065767f2528a9ff14d09c4b53f32839fdc19b7795d596d94010c526dea7de36601808c9846177d21cff7e6534361c9f8f8ca61f1861834e4b792af55af6b0519daf575a58cef89f97d4bb21c2acac22386d1e8b4f6de62aa58e44c714198c96aa1ac9de6decbadaf3861115e7931b52176c61912e2e27fa7afe2d165efa99bdc362c7966541610d5754a4e841b2a4f8c46297348287db67feadf30b0be6f4ad5aac350e3127bd0dee00"/366, @ANYRESOCT=r6], 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) 2m29.484307635s ago: executing program 1 (id=247): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x145342, 0x0) sendfile(r1, r0, 0x0, 0x7fffefff) r2 = syz_usb_connect$lan78xx(0x4, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_disconnect(r2) fadvise64(r0, 0x9, 0x9, 0x2) sendfile(r0, r0, 0x0, 0x7ffff000) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async) openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x145342, 0x0) (async) sendfile(r1, r0, 0x0, 0x7fffefff) (async) syz_usb_connect$lan78xx(0x4, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) (async) syz_usb_disconnect(r2) (async) fadvise64(r0, 0x9, 0x9, 0x2) (async) sendfile(r0, r0, 0x0, 0x7ffff000) (async) 2m29.054045562s ago: executing program 1 (id=249): r0 = syz_clone(0x0, 0x0, 0xfffffffffffffead, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) ioctl$KVM_SET_GUEST_DEBUG(0xffffffffffffffff, 0x4048ae9b, &(0x7f0000000000)={0x1e0002, 0x0, [0x0, 0x57b, 0x1, 0xfcb, 0x6, 0xa, 0x1]}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) process_mrelease(r1, 0x700000000000000) r5 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) fstat(r6, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(0x0, r7) r8 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r8, 0x40405514, &(0x7f0000000540)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0xfffffffffffffe00, 0x0, 0x218, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff9a, 0x0, 0x9, 0x0, 0x0, 0x100000001, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2, 0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x40, 0x8, 0x0, 0x0, 0x0, 0x0, 0x7, 0x4000000000000000, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0xff, 0x0, 0x3, 0x7, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0xc, 0x2, 0x0, 0x20, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x3, 0x4000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r5, 0x2000) r9 = accept$ax25(0xffffffffffffffff, &(0x7f0000000000)={{0x3, @default}, [@netrom, @null, @null, @null, @default, @rose, @rose]}, &(0x7f0000000080)=0x48) ioctl$SIOCAX25DELUID(r9, 0x89e2, &(0x7f00000000c0)={0x3, @default, r7}) 2m28.72883686s ago: executing program 1 (id=251): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='comm\x00') exit(0x1ff) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) fadvise64(r0, 0x92, 0x5, 0x2) writev(r0, &(0x7f0000001380)=[{&(0x7f0000000140)="79666f4aa5110b7a55d67f8efed956f45c2526ba07f058c7c637c0ffbfd2927b0b273912df589d47", 0x28}, {&(0x7f0000001400)="89aff907c36e73b6acddd76e57a993e11cc23fdfffeb23d4ed0127326628535341eeb92edcd64f4e5c4c8cedb8d3b13c9cfdaf060cd0dd6db2e7451255d959bb39155a6c0021516d6a5afc4e28536e9dedcb61fca9608a0ff64c66a5a365725c8dcd41f6c78b9b4832b85d58647d26343cf2b6195f6f717f4086d26a7d920dd7c9070e630245c7b097daece7b98e7d2bfbcc89b5273ac59014d0c8eb7d549d3d32d726d48a67571e3f86dc08e405ae7b255aeeb9c25db06ba1fc189a7607b995c7c27bffb02b2ee4e643ad6dfe464d2d84ed7b1ba08631d28f96d58ad87ff26e52b9f8b8f02cc817584e7060058cb5b24b0d81911f124533dce09acd194348df1e420ee5f68327e6477d792b4fa83dbed3a67bdc74fbd10ecd0d9c7ac60b85393355bbceb4feed875f201db0ca39ff7ac7741b719ae9fc9e47e0e4a04fc249860c09191139424e9d6549c498ab5db229db92dc04342b08e668cafe9aa4cd5c34bca1efbb36bf5c4138a203866b6d5e52815334246f87ad6f5b9ea28d0c10febf5951f3d829368ce10b75886297560a34fa26d244400725291e05c776ad38b04ea8840f3c56e6769bc99577f316579e67b59247be0010da7221d23cee6f6c641949b13e41aedef4d71a8b98ce29ba15373d517278be8935de920bcc771eb49a910e3e53ca3f3d230250b4e1fbcb48380ea617261c3d53bc6d3fde523148b4db2155fc4bede4697a47f5b2141c5bd7255bb4e6a3e8f598838abe65aeb6750c16fd73d6817a4f236923c1c0c02faf06f97a17e710e4481b6e372d702b9705a0b98e79a1cb0fcebf10b7a63738ac6787834945de9b951d617b617cbee70c3f02fc3cd8d499a073a8e2b5c43f38564338ae78f7fc81eea75a944a435fd469aebfc19f413b8210fbbed50abce88c5a61bd4d9bbd0958ffa907a33ec95087dd3bf112434a5493d26592758f831a54efca1cd69e1a0a81b89ce0f66de72f3b1a5988b32c34f7890e4a9c590d2b7e2ba16b95a1a00bffca9db11f5e355eecf516603791df3f4bb474be8539cdb87ff285059be0955e97f47a0404ce38d219a05f4f68866ae6ccecb0849471fcf41ce63737f730007c44b60d4a94d51c440e4c8b23146ded1d30e65314237c69ce6cd2adfcc2399bebeef1210181f6f8b9964b99aea1754c33109f00101033c6859dd13123bb53059bfb32ea2113f2ed97400552efaf66a28b54c492184447c3def6ea37b57cc1cfe254b10e9c44b6b0c260bafe61c871e2cdb2cb35ed94e1f36a60109ea3ae3989145cad1cfaf75d1deaa088db1daa4359a4d71b9142f7a508888de8333bed1aedd52759c8fe6e79dd5a81b5f8bd2651933f09c6b777f9222e0febb6a788b7db357f681bf896f80cb5abce0c37b26a55faf2ffd8f4d33d0169aae64e8c6d6b6c8c05118ff57ce4af58d380f6a0bdb6ea89196dd34a617ba097cd490db6b7edcf3bfd2e8bedc15e0793cf310a56a39b1079b1ba8565ec3f6cefa7dcdd7646394baa3e8fa8a4dc4a020f759ae3f162965448d93eb9305f248346ad9b9116e2e6b01c645a2ddc53cd7e72a5d8ce1ae6ffdca901e7e816549c5be89fac5d602a150b1a882f3cba2a9bcf06288cac5f44cc7a35a563cf003106677770839069055b4389c9de9713515bcb0e6396f8163f5c3cb32adf6c7cdc0aae0355234df062a1f48938406c38f3be5921c7709a27353729f3c26fc8cd70e1233d1c92d8f9306b9f488fc0f86d120b44668ee455656649571c71027916b76c02c89d38296ef5ff0512044bff82fc767ccab932c3897d80aeb7e199e4f587f17332732770c0bd945405939a26702b57e887c70964663e6b190432863cd5891a6b3212fad276eb443c1c797c5837854a74cadb9cf33eaed7198af5f304672a1617ba8e671fe98d422cb2dfcdb9be352d5d56604efae07e685096e9500ab171c5c9728f8c0f061116ff58edb8f533aa29b89ff6eb3880759703294b6f8351dea7059d72fb3aa9227d6765249785d08227ff210dbc1c3e0b7aa7779969dea724842251ab34c81bd19361d8af5dca8e8fcef746445b753d9fc9447fddfdd2857d3a823717b1a74fa4f6070c47737e64112691e69ed6913ac2a24e6dfb5af6e502f3feafc69e83f913a0d36b791f1f730d148aed68261346193959aaea1fdd417aa27f0458a265fe77986d84df3b61e26300cfceb4291f2de60e27940f5a529e694e86f7737db0ed1e19a0996c4e7ed3cd96d017001e3284e1403f2f1c52712b7486b41fb02a2961a91a631e9c85e8814bd96fea3a8408dd9f78cb4620b3181a39d5c52ba06d04b1ce4ea44ec4743ecb10795899a399e2b3a2228fb113731ee1721718607cd3617ebac14242b9f4135f9be0b77a3856ec9c4076c541a4ddc8e4f5056eadbc9fd2fe25bb960cd1c6453275a2f6c7297a4eae1bae3c63c098731e2bebb796f3a1bba052aae4cdaf1ab7fd214c41aac4c411eb1b1e2bad701674af6b799e02692e409695052b174b926e4740cd026245beb5c3565053fe4be59bfb7ebc17df11b61676e80dc292ea5657d000d3c34775f2c99b36a08b2ff4a808d1c4873eec608d2250998557b75507c865a9adb414dcc8e216377536129ce664353fd05e6e4f2a8d2783e753437a1bd46ea2f0516e5173b4a6e157d245b7807b7073bf0ce311aa45c572f47d5fe146234472215d8c3404d3431ce852d6d40149c7e67cab6a937510cdf8de3f092d6baaa32ce6e1f4fc70110f56d34c3735bd5b3d76b39b45e257407ade6c29a50f5d9bfd12525bcefbb780516676517f5cdb78b7f83e158653398160c51a062a1cb5cb1e47e48aad822c22313756d42f3c326b95a527eab3a6fe6e336982844f44f5e7f6d76a9aabbe856d4b113d7dc581293a92cb631eae970eda8656b829035b15742bca75035b3a87f3b6402d8da08fbcdcd40b820adbf81d426e913dacd3a3720d19f8556ddcc3f2c7e5f2e7f352124bedca59a85d7bb35fc1f6b60ae0b031bb597249c9bdc7946371a660dd913d63575d4f1022f5a910b7722b3f4edcb2801963df71428dc00c31d82cd49a898cb934e48d92f819d009e5f2f25cbd81bf2552d5175eb693ac89c6faf10e380d5b5b9f971f29e006911f25d1ba2abaf2e9bd1e3fa617e69dd6caeb35e0f2aab249582778d5d3d77dfb3cff684ea00bc416f49aa7883050d7b81f35ec238355cc1a9e3a973d3660440781e4aadcf379988d244f9207765ca2220a939baea92fc3282d0cdadcfc4617564b91849207a7494e8cc65baf35c22a4829e6bdf534921cea9bcf339f16810cf6fcf627466024fa3cbb47bafd214c2dcfa00a085d8cbdea1dea172278929658d70a03885cea1eff3ee581932e975b0ba239682217470a082c95cdb7d72f60a9ce7dabda59b3236f7b94bb275d22d4696a9cd952a8cccb7ed05a88ea2766af2eed4d2f8271b22b51de9481998e3a470df699ecfc296793d01ea5898814e7bc24e3d616ed7ed9627b8776300d39107b4e5705d3ccb312fdffaa69388fb26623c9af8110b1a7d46f09948f7c6beaf73163b20010428536f3e298183e628d05dcbb6b2e3003e502c25efa8549dec4241755407792f401b03fb1ce4b7f8d09ba11a2847a4a0d791bd3d5d286c90aec2f5715120ecbe2eb095927a62a047d53ee4a487d81aa4682103bbd389f66ee7b83a12e8f221e285f9c3554366e27dd5f240b00d3cd0e3d72e0100c2e12d20efae22c42165d774f999968e380671f135f91b60aa2b114ef79d0700e64410af8814d32bce45571611a8641c4ff38708f32e02daf6288de47e3e5799f214367a1e37dd48cf1e015147559a57d642a814cf23797c2c1565ae2b334484301d9fffcd2dea583b94748bd4d5b6aa0dfdfd47f1e5c06255e0f78ff0c02efaf7fc3cd1701f4f3e4d5e1593c85425dfcc2c87409fee311026d97f3029f42b8b207ebed55c044988945312922121d0f1dba991c6807a42ba97466494d1fbca2286fed8a26a4ef58e76c70af2a0024cd1c2dfafe9edec3ad535111761983f6cd6f1c40d18dada4c60268b36ecec9d7dd555b7337a424dcc7a9af73cdfb1bd834c27886002e53bbc72d0a6668bce7a2a439393becaf0a40fa838da7e10a5641e3b66f47c3cf4822bcfe33896e0a230cec5aa93375a90e025a29b9db7db7c23f817d7f47f36eb17e0dfc506c913cd4a1d0968a3966e03479d5ac96f56871ff9359e363e5bdb0e44e433afc2979722abd3c74d9ce91d62b338874016421a17171cbe6349a0631a2f2c571c1386120cbd780c00a07aef47eb022e1310464cbeeb1943c904461034445f0079b59941c693312d6589174023d7d697c605c1fa7fb75999794eaa7567982f382af4833fc601cbb4d92a87c3c8cc7b808687c2157ff702d62aca966e9950f265f546254fc5076d866885aa35e928960313199b753d08c35d7dba551fbc93c3108204267cfab5a8a030df81309e9655e4ba75474e2d7ba7777bf0245d9de62550c91598acd13af6989e074c417bd926b3980decff01b5ec925fa1021f12cb031e94cd803dc53f793b7eca6245292bc7ee0ca5eaa031ce5adffa85c4860c261bbec090e44020b6777d94b83f81d419a58e6ec1018f2439bcba1b5e3c712245eef6dc972c53c28b235cb1ea52a3912d0a228f9a08045064477a20372a99172533c14c14619d924932ff8661190543bdc07b15df63c4750b27614b0578d46e1e20122c3a8196d0365157877696ac5b27fa7529227473fff4fcc3b105fc07d317fab8de9c2b9a7995d6cf02a21b365cca71294f74764f33e0929df5275b064a32b12a5635abbca70e0aaf071f80e59a0f4e5a66f6a90868b4e83faf0971eb7f9414dcbbc577f7406a5d6a571bea1249c8bb5a71e08730dc3e11f86cab20172bc8395d4edeeac99c7f8b4259832b446cdf459e15c1ad31eb588b90c3dedd5780e59ea8947321a91a6c01ee73a950b52a0bce54993eb199b44ee1de6200e52413ffd998b6f5a1b3cfe2ff575d42b8dd6157e87a8484729877baa30b4121213dbb81fccf2958add55e6d6da01db6952dd0a48ffd30929b8186d7d7692dd23c274a27e1603dbd76967048d2650e3412eb97a69560287e54a8bdecf4c49127e9a0cb878f0698bf34812177f0fd743bf543e2e5460dd924e8da7582d99fc348b24f7aabcafadee8b63ce2651e08170c677ede20ca872018202b63f09783fda184e87dc937794efa267f0a3479c15a26cd4ab7fb14ab548deae7ee43307834fd8a73734c3eb0a097304c3839c47a7e06d1194fc1cb5c76da5417c26fdd08fcaea2d7e82fffc7a24c3e97f793f8bc60450f7bedd6ca592ddbb15f24c1d37deea806ee9b5f6c977a21db82c4aae77fe5ae52610d4aa371a693e4a369bc854f085f61cb9864768d3814b237d7e0f611c5b3765a698370097503f8df93a94d6835d23c9143fc63408e24d2cc47fe457c215d641040ffa640314f4c9ac02d02fdc34aa54531769d620744d21723e139a6bee3cb7addc5ba1e90a0b384e578e211349ec50c6916b682224ab27b23a8726ff0ec5e05fd3b26e0da42bd2b4819d6691d9fe0d59cfe32f6b1a1bef051c5481efa845de010784e509bc36e1663f6f82ac7462ea052a2a3f3478018548db502332a4023d74de4657e3516e6643cdac7c991c90d2b4c00fc21821286fb25cd0ee4188d844ce7368a66be5b44a74cefc397b5e2308f0002a3762e95d2f1b9822c2a99c8ca50b756a9de77f152b7c0e6a3442b05c58e294697e250815d8122f50eded23", 0x1000}, {&(0x7f0000001180)="aee028c4ed546ad806381b9f0930af73ff82c047ca6bd033ba597c101869766ad12410c8f3fbe870b29dcb78d068188001a985d35d2f31c8dbf8450307c18169d19e121f679ed49d1d6ec8ad7d021870cca94d3673e7611f25318ffd7d9bca5b0f913e714cdcc39530b1190423d03982ddeab64ae40d92d742a7ee4ad308b787c225e5b65065a6cdd4689e946d4351977af7ee71fd0449f8e64f46c56bc9a118598b07d28206a8de76744d58bdc8f9e8318df4466eb53c8d95ad2eec60947db4c16882c49a23dfafbbd410c95ad6602161ebfd950e4ca5edbb6a12dce832ce87a14ae0804098db134f9f", 0xffffff99}, {&(0x7f0000001280)="44c3d9ce6075a75a84d9ae18551114b0c1f155ff4930ecca4a92ff1000e0b8d851b8bfe9aa5b4d88d7d4e31892fe20f001ef8de0a5159e02df5e1c51f237679187532b609a9bb3e6ac28331e2a9b265ef778ec2b39c3ef12a866cc9030e8cbfa247b07b13972936a8b1c53ac7e8a24e4e2a8b1a8cc409e7501e09cb3fbb5ed2147b0", 0x82}, {&(0x7f0000001340)}], 0x5) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000006080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010027bd700001dcdf250c00460008000300", @ANYRES32=r4, @ANYBLOB="0500080003000000"], 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x10000002) ioctl$FS_IOC_RESVSP(r1, 0x40305839, &(0x7f0000000000)={0x0, 0x2, 0xefff, 0xfa64}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r0, 0xa4717000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="050001000000000000004400000008000300", @ANYRES32=r7, @ANYBLOB="0c0023800500070001000000"], 0x28}}, 0x0) r8 = fsopen(&(0x7f0000000280)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) r9 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r9, 0x40086602, &(0x7f00000002c0)=0x20) r10 = socket$kcm(0x10, 0x2, 0x0) r11 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r11, &(0x7f0000000080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) connect$bt_l2cap(r11, &(0x7f0000000140)={0x1f, 0x7, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmsg$kcm(r10, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000980)="d8000000180081054e81f782db44b904021d005c06007c09e8fed9e40a00154002001426c1e1b8c708000b0000000401a80016000800024009001100036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee7a7cef4090000001fb791643a5ee4ce1b14d6d93059dac7149393cccfbd6761e627d4c12cdfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a502504000000fa09d5e14ace69ed0bffece0b42a9ecbee5d81320344d2f16af094531c7fe95aa049a240db2d68a5b23564b8808b", 0xd8}], 0x1}, 0x400a044) r12 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r12, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r12, &(0x7f0000000000)={0xa, 0x4e21, 0x1, @mcast1, 0x2}, 0x1c) 2m27.714300055s ago: executing program 1 (id=255): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f00000001c0)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x8, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f00000003c0)={"22ec5e2bec4a375c522af64f229809cb0c4a1efb0ea2a18dd2a700e7c88914defdcdc1b95a0a4c3eb8b8f860a0f29f12dadcf8b2346a22eafbb58943fcca0aa4757d1729e9231e046b1d6dfb4e6375aa0371dad7061c91b7bc00cb7b1ed285c214034e2f3d87a3dbb6979a2093955b42cf8797a8addc0243423357025798290f38a92296dff9a354bdc29ba5e039bca5b57b14619ef3da2c6ec1d11ef1e24baa4e2f4eb9fdb01d81cf64cdbdae2bbcca3fae284bc0c44dc906c7653c6014755dcef6e1c63f4ce787c6837463ed5b8b4382aec6617799c5a63cee9e0224491b4ab88149874226fcea675302a54649199e26735fa247c217cb5ebaae9d83057739530858913c2b039a4940809b22e35d7b58297da1ae76a7a982c1254f2421c1117e267a322923786db801aeb1059e8017f4d9c72e3dbb7d4885cb9581832add7ece558769892065a0ee99307534bbf997f520c45d73fe8e18497d81899b14f56589f71aae91b93b5b65a98a79f26efbd1eef1d5397c812a0c30364705bbd1c9926338b4c093b6f4c307a141965f8a53ec96a4a5082d2b8c6360a42185fc7422522518e75b88994b77b4603f419b25fa3d48cad0e8fb223b6466debffd1d1e8217873e941f0f8a522b2ce17dfab187590e3a592d44fdb60b35e2e74f5b79707ad1787f93baf197eaabb222ff1e4970cbc0811cab29fd91b4562135ccc9579e00802384b6199d3e761026063c6d293b87253fa89a983e6ea8ccd225d3eda481d0b214c72b12f83ef224defe7ac1e64eb11517a333f9598569c93812e60d882f2b5abd74f539e6995abf0b9c1ea5b10f5b53ddce5407767300ee257360ed94dfec1b83534bb1a8aa5ae1423fcda322a5df02afa8f3285033470e0265915202064cf99eafaa2f43c9c0e2c52896e7f85be4a36f5cebe92ab6a1f07891e43d616a2fc969adce8e2c4b30f781cea070e8721f25c3ffefee781a5107787fdc5e1420e70f4197f90e6f9efdf1fc01fe53937961529f1ee641fb12ce945f84e4d493da9692b75cf00d3da10bc8f87e8c2f9435152f4c8ce132aecbc3586d8441f101941b1af0cfd6a8d91b1384bbeef27af413693f2f4ccf77ddeb087cd88c429c819f98551c206edae526f56e504688c1492fc45361db28a2acbde52f137d019e0b01996a97602a751f5670d11c3bb72d56a2ce52cd1c173dfcfe64b97ab939a1aa2848af5c366091327a0d492fa60e83d0f25b454401f4fa284f54dda3688ff1c5e3b75d282adb1c4cc9a0ff0fb11696f0831d41d365dee8ebc11146ae5ba91a12d5dab2f8f6c5750a90568f89a80719f95a0224ea2e0b418cbb64797402573b84ded7a91ddead81a7b376b7b102f9cecc10f2d60017d0768f99ab2e274406ba255d0cc58b54de7af7f0d5d536a01b445fe6c62d375d651d38c9046c6c1a0388a4b7883a"}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e21, @empty}}, 0xc, 0x6}, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x36, 0x790, 0x80000000002, 0x180, 0x400000004, 0xffffffffffffffff, 0xf1, 0x3, 0xfffffffffffffd7e, 0x45, 0x0, 0x3b9, 0xfffffffffffffffe, 0x0, 0x0, 0x8], 0x8000000, 0x3c4210}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r0, 0xa4717000) 2m12.708533685s ago: executing program 32 (id=255): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f00000001c0)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b000ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x3a}], 0x1, 0x8, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f00000003c0)={"22ec5e2bec4a375c522af64f229809cb0c4a1efb0ea2a18dd2a700e7c88914defdcdc1b95a0a4c3eb8b8f860a0f29f12dadcf8b2346a22eafbb58943fcca0aa4757d1729e9231e046b1d6dfb4e6375aa0371dad7061c91b7bc00cb7b1ed285c214034e2f3d87a3dbb6979a2093955b42cf8797a8addc0243423357025798290f38a92296dff9a354bdc29ba5e039bca5b57b14619ef3da2c6ec1d11ef1e24baa4e2f4eb9fdb01d81cf64cdbdae2bbcca3fae284bc0c44dc906c7653c6014755dcef6e1c63f4ce787c6837463ed5b8b4382aec6617799c5a63cee9e0224491b4ab88149874226fcea675302a54649199e26735fa247c217cb5ebaae9d83057739530858913c2b039a4940809b22e35d7b58297da1ae76a7a982c1254f2421c1117e267a322923786db801aeb1059e8017f4d9c72e3dbb7d4885cb9581832add7ece558769892065a0ee99307534bbf997f520c45d73fe8e18497d81899b14f56589f71aae91b93b5b65a98a79f26efbd1eef1d5397c812a0c30364705bbd1c9926338b4c093b6f4c307a141965f8a53ec96a4a5082d2b8c6360a42185fc7422522518e75b88994b77b4603f419b25fa3d48cad0e8fb223b6466debffd1d1e8217873e941f0f8a522b2ce17dfab187590e3a592d44fdb60b35e2e74f5b79707ad1787f93baf197eaabb222ff1e4970cbc0811cab29fd91b4562135ccc9579e00802384b6199d3e761026063c6d293b87253fa89a983e6ea8ccd225d3eda481d0b214c72b12f83ef224defe7ac1e64eb11517a333f9598569c93812e60d882f2b5abd74f539e6995abf0b9c1ea5b10f5b53ddce5407767300ee257360ed94dfec1b83534bb1a8aa5ae1423fcda322a5df02afa8f3285033470e0265915202064cf99eafaa2f43c9c0e2c52896e7f85be4a36f5cebe92ab6a1f07891e43d616a2fc969adce8e2c4b30f781cea070e8721f25c3ffefee781a5107787fdc5e1420e70f4197f90e6f9efdf1fc01fe53937961529f1ee641fb12ce945f84e4d493da9692b75cf00d3da10bc8f87e8c2f9435152f4c8ce132aecbc3586d8441f101941b1af0cfd6a8d91b1384bbeef27af413693f2f4ccf77ddeb087cd88c429c819f98551c206edae526f56e504688c1492fc45361db28a2acbde52f137d019e0b01996a97602a751f5670d11c3bb72d56a2ce52cd1c173dfcfe64b97ab939a1aa2848af5c366091327a0d492fa60e83d0f25b454401f4fa284f54dda3688ff1c5e3b75d282adb1c4cc9a0ff0fb11696f0831d41d365dee8ebc11146ae5ba91a12d5dab2f8f6c5750a90568f89a80719f95a0224ea2e0b418cbb64797402573b84ded7a91ddead81a7b376b7b102f9cecc10f2d60017d0768f99ab2e274406ba255d0cc58b54de7af7f0d5d536a01b445fe6c62d375d651d38c9046c6c1a0388a4b7883a"}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e21, @empty}}, 0xc, 0x6}, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x36, 0x790, 0x80000000002, 0x180, 0x400000004, 0xffffffffffffffff, 0xf1, 0x3, 0xfffffffffffffd7e, 0x45, 0x0, 0x3b9, 0xfffffffffffffffe, 0x0, 0x0, 0x8], 0x8000000, 0x3c4210}) ioctl$KVM_RUN(r3, 0xae80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r0, 0xa4717000) 1m6.566119418s ago: executing program 0 (id=868): fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000200)='fuseblk\x00', 0x0) (async) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x1b, 0x0, &(0x7f0000000180)) (async) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x165342, 0x0) (async) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f0000000140)={0x3e, 0x2, {0x5, @struct={0x80000000, 0x100}, 0x0, 0x1, 0x8000000000000001, 0x100000000000000, 0x3, 0x401, 0x2, @usage=0xfffffffffffffffc, 0xfffffff8, 0x6, [0x5, 0x8, 0x7, 0x1, 0x3, 0x7fffffffffffffff]}, {0x0, @struct={0x9, 0x5}, 0x0, 0x2, 0x10, 0x7, 0xba, 0x1, 0x0, @usage=0x4, 0x4, 0x6, [0x80000000, 0x5, 0x100000001, 0x66, 0xc, 0x4]}, {0x800, @struct={0x401, 0x8}, 0x0, 0x101, 0x7, 0x76c0, 0x7, 0x3, 0x8, @struct={0x2, 0x1ff}, 0x1, 0x800, [0x1ff, 0x8001, 0x7ff, 0xfff, 0x8, 0x5]}, {0x3, 0xb1d6, 0x2c68}}) (async) r3 = socket(0x10, 0x3, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x10) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) (async) chdir(&(0x7f00000000c0)='./bus\x00') chdir(&(0x7f0000000540)='./cgroup\x00') (async) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffed3) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) read$FUSE(r4, 0x0, 0x0) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000e00)=ANY=[@ANYBLOB="12011001c5a6db4063070131a47f010203010902920001028f00060904020a00ff381e7f"], 0x0) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) (async) ioctl$COMEDI_BUFCONFIG(r5, 0x8020640d, &(0x7f0000000180)={0x9a, 0x6, 0x5ae6fefe, 0xf}) (async) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109005000118049002100c9a7befe6f6d645a1a11b81b2c4b101c7510e19feecb90ee6bb49f6cc7a2c50fd57c06db1a75df432aa833928a0772ff8f5e9ed32d3b477d35b296674f1fe35663c0d236fd000000200106"], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x0) (async) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000001440), r1) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r3, &(0x7f0000001540)={&(0x7f0000001400), 0xc, &(0x7f0000001500)={&(0x7f0000001480)={0x50, r6, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x10}, 0x400c000) (async) write(r2, &(0x7f0000000400)="547bbee68789313efe846d6698abfeac0d12b144933fa6f684f1ba13b34680bf4b9ea70f71faa2a82a45ab47458c1f827355ad34033fbb8b9699eb0b279252dfcf29e377e14dcfbde42857cbf2aa88d3dad8ec2deea7afe4e747fa392fe01d425970fb2dd7a000ea3889f0d9021f347818106963e18c256e3df26b41c61d30284a8ad61c6269756119d62e3a7a24c1dcd09d3eb35dfee6ec945ac190c4797988e0d7f6f38bf9b124431dd8208a9208195a70c8e558c216e78d5f5b3f6df6f155e16bf7dd8f4e9eaf61d5142a82da7a87aeca19c25b631cd8a14ce9f2fc8dbcd05f51dc9260abc82d780c9358bd6411ebf48520694d413024432d0bfc3759a620289c9c8705009fd829da6eb5b72b454436b0af8e9dc4941ca2cff92561cad984e15849dcd73f04c7f70a30304da2fbc17f421767ad5ce47ed79d6698428eada9a39faa02f978699bc8c482224a2d5f85cc1135ea92ac1c610e32f1e7c82da6d91e0c8634da679760c32c3e891db352b76b61a65bbdd023e093a8e0d37fd8cd00679cb1bceaac84b05861740c221b2cb4afa1ce8b091c815fc4bd83995b5bf5dcdf2912572cf6180ec27445404917ff9e8e6604e2afc19a1bb3745914f0a101e03e44ea5f64d40402f12a81310c97086fb01d04e82799c40f29348eb283ad58a40d608a47fbf9a25dbb308aa03b2425ffa896e1a70a37cf49e6dbdeda39ee88aadb26811eba78a0dfe5400a51428c31582edcc5f75b5dd963707a54b9b1e35f9966995d6474acbf7094124cecf38369aba3f6a5e3ad071f5e3df902843a3947623fe01571d97625c3e27721b08a6f85fd7b879acd400de5beabdd2603d566fdb4018bf8bd74c3ea1ae67c988992c7dab4ebcf501a73815e1b527d3ff1cf9e729d55127118565f794d253fef25609e5a415615d1b5fca5381b49446d9b9e75fbfcdd9218b0d8d8d965871b897544e32fd0b4cb5600ffdcdb0056bcad75216759590f8a94db82b0acd2a5a34e5c34241a19f1a7a7cceb894341f55c6b474f3cc052f9863a67519dfadee6576f08d7448929424c13e845e2e636b87dc14e1ab4ad05d69f896ca1bc5c1267befb686c4207e21aa30bdae1d1602d3e4080784834e213c426ba5446f90d3b3885a5d6942c6b0e637f5bb9c7908460bd7d04497ab054c8fc7f89068f7535976ad051bfe94c243ce7604a63b2099b69f1ed73590a318fad9a170fa0cddfe60e981a92de2e1aab3465b11a968108e08deadfa1fa546c4cbc0c34ac28597848562583ae8d93cb60f2e06c7a1f743add51eb8cd732b40d48fde00117cb2d654100dfcc66b7c9fefac80e137caa5cf43ae897780251a3ebbc4ddd3b003168963c9e2c9446cb29731fc4bbb5e551aca6913f7b8576ce34012581b5a363917970399ca369688e637cf06ff3c8114383d2fcbf9c69f1ca63cd21695254a440df5ef0a8abfdbd0a651a533b6cdb82382e3bd70f87c1d3eb0a6e22452605026fafe6d35158c0728c1050a39330c80ee2ee0b09366fc6382883ecd0796feec657b36aee4091471e406e9faffd5ede27943e5fbf1b7249ab8bad71f60063697f04db52e980a9fb3eb5e53b89be8a5f0e6afea7435789ecd444c28eb411cdc2158e434178749f36cc957dbd17efb2b218592f78d6864f2708e8c6db2da0d3f6de53959afec0c90d3d62a13a0bc3857bce58d81223eddd05cf3c1ec6b3fc5307d0f16d470f2065300295197e9fa81d2e5574b2c7b18f1c6c85156a9b1174d62dcd3cb026f4b67e6babd66c8f427b9687585f37b18c82e0100507035e78ce010b78ea1b5d3884db25df36ae929dd535a854a31cba5e47655873df72be7463c600b704e9da0e7cb2d61d0710248814ecced2eef8f227c8aec308c2c9d0a39d1a6b306080e8eaef8edece0f6d0d1612c582d70c3999a1a6bd529538f51ba4869ce74bc8509a7126d96db118cdb55411a36f4361d53c8027c12a7486e9c84e4de445b454630be27bdc2ec268702d9c1890297bdd1fc7a235f1a47f4645d286146f3cb9a7ce650f4157a1e7f134eb1815001d59905d3103efad3c66479330e8a5da941c9c38bf21bc0770e3fd56cafa19ad6e9d51f94ed4f900062b5602653aacdcc956aeecfb1dd613caf918e1ca8ef2e1504c42768e77df43569d5fe4b48c237cad5285c578b26b4e47c8ce06fd2686e17eb6d5df5645d0fdde7782216be07a1135dabc3a59598bdbab249c5391832f18ac5163aa7a1a890128a4520835a53eb750604c5e328ecb3216516b3eba3f97652caeb4327da8865880a932dc8e7668666ac3b76a2a424ca37b5dfb52495710611e20790427a9f9e7ac59bb86f0fb7a17a5def347a98dd8e733b784d78d5c7f16f327a2606d4252411457465540a60b0757802f470d08337c0fe4eee5f5cfe4f296d0f7068e80828a022c95632beb7b7f802135e246b1adebebf24c821dee7205e9fe1a437b16aaa8dcb4a58b0bdbc8dbc2fce09271c27430cc9ca8141955ec5ff4228627c3816cfe1bb2c0f40f6a61e8bfa4e2dd744e41ed80b83e9aef77119f4b062b98e86690711e83e795bafa7a8db16f241cee76aa01ff749100c113fda966aa8c83ebe975f760c18e3864065a5de6e8028a9e3199f4acff11e14bb13bc50faf97fdeab46edc371e55cab78841a2de17ca116b0183ac38b658c57a64ab11bb0de071c971a7a5175ad0bac6ac1d1118230a5412a35bd005b369df0e04e749ea93d7e56f713b9ceff580547a2a76ea4753a78b4a5cd0311024c5536b536c8ede63bac8e8b4c5851248d9098a7c6bcc3d5f209178b45aef3c1afa4ab73d8feac3e1f771626d73d85f72dc15d16bd3b7b93e622626f6f3d96b4425d328236cf1579f1ca834a7b318b012e27b9a2dc528189cf1eb3705d90de50ce7ac0c256b7e41500113e164fb7d53c74c6f829552a5bce73eeab9a46d01551bdab18fd3a7e82b036872f1e876b12c5676f63a6ef0c6ff159788a0c2fc40f179a259c656e8aba9295e90027e74ef910ce3c56d6e2de917947410b05603b6a5052453f13e6ac058b3f621573bfe6224bad8c3a5f575e1eb774839cb554c53c9b3ad623df6c5c9627cce856f9ba5847557bc9f854cbb37a936f20a733ba352ee5b343b941290a399fb862434d1b551da420053cad3bad65195cde40b345740e30e9a22619add8aedb763473b729c0649f7a1ea45325534c9b629a1fe3a54a78fe44969715182c6df5c9ecf6878380831b2996579332ac37286e72ab16824c3fc9ef8d74a7f1f5cf80fa37f6bb990db3a7a70139887a4eba0763247c58f4fe770a0496a5ef49a3ba4d62bb900644d49b5fba7e58d58af6ae50c96da346618434ed46b8f4c27cde5e8863d5b090dc117f3b16db2c4273fa84f8b06d3df436bf4a8cfa6d33d7f0e78ef422d5d7640c821398c9adf4d6ccb1b2f7cd0e497023cfdd6b5bb9ad6a29edb8b78fb3322414cad1458eb12699853acb165076db7088f518386380850c111cbe74034ddbfe217db714325ebc4d6b46eba640cf125b87eed0832077ab775e475e431079756b3da6f9bb3c861ce7eabf6adf70b76eb9642a1bab3d7afef2d7b40c8a19b98123ad7449c1039c494e73bc91a86e8e92c39a9482cf60605b9e5c209262c4fcfde76ee370bd6a78253b64c5cbb19a11b34c5a9ccf634c52751277268cd97e795b43867af5a4db51bd631ac547906fd52aff43eb98edacecf08f94a060902b5cb82e87ec856305005bd1150e581d9717460e31ba724da5e7ad72fa580f8509fe838dbc1bfbbf53e29688f25ca602d2de702e4411d3d133e2ab2f454f71f98efc2cd0eb468544cacf608c6689ef122009cf61e813e26b7b2b1695143fcd510f509ec2bf7205e674ba6767eaa29605c51e434c298bde0969617292e960d22b085632d241aa2a8e0f6ac6f2d56d0ed2c6bd3eca306a3224915065894480e737c7d7a11901bb7f977525cfcab652476baab0fd3b68dc59fd14ccdd6248bd5c5a0ab1dbae28a848b2d4ad0d973bb149ff4115b0436b7d145a6f8081d314039131f60dc8ed0ccf2c4971f0a59a65b3b1ef638e6d009dff793a4b7266c58f88bb117d665cae8fc6f6c2840470333bdbc8df12c6633a6ac7b664e089a85dc6d49f52459dd2df1be552194eef6027c1b45f62b97647788c3325f05609c1e02cbc9a18be72e4b502df719e4f9cb82615e3a03b5732328e552023dbfdcf91ed5ab51242e7d09a9b73674f0946976d8a8fa9288dce4d54d5820a0f0053b892685f79a6c8dbac724fce4d24a7b75e383f54ac58af3951d666a22f158637acc4f0e09e248e85f8e1439501afc0d5b7e9eab40fa737ae93482a1e29f3e327fa31d0d764c65ab976af1eb91fe08c5bc10a48b93453ad192d1d538cf93b792a70246bde99f46a78b670edea552840e08c787c928ee311f954b73d07287a59b470e38d4e624ddba8e4b21a74d7c07cc684b0ea82212129901029e74312866722dfa2dc53de3e8ddc00adc21deb7510ed15c50d139296297408da3d6beb589e7bb3f1d74e4e8dddec14b9cdf371d7f142136cdca5644d09edd97228a0abcd2e7b402c5cc68683cb980f50ca7aea8338dc5990a6ebb2d2b95a3deecc45f5a4f4e0e40a57e29f3e227c41db00e17dc962e2ea3184b5057c89974bcab651a22e588a527d7d8ec695e7ab5622c1ad3763d045a8393b7acfa04488556ac957777d1aebfc5d0e2a8150a6984d5607ac2400789d8f622c837d6a9b78fcc2d8aa872949edde53e3a99b5f5bf35bff5f0db7874ad3f172f9d8dd6cbb17a770b1482c79b9a15605cd0d89c6bae9aa6db8e886cfff8f843b99df95dde88c96202ae6ced4d539a3f70997ee7b2bdb7bbe529f9bc55b143066de8d9dcd7fa38c54094f2235e4a17ef8e910b4d48c373ce5e6fc9824ca8f115e579b002df16c591557cd6cac1363b8d8fc656075ca703a87f1efa76e4122eb7358389f659681fb49cb82215f73b284a7678b8b1528472d0cfab1980ee3d4410bdc1c31f1f798c3ca5744077e2f6cb4ca6e415f1e3afc8c00dd95d3307de5428883513f01ed19dde487e1c103619fd78583f09d02982512e0ee20a670b3b24986dcb7431f1ef3fd12e801bb2454213ff7b1962a464647eb4c8125cf2ed098160da880024a98add9b2917e133dcee7a8e25387fd5bf2b3f8fb05b2f7ed5f719b30b9cca4b1754e31d48bd2ec79e7e9c155130ea5f0876f3bb4d94ac74b209633ecb03deb8b9448e8cf4b4bcb04ffdb38ac457881f84636246a4e5e7773166129fb8b7803c6dde0ee69fd1f76f1d93b729eacc9d8dbd6e61e638a3f8de972a824936b1d869a15daaa21db04760e9110c5b7c736671d31a72fcd57a6f7424c898791cafa21a48921215a78d60a367aa7c6284a1aaa1fee0c5291bdc91bf8c032c9917fd28e68fc046ea4b17952f1abbe01af5f19e4fa99fc6a985f6264f9efbb208e6146d3465cc603ef36d3d59b5197bca1696bf5658b60cf0e0455cb1e174e52c4acb712a3ed9202a1ae334427b93305939c7f15e9e5eed09b5fc8d1e3836720d46d133841d4482ec2427d3002d95bce996b4b2d5b59b2a43970afe35517674bfdd8807931697422045f60641138fefa27865b9d477ef04847dd02d305e8f15e228522e54d1ffda6d5b26ad831146c66e6f9153ebeb0785ea75283df66816d771c7e4297c1686d06494a59046313169f2e2b4988a2758198fcb166d9d112d187a4456503e6c0bdfb390c89dcebf3cb8260a27fdebddbc6071857010ad4c59c062db35a4", 0x1f000) 1m6.564036536s ago: executing program 0 (id=869): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x8d, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f0000000080)={{0x5, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf411119ed8bebbb9, 0x20011, r0, 0x52fbf000) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r4, 0x4018aee2, &(0x7f0000001280)=@attr_pmu_filter={0x0, 0x1, 0x1, 0x0}) 1m6.51595364s ago: executing program 0 (id=870): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000140)=ANY=[@ANYBLOB="0100000000000000010001c0"]) 1m6.440139119s ago: executing program 0 (id=871): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x118}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x260) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) setitimer(0x2, &(0x7f00000000c0)={{0x0, 0xea60}, {0xffffffff}}, 0x0) ioctl$FS_IOC_GETFSLABEL(r1, 0x400452c8, &(0x7f0000000100)) close(r1) listen(r0, 0x200) listen(r0, 0x18002) mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x208002, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/65, 0x328000, 0x800}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) r5 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) syz_clone3(&(0x7f0000000340)={0x200000000, 0x0, 0x0, 0x0, {0x3a}, 0x0, 0x0, 0x0, 0x0, 0x0, {r6}}, 0x58) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) accept4(r3, 0x0, 0x0, 0x800) 1m6.331147105s ago: executing program 0 (id=873): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x149342, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000a, 0x28011, r0, 0xffffe000) r1 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$KDFONTOP_GET(r1, 0x4b72, &(0x7f00000012c0)={0x1, 0x0, 0x1d, 0x16, 0x400084, &(0x7f0000000ec0)}) 1m5.885468527s ago: executing program 0 (id=878): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000080), 0x8) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) (async) socket$inet(0x2, 0x3, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)=0x20) (async) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x2c2810, r2, 0xee59f000) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) 1m5.724642287s ago: executing program 33 (id=878): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000080), 0x8) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) (async) socket$inet(0x2, 0x3, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)=0x20) (async) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, 0x0) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x2c2810, r2, 0xee59f000) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) 5.509162373s ago: executing program 5 (id=1498): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r1, 0x114, 0xa, 0x0, 0x0) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) futex(&(0x7f0000004000)=0x2, 0x8d, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r0, 0xa4717000) 4.966354949s ago: executing program 5 (id=1503): syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="120100002eab5a40401c3405cc6d010203010902120001000000000904"], 0x0) (async) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="120100002eab5a40401c3405cc6d010203010902120001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000780)={0x40, 0x6, 0x6, "1b56b2fccab4"}, &(0x7f0000000880)={0x0, 0xa, 0x1, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x59327139ae2673af, 0x12, r1, 0x57789000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x59327139ae2673af, 0x12, r1, 0x57789000) syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_mr_vif\x00') madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 4.449876633s ago: executing program 2 (id=1511): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x12, r0, 0x57789000) r1 = syz_open_dev$video(&(0x7f00000010c0), 0x8, 0x0) ioctl$VIDIOC_S_AUDIO(r1, 0x40345622, &(0x7f0000000000)={0x1, "4736648697e632757ef4a32c7442e822e9229dde4fd508f890e42396416578e3", 0x3, 0x1}) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) r2 = socket$kcm(0x10, 0x2, 0x4) close(r2) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000380)="5c00000013006bcc9e3be35c8617aa31076b876c1d0000007ea60864160af36514000cc008001f0007000700060001c00207a2e31f3b67e54f251e618294ff4051f60a84c9f4d4938037e786a6d00010000400000000000000c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40040c4) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 4.373049818s ago: executing program 2 (id=1512): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000040)={0x28, 0x2, r2, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r2, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f0000000100)={0x28, 0x1, 0x0, r2, 0x0, 0x0, 0xdead, 0x4, &(0x7f00000000c0)}) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x3000005, 0x2776419a468a50f1, r3, 0xfd1de000) ioctl$TIOCL_UNBLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) 4.29445483s ago: executing program 2 (id=1513): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0x8ee4a000) memfd_create(&(0x7f0000000000)='\xfb\"a&\x8fe\x11\x8c\xd64\xf9 \x00\x00\x00\x00\x00\x12\x1a\'<\xf5\xbeV\x12\xaal\xfa\xf0o\xd8\xb1,\xbd>M\xe3\x98?\xd9\x96\xab\xc7\x06F\x9b\xab\xc8\x1e\x89]\x13bZ\x8d /#k\x95\x9eLV(\x8a\x0e\x93\x93Vc]mP\xbativ\xce\xa4K\xfb\xf2\xe0\xbf\x9d\xa1\xa2\xcd\xb39\xb4\x17a9\x1c\x82\x1aLTM\xac\xe2M\xd6\xe2\x18\xaf\x91X\x8c\x87\xc2\xa1\x1b\xfe\xe7\xbc\xf7\xeb\xdeL\x1d\x98Zq\xcc%\x98\xb0Yc\xec\xb7\xb5m(9\xde\xd3\xefB\xd4\xee\xb5\xee\xe0\xaa\xdd\x00\xb1jOB\xdas\xe3\xb47}%)\xb9\xbf{\xce\x94^\xec\xdf\xbcW\xe0I\x0e\xa4\x1e}\x06\vK\xed\x11\x880\x0e\x9c\xaeVU\x88\xb0\x842kgA]\x1e\x88\xecif\xee\xba\x8b\xc6\"\xcej\x84\x06\x8a\x99\x80\xd7\xcf\x96\xed\x89\x1e6\x93+\xec#\x1d2\xb8\x80Z\xf7\x06\xbe\xc9[L\xc5\xc9\xb5\xd6{\xee\xce\x17\x89\xa6r\xc5j\xec\x1b\xaa\x996\x14e\xcf\x8axQ\x8fXeT\'0.\x85\xa2\xc8\xb3c\t\xe8\x1a\x89\xecL\xcf\xd8\xb5\xfb\xbc\tX\x88\xbe\xf4@[\xb2\xd5\x8c\xb9\x0e\x17\x8b\xce\xd09\xd2\xfb\x9e\xef\xabR\x88\x17\x9et\xf7\x9c\x01\x91\xacH\xdb\xf9\xcb\x7fh\x83>\x8e\xe1=\xedR\xc9\xe68h\x19\xafLD\x94\x93\xebT\x15\x817\x9d#\xea\xd2\xa8\xfb^\x8c\x87#\x10', 0x7) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r2, 0x0, 0xffffffdb) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cgroup.events\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000240)={0xffffffffffffffff}, 0x111, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r5, &(0x7f00000002c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000200), r6}}, 0x18) madvise(&(0x7f0000127000/0x2000)=nil, 0x2000, 0x15) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) 3.467204847s ago: executing program 2 (id=1522): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x206642, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x8c2770cd7d158fc7, 0x0) sendfile(r1, r0, 0x0, 0x7fffefff) fadvise64(r0, 0x9, 0x9, 0x2) r2 = socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r2) sendmsg$netlink(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) recvmmsg(r2, &(0x7f00000077c0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002040)=""/4096, 0x1000}], 0x0, 0x0, 0xfffffe2a}}, {{0x0, 0x0, 0x0}}], 0x400000000000059, 0x2040, 0x0) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x1, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e24, 0x7ff, @ipv4={'\x00', '\xff\xff', @remote}, 0x8}, 0x1c) write(r3, 0x0, 0x0) sendfile(r0, r0, 0x0, 0x7ffff000) 3.439609883s ago: executing program 2 (id=1523): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x8800, 0x0) ioctl$SIOCX25SSUBSCRIP(0xffffffffffffffff, 0x89e1, &(0x7f0000000300)={'ip6gretap0\x00', 0x7fff, 0x4}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) preadv(0xffffffffffffffff, &(0x7f0000000440)=[{0x0}], 0x1, 0x4, 0x80000000) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000400)={0xf0f014, 0x105}) ptrace(0x10, r1) ptrace$poke(0x5, r1, &(0x7f0000000080), 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r0, 0xa471a000) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000080)={0xf0f003}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) syz_genetlink_get_family_id$batadv(&(0x7f0000000100), 0xffffffffffffffff) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000001c0)={'erspan0\x00', 0x0}) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) r6 = syz_open_dev$vim2m(0x0, 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_QBUF(r6, 0xc058560f, 0x0) syz_genetlink_get_family_id$netlbl_cipso(0x0, 0xffffffffffffffff) r7 = syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000402609333300000000000109022d000100000000090400000503000200092100003301220500090581"], 0x0) syz_usb_control_io(r7, 0x0, 0x0) syz_usb_control_io(r7, &(0x7f0000000240)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="400e135238493b1060d4115e4a6b0869aadbb816a4f923936b455bd612c103dd044a0c063c8d4fc8510b4a6ea2bd44f8bf13abc3"], 0x0, 0x0, 0x0, 0x0}, 0x0) r8 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) ioctl$EVIOCGKEYCODE_V2(r8, 0x80284504, &(0x7f0000000040)=""/95) syz_genetlink_get_family_id$netlbl_calipso(0x0, 0xffffffffffffffff) sendto$packet(r4, &(0x7f00000000c0)="3f031c00eee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.903355548s ago: executing program 5 (id=1532): r0 = openat$binfmt_register(0xffffff9c, &(0x7f0000000000), 0x1, 0x0) pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)="02a4645605d0d06e886e277662695d728d77b39c11dfd2f93d71436f40821414082a0edf79f5e19b46819ca4a2572bf40853430dbf9942844c7aa49bf0a0dbfca693d0ebbebaae5ff0df8b01a36630034471a6f8ff4a8005cf399adfb40b8c70ebe9fdbe8111259541dc47449ba15255cf134110c9716d996f3ce79defe5ad5100", 0x81}], 0x1, 0x2, 0x0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0xac) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCCBRK(r3, 0x5428) sendmmsg$inet6(r2, &(0x7f0000000800)=[{{&(0x7f0000000240)={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x14}, 0x6}, 0x1c, &(0x7f0000000680)}}, {{&(0x7f0000000000)={0xa, 0x4e22, 0x3ff, @private0={0xfc, 0x0, '\x00', 0x1}, 0x414}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000300)="6065a050913692ddf3cd889bef491cb263f56207c9a4dffa000000000000025aedc6fbc52519c4a75a94ddbf4f777a694e56924ed37316da03b5b35e1d033e7115733c045ce80b59c6846e4a207056ce952249a14a5751837b312e42b6a113e79bdb63f244ee2011bdf63d28c894c55acecaa0fd67ba9d9cb2254969d1296cc2b2ea2c06132fdce3b754e369e96d0ff91dbbe1f5254da02ea2645c609c5197e4871bd734a5e3a0572835a1f59ff86c5c2bea2f03e5739cba0bacf749ac31634e45677d87b07347c2ce19951e783dd2986970124403319bc7da9daaec4664b21822d7920000005e50bd5fbac9fb29d5c58739ee82a28c6fb0c3aa11f0bf35d5b6666c733ad609ce68d39ab64263507c9a2eca198b15f55df4f9f621f9ef3e495cd69871183fa5297340b68a940000000000000000000000000000000000000000000000004757283288f23025fd42ba00861fb3258e8da8b8c86b3401ff93a9058d6208a06c714da91f00e4b9b7d02a3d28a54da103285775127be765b1a948", 0x17f}], 0x1}}], 0x2, 0x4000840) setsockopt(r1, 0x4, 0x7fff, &(0x7f0000000100)="020000000980ffff", 0x8) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000994bd740f60d5600b5a0000000010902120001000000000904"], 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r1) sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f00000002c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000280)={&(0x7f0000000480)={0x1c4, r4, 0x10, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0xcc, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x700c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x309}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x626}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff000}]}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x101}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xa}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7b}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xc500}]}, @TIPC_NLA_BEARER={0x1c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'team0\x00'}}]}, @TIPC_NLA_NODE={0x28, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x23, 0x3, "bdfb17fde14905b7d26527f2a9e54d8059b4beb4a4daff280423b30f645a00"}]}, @TIPC_NLA_NET={0x48, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0xbfd0}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4828}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xffff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xe}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x61}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}]}, @TIPC_NLA_PUBL={0x4}]}, 0x1c4}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY_LEVEL(r5, 0x0, 0x2, &(0x7f0000000200)=0x1, 0x4) mount(&(0x7f0000000180)=@rnullb, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='jfs\x00', 0x8010, 0x0) 1.418681998s ago: executing program 3 (id=1538): socket(0x2, 0x2, 0x0) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000080)='.log\x00', 0x1812c1, 0x0) fchown(r0, 0xee01, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}, 0x3, 0x2, 0x2}}, 0x80, 0x0, 0xfffffffffffffcb5}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8001c00180081064e81f782db44b9b545c7910006007c09e8fe55a10a0017", 0x1f}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000210081044e81f7d28344b904020000", 0x2}], 0x1}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="043900002000ef029dd2b97576b11d210a"], 0x33fe0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000000000002700000018000180140002000b46623973797a5f74756e0000000000"], 0x2c}}, 0x20000040) ioctl$UFFDIO_WRITEPROTECT(r0, 0xc018aa06, &(0x7f0000000000)={{&(0x7f000081a000/0x3000)=nil, 0x3000}, 0x1}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x19, 0x0, 0x39) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$rxrpc(0x21, 0x2, 0xa) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r0, 0xc080661a, &(0x7f0000000140)={@desc={0x1, 0x0, @desc4}}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000600)=[@text16={0x10, 0x0}], 0x1, 0x74, 0x0, 0xfffffcda) mprotect(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x8) ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x1}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setregset(0x4205, r6, 0x202, &(0x7f0000000000)={0x0}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYBLOB="04000000000000008504"]) mmap$snddsp_control(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000000, 0x2010, r2, 0x83000000) r7 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0xaa36b000) 1.226849478s ago: executing program 3 (id=1540): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') move_mount(r0, 0x0, r0, &(0x7f0000000080)='./mnt\x00', 0x214) r1 = syz_open_dev$dri(&(0x7f0000000000), 0xb8c8, 0x440080) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/seq/timer\x00', 0x41, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000080)={0x7, 0x8, 0xffffff7f}) clock_gettime(0x1, &(0x7f00000000c0)={0x0, 0x0}) r5 = socket$caif_seqpacket(0x25, 0x5, 0x4) ppoll(&(0x7f0000000040)=[{r1, 0x6280}, {r5, 0x4c0}, {r5, 0x14}, {r1, 0x200}], 0x4, &(0x7f0000000100), &(0x7f0000000180)={[0x4]}, 0x8) clock_settime(0x0, &(0x7f0000009ac0)={r3, r4+10000000}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r1, 0x100000000) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88980, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r6, 0x5708e000) 1.12234719s ago: executing program 3 (id=1542): prlimit64(0x0, 0xe, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x4c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000000906010200000000000000000500fff7240007800c000180080001406401012008000a40004000020c00028008000140640101000900020073797a31000000000500010007"], 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x101802, 0x0) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) r3 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0xfffffffffffffffc, 0x6, 0xb0, @scatter={0x0, 0x40000000, 0x0}, &(0x7f0000000280)="bec5264913cd", 0x0, 0x3, 0x10000, 0x22, 0x0}) sendfile(r0, r0, &(0x7f0000000180)=0xfffffffffffffffc, 0x7) syz_usb_connect(0x5, 0x46, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0xd0, 0x9c, 0x5, 0x10, 0x2040, 0x4900, 0x5e14, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x34, 0x1, 0x5, 0x9, 0x0, 0x0, [{{0x9, 0x4, 0x97, 0x7, 0x3, 0x6f, 0x71, 0x3c, 0x9, [], [{{0x9, 0x5, 0x6, 0x10, 0x400, 0x9, 0xd7, 0xce, [@generic={0x7, 0x5, "dfd6053275"}]}}, {{0x9, 0x5, 0x2, 0x0, 0x8, 0x80, 0x4, 0x1}}, {{0x9, 0x5, 0x9, 0x10, 0x3ff, 0x99, 0x1, 0x6}}]}}]}}]}}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}) writev(r2, &(0x7f0000000300)=[{&(0x7f0000000680)="580000004b8004023655fdbaded39d65000b4824ca940417a3cd3639e431e8e2125f6c00940f6a0325010ebc0000000000000080001328baf0fffeffe809005300fff5dd02000000000000000c10003d5bcf6916b4114b32793792c395da89991a8be619c7ce1ecf8b6e3501aeb67cdb99f356f9518492cbf6d88e98f0df275f9f6dd0e185ac9b0b8902c883e0b63cf78a6f36b97cab227f62b6d35dcd058a8957d1bbf401e51d4302cbc17c3201e7b12fa4daac244b96d402183b429bbe400236cd1f8d50f2568ac466a6d40024f87588cbe7808c481b157f18acb07cee62b1d238ba704435ee1c055697eb1ee0e2cfa36d2efbf1ac9fa85fe4", 0xfdae}], 0x1) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a85352, &(0x7f0000000080)={{0xa2, 0xf2}, 'port1\x00', 0x40, 0x181040, 0x800, 0x5, 0x200, 0x3, 0x1, 0x0, 0x0, 0x5}) 683.026491ms ago: executing program 4 (id=1548): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x12, r0, 0xe6683000) futex(0x0, 0x2, 0x0, 0x0, &(0x7f0000048000)=0xfffffffc, 0x0) r1 = timerfd_create(0x7, 0x0) timerfd_settime(r1, 0x0, &(0x7f0000007000)={{0x0, 0x4}, {0x0, 0x3938700}}, 0x0) readv(r1, &(0x7f0000000200)=[{0x0}], 0x1) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) r3 = socket(0xa, 0x3, 0x3a) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000003c0)={'bridge0\x00', 0x0}) timerfd_settime(0xffffffffffffffff, 0x1, 0x0, 0x0) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000240)={0x4, 0x0, 0x0, r5}, 0xc) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000080)={0x0, 0x0, 0x0, r5}, 0xc) setsockopt$inet6_mreq(r2, 0x29, 0x1c, &(0x7f0000000000)={@private2={0xfc, 0x2, '\x00', 0x1}, r5}, 0x14) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa07, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)={'#! ', '', [{0x20, 'b\x00\x04\xf5@/d\x90\x10\x8ede\xb1*io.bfq.io_merYm\x04\xef\x9a\xb3\xe2\x05\x00\x00\bE\xdc\xe8\xbdrecursi'}]}, 0x36) 590.251754ms ago: executing program 4 (id=1549): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000080), 0x101802, 0x0) (async) r1 = socket$vsock_stream(0x28, 0x1, 0x0) (async) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002100)='/proc/bus/input/devices\x00', 0x0, 0x0) (async) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) setsockopt$sock_timeval(r3, 0x1, 0x14, &(0x7f0000002080), 0x10) read$FUSE(r2, &(0x7f0000000040)={0x2020}, 0x2020) (async, rerun: 64) r4 = syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) (rerun: 64) syz_usb_control_io$rtl8150(r4, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$rtl8150(r4, 0x0, &(0x7f0000000800)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)={0x40, 0x5, 0x1, "a9"}}) (rerun: 32) syz_usb_control_io$rtl8150(r4, 0x0, &(0x7f0000001040)={0x2c, &(0x7f0000000e80)={0x40, 0x1588bd1baad00f9e, 0x6, "e78bbcd0c31c"}, 0x0, 0x0, 0x0, 0x0}) (async) read$char_usb(r2, &(0x7f00000000c0)=""/76, 0x4c) (async) socket$inet(0x2, 0x1, 0x0) (async) setsockopt$inet_tcp_int(r2, 0x6, 0x5, &(0x7f0000000200)=0x7760, 0x4) (async, rerun: 64) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) (async, rerun: 64) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000740)={0x26, 'skcipher\x00', 0x0, 0x0, 'adiantum(xchacha20,serpent)\x00'}, 0x4e) bind$alg(r5, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(twofish-asm)\x00'}, 0x58) (async) inotify_add_watch(r2, &(0x7f0000000040)='./file0\x00', 0x10000000) (async) r6 = socket(0x10, 0x803, 0x0) write(r6, &(0x7f0000000040)="1c0000005e001f3814584707f9f4ffffff000000250000001ff80020", 0x1c) (async) connect$vsock_stream(r1, &(0x7f0000000000)={0x28, 0x0, 0x2711, @my=0x0}, 0x10) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) (async, rerun: 64) r8 = socket$can_raw(0x1d, 0x3, 0x1) (rerun: 64) setsockopt$CAN_RAW_FILTER(r8, 0x65, 0x1, 0x0, 0x0) (async, rerun: 64) bind$can_raw(r8, &(0x7f0000000040), 0x10) (async, rerun: 64) close_range(r7, 0xffffffffffffffff, 0x0) (async) pwritev2(r0, &(0x7f0000000000)=[{&(0x7f0000000340)="34c756994e83eb", 0x7}], 0x1, 0xfffffffe, 0x4, 0x1) 496.86795ms ago: executing program 5 (id=1550): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x64342, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0xae44, 0x77) (async) ioctl$KVM_X86_SET_MCE(r3, 0x4040ae9e, &(0x7f0000000140)={0xe200000000000000, 0x3000, 0xfffffffffffffffd, 0x0, 0x18}) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="9000000000010104000000000000000002000000240001801400018008000100e000000208000200ac1414000c0002800500010000000000240002800c00028005000100000000001400018008000100e000000208000200e000000208000740000000002c000e801400018008000100e000000208000200000000000c000280050001"], 0x90}}, 0x0) (async) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x8}, 0x0) r5 = syz_open_dev$I2C(&(0x7f0000000040), 0x7fffffff, 0x180c0) ioctl$I2C_PEC(r5, 0x708, 0x7ff) (async) syz_io_uring_setup(0x3b48, &(0x7f0000000280)={0x0, 0xc5ba, 0x1, 0x0, 0xc3}, 0x0, 0x0) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_VENDOR(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)={0x30, r6, 0x701, 0x0, 0x0, {{}, {@val={0x8, 0x1, 0xc}, @void, @val={0xc, 0x99, {0x9, 0x58}}}}, [@NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x8000}]}, 0x30}, 0x1, 0x0, 0x0, 0x8080}, 0x800) (async) sendfile(r0, r0, 0x0, 0x7ffff000) 491.323998ms ago: executing program 3 (id=1551): mount(&(0x7f0000000000)=@filename='./cgroup\x00', &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='nfs\x00', 0x200808, 0x0) (async) socketpair(0xa, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000100)=""/246, 0xf6}, {&(0x7f0000000200)=""/236, 0xec}, {&(0x7f0000000300)=""/64, 0x40}, {&(0x7f0000000340)=""/61, 0x3d}, {&(0x7f0000000380)=""/121, 0x79}, {&(0x7f0000000400)=""/155, 0x9b}, {&(0x7f00000004c0)=""/56, 0x38}, {&(0x7f0000000500)=""/187, 0xbb}, {&(0x7f00000005c0)=""/128, 0x80}], 0x9}, 0x4}, {{&(0x7f0000000700)=@pppol2tpv3, 0x80, &(0x7f0000000900)=[{&(0x7f0000000780)=""/236, 0xec}, {&(0x7f0000000880)=""/123, 0x7b}], 0x2, &(0x7f0000000940)=""/204, 0xcc}, 0xfffffffe}], 0x2, 0x40000021, &(0x7f0000000ac0)={0x77359400}) 394.407229ms ago: executing program 4 (id=1552): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000140)={0x4, 0x6000, 0x9, 0xf, 0x7fff}) r2 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r2, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x8008551d, &(0x7f0000000a00)={0xf9a0, 0x2, [{0x1, 0x1}, {0x9, 0x1}]}) r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x2c39000) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="3000000064000100000000020000000008000000", @ANYRES32=r4], 0x30}], 0x1}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r4) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r7 = dup(r6) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000540)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r7}, 0x2c, {[{@access_user}], [], 0x6b}}) ioctl$KVM_GET_NR_MMU_PAGES(r7, 0xae45, 0x7) 389.069774ms ago: executing program 3 (id=1553): r0 = gettid() timer_create(0x3, &(0x7f0000533fa0)={0x0, 0x20, 0x0, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x1802, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) close(0x3) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f00000000c0)='romfs\x00', 0x40800, 0x0) 297.682843ms ago: executing program 2 (id=1554): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x9, 0x4008031, 0xffffffffffffffff, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) (async) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000180)=0x4000000) (async) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000080)=0x2101224) pwritev(r1, &(0x7f0000000040)=[{&(0x7f0000000300)="00214717a7070075007c5fe03af5b2a1b7cee7a4ebf4", 0x16}], 0x1, 0x73a, 0x1) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000005, 0x22052, r0, 0x2000) 254.281953ms ago: executing program 5 (id=1555): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x507a40, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x7, 0x96}, &(0x7f0000000080)=0x8) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x22) r2 = landlock_create_ruleset(&(0x7f0000000540)={0x2000, 0x2}, 0x18, 0x0) r3 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x7178c3, 0x13d) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000340)={0x2000, r3}, 0x0) landlock_restrict_self(r2, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', r3, &(0x7f0000000000)='./file0\x00', 0x4) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, &(0x7f00000000c0)={r1, 0x80}, 0x8) newfstatat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x2000) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) syz_genetlink_get_family_id$nl80211(&(0x7f00000006c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000001040)={'wlan1\x00'}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) execve(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000680)={[&(0x7f0000000980)='system.posix_acl_access\x00 \x91\x9ao\"|\xadS\xd5h>\xa7\a\xa0\x13Fxy\xfe\xad\x12\f~PK\x89b\xd9zi\x19\x80\x8fm`\x8f\x00\xa4\xa7\x9c\xc0\x1c9[\x8co8cL9A\xaa\xa8K2\xacz\xe1\x81\xe3', &(0x7f0000000640)='-\x00']}, &(0x7f0000000500)={[&(0x7f00000006c0)='/d%v/net/tun\x00', &(0x7f0000000700)='\x00', &(0x7f0000000740)='syzkaller1\x00', &(0x7f0000000800)='\x1cposix_acl_access\x00\x98\xf2u\"\x8d\'(\xf4\x8e=L4\a\x9aT\xf1\xed\x8b\xb4\xdcf\n\n\x91\x11fn\xec6\xaa\xb9\x95\xcb\x817\\)\x0fF\\!T\xb8\xc9I\x15\x8cY\xdby/\x84\xa5\x9a\xf1L\xf8', &(0x7f00000007c0)='\x00', &(0x7f0000000200)='systaccess\x83K\xb2\xaf\x04\x1b\xc9\xbb\x00'/32]}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x308) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000880)=ANY=[@ANYBLOB="01010000", @ANYBLOB="86ab55128713f672d776597d956eae87f9a4eabbccf827a61768895d734e4c5fc021d0f9c8a7edcad68e58f94cb72d", @ANYRES8, @ANYRESOCT, @ANYRESDEC=r4]) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) setreuid(0x0, r6) getsockopt$inet6_IPV6_IPSEC_POLICY(r7, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@dev, @in=@private}}, {{@in6=@remote}, 0x0, @in6=@private1}}, &(0x7f0000000140)=0xe8) getresuid(&(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000480)) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000004c0)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff, 0xffffffffffffffff}}, './file0\x00'}) socket$inet(0x2, 0xa, 0x7) getgid() 130.292686ms ago: executing program 4 (id=1556): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x20011, r0, 0xd6baf000) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x5) r2 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_SEND_PRIO(r2, 0x6b, 0x3, &(0x7f0000000100)=0x5, 0x4) (async) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r3 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') preadv(r4, &(0x7f00000001c0)=[{&(0x7f0000000500)=""/212, 0xd4}], 0x1, 0x33, 0x0) (async) ioctl$VIDIOC_SUBSCRIBE_EVENT(r3, 0x4020565a, &(0x7f0000000180)={0x3, 0x980900, 0x1}) r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x20a80, 0x0) ioctl$PTP_PEROUT_REQUEST(r5, 0x40383d03, &(0x7f00000000c0)={{0x3, 0x26b}, {0x9, 0x7fffffff}, 0x1, 0x1}) (async) ioctl$VIDIOC_QUERYMENU(r3, 0xc008561c, &(0x7f00000001c0)={0x980900, 0x8081, @name="6736516728a5678c18a4ec047f3f1fa52fe9a9987d0406b3a0c705c611b66f06"}) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x3) (async) mremap(&(0x7f000085f000/0x1000)=nil, 0x1000, 0x13000, 0x4, &(0x7f0000018000/0x13000)=nil) 96.242399ms ago: executing program 4 (id=1557): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x64a00, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4, 0x20011, r0, 0xd6bb3000) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) madvise(&(0x7f0000343000/0x1000)=nil, 0x1000, 0x13) 58.955042ms ago: executing program 3 (id=1558): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4202, 0x0) preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0xfffffe8b}], 0x2, 0x0, 0x0, 0x1a) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendfile(r2, r1, &(0x7f0000000080)=0x7, 0x10) 2.333202ms ago: executing program 5 (id=1559): syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(0xffffffffffffffff, 0x104, 0x3, &(0x7f0000000280)=0x55e, 0xfffffffffffffcd3) (async) r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) (async) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) (async, rerun: 64) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000000c0)={'pcl818\x00', [0x4f27, 0x629, 0x2, 0x404, 0x2, 0xcc7, 0xfff, 0x5c952399, 0xd, 0x3ff, 0x2, 0x1, 0x1, 0x1, 0x9, 0xe1cb, 0x0, 0x1a449, 0x3, 0x40000003, 0x8b, 0xfffffffd, 0x70000000, 0x20001e56, 0xb, 0xe69, 0x3c, 0x8, 0x106, 0x0, 0x1]}) (rerun: 64) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x54, 0xa, 0x0, "3258ae1e10006c5d354000"}) (async, rerun: 32) r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0) (async, rerun: 32) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) (async, rerun: 64) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000000), 0x109c021, &(0x7f00000003c0)={[{@redirect_dir_off}]}) (rerun: 64) setxattr$trusted_overlay_opaque(&(0x7f0000000680)='./bus\x00', &(0x7f00000006c0), &(0x7f0000000700), 0x2, 0x3) (async) r3 = socket$inet_sctp(0x2, 0x800000000000001, 0x84) sendto$inet(r3, &(0x7f00000005c0)="7bf545fc3145590bed104a3eee5d7d8c0000000000000000989ff3f8ba", 0x1d, 0x8001, &(0x7f0000030ff0)={0x2, 0x461f, @rand_addr=0x64010101}, 0x10) sendto$inet(r3, &(0x7f0000000100)='\x00', 0x1, 0x0, &(0x7f00000000c0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) (async) shutdown(r3, 0x1) (async) execve(&(0x7f0000000040)='./bus\x00', &(0x7f0000000240)={[&(0x7f0000000180)='overlay\x00', &(0x7f0000000200)='/!/\x00']}, &(0x7f0000000540)) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async) syz_open_dev$evdev(&(0x7f0000000640), 0x59, 0x440000) setsockopt$inet_sctp_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000440)={0x0, 0xc137, 0x2, 0x7, 0x0, 0x4}, 0x14) fadvise64(r2, 0x7, 0x1ff, 0x1) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) socketpair(0x1, 0x3, 0x1, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$rds(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000980)=[{0x0}, {&(0x7f00000006c0)=""/85, 0x55}, {&(0x7f0000000740)=""/127, 0x7f}, {&(0x7f00000007c0)=""/2, 0x2}, {&(0x7f0000000800)=""/194, 0xc2}, {&(0x7f0000000900)=""/124, 0x7c}], 0x6, &(0x7f0000000a80)=[@mask_cswp={0x58, 0x114, 0x9, {{0x17, 0x80000000}, &(0x7f0000000a00)=0x7, 0x0, 0x0, 0x7, 0x3, 0x5e13, 0x78, 0x1000000000000}}], 0x58, 0x4000000}, 0x4000080) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$inet(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000002c0)="beaa38543627a7a662afe0d83fc3e43fc6c358893ae9cb8787f4659b80c54d51815d240ba45b930936aecd07ff84b35954a5a75c1ba4252e11ab09ebfa468f58829bb24aebceb9", 0x47}], 0x1}, 0x20048050) (async) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) write$P9_RSTATu(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[@ANYBLOB="930200007d00000005f0000000000000040000000000000000000000000000000000000000000000000000000000000000001f00206e6f6465767b6376666f7892ffffff8102000000000031ffcebc920000003800704a86cec602007dfa673effeb09b5351f5bde05f700000000187b8200b500003b595fcb14"], 0x232) 0s ago: executing program 4 (id=1560): getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x111, 0x6f, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000280)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01a3be875f4fc157ddd1a731344c002bbd7000fbdb7a049c00000006000000", @ANYRES32=r1, @ANYBLOB="1c002c80080000000000000008000000000000000800000007000000"], 0x38}, 0x1, 0x0, 0x0, 0x24004084}, 0x4000000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x3c, r4, 0x5, 0x70bd27, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_SSID={0x5, 0x34, @random="8b"}, @crypto_settings=[@NL80211_ATTR_CIPHER_SUITES_PAIRWISE={0x18, 0x49, [0xfac09, 0xfac05, 0xfac08, 0xfac0d, 0xfac00]}]]}, 0x3c}}, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r2, 0x400, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x28044040}, 0x8000) r6 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000000cc0)={0x1, @pix_mp={0x0, 0x0, 0x32314241}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x12, r6, 0xa0e52000) mincore(&(0x7f0000ffe000/0x2000)=nil, 0x2000, &(0x7f0000000000)=""/176) openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) madvise(&(0x7f00009d0000/0x4000)=nil, 0x4000, 0x9) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r8 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r8, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r8, 0x40946400, &(0x7f00000000c0)={'8255\x00', [0x4f27, 0x5, 0x2, 0x421, 0x1, 0xcc7, 0x7fffffff, 0x5c952399, 0x80000005, 0x3ff, 0x2, 0x300, 0x1, 0x3, 0x0, 0x0, 0x0, 0x8, 0xfffffffa, 0x1ff, 0x80000089, 0xa, 0x0, 0x20001e54, 0xffffeada, 0x3, 0x3d, 0x8, 0x4, 0x8000000, 0xdffffffa]}) socket$inet6_mptcp(0xa, 0x1, 0x106) openat$vicodec1(0xffffffffffffff9c, 0x0, 0x2, 0x0) r9 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000100)='asymmetric\x00', 0x0, &(0x7f0000000b00)="1081", 0x2, r9) r10 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r10) ptrace$setregset(0x4205, r10, 0x204, &(0x7f00000000c0)={0x0}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) kernel console output (not intermixed with test programs): open blockdev [ 186.971377][ T5982] usb 3-1: USB disconnect, device number 43 [ 186.988926][ T5902] usb 5-1: 2:1 : no or invalid class specific endpoint descriptor [ 187.013296][ T5902] usb 5-1: 2:1 : format type 9 is not supported yet [ 187.070899][ T5902] usb 5-1: USB disconnect, device number 17 [ 187.125248][ T5871] udevd[5871]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 187.441544][ T8631] block nbd2: Attempted send on invalid socket [ 187.448654][ T8631] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 187.458209][ T8631] hfs: can't find a HFS filesystem on dev nbd2 [ 187.643331][ T5186] Bluetooth: hci0: Malformed MSFT vendor event: 0x02 [ 187.815965][ T8649] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 187.846527][ T8650] binder: BINDER_SET_CONTEXT_MGR already set [ 187.855728][ T8650] binder: 8644:8650 ioctl 4018620d 200000004a80 returned -16 [ 187.940270][ T8654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 187.974131][ T8654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.219146][ T5918] usb 1-1: USB disconnect, device number 55 [ 188.602946][ T5902] usb 3-1: new full-speed USB device number 44 using dummy_hcd [ 188.785286][ T5902] usb 3-1: unable to get BOS descriptor or descriptor too short [ 188.793565][ T5940] usb 4-1: Cannot set autoneg [ 188.799781][ T5902] usb 3-1: not running at top speed; connect to a high speed hub [ 188.807732][ T5940] MOSCHIP usb-ethernet driver 4-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -110 [ 188.830825][ T5902] usb 3-1: config 9 has an invalid interface number: 49 but max is 0 [ 188.844613][ T5902] usb 3-1: config 9 has no interface number 0 [ 188.859626][ T5902] usb 3-1: config 9 interface 49 has no altsetting 0 [ 188.876542][ T5902] usb 3-1: New USB device found, idVendor=c251, idProduct=4003, bcdDevice= 1.00 [ 188.886117][ T5902] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.894231][ T5902] usb 3-1: Product: syz [ 188.898489][ T5902] usb 3-1: Manufacturer: syz [ 188.903146][ T5902] usb 3-1: SerialNumber: syz [ 189.001810][ T8693] /dev/rnullb0: Can't open blockdev [ 189.068679][ T8696] 9p: Unknown parameter 'fscache' [ 189.113352][ T8700] syzkaller1: entered promiscuous mode [ 189.119407][ T8700] syzkaller1: entered allmulticast mode [ 189.163503][ T5902] usb-storage 3-1:9.49: USB Mass Storage device detected [ 189.172170][ T5902] usb-storage 3-1:9.49: Quirks match for vid c251 pid 4003: 80 [ 189.251519][ T5902] usb 3-1: USB disconnect, device number 44 [ 189.252577][ T5918] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 189.402573][ T5918] usb 1-1: device descriptor read/64, error -71 [ 189.642394][ T5918] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 189.772656][ T5918] usb 1-1: device descriptor read/64, error -71 [ 189.882416][ T5918] usb usb1-port1: attempt power cycle [ 190.198920][ T8727] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 190.205501][ T8727] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 190.214632][ T8727] vhci_hcd vhci_hcd.0: Device attached [ 190.221320][ T8728] vhci_hcd: connection closed [ 190.221479][ T13] vhci_hcd: stop threads [ 190.230800][ T5918] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 190.230997][ T13] vhci_hcd: release socket [ 190.243708][ T13] vhci_hcd: disconnect device [ 190.252906][ T5918] usb 1-1: device descriptor read/8, error -71 [ 190.336533][ T8731] syzkaller1: entered promiscuous mode [ 190.342457][ T8731] syzkaller1: entered allmulticast mode [ 190.483690][ T8735] /dev/rnullb0: Can't open blockdev [ 190.493225][ T5918] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 190.513432][ T5918] usb 1-1: device descriptor read/8, error -71 [ 190.622037][ T5918] usb usb1-port1: unable to enumerate USB device [ 190.760430][ T8744] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 190.902025][ T8751] syzkaller1: entered promiscuous mode [ 190.907635][ T8751] syzkaller1: entered allmulticast mode [ 190.991486][ T8757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 191.000210][ T8757] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.124462][ T8771] program syz.2.762 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 191.136764][ T8771] program syz.2.762 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 191.185115][ T8779] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 191.196186][ T8779] /dev/rnullb0: Can't open blockdev [ 191.360937][ T8784] /dev/rnullb0: Can't open blockdev [ 191.451596][ T5902] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 191.611611][ T5902] usb 3-1: Using ep0 maxpacket: 16 [ 191.618449][ T5902] usb 3-1: config 4 has an invalid interface number: 51 but max is 0 [ 191.627694][ T5902] usb 3-1: config 4 has no interface number 0 [ 191.634163][ T5902] usb 3-1: config 4 interface 51 has no altsetting 0 [ 191.643182][ T5902] usb 3-1: New USB device found, idVendor=0409, idProduct=0063, bcdDevice=83.4b [ 191.653081][ T5902] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.661107][ T5902] usb 3-1: Product: syz [ 191.665818][ T5902] usb 3-1: Manufacturer: syz [ 191.670448][ T5902] usb 3-1: SerialNumber: syz [ 191.682043][ T5902] upd78f0730 3-1:4.51: upd78f0730 converter detected [ 191.691500][ T5902] usb 3-1: upd78f0730 converter now attached to ttyUSB0 [ 191.802456][ T8792] block nbd4: NBD_DISCONNECT [ 191.880965][ T8779] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 191.888063][ T8794] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 191.900296][ T8779] /dev/rnullb0: Can't open blockdev [ 191.901641][ T8794] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.915415][ T5902] usb 3-1: USB disconnect, device number 45 [ 191.926226][ T5902] upd78f0730 ttyUSB0: upd78f0730 converter now disconnected from ttyUSB0 [ 191.940226][ T5902] upd78f0730 3-1:4.51: device disconnected [ 192.187566][ T8813] /dev/rnullb0: Can't open blockdev [ 192.261023][ T5958] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 192.412213][ T8818] syzkaller1: entered promiscuous mode [ 192.417965][ T8818] syzkaller1: entered allmulticast mode [ 192.424333][ T5958] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 192.436675][ T5958] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 192.448707][ T5958] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 192.462451][ T5958] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 192.480662][ T5958] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.489108][ T5958] usb 5-1: Product: syz [ 192.493572][ T5958] usb 5-1: Manufacturer: syz [ 192.498433][ T5958] usb 5-1: SerialNumber: syz [ 192.506051][ T5958] usb 5-1: config 0 descriptor?? [ 192.516336][ T8799] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 192.524376][ T8799] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 192.550207][ T5958] usb 5-1: ucan: probing device on interface #0 [ 192.952168][ T1219] usb 1-1: new full-speed USB device number 60 using dummy_hcd [ 193.153237][ T5958] ucan 5-1:0.0: probe with driver ucan failed with error -22 [ 193.309178][ T8846] /dev/rnullb0: Can't open blockdev [ 193.359041][ T8799] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 193.372495][ T8799] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 193.383831][ T8799] /dev/rnullb0: Can't open blockdev [ 193.391146][ T5958] usb 5-1: USB disconnect, device number 18 [ 193.508787][ T8851] Invalid ELF header magic: != ELF [ 193.516171][ T8851] /dev/rnullb0: Can't open blockdev [ 193.559521][ T8853] syzkaller1: entered promiscuous mode [ 193.565193][ T8853] syzkaller1: entered allmulticast mode [ 193.855079][ T8858] wlan1 speed is unknown, defaulting to 1000 [ 193.946436][ T8861] /dev/rnullb0: Can't open blockdev [ 193.958043][ T8862] /dev/rnullb0: Can't open blockdev [ 194.410050][ T5923] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 194.572300][ T5923] usb 5-1: config 0 has an invalid interface number: 170 but max is 0 [ 194.580556][ T5923] usb 5-1: config 0 has no interface number 0 [ 194.586687][ T5923] usb 5-1: config 0 interface 170 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 194.597716][ T5923] usb 5-1: config 0 interface 170 has no altsetting 0 [ 194.609182][ T5923] usb 5-1: New USB device found, idVendor=061d, idProduct=c1a0, bcdDevice=43.96 [ 194.618459][ T5923] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 194.626668][ T5923] usb 5-1: Product: syz [ 194.632943][ T5923] usb 5-1: Manufacturer: syz [ 194.637586][ T5923] usb 5-1: SerialNumber: syz [ 194.647218][ T5923] usb 5-1: config 0 descriptor?? [ 194.666141][ T5923] quatech2 5-1:0.170: Quatech 2nd gen USB to Serial Driver converter detected [ 194.711863][ T8877] syzkaller1: entered promiscuous mode [ 194.717637][ T8877] syzkaller1: entered allmulticast mode [ 194.926280][ T8881] /dev/rnullb0: Can't open blockdev [ 195.016746][ T5923] usb 5-1: qt2_attach - failed to power on unit: -71 [ 195.049789][ T5923] quatech2 5-1:0.170: probe with driver quatech2 failed with error -71 [ 195.069414][ T5923] usb 5-1: USB disconnect, device number 19 [ 195.429705][ T5902] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 195.519840][ T8901] /dev/rnullb0: Can't open blockdev [ 195.545223][ T8903] /dev/rnullb0: Can't open blockdev [ 195.589314][ T5902] usb 3-1: device descriptor read/64, error -71 [ 195.645966][ T8905] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 195.693905][ T8905] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 195.728411][ T8905] netlink: 'syz.3.806': attribute type 1 has an invalid length. [ 195.839204][ T5902] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 195.969204][ T5902] usb 3-1: device descriptor read/64, error -71 [ 196.089232][ T5902] usb usb3-port1: attempt power cycle [ 196.379152][ T5958] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 196.459043][ T5902] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 196.491509][ T5902] usb 3-1: device descriptor read/8, error -71 [ 196.508933][ T5958] usb 5-1: device descriptor read/64, error -71 [ 196.748779][ T5958] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 196.748794][ T5902] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 196.771112][ T5902] usb 3-1: device descriptor read/8, error -71 [ 196.888726][ T5958] usb 5-1: device descriptor read/64, error -71 [ 196.890354][ T5902] usb usb3-port1: unable to enumerate USB device [ 196.988613][ T5940] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 196.998968][ T5958] usb usb5-port1: attempt power cycle [ 197.138638][ T5940] usb 1-1: Using ep0 maxpacket: 16 [ 197.145763][ T5940] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 197.155043][ T5940] usb 1-1: config 0 has no interface number 0 [ 197.161432][ T5940] usb 1-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 25296, setting to 1024 [ 197.174370][ T5940] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 197.184315][ T5940] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 197.194469][ T5940] usb 1-1: Product: syz [ 197.199104][ T5940] usb 1-1: SerialNumber: syz [ 197.208524][ T5940] usb 1-1: config 0 descriptor?? [ 197.214771][ T8949] netlink: 'syz.3.821': attribute type 27 has an invalid length. [ 197.219479][ T5940] cm109 1-1:0.8: invalid payload size 1024, expected 4 [ 197.232406][ T5940] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input22 [ 197.233546][ T8949] netlink: 164 bytes leftover after parsing attributes in process `syz.3.821'. [ 197.344961][ T8954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 197.353718][ T5958] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 197.357254][ T8954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 197.379903][ T5958] usb 5-1: device descriptor read/8, error -71 [ 197.593247][ T8961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 197.601979][ T8961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 197.628394][ T5958] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 197.648915][ T5958] usb 5-1: device descriptor read/8, error -71 [ 197.710101][ C1] cm109 1-1:0.8: cm109_urb_irq_callback: urb status -71 [ 197.717294][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 197.724497][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 197.731664][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 197.738839][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 197.746972][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 197.754136][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 197.761305][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 197.761644][ T5958] usb usb5-port1: unable to enumerate USB device [ 197.768574][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 197.782697][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 197.789882][ C1] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 197.797318][ T5940] usb 1-1: USB disconnect, device number 61 [ 197.803330][ C1] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 197.822647][ T5940] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 197.913904][ T8966] syzkaller1: entered promiscuous mode [ 197.919753][ T8966] syzkaller1: entered allmulticast mode [ 198.594462][ T8994] workqueue: Failed to create a rescuer kthread for wq "nfc7_nci_tx_wq": -EINTR [ 198.862092][ T9035] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 198.885794][ T9035] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 199.171543][ T9049] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 199.178825][ T9049] IPv6: NLM_F_CREATE should be set when creating new route [ 199.186054][ T9049] IPv6: NLM_F_CREATE should be set when creating new route [ 199.193302][ T9049] IPv6: NLM_F_CREATE should be set when creating new route [ 199.358398][ T5918] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 199.508759][ T5918] usb 3-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 199.519458][ T5918] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.532653][ T5918] usb 3-1: config 0 descriptor?? [ 199.550194][ T5918] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 199.557993][ T5923] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 199.688958][ T5923] usb 5-1: device descriptor read/64, error -71 [ 199.753138][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.762693][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.927513][ T5923] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 199.972898][ T5918] cpia1 3-1:0.0: unexpected state after lo power cmd: 00 [ 200.067119][ T5923] usb 5-1: device descriptor read/64, error -71 [ 200.177429][ T5923] usb usb5-port1: attempt power cycle [ 200.180292][ T9080] 8021q: adding VLAN 0 to HW filter on device bond0 [ 200.195247][ T9080] bond0: (slave rose0): Enslaving as an active interface with an up link [ 200.325882][ T9090] input: syz1 as /devices/virtual/input/input23 [ 200.417584][ T9096] /dev/rnullb0: Can't open blockdev [ 200.516879][ T5923] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 200.525231][ T9047] netlink: 'syz.2.837': attribute type 3 has an invalid length. [ 200.535790][ T9105] /dev/rnullb0: Can't open blockdev [ 200.548066][ T5923] usb 5-1: device descriptor read/8, error -71 [ 200.566873][ T9047] netlink: 3 bytes leftover after parsing attributes in process `syz.2.837'. [ 200.740141][ T9115] netlink: 8 bytes leftover after parsing attributes in process `syz.0.854'. [ 200.776051][ T9115] netlink: 8 bytes leftover after parsing attributes in process `syz.0.854'. [ 200.786922][ T5923] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 200.836112][ T5923] usb 5-1: device descriptor read/8, error -71 [ 200.874374][ T5918] gspca_cpia1: usb_control_msg 02, error -71 [ 200.886973][ T5918] gspca_cpia1: usb_control_msg 05, error -71 [ 200.890649][ T9125] /dev/rnullb0: Can't open blockdev [ 200.908778][ T5918] cpia1 3-1:0.0: unexpected systemstate: 00 [ 200.930037][ T5918] usb 3-1: USB disconnect, device number 50 [ 200.939747][ T9115] /dev/rnullb0: Can't open blockdev [ 200.946977][ T5923] usb usb5-port1: unable to enumerate USB device [ 201.187648][ T9148] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.198642][ T9148] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.461709][ T9165] block nbd2: Attempted send on invalid socket [ 201.473064][ T9165] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 201.482817][ T9165] MINIX-fs: unable to read superblock [ 201.827218][ T5860] Bluetooth: hci2: command 0x0406 tx timeout [ 201.833371][ T5860] Bluetooth: hci1: command 0x0406 tx timeout [ 202.393405][ T9201] FAULT_INJECTION: forcing a failure. [ 202.393405][ T9201] name failslab, interval 1, probability 0, space 0, times 1 [ 202.406486][ T9201] CPU: 0 UID: 0 PID: 9201 Comm: syz.2.874 Not tainted syzkaller #0 PREEMPT(full) [ 202.406512][ T9201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 202.406524][ T9201] Call Trace: [ 202.406531][ T9201] [ 202.406540][ T9201] dump_stack_lvl+0x189/0x250 [ 202.406575][ T9201] ? __pfx____ratelimit+0x10/0x10 [ 202.406601][ T9201] ? __pfx_dump_stack_lvl+0x10/0x10 [ 202.406631][ T9201] ? __pfx__printk+0x10/0x10 [ 202.406661][ T9201] ? __pfx___might_resched+0x10/0x10 [ 202.406683][ T9201] ? lock_acquire+0x5f/0x360 [ 202.406703][ T9201] should_fail_ex+0x414/0x560 [ 202.406732][ T9201] should_failslab+0xa8/0x100 [ 202.406753][ T9201] __kmalloc_noprof+0xcb/0x4b0 [ 202.406781][ T9201] ? tomoyo_encode+0x28b/0x550 [ 202.406809][ T9201] tomoyo_encode+0x28b/0x550 [ 202.406838][ T9201] tomoyo_realpath_from_path+0x58d/0x5d0 [ 202.406866][ T9201] ? tomoyo_domain+0xd9/0x130 [ 202.406895][ T9201] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 202.406916][ T9201] tomoyo_path_number_perm+0x1e8/0x5a0 [ 202.406938][ T9201] ? lock_release+0x4b/0x3e0 [ 202.406957][ T9201] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 202.406981][ T9201] ? rcu_is_watching+0x15/0xb0 [ 202.407003][ T9201] ? lock_release+0x4b/0x3e0 [ 202.407020][ T9201] ? vfs_write+0x956/0xb30 [ 202.407042][ T9201] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 202.407082][ T9201] ? __fget_files+0x3a0/0x420 [ 202.407106][ T9201] ? __fget_files+0x2a/0x420 [ 202.407131][ T9201] security_file_ioctl+0xcb/0x2d0 [ 202.407152][ T9201] __se_sys_ioctl+0x47/0x170 [ 202.407183][ T9201] do_syscall_64+0xfa/0xfa0 [ 202.407210][ T9201] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.407229][ T9201] ? clear_bhb_loop+0x60/0xb0 [ 202.407251][ T9201] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.407270][ T9201] RIP: 0033:0x7fd8b358ebe9 [ 202.407288][ T9201] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 202.407306][ T9201] RSP: 002b:00007fd8b4424038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 202.407328][ T9201] RAX: ffffffffffffffda RBX: 00007fd8b37c5fa0 RCX: 00007fd8b358ebe9 [ 202.407350][ T9201] RDX: 0000200000000140 RSI: 000000004008ae89 RDI: 0000000000000005 [ 202.407364][ T9201] RBP: 00007fd8b4424090 R08: 0000000000000000 R09: 0000000000000000 [ 202.407376][ T9201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 202.407388][ T9201] R13: 00007fd8b37c6038 R14: 00007fd8b37c5fa0 R15: 00007ffc2789dfe8 [ 202.407410][ T9201] [ 202.407427][ T9201] ERROR: Out of memory at tomoyo_realpath_from_path. [ 202.636899][ T9207] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 202.676139][ T9207] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 202.998474][ T9221] sg_write: process 649 (syz.2.881) changed security contexts after opening file descriptor, this is not allowed. [ 203.013506][ T9213] 9p: Unknown parameter 'port0x000005@ ['00000004e22' [ 203.150586][ T5860] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 203.158743][ T5860] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 203.166031][ T5860] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 203.173965][ T5860] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 203.183522][ T5860] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 203.282122][ T9223] wlan1 speed is unknown, defaulting to 1000 [ 203.307652][ T9230] syzkaller1: entered promiscuous mode [ 203.339214][ T9230] syzkaller1: entered allmulticast mode [ 203.655712][ T9223] chnl_net:caif_netlink_parms(): no params data found [ 203.699379][ T9245] ./cgroup: Can't lookup blockdev [ 203.759494][ T9223] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.792804][ T9223] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.811699][ T9223] bridge_slave_0: entered allmulticast mode [ 203.831142][ T9223] bridge_slave_0: entered promiscuous mode [ 203.847749][ T9223] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.854988][ T9223] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.867720][ T9223] bridge_slave_1: entered allmulticast mode [ 203.879169][ T9223] bridge_slave_1: entered promiscuous mode [ 203.945965][ T9223] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 203.968129][ T9223] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 204.013141][ T9223] team0: Port device team_slave_0 added [ 204.029279][ T9223] team0: Port device team_slave_1 added [ 204.106146][ T9223] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 204.182380][ T9223] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 204.237329][ T9223] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 204.269409][ T9223] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 204.276721][ T9223] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 204.303178][ T9223] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 204.350884][ T9223] hsr_slave_0: entered promiscuous mode [ 204.357799][ T9223] hsr_slave_1: entered promiscuous mode [ 204.363907][ T9223] debugfs: 'hsr0' already exists in 'hsr' [ 204.399855][ T9250] FAULT_INJECTION: forcing a failure. [ 204.399855][ T9250] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 204.414901][ T9223] Cannot create hsr debugfs directory [ 204.444901][ T9250] CPU: 0 UID: 0 PID: 9250 Comm: syz.4.888 Not tainted syzkaller #0 PREEMPT(full) [ 204.444929][ T9250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 204.444942][ T9250] Call Trace: [ 204.444950][ T9250] [ 204.444959][ T9250] dump_stack_lvl+0x189/0x250 [ 204.444996][ T9250] ? __pfx____ratelimit+0x10/0x10 [ 204.445023][ T9250] ? __pfx_dump_stack_lvl+0x10/0x10 [ 204.445054][ T9250] ? __pfx__printk+0x10/0x10 [ 204.445082][ T9250] ? __might_fault+0xb0/0x130 [ 204.445116][ T9250] ? rcu_is_watching+0x15/0xb0 [ 204.445148][ T9250] should_fail_ex+0x414/0x560 [ 204.445179][ T9250] _copy_from_user+0x2d/0xb0 [ 204.445204][ T9250] kvm_arch_vcpu_ioctl+0x638/0x2a80 [ 204.445231][ T9250] ? unwind_next_frame+0xa5/0x2390 [ 204.445259][ T9250] ? kvm_arch_vcpu_ioctl+0x5f8/0x2a80 [ 204.445283][ T9250] ? unwind_next_frame+0xa5/0x2390 [ 204.445310][ T9250] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 204.445338][ T9250] ? unwind_next_frame+0xa5/0x2390 [ 204.445362][ T9250] ? rcu_is_watching+0x15/0xb0 [ 204.445385][ T9250] ? unwind_next_frame+0xa5/0x2390 [ 204.445412][ T9250] ? unwind_next_frame+0xa5/0x2390 [ 204.445436][ T9250] ? rcu_is_watching+0x15/0xb0 [ 204.445460][ T9250] ? is_bpf_text_address+0x26/0x2b0 [ 204.445479][ T9250] ? rcu_is_watching+0x15/0xb0 [ 204.445503][ T9250] ? rcu_is_watching+0x15/0xb0 [ 204.445525][ T9250] ? lock_release+0x4b/0x3e0 [ 204.445544][ T9250] ? lock_release+0x4b/0x3e0 [ 204.445566][ T9250] ? is_bpf_text_address+0x292/0x2b0 [ 204.445585][ T9250] ? is_bpf_text_address+0x26/0x2b0 [ 204.445606][ T9250] ? kernel_text_address+0xa5/0xe0 [ 204.445638][ T9250] ? __kernel_text_address+0xd/0x40 [ 204.445669][ T9250] ? unwind_get_return_address+0x4d/0x90 [ 204.445694][ T9250] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 204.445723][ T9250] ? arch_stack_walk+0xfc/0x150 [ 204.445756][ T9250] ? stack_trace_save+0x9c/0xe0 [ 204.445782][ T9250] ? __pfx_stack_trace_save+0x10/0x10 [ 204.445810][ T9250] ? stack_depot_save_flags+0x40/0x860 [ 204.445843][ T9250] ? kasan_save_track+0x4f/0x80 [ 204.445871][ T9250] ? kasan_save_track+0x3e/0x80 [ 204.445899][ T9250] ? __kasan_save_free_info+0x46/0x50 [ 204.445923][ T9250] ? __kasan_slab_free+0x5b/0x80 [ 204.445953][ T9250] ? kfree+0x18e/0x440 [ 204.445980][ T9250] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 204.446003][ T9250] ? security_file_ioctl+0xcb/0x2d0 [ 204.446024][ T9250] ? __se_sys_ioctl+0x47/0x170 [ 204.446054][ T9250] ? do_syscall_64+0xfa/0xfa0 [ 204.446081][ T9250] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.446106][ T9250] ? __mutex_trylock_common+0x153/0x260 [ 204.446139][ T9250] ? __pfx___mutex_trylock_common+0x10/0x10 [ 204.446167][ T9250] ? rcu_is_watching+0x15/0xb0 [ 204.446190][ T9250] ? trace_contention_end+0x39/0x120 [ 204.446215][ T9250] ? __mutex_lock+0x335/0x1350 [ 204.446249][ T9250] ? kvm_vcpu_ioctl+0x22e/0xe90 [ 204.446271][ T9250] ? __pfx___mutex_lock+0x10/0x10 [ 204.446299][ T9250] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 204.446325][ T9250] ? do_vfs_ioctl+0xbe8/0x1430 [ 204.446342][ T9250] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 204.446366][ T9250] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 204.446399][ T9250] kvm_vcpu_ioctl+0x74d/0xe90 [ 204.446422][ T9250] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 204.446442][ T9250] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 204.446482][ T9250] ? __fget_files+0x3a0/0x420 [ 204.446507][ T9250] ? __fget_files+0x2a/0x420 [ 204.446533][ T9250] ? bpf_lsm_file_ioctl+0x9/0x20 [ 204.446561][ T9250] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 204.446580][ T9250] __se_sys_ioctl+0xf9/0x170 [ 204.446611][ T9250] do_syscall_64+0xfa/0xfa0 [ 204.446639][ T9250] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.446659][ T9250] ? clear_bhb_loop+0x60/0xb0 [ 204.446682][ T9250] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 204.446702][ T9250] RIP: 0033:0x7f021c38ebe9 [ 204.446720][ T9250] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 204.446738][ T9250] RSP: 002b:00007f021d216038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 204.446760][ T9250] RAX: ffffffffffffffda RBX: 00007f021c5c5fa0 RCX: 00007f021c38ebe9 [ 204.446776][ T9250] RDX: 0000200000000140 RSI: 000000004008ae89 RDI: 0000000000000005 [ 204.446789][ T9250] RBP: 00007f021d216090 R08: 0000000000000000 R09: 0000000000000000 [ 204.446803][ T9250] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 204.446815][ T9250] R13: 00007f021c5c6038 R14: 00007f021c5c5fa0 R15: 00007ffd43577d58 [ 204.446838][ T9250] [ 205.039813][ T9223] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 205.054628][ T9223] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 205.064925][ T9223] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 205.074766][ T9223] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 205.170321][ T9223] 8021q: adding VLAN 0 to HW filter on device bond0 [ 205.187210][ T9223] 8021q: adding VLAN 0 to HW filter on device team0 [ 205.201389][ T8836] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.208649][ T8836] bridge0: port 1(bridge_slave_0) entered forwarding state [ 205.276531][ T5860] Bluetooth: hci1: command tx timeout [ 205.306074][ T9223] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 205.316536][ T9223] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 205.333443][ T8836] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.340597][ T8836] bridge0: port 2(bridge_slave_1) entered forwarding state [ 205.420490][ T9273] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 205.682653][ T9223] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 205.945071][ T1219] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 206.062513][ T9223] veth0_vlan: entered promiscuous mode [ 206.086231][ T9223] veth1_vlan: entered promiscuous mode [ 206.095572][ T1219] usb 5-1: Using ep0 maxpacket: 16 [ 206.104254][ T1219] usb 5-1: too many configurations: 18, using maximum allowed: 8 [ 206.118680][ T9223] veth0_macvtap: entered promiscuous mode [ 206.129514][ T1219] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 206.134982][ T9223] veth1_macvtap: entered promiscuous mode [ 206.137654][ T1219] usb 5-1: can't read configurations, error -61 [ 206.175133][ T9223] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 206.182716][ T9293] /dev/rnullb0: Can't open blockdev [ 206.190188][ T9223] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 206.210354][ T8834] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 206.219475][ T8834] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 206.231073][ T8834] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 206.252993][ T8834] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 206.271346][ T9295] /dev/rnullb0: Can't open blockdev [ 206.296569][ T1219] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 206.356029][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 206.380733][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 206.410178][ T9303] Malformed UNC in devname [ 206.410178][ T9303] [ 206.419741][ T9303] CIFS: VFS: Malformed UNC in devname [ 206.425291][ T8835] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 206.433508][ T8835] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 206.465922][ T1219] usb 5-1: Using ep0 maxpacket: 16 [ 206.478976][ T1219] usb 5-1: too many configurations: 18, using maximum allowed: 8 [ 206.499138][ T1219] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 206.515796][ T1219] usb 5-1: can't read configurations, error -61 [ 206.532587][ T1219] usb usb5-port1: attempt power cycle [ 206.589296][ T9310] ./cgroup: Can't lookup blockdev [ 206.663450][ T9312] syzkaller1: entered promiscuous mode [ 206.669827][ T9312] syzkaller1: entered allmulticast mode [ 206.783419][ T9316] /dev/rnullb0: Can't open blockdev [ 206.874255][ T1219] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 206.895237][ T1219] usb 5-1: Using ep0 maxpacket: 16 [ 206.901259][ T1219] usb 5-1: too many configurations: 18, using maximum allowed: 8 [ 206.911199][ T1219] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 206.919084][ T1219] usb 5-1: can't read configurations, error -61 [ 206.933698][ T5982] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 206.967578][ T9326] netlink: 'syz.3.910': attribute type 1 has an invalid length. [ 206.979636][ T9326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 206.988532][ T9326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 207.053786][ T1219] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 207.074765][ T1219] usb 5-1: Using ep0 maxpacket: 16 [ 207.080391][ T1219] usb 5-1: too many configurations: 18, using maximum allowed: 8 [ 207.088290][ T5982] usb 3-1: Using ep0 maxpacket: 8 [ 207.094980][ T1219] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 207.102583][ T1219] usb 5-1: can't read configurations, error -61 [ 207.109760][ T1219] usb usb5-port1: unable to enumerate USB device [ 207.117858][ T5982] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 207.128048][ T5982] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 207.137897][ T5982] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 207.162516][ T5982] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 207.176422][ T5982] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 207.189111][ T5982] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.240712][ T9330] /dev/rnullb0: Can't open blockdev [ 207.343648][ T5860] Bluetooth: hci1: command tx timeout [ 207.405001][ T5982] usb 3-1: GET_CAPABILITIES returned 0 [ 207.410559][ T5982] usbtmc 3-1:16.0: can't read capabilities [ 207.608417][ T9314] usb 3-1: usbtmc_ioctl_clear_in_halt returned -32 [ 207.617434][ T9314] /dev/rnullb0: Can't open blockdev [ 207.623652][ T9332] /dev/rnullb0: Can't open blockdev [ 207.630189][ T1219] usb 3-1: USB disconnect, device number 51 [ 208.090778][ T9343] /dev/rnullb0: Can't open blockdev [ 208.142344][ T9345] syzkaller1: entered promiscuous mode [ 208.153069][ T9345] syzkaller1: entered allmulticast mode [ 208.413117][ T5923] usb 3-1: new full-speed USB device number 52 using dummy_hcd [ 208.566299][ T5923] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 6 [ 208.567406][ T9350] syzkaller1: entered promiscuous mode [ 208.579342][ T5923] usb 3-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 208.579369][ T5923] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.583691][ T5923] usb 3-1: config 0 descriptor?? [ 208.594236][ T9350] syzkaller1: entered allmulticast mode [ 208.762909][ T9353] dlm: non-version read from control device 2 [ 209.030909][ T5923] uclogic 0003:5543:0003.000E: hidraw0: USB HID v10.00 Device [HID 5543:0003] on usb-dummy_hcd.2-1/input0 [ 209.115549][ T9368] syzkaller1: entered promiscuous mode [ 209.123188][ T9368] syzkaller1: entered allmulticast mode [ 209.130826][ T9368] FAULT_INJECTION: forcing a failure. [ 209.130826][ T9368] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 209.144417][ T9368] CPU: 1 UID: 0 PID: 9368 Comm: syz.3.925 Not tainted syzkaller #0 PREEMPT(full) [ 209.144443][ T9368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 209.144456][ T9368] Call Trace: [ 209.144464][ T9368] [ 209.144472][ T9368] dump_stack_lvl+0x189/0x250 [ 209.144508][ T9368] ? __pfx____ratelimit+0x10/0x10 [ 209.144533][ T9368] ? __pfx_dump_stack_lvl+0x10/0x10 [ 209.144563][ T9368] ? __pfx__printk+0x10/0x10 [ 209.144589][ T9368] ? __might_fault+0xb0/0x130 [ 209.144622][ T9368] ? rcu_is_watching+0x15/0xb0 [ 209.144645][ T9368] should_fail_ex+0x414/0x560 [ 209.144675][ T9368] _copy_from_iter+0x1de/0x1790 [ 209.144693][ T9368] ? unwind_next_frame+0xa5/0x2390 [ 209.144717][ T9368] ? rcu_is_watching+0x15/0xb0 [ 209.144739][ T9368] ? unwind_next_frame+0xa5/0x2390 [ 209.144764][ T9368] ? unwind_next_frame+0xa5/0x2390 [ 209.144791][ T9368] ? __pfx__copy_from_iter+0x10/0x10 [ 209.144823][ T9368] ? rcu_is_watching+0x15/0xb0 [ 209.144844][ T9368] ? lock_release+0x4b/0x3e0 [ 209.144862][ T9368] ? lock_release+0x4b/0x3e0 [ 209.144884][ T9368] tun_get_user+0x488/0x3e20 [ 209.144912][ T9368] ? rcu_is_watching+0x15/0xb0 [ 209.144933][ T9368] ? lock_release+0x4b/0x3e0 [ 209.144954][ T9368] ? aa_file_perm+0x44d/0x1550 [ 209.144981][ T9368] ? __pfx_tun_get_user+0x10/0x10 [ 209.145005][ T9368] ? _parse_integer_limit+0x1ae/0x1f0 [ 209.145036][ T9368] ? kstrtoull+0x12f/0x1d0 [ 209.145067][ T9368] ? ref_tracker_alloc+0x318/0x460 [ 209.145096][ T9368] ? get_pid_task+0x20/0x1f0 [ 209.145124][ T9368] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 209.145154][ T9368] ? tun_get+0x1c/0x2f0 [ 209.145176][ T9368] ? tun_get+0x1c/0x2f0 [ 209.145199][ T9368] ? rcu_is_watching+0x15/0xb0 [ 209.145220][ T9368] ? tun_get+0x1c/0x2f0 [ 209.145242][ T9368] ? lock_release+0x4b/0x3e0 [ 209.145259][ T9368] ? common_file_perm+0x1b5/0x230 [ 209.145285][ T9368] ? tun_get+0x1c/0x2f0 [ 209.145310][ T9368] tun_chr_write_iter+0x113/0x200 [ 209.145335][ T9368] vfs_write+0x5c9/0xb30 [ 209.145356][ T9368] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 209.145381][ T9368] ? __pfx_vfs_write+0x10/0x10 [ 209.145405][ T9368] ? __fget_files+0x2a/0x420 [ 209.145438][ T9368] ksys_write+0x145/0x250 [ 209.145458][ T9368] ? __pfx_ksys_write+0x10/0x10 [ 209.145476][ T9368] ? rcu_is_watching+0x15/0xb0 [ 209.145501][ T9368] do_syscall_64+0xfa/0xfa0 [ 209.145528][ T9368] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.145548][ T9368] ? clear_bhb_loop+0x60/0xb0 [ 209.145571][ T9368] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.145589][ T9368] RIP: 0033:0x7fdc9fb8ebe9 [ 209.145606][ T9368] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 209.145623][ T9368] RSP: 002b:00007fdca0a57038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 209.145644][ T9368] RAX: ffffffffffffffda RBX: 00007fdc9fdc5fa0 RCX: 00007fdc9fb8ebe9 [ 209.145659][ T9368] RDX: 0000000000000fce RSI: 0000200000001800 RDI: 0000000000000003 [ 209.145673][ T9368] RBP: 00007fdca0a57090 R08: 0000000000000000 R09: 0000000000000000 [ 209.145685][ T9368] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 209.145696][ T9368] R13: 00007fdc9fdc6038 R14: 00007fdc9fdc5fa0 R15: 00007fff22ccdb48 [ 209.145719][ T9368] [ 209.218744][ T9348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 209.432513][ T5860] Bluetooth: hci1: command tx timeout [ 209.445951][ T5958] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 209.456335][ T9348] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 209.507085][ T5902] usb 3-1: USB disconnect, device number 52 [ 209.567268][ T9370] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 209.568143][ T9371] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 209.594238][ T9371] overlayfs: fs on './file0' does not support file handles, falling back to xino=off. [ 209.616761][ T5958] usb 5-1: config 0 has an invalid interface number: 128 but max is 0 [ 209.625191][ T5958] usb 5-1: config 0 has no interface number 0 [ 209.631353][ T5958] usb 5-1: config 0 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 209.645090][ T5958] usb 5-1: config 0 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 209.655273][ T5958] usb 5-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 209.664491][ T5958] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.675313][ T5958] usb 5-1: config 0 descriptor?? [ 209.834121][ T1080] Bluetooth: hci4: Frame reassembly failed (-84) [ 209.976686][ T9384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 209.987506][ T9384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 209.997644][ T9384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.006543][ T9384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.068777][ T9388] /dev/rnullb0: Can't open blockdev [ 210.082589][ T1219] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 210.096596][ T5958] uclogic 0003:256C:006D.000F: interface is invalid, ignoring [ 210.172041][ T9394] syzkaller1: entered promiscuous mode [ 210.177627][ T9394] syzkaller1: entered allmulticast mode [ 210.185234][ T9394] FAULT_INJECTION: forcing a failure. [ 210.185234][ T9394] name failslab, interval 1, probability 0, space 0, times 0 [ 210.198272][ T9394] CPU: 0 UID: 0 PID: 9394 Comm: syz.2.934 Not tainted syzkaller #0 PREEMPT(full) [ 210.198299][ T9394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 210.198312][ T9394] Call Trace: [ 210.198320][ T9394] [ 210.198328][ T9394] dump_stack_lvl+0x189/0x250 [ 210.198364][ T9394] ? __pfx____ratelimit+0x10/0x10 [ 210.198388][ T9394] ? __pfx_dump_stack_lvl+0x10/0x10 [ 210.198419][ T9394] ? __pfx__printk+0x10/0x10 [ 210.198448][ T9394] ? __pfx___might_resched+0x10/0x10 [ 210.198469][ T9394] ? lock_acquire+0x5f/0x360 [ 210.198489][ T9394] should_fail_ex+0x414/0x560 [ 210.198518][ T9394] should_failslab+0xa8/0x100 [ 210.198538][ T9394] kmem_cache_alloc_node_noprof+0x76/0x390 [ 210.198569][ T9394] ? __alloc_skb+0x112/0x2d0 [ 210.198595][ T9394] __alloc_skb+0x112/0x2d0 [ 210.198623][ T9394] alloc_skb_with_frags+0xca/0x890 [ 210.198655][ T9394] ? rcu_is_watching+0x15/0xb0 [ 210.198676][ T9394] ? lock_release+0x4b/0x3e0 [ 210.198694][ T9394] ? __might_fault+0xb0/0x130 [ 210.198723][ T9394] sock_alloc_send_pskb+0x857/0x990 [ 210.198751][ T9394] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 210.198770][ T9394] ? rcu_is_watching+0x15/0xb0 [ 210.198792][ T9394] ? lock_release+0x4b/0x3e0 [ 210.198809][ T9394] ? lock_release+0x4b/0x3e0 [ 210.198836][ T9394] ? iov_iter_advance+0x8b/0x1c0 [ 210.198856][ T9394] tun_get_user+0xa43/0x3e20 [ 210.198884][ T9394] ? rcu_is_watching+0x15/0xb0 [ 210.198906][ T9394] ? lock_release+0x4b/0x3e0 [ 210.198927][ T9394] ? aa_file_perm+0x44d/0x1550 [ 210.198960][ T9394] ? __pfx_tun_get_user+0x10/0x10 [ 210.198985][ T9394] ? _parse_integer_limit+0x1ae/0x1f0 [ 210.199017][ T9394] ? kstrtoull+0x12f/0x1d0 [ 210.199048][ T9394] ? ref_tracker_alloc+0x318/0x460 [ 210.199077][ T9394] ? get_pid_task+0x20/0x1f0 [ 210.199105][ T9394] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 210.199135][ T9394] ? tun_get+0x1c/0x2f0 [ 210.199157][ T9394] ? tun_get+0x1c/0x2f0 [ 210.199180][ T9394] ? rcu_is_watching+0x15/0xb0 [ 210.199200][ T9394] ? tun_get+0x1c/0x2f0 [ 210.199223][ T9394] ? lock_release+0x4b/0x3e0 [ 210.199241][ T9394] ? common_file_perm+0x1b5/0x230 [ 210.199267][ T9394] ? tun_get+0x1c/0x2f0 [ 210.199293][ T9394] tun_chr_write_iter+0x113/0x200 [ 210.199318][ T9394] vfs_write+0x5c9/0xb30 [ 210.199339][ T9394] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 210.199364][ T9394] ? __pfx_vfs_write+0x10/0x10 [ 210.199386][ T9394] ? __fget_files+0x2a/0x420 [ 210.199413][ T9394] ksys_write+0x145/0x250 [ 210.199435][ T9394] ? __pfx_ksys_write+0x10/0x10 [ 210.199450][ T9394] ? rcu_is_watching+0x15/0xb0 [ 210.199467][ T9394] do_syscall_64+0xfa/0xfa0 [ 210.199487][ T9394] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.199500][ T9394] ? clear_bhb_loop+0x60/0xb0 [ 210.199516][ T9394] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.199530][ T9394] RIP: 0033:0x7fd8b358ebe9 [ 210.199542][ T9394] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 210.199554][ T9394] RSP: 002b:00007fd8b4424038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 210.199571][ T9394] RAX: ffffffffffffffda RBX: 00007fd8b37c5fa0 RCX: 00007fd8b358ebe9 [ 210.199582][ T9394] RDX: 0000000000000fce RSI: 0000200000001800 RDI: 0000000000000003 [ 210.199592][ T9394] RBP: 00007fd8b4424090 R08: 0000000000000000 R09: 0000000000000000 [ 210.199600][ T9394] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 210.199609][ T9394] R13: 00007fd8b37c6038 R14: 00007fd8b37c5fa0 R15: 00007ffc2789dfe8 [ 210.199625][ T9394] [ 210.643579][ T1219] usb 6-1: unable to get BOS descriptor or descriptor too short [ 210.651831][ T1219] usb 6-1: not running at top speed; connect to a high speed hub [ 210.660541][ T1219] usb 6-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 210.674522][ T1219] usb 6-1: New USB device found, idVendor=1163, idProduct=0100, bcdDevice=dc.ba [ 210.685350][ T1219] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.693448][ T1219] usb 6-1: Product: syz [ 210.697648][ T1219] usb 6-1: Manufacturer: syz [ 210.702715][ T1219] usb 6-1: SerialNumber: syz [ 211.135668][ T1219] cypress_m8 6-1:5.0: DeLorme Earthmate USB converter detected [ 211.149861][ T1219] earthmate ttyUSB0: required endpoint is missing [ 211.159544][ T9427] netlink: 277 bytes leftover after parsing attributes in process `syz.3.939'. [ 211.162396][ T1219] usb 6-1: USB disconnect, device number 2 [ 211.191281][ T1219] cypress_m8 6-1:5.0: device disconnected [ 211.413235][ T5923] IPVS: starting estimator thread 0... [ 211.501433][ T5869] Bluetooth: hci1: command tx timeout [ 211.511644][ T9437] IPVS: using max 52 ests per chain, 124800 per kthread [ 211.647988][ T9441] syzkaller1: entered promiscuous mode [ 211.653648][ T9441] syzkaller1: entered allmulticast mode [ 211.755474][ T9443] syzkaller1: entered promiscuous mode [ 211.761085][ T9443] syzkaller1: entered allmulticast mode [ 211.911181][ T5869] Bluetooth: hci4: command 0x1003 tx timeout [ 211.911911][ T5860] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 212.272621][ T5923] usb 5-1: USB disconnect, device number 32 [ 212.366512][ T9470] netlink: 12 bytes leftover after parsing attributes in process `syz.3.951'. [ 212.428094][ T9474] syzkaller1: entered promiscuous mode [ 212.460927][ T9474] syzkaller1: entered allmulticast mode [ 212.482215][ T9481] FAULT_INJECTION: forcing a failure. [ 212.482215][ T9481] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 212.521755][ T9481] CPU: 0 UID: 0 PID: 9481 Comm: syz.2.952 Not tainted syzkaller #0 PREEMPT(full) [ 212.521783][ T9481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 212.521796][ T9481] Call Trace: [ 212.521804][ T9481] [ 212.521812][ T9481] dump_stack_lvl+0x189/0x250 [ 212.521847][ T9481] ? __pfx____ratelimit+0x10/0x10 [ 212.521873][ T9481] ? __pfx_dump_stack_lvl+0x10/0x10 [ 212.521902][ T9481] ? __pfx__printk+0x10/0x10 [ 212.521932][ T9481] ? lock_acquire+0x5f/0x360 [ 212.521954][ T9481] should_fail_ex+0x414/0x560 [ 212.521984][ T9481] prepare_alloc_pages+0x213/0x610 [ 212.522010][ T9481] __alloc_frozen_pages_noprof+0x123/0x370 [ 212.522035][ T9481] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 212.522060][ T9481] ? rcu_is_watching+0x15/0xb0 [ 212.522084][ T9481] ? policy_nodemask+0x27c/0x720 [ 212.522117][ T9481] alloc_pages_mpol+0x232/0x4a0 [ 212.522136][ T9481] alloc_pages_noprof+0xa9/0x190 [ 212.522156][ T9481] alloc_skb_with_frags+0x233/0x890 [ 212.522192][ T9481] sock_alloc_send_pskb+0x857/0x990 [ 212.522221][ T9481] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 212.522242][ T9481] ? rcu_is_watching+0x15/0xb0 [ 212.522263][ T9481] ? lock_release+0x4b/0x3e0 [ 212.522281][ T9481] ? lock_release+0x4b/0x3e0 [ 212.522299][ T9481] ? iov_iter_advance+0x8b/0x1c0 [ 212.522328][ T9481] tun_get_user+0xa43/0x3e20 [ 212.522356][ T9481] ? rcu_is_watching+0x15/0xb0 [ 212.522378][ T9481] ? lock_release+0x4b/0x3e0 [ 212.522399][ T9481] ? aa_file_perm+0x44d/0x1550 [ 212.522427][ T9481] ? __pfx_tun_get_user+0x10/0x10 [ 212.522451][ T9481] ? _parse_integer_limit+0x1ae/0x1f0 [ 212.522483][ T9481] ? kstrtoull+0x12f/0x1d0 [ 212.522515][ T9481] ? ref_tracker_alloc+0x318/0x460 [ 212.522544][ T9481] ? get_pid_task+0x20/0x1f0 [ 212.522571][ T9481] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 212.522602][ T9481] ? tun_get+0x1c/0x2f0 [ 212.522625][ T9481] ? tun_get+0x1c/0x2f0 [ 212.522648][ T9481] ? rcu_is_watching+0x15/0xb0 [ 212.522668][ T9481] ? tun_get+0x1c/0x2f0 [ 212.522690][ T9481] ? lock_release+0x4b/0x3e0 [ 212.522707][ T9481] ? common_file_perm+0x1b5/0x230 [ 212.522732][ T9481] ? tun_get+0x1c/0x2f0 [ 212.522758][ T9481] tun_chr_write_iter+0x113/0x200 [ 212.522784][ T9481] vfs_write+0x5c9/0xb30 [ 212.522806][ T9481] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 212.522830][ T9481] ? __pfx_vfs_write+0x10/0x10 [ 212.522854][ T9481] ? __fget_files+0x2a/0x420 [ 212.522882][ T9481] ksys_write+0x145/0x250 [ 212.522903][ T9481] ? __pfx_ksys_write+0x10/0x10 [ 212.522924][ T9481] ? rcu_is_watching+0x15/0xb0 [ 212.522947][ T9481] do_syscall_64+0xfa/0xfa0 [ 212.522974][ T9481] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.522994][ T9481] ? clear_bhb_loop+0x60/0xb0 [ 212.523016][ T9481] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.523035][ T9481] RIP: 0033:0x7fd8b358ebe9 [ 212.523052][ T9481] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 212.523070][ T9481] RSP: 002b:00007fd8b4403038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 212.523092][ T9481] RAX: ffffffffffffffda RBX: 00007fd8b37c6090 RCX: 00007fd8b358ebe9 [ 212.523107][ T9481] RDX: 0000000000000fce RSI: 0000200000001800 RDI: 0000000000000003 [ 212.523119][ T9481] RBP: 00007fd8b4403090 R08: 0000000000000000 R09: 0000000000000000 [ 212.523132][ T9481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 212.523144][ T9481] R13: 00007fd8b37c6128 R14: 00007fd8b37c6090 R15: 00007ffc2789dfe8 [ 212.523167][ T9481] [ 213.209685][ T9513] team_slave_0: entered promiscuous mode [ 213.215439][ T9513] team_slave_1: entered promiscuous mode [ 213.223176][ T9513] netlink: 8 bytes leftover after parsing attributes in process `syz.5.958'. [ 213.232649][ T9513] /dev/rnullb0: Can't open blockdev [ 213.268360][ T9512] /dev/rnullb0: Can't open blockdev [ 213.289618][ T9513] team_slave_0: left promiscuous mode [ 213.295123][ T9513] team_slave_1: left promiscuous mode [ 213.411253][ T9529] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 213.411535][ T9529] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 213.712388][ T9536] syzkaller1: entered promiscuous mode [ 213.723010][ T9536] syzkaller1: entered allmulticast mode [ 213.730631][ T9536] FAULT_INJECTION: forcing a failure. [ 213.730631][ T9536] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 213.746758][ T9536] CPU: 1 UID: 0 PID: 9536 Comm: syz.5.964 Not tainted syzkaller #0 PREEMPT(full) [ 213.746787][ T9536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 213.746799][ T9536] Call Trace: [ 213.746807][ T9536] [ 213.746815][ T9536] dump_stack_lvl+0x189/0x250 [ 213.746851][ T9536] ? __pfx____ratelimit+0x10/0x10 [ 213.746876][ T9536] ? __pfx_dump_stack_lvl+0x10/0x10 [ 213.746905][ T9536] ? __pfx__printk+0x10/0x10 [ 213.746930][ T9536] ? __might_fault+0xb0/0x130 [ 213.746964][ T9536] ? rcu_is_watching+0x15/0xb0 [ 213.746987][ T9536] should_fail_ex+0x414/0x560 [ 213.747016][ T9536] _copy_from_iter+0x1de/0x1790 [ 213.747036][ T9536] ? skb_set_owner_w+0x25b/0x3a0 [ 213.747069][ T9536] ? sock_alloc_send_pskb+0x875/0x990 [ 213.747091][ T9536] ? __pfx__copy_from_iter+0x10/0x10 [ 213.747114][ T9536] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 213.747136][ T9536] skb_copy_datagram_from_iter+0xf5/0x720 [ 213.747156][ T9536] ? lock_release+0x4b/0x3e0 [ 213.747175][ T9536] ? skb_put+0x11b/0x210 [ 213.747202][ T9536] tun_get_user+0x1691/0x3e20 [ 213.747239][ T9536] ? rcu_is_watching+0x15/0xb0 [ 213.747261][ T9536] ? lock_release+0x4b/0x3e0 [ 213.747283][ T9536] ? aa_file_perm+0x44d/0x1550 [ 213.747311][ T9536] ? __pfx_tun_get_user+0x10/0x10 [ 213.747334][ T9536] ? _parse_integer_limit+0x1ae/0x1f0 [ 213.747366][ T9536] ? kstrtoull+0x12f/0x1d0 [ 213.747398][ T9536] ? ref_tracker_alloc+0x318/0x460 [ 213.747426][ T9536] ? get_pid_task+0x20/0x1f0 [ 213.747453][ T9536] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 213.747483][ T9536] ? tun_get+0x1c/0x2f0 [ 213.747505][ T9536] ? tun_get+0x1c/0x2f0 [ 213.747528][ T9536] ? rcu_is_watching+0x15/0xb0 [ 213.747548][ T9536] ? tun_get+0x1c/0x2f0 [ 213.747571][ T9536] ? lock_release+0x4b/0x3e0 [ 213.747588][ T9536] ? common_file_perm+0x1b5/0x230 [ 213.747613][ T9536] ? tun_get+0x1c/0x2f0 [ 213.747639][ T9536] tun_chr_write_iter+0x113/0x200 [ 213.747664][ T9536] vfs_write+0x5c9/0xb30 [ 213.747685][ T9536] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 213.747710][ T9536] ? __pfx_vfs_write+0x10/0x10 [ 213.747733][ T9536] ? __fget_files+0x2a/0x420 [ 213.747761][ T9536] ksys_write+0x145/0x250 [ 213.747781][ T9536] ? __pfx_ksys_write+0x10/0x10 [ 213.747803][ T9536] ? rcu_is_watching+0x15/0xb0 [ 213.747826][ T9536] do_syscall_64+0xfa/0xfa0 [ 213.747852][ T9536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.747872][ T9536] ? clear_bhb_loop+0x60/0xb0 [ 213.747894][ T9536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 213.747912][ T9536] RIP: 0033:0x7f91b958ebe9 [ 213.747930][ T9536] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 213.747947][ T9536] RSP: 002b:00007f91b77f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 213.747968][ T9536] RAX: ffffffffffffffda RBX: 00007f91b97c5fa0 RCX: 00007f91b958ebe9 [ 213.747982][ T9536] RDX: 0000000000000fce RSI: 0000200000001800 RDI: 0000000000000003 [ 213.747995][ T9536] RBP: 00007f91b77f6090 R08: 0000000000000000 R09: 0000000000000000 [ 213.748007][ T9536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 213.748018][ T9536] R13: 00007f91b97c6038 R14: 00007f91b97c5fa0 R15: 00007ffca6804c98 [ 213.748040][ T9536] [ 214.354473][ T9547] syzkaller1: entered promiscuous mode [ 214.360378][ T9547] syzkaller1: entered allmulticast mode [ 214.399976][ T5918] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 214.561790][ T5918] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 214.593736][ T5918] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 214.619937][ T5918] usb 6-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 214.653014][ T5918] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.674204][ T5918] usb 6-1: config 0 descriptor?? [ 214.694582][ T9556] /dev/rnullb0: Can't open blockdev [ 214.799787][ T1568] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 214.961407][ T1568] usb 5-1: Using ep0 maxpacket: 16 [ 214.981877][ T1568] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 214.989273][ T9572] netlink: 8 bytes leftover after parsing attributes in process `syz.3.975'. [ 214.997671][ T1568] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 215.012102][ T1568] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 215.024337][ T9573] /dev/rnullb0: Can't open blockdev [ 215.024825][ T9572] netlink: 176 bytes leftover after parsing attributes in process `syz.3.975'. [ 215.029922][ T9574] /dev/rnullb0: Can't open blockdev [ 215.059467][ T1568] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 215.075838][ T1568] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 215.088988][ T5918] playstation 0003:054C:0DF2.0010: unknown main item tag 0x0 [ 215.089560][ T1568] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 215.132211][ T5918] playstation 0003:054C:0DF2.0010: unknown main item tag 0x0 [ 215.144153][ T5918] playstation 0003:054C:0DF2.0010: unknown main item tag 0x0 [ 215.148764][ T9579] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 215.153956][ T5918] playstation 0003:054C:0DF2.0010: unknown main item tag 0x0 [ 215.160994][ T1568] usb 5-1: Manufacturer: syz [ 215.172061][ T5918] playstation 0003:054C:0DF2.0010: unknown main item tag 0x0 [ 215.182691][ T5918] playstation 0003:054C:0DF2.0010: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.5-1/input0 [ 215.196231][ T9579] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 215.225805][ T1568] usb 5-1: config 0 descriptor?? [ 215.682747][ T5918] playstation 0003:054C:0DF2.0010: Failed to retrieve feature with reportID 32: -71 [ 215.692483][ T5918] playstation 0003:054C:0DF2.0010: Failed to retrieve DualSense firmware info: -71 [ 215.701911][ T5918] playstation 0003:054C:0DF2.0010: Failed to get firmware info from DualSense [ 215.711544][ T5918] playstation 0003:054C:0DF2.0010: Failed to create dualsense. [ 215.721382][ T5918] playstation 0003:054C:0DF2.0010: probe with driver playstation failed with error -71 [ 215.733249][ T5918] usb 6-1: USB disconnect, device number 3 [ 216.066159][ T9604] syz.3.984 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 216.081379][ T9605] netlink: 4083 bytes leftover after parsing attributes in process `syz.4.983'. [ 216.091488][ T9602] netlink: 4083 bytes leftover after parsing attributes in process `syz.4.983'. [ 216.172765][ T9609] tmpfs: Unknown parameter 'obj_roe' [ 216.234071][ T9611] /dev/rnullb0: Can't open blockdev [ 216.383634][ T9617] 9p: Could not find request transport: 0xffffffffffffffff [ 216.660715][ T9639] fuse: Bad value for 'user_id' [ 216.665633][ T9639] fuse: Bad value for 'user_id' [ 216.765381][ T9648] syzkaller1: entered promiscuous mode [ 216.771151][ T9648] syzkaller1: entered allmulticast mode [ 216.779080][ T9650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 216.781143][ T9648] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 216.787916][ T9650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 216.793413][ T9648] syzkaller1: Linktype set failed because interface is up [ 216.812606][ T1167] syzkaller1: tun_net_xmit 70 [ 216.857329][ T9640] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 216.866650][ T9640] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.138219][ T9663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.148098][ T9663] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.159244][ T9663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.168035][ T9663] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.521967][ T5940] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 217.553588][ T5940] hid-generic 0000:0000:0000.0011: hidraw0: HID v0.00 Device [syz1] on syz0 [ 217.901440][ T9679] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.913617][ T9679] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.927773][ T9681] use of bytesused == 0 is deprecated and will be removed in the future, [ 217.939865][ T9681] use the actual size instead. [ 217.985522][ T9687] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.994273][ T9687] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.188049][ T1219] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 218.341641][ T1219] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 218.352353][ T1219] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.360493][ T1219] usb 3-1: Product: syz [ 218.364672][ T1219] usb 3-1: Manufacturer: syz [ 218.369420][ T1219] usb 3-1: SerialNumber: syz [ 218.375306][ T1219] usb 3-1: config 0 descriptor?? [ 218.383368][ T1219] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 218.617107][ T9693] syzkaller1: entered promiscuous mode [ 218.625541][ T9693] syzkaller1: entered allmulticast mode [ 218.634845][ T9693] syzkaller1: left promiscuous mode [ 218.639403][ T9695] /dev/rnullb0: Can't open blockdev [ 218.640247][ T9693] syzkaller1: left allmulticast mode [ 218.685556][ T9697] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.697361][ T9697] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.826152][ T9702] input: syz1 as /devices/virtual/input/input24 [ 219.009443][ T1219] gspca_sunplus: reg_r err -71 [ 219.014325][ T1219] sunplus 3-1:0.0: probe with driver sunplus failed with error -71 [ 219.027482][ T1219] usb 3-1: USB disconnect, device number 53 [ 219.128446][ T5902] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 219.236357][ T9715] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 219.246279][ T9715] /dev/rnullb0: Can't open blockdev [ 219.286101][ T9717] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.287880][ T5902] usb 6-1: Using ep0 maxpacket: 8 [ 219.297691][ T9717] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.306613][ T5902] usb 6-1: config 0 has an invalid interface number: 115 but max is 0 [ 219.316642][ T5902] usb 6-1: config 0 has no interface number 0 [ 219.325162][ T5902] usb 6-1: too many endpoints for config 0 interface 115 altsetting 116: 101, using maximum allowed: 30 [ 219.337645][ T5902] usb 6-1: config 0 interface 115 altsetting 116 has 0 endpoint descriptors, different from the interface descriptor's value: 101 [ 219.367485][ T5902] usb 6-1: config 0 interface 115 has no altsetting 0 [ 219.397659][ T5902] usb 6-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 219.412238][ T5902] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.421447][ T5902] usb 6-1: Product: syz [ 219.425727][ T5902] usb 6-1: Manufacturer: syz [ 219.431435][ T5902] usb 6-1: SerialNumber: syz [ 219.446632][ T5902] usb 6-1: config 0 descriptor?? [ 219.454299][ T5902] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 219.614583][ T9724] netlink: 'syz.2.1025': attribute type 4 has an invalid length. [ 219.637362][ T9724] netlink: 'syz.2.1025': attribute type 4 has an invalid length. [ 219.731743][ T9721] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1024'. [ 220.210434][ T9731] program syz.4.1027 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 220.450292][ T9737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 220.459484][ T9737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.205254][ T9765] /dev/rnullb0: Can't open blockdev [ 221.934469][ T1219] usb 6-1: USB disconnect, device number 4 [ 222.005826][ T9807] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 222.028130][ T9808] /dev/rnullb0: Can't open blockdev [ 222.033995][ T9807] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.296874][ T5186] Bluetooth: hci3: command 0x0406 tx timeout [ 222.515951][ T5902] usb 3-1: new low-speed USB device number 54 using dummy_hcd [ 222.614095][ T9842] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 222.630796][ T9842] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.643203][ T5186] Bluetooth: hci0: ISO packet for unknown connection handle 0 [ 222.676097][ T5902] usb 3-1: Invalid ep0 maxpacket: 64 [ 222.802139][ T9852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 222.810925][ T9852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.818038][ T5902] usb 3-1: new low-speed USB device number 55 using dummy_hcd [ 222.975732][ T5902] usb 3-1: Invalid ep0 maxpacket: 64 [ 222.981468][ T5902] usb usb3-port1: attempt power cycle [ 223.144524][ T9857] /dev/rnullb0: Can't open blockdev [ 223.243799][ T31] audit: type=1326 audit(1756635044.149:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9862 comm="syz.4.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f021c38ebe9 code=0x50000 [ 223.270330][ T31] audit: type=1326 audit(1756635044.149:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9862 comm="syz.4.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f021c38ebe9 code=0x50000 [ 223.292780][ T31] audit: type=1326 audit(1756635044.149:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9862 comm="syz.4.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f021c38ebe9 code=0x50000 [ 223.316916][ T31] audit: type=1326 audit(1756635044.149:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9862 comm="syz.4.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f021c38ebe9 code=0x50000 [ 223.339753][ T31] audit: type=1326 audit(1756635044.149:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9862 comm="syz.4.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f021c38ebe9 code=0x50000 [ 223.347034][ T5902] usb 3-1: new low-speed USB device number 56 using dummy_hcd [ 223.361899][ T31] audit: type=1326 audit(1756635044.149:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9862 comm="syz.4.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f021c38ebe9 code=0x50000 [ 223.391519][ T31] audit: type=1326 audit(1756635044.149:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9862 comm="syz.4.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f021c38ebe9 code=0x50000 [ 223.399386][ T5902] usb 3-1: Invalid ep0 maxpacket: 64 [ 223.420800][ T31] audit: type=1326 audit(1756635044.149:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9862 comm="syz.4.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f021c38ebe9 code=0x50000 [ 223.445655][ T31] audit: type=1326 audit(1756635044.149:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9862 comm="syz.4.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f021c38ebe9 code=0x50000 [ 223.468005][ T31] audit: type=1326 audit(1756635044.149:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9862 comm="syz.4.1056" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f021c38ebe9 code=0x50000 [ 223.545403][ T5902] usb 3-1: new low-speed USB device number 57 using dummy_hcd [ 223.557624][ T1219] usb 6-1: new low-speed USB device number 5 using dummy_hcd [ 223.567407][ T5902] usb 3-1: Invalid ep0 maxpacket: 64 [ 223.573430][ T5902] usb usb3-port1: unable to enumerate USB device [ 223.695288][ T1219] usb 6-1: device descriptor read/64, error -71 [ 223.940063][ T1219] usb 6-1: new low-speed USB device number 6 using dummy_hcd [ 224.086686][ T1219] usb 6-1: device descriptor read/64, error -71 [ 224.216658][ T1219] usb usb6-port1: attempt power cycle [ 224.294961][ T5186] Bluetooth: hci1: command 0x0405 tx timeout [ 224.554846][ T1219] usb 6-1: new low-speed USB device number 7 using dummy_hcd [ 224.575273][ T1219] usb 6-1: device descriptor read/8, error -71 [ 224.814710][ T1219] usb 6-1: new low-speed USB device number 8 using dummy_hcd [ 224.866598][ T1219] usb 6-1: device descriptor read/8, error -71 [ 224.896052][ T9884] tmpfs: Unknown parameter 'noinode32' [ 224.971696][ T9886] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 224.989788][ T1219] usb usb6-port1: unable to enumerate USB device [ 225.011873][ T9886] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 225.824217][ T5918] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 225.994169][ T5918] usb 3-1: Using ep0 maxpacket: 8 [ 226.005232][ T5918] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.026017][ T5918] usb 3-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice=ef.00 [ 226.038884][ T5918] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=255 [ 226.055651][ T5918] usb 3-1: Product: syz [ 226.059928][ T5918] usb 3-1: Manufacturer: syz [ 226.071424][ T5918] usb 3-1: SerialNumber: syz [ 226.079341][ T5918] usb 3-1: config 0 descriptor?? [ 226.108072][ T9903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 226.140084][ T9903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 226.271141][ T9906] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 226.521871][ T9914] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1075'. [ 227.663709][ T1568] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 227.823195][ T1568] usb 6-1: Using ep0 maxpacket: 16 [ 227.832551][ T1568] usb 6-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 227.841816][ T1568] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 227.849867][ T1568] usb 6-1: Product: syz [ 227.854132][ T1568] usb 6-1: Manufacturer: syz [ 227.858748][ T1568] usb 6-1: SerialNumber: syz [ 227.865883][ T1568] usb 6-1: config 0 descriptor?? [ 228.079224][ T1568] speedtch 6-1:0.0: speedtch_bind: data interface not found! [ 228.089410][ T1568] speedtch 6-1:0.0: usbatm_usb_probe: bind failed: -19! [ 228.104655][ T1568] usb 6-1: USB disconnect, device number 9 [ 228.415084][ T9960] /dev/rnullb0: Can't open blockdev [ 228.601736][ T5958] usb 3-1: USB disconnect, device number 58 [ 228.901863][ T9976] hugetlbfs: Bad value '' for mount option 'size' [ 228.901863][ T9976] [ 228.915410][ T9976] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 228.936944][ T9976] kvm: pic: non byte read [ 228.941749][ T9976] kvm: pic: level sensitive irq not supported [ 228.941852][ T9976] kvm: pic: non byte read [ 228.955852][ T9976] kvm: pic: level sensitive irq not supported [ 228.955921][ T9976] kvm: pic: non byte read [ 228.967281][ T9976] kvm: pic: level sensitive irq not supported [ 228.967353][ T9976] kvm: pic: non byte read [ 228.977270][ T9984] /dev/rnullb0: Can't open blockdev [ 229.012898][ T5958] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 229.172871][ T5958] usb 6-1: Using ep0 maxpacket: 8 [ 229.180053][ T5958] usb 6-1: config 5 has an invalid interface number: 52 but max is 1 [ 229.190610][ T5958] usb 6-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 229.212803][ T5958] usb 6-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 229.221711][ T5958] usb 6-1: config 5 has no interface number 0 [ 229.236099][ T5958] usb 6-1: New USB device found, idVendor=04b4, idProduct=0002, bcdDevice=e2.5c [ 229.254815][ T5958] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.274245][ T5958] usb 6-1: Product: syz [ 229.278616][ T5958] usb 6-1: Manufacturer: syz [ 229.287206][ T5958] usb 6-1: SerialNumber: syz [ 229.446220][T10004] /dev/rnullb0: Can't open blockdev [ 229.519053][ T5958] cytherm 6-1:5.52: Cypress thermometer device now attached [ 229.545772][ T5958] usb 6-1: USB disconnect, device number 10 [ 229.559021][ T5958] cytherm 6-1:5.52: Cypress thermometer now disconnected [ 229.782389][T10016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.795703][T10016] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.041529][T10018] rdma_rxe: rxe_newlink: failed to add wlan1 [ 230.041534][T10019] rdma_rxe: rxe_newlink: failed to add wlan1 [ 230.059328][T10018] /dev/rnullb0: Can't open blockdev [ 230.385771][T10036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.402207][T10036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.412919][T10037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.423530][T10037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.611905][ T5958] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 230.688169][T10049] netlink: 'syz.3.1111': attribute type 28 has an invalid length. [ 230.752407][ T5958] usb 3-1: device descriptor read/64, error -71 [ 230.810993][T10058] /dev/rnullb0: Can't open blockdev [ 230.824469][T10060] /dev/rnullb0: Can't open blockdev [ 230.892975][T10069] /dev/rnullb0: Can't open blockdev [ 230.904739][T10069] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.924243][T10069] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 231.001860][ T5958] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 231.127711][T10082] /dev/rnullb0: Can't open blockdev [ 231.131705][ T5958] usb 3-1: device descriptor read/64, error -71 [ 231.186697][T10084] ubi: mtd0 is already attached to ubi7 [ 231.236290][T10086] /dev/rnullb0: Can't open blockdev [ 231.251879][ T5958] usb usb3-port1: attempt power cycle [ 231.456142][T10097] rdma_rxe: rxe_newlink: failed to add wlan1 [ 231.467309][T10097] /dev/rnullb0: Can't open blockdev [ 231.591604][ T5958] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 231.624215][ T5958] usb 3-1: device descriptor read/8, error -71 [ 231.683311][T10115] /dev/rnullb0: Can't open blockdev [ 231.747799][T10120] syzkaller1: entered promiscuous mode [ 231.756436][T10120] syzkaller1: entered allmulticast mode [ 231.862222][ T5958] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 231.882369][ T5958] usb 3-1: device descriptor read/8, error -71 [ 231.995028][ T5958] usb usb3-port1: unable to enumerate USB device [ 232.251020][ T5918] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 232.411031][ T5918] usb 6-1: Using ep0 maxpacket: 32 [ 232.416861][ T5918] usb 6-1: too many configurations: 17, using maximum allowed: 8 [ 232.425987][ T5918] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 232.435518][ T5918] usb 6-1: config 0 has no interface number 0 [ 232.445114][ T5918] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 232.466205][ T5918] usb 6-1: config 0 has no interface number 0 [ 232.473607][ T5918] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 232.481962][ T5918] usb 6-1: config 0 has no interface number 0 [ 232.489727][ T5918] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 232.511515][ T5918] usb 6-1: config 0 has no interface number 0 [ 232.519598][ T5918] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 232.527962][ T5918] usb 6-1: config 0 has no interface number 0 [ 232.535474][ T5918] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 232.544033][ T5918] usb 6-1: config 0 has no interface number 0 [ 232.552021][ T5918] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 232.560194][ T5918] usb 6-1: config 0 has no interface number 0 [ 232.567262][ T5918] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 232.585208][ T5918] usb 6-1: config 0 has no interface number 0 [ 232.598002][ T5918] usb 6-1: New USB device found, idVendor=108c, idProduct=0168, bcdDevice=84.b2 [ 232.607217][ T5918] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.616268][ T5918] usb 6-1: Product: syz [ 232.621236][ T5918] usb 6-1: Manufacturer: syz [ 232.625887][ T5918] usb 6-1: SerialNumber: syz [ 232.632274][ T5918] usb 6-1: config 0 descriptor?? [ 232.638612][ T5918] etas_es58x 6-1:0.2: Starting syz syz (Serial Number syz) [ 232.745233][T10137] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.754665][T10137] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 232.775755][T10137] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.785273][T10137] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 232.840379][ T5918] etas_es58x 6-1:0.2: could not parse product info: '424242424242' [ 233.036072][T10151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.046465][T10151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.267215][ C0] etas_es58x 6-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0x0061. [ 233.278228][ C0] etas_es58x 6-1:0.2: es58x_split_urb_try_recovery: Recovery failed [ 233.286236][ C0] etas_es58x 6-1:0.2: es58x_split_urb() returned error -EBADMSG [ 233.293993][ C0] etas_es58x 6-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0xC7D8. [ 233.305006][ C0] etas_es58x 6-1:0.2: es58x_split_urb_try_recovery: Recovery failed [ 233.313008][ C0] etas_es58x 6-1:0.2: es58x_split_urb() returned error -EBADMSG [ 233.321254][ T5530] etas_es58x 6-1:0.2 can1: bit-timing not yet defined [ 233.409597][ C0] etas_es58x 6-1:0.2: es58x_check_rx_urb: Expected sequence 0xFECA for start of frame but got 0x0000. [ 233.420716][ C0] etas_es58x 6-1:0.2: Could not reconstitute incomplete command from previous URB, dropping 351 bytes [ 233.431746][ C0] etas_es58x 6-1:0.2: Error code: -EBADRQC, es58x_dev->rx_cmd_buf_len: 3, urb->actual_length: 348 [ 233.655934][T10173] /dev/rnullb0: Can't open blockdev [ 233.748911][T10177] 9p: Unknown parameter '՗port' [ 234.058349][T10182] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 234.067130][T10182] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 234.380068][ T5530] etas_es58x 6-1:0.2: es58x_free_urbs: Timeout, some TX urbs still remain [ 234.389478][ C0] etas_es58x 6-1:0.2: es58x_read_bulk_callback: error -ENOENT [ 234.397232][ T5530] etas_es58x 6-1:0.2 can1: es58x_open: Could not open the network device: -EINVAL [ 234.420732][T10187] syzkaller1: entered promiscuous mode [ 234.427044][T10187] syzkaller1: entered allmulticast mode [ 234.568479][T10195] netdevsim netdevsim2 : renamed from netdevsim0 (while UP) [ 234.662128][T10203] /dev/rnullb0: Can't open blockdev [ 234.747026][T10208] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 234.756566][T10208] overlayfs: missing 'lowerdir' [ 234.829981][ T1568] usb 3-1: new full-speed USB device number 63 using dummy_hcd [ 234.920366][ T5530] etas_es58x 6-1:0.2: es58x_set_realtime_diff_ns: Previous request to set timestamp has not completed yet [ 234.933566][ C0] etas_es58x 6-1:0.2: es58x_read_bulk_callback: error -ENOENT [ 234.942223][ C0] etas_es58x 6-1:0.2: es58x_read_bulk_callback: error -ENOENT [ 234.959276][ C0] etas_es58x 6-1:0.2: es58x_read_bulk_callback: error -ENOENT [ 234.967266][ C0] etas_es58x 6-1:0.2: es58x_read_bulk_callback: error -ENOENT [ 234.976631][ C0] etas_es58x 6-1:0.2: es58x_read_bulk_callback: error -ENOENT [ 234.984276][ T5530] etas_es58x 6-1:0.2 can0: es58x_open: Could not open the network device: -EBUSY [ 234.991102][ T1568] usb 3-1: New USB device found, idVendor=13d8, idProduct=0020, bcdDevice=f7.31 [ 235.004721][ T1568] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.018802][ T1568] usb 3-1: config 0 descriptor?? [ 235.028585][ T1568] usb 3-1: selecting invalid altsetting 3 [ 235.058052][ T1568] comedi comedi5: could not set alternate setting 3 in high speed [ 235.086728][ T1568] usbduxsigma 3-1:0.0: driver 'usbduxsigma' failed to auto-configure device. [ 235.127441][ T1568] usbduxsigma 3-1:0.0: probe with driver usbduxsigma failed with error -22 [ 235.181217][T10216] wlan1 speed is unknown, defaulting to 1000 [ 235.201378][ C0] etas_es58x 6-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 235.210619][ C0] etas_es58x 6-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 235.219824][ C0] etas_es58x 6-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 235.229017][ C0] etas_es58x 6-1:0.2: es58x_read_bulk_callback: error -EPROTO. Device unplugged? [ 235.244553][ T1219] usb 6-1: USB disconnect, device number 11 [ 235.255835][ T1219] etas_es58x 6-1:0.2: Disconnecting syz syz [ 235.263623][ T5902] usb 3-1: USB disconnect, device number 63 [ 235.405626][T10231] syzkaller1: entered promiscuous mode [ 235.415036][T10231] syzkaller1: entered allmulticast mode [ 236.219222][ T1568] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 236.305630][T10285] /dev/rnullb0: Can't open blockdev [ 236.407950][ T1568] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 236.426320][ T1568] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 236.443963][T10292] /dev/rnullb0: Can't open blockdev [ 236.468076][ T1568] usb 6-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 236.530889][ T1568] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.564260][ T1568] usb 6-1: config 0 descriptor?? [ 236.813279][T10319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 236.842343][T10319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 236.873723][T10319] /dev/rnullb0: Can't open blockdev [ 237.118922][T10324] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1175'. [ 237.128030][T10324] IPv6: NLM_F_CREATE should be specified when creating new route [ 237.137775][T10324] IPv6: Can't replace route, no match found [ 237.305082][T10331] virtio-fs: tag not found [ 237.350647][ T10] IPVS: starting estimator thread 0... [ 237.440005][T10336] IPVS: using max 41 ests per chain, 98400 per kthread [ 237.472436][T10340] /dev/rnullb0: Can't open blockdev [ 237.472932][T10342] /dev/rnullb0: Can't open blockdev [ 237.486382][T10342] /dev/rnullb0: Can't open blockdev [ 237.540561][T10345] syzkaller1: entered promiscuous mode [ 237.546119][T10345] syzkaller1: entered allmulticast mode [ 237.644904][T10353] ptm ptm27: ldisc open failed (-12), clearing slot 27 [ 237.783088][T10367] mkiss: ax0: crc mode is auto. [ 237.904606][T10373] /dev/rnullb0: Can't open blockdev [ 237.911198][T10374] netlink: 'syz.2.1194': attribute type 27 has an invalid length. [ 238.507113][T10382] syzkaller1: entered promiscuous mode [ 238.512879][T10382] syzkaller1: entered allmulticast mode [ 238.674651][T10395] 9p: Unknown parameter '0xffffffffffffffff' [ 238.686525][T10397] /dev/rnullb0: Can't open blockdev [ 238.771546][T10403] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 238.817942][T10403] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 238.913480][T10415] netlink: 'syz.3.1208': attribute type 27 has an invalid length. [ 238.923587][T10415] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1208'. [ 238.970232][T10420] syzkaller1: entered promiscuous mode [ 238.975929][T10420] syzkaller1: entered allmulticast mode [ 239.375253][T10425] /dev/rnullb0: Can't open blockdev [ 239.402519][ T1568] usb 6-1: USB disconnect, device number 12 [ 239.591117][T10440] netlink: 830 bytes leftover after parsing attributes in process `syz.4.1216'. [ 239.605066][T10440] /dev/rnullb0: Can't open blockdev [ 239.747975][T10447] syzkaller1: entered promiscuous mode [ 239.755735][T10447] syzkaller1: entered allmulticast mode [ 239.982286][T10460] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 240.014588][T10460] /dev/rnullb0: Can't open blockdev [ 240.104437][T10469] /dev/rnullb0: Can't open blockdev [ 240.230355][T10477] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1228'. [ 240.244634][T10477] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1228'. [ 240.267983][T10476] syzkaller1: entered promiscuous mode [ 240.273504][T10476] syzkaller1: entered allmulticast mode [ 240.490165][T10494] /dev/rnullb0: Can't open blockdev [ 240.518368][T10496] /dev/rnullb0: Can't open blockdev [ 240.625253][T10504] /dev/rnullb0: Can't open blockdev [ 240.709124][T10510] /dev/rnullb0: Can't open blockdev [ 240.939873][T10524] syzkaller1: entered promiscuous mode [ 240.954410][T10524] syzkaller1: entered allmulticast mode [ 241.066997][T10532] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 241.073961][T10532] /dev/rnullb0: Can't open blockdev [ 241.092561][T10534] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.101990][T10534] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 241.286510][ T1219] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 241.436517][ T1219] usb 6-1: Using ep0 maxpacket: 16 [ 241.446662][ T1219] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 241.459471][ T1219] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 241.466423][ T1568] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 241.481554][ T1219] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 241.492417][ T1219] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.501768][ T1219] usb 6-1: Product: syz [ 241.506052][ T1219] usb 6-1: Manufacturer: syz [ 241.511958][ T1219] usb 6-1: SerialNumber: syz [ 241.616328][ T1568] usb 3-1: device descriptor read/64, error -71 [ 241.724912][ T1219] usb 6-1: 0:2 : does not exist [ 241.742564][ T1219] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 241.783918][ T1219] usb 6-1: 5:0: cannot get min/max values for control 3 (id 5) [ 241.837766][ T1219] usb 6-1: 5:0: cannot get min/max values for control 4 (id 5) [ 241.852855][ T1219] usb 6-1: 5:0: cannot get min/max values for control 8 (id 5) [ 241.869871][ T1568] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 241.873921][ T1219] usb 6-1: 5:0: cannot get min/max values for control 3 (id 5) [ 241.909707][ T1219] usb 6-1: USB disconnect, device number 13 [ 241.933841][T10552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.954201][T10553] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.964551][T10553] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 241.978326][T10552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 241.986664][ T5871] udevd[5871]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 242.010495][T10552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 242.019434][T10552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 242.037046][ T1568] usb 3-1: device descriptor read/64, error -71 [ 242.146237][ T1568] usb usb3-port1: attempt power cycle [ 242.505862][ T1568] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 242.550416][ T1568] usb 3-1: device descriptor read/8, error -71 [ 242.601184][T10559] syzkaller1: entered promiscuous mode [ 242.615059][T10559] syzkaller1: entered allmulticast mode [ 242.827483][ T1568] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 242.856755][ T1568] usb 3-1: device descriptor read/8, error -71 [ 242.904516][T10575] /dev/sg0: Can't lookup blockdev [ 242.965821][ T1568] usb usb3-port1: unable to enumerate USB device [ 243.006910][T10580] /dev/rnullb0: Can't open blockdev [ 243.149876][T10586] /dev/rnullb0: Can't open blockdev [ 243.208277][T10577] kvm: kvm [10576]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x5407 [ 243.244647][T10589] 9pnet: p9_errstr2errno: server reported unknown error @ [ 243.321145][T10589] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3889405060 (497843847680 ns) > initial count (482886417536 ns). Using initial count to start timer. [ 243.326511][ T1568] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 243.403037][T10592] syzkaller1: entered promiscuous mode [ 243.410510][T10592] syzkaller1: entered allmulticast mode [ 243.535009][ T1568] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 243.545668][ T1568] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 243.575529][ T1568] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 243.585204][ T1568] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 243.635250][ T1568] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 243.666767][ T1568] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 243.681937][ T1568] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 243.699801][ T1568] usb 6-1: Product: syz [ 243.704003][ T1568] usb 6-1: Manufacturer: syz [ 243.730548][ T1568] cdc_wdm 6-1:1.0: skipping garbage [ 243.741839][T10600] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1270'. [ 243.750951][ T1568] cdc_wdm 6-1:1.0: skipping garbage [ 243.758031][ T1568] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 243.763978][ T1568] cdc_wdm 6-1:1.0: Unknown control protocol [ 243.855000][ T5186] Bluetooth: Unexpected start frame (len 18) [ 243.861315][ T5186] Bluetooth: hci0: link tx timeout [ 243.868370][ T5186] Bluetooth: hci0: killing stalled connection 10:aa:aa:aa:aa:aa [ 243.876307][ T5186] Bluetooth: hci0: link tx timeout [ 243.881591][ T5186] Bluetooth: hci0: killing stalled connection 11:aa:aa:aa:aa:aa [ 243.938257][ T1568] usb 6-1: USB disconnect, device number 14 [ 244.141222][T10615] wlan1 speed is unknown, defaulting to 1000 [ 244.149884][T10583] trusted_key: syz.5.1264 sent an empty control message without MSG_MORE. [ 244.238586][T10619] syzkaller1: entered promiscuous mode [ 244.241315][T10621] ./cgroup: Can't lookup blockdev [ 244.244313][T10619] syzkaller1: entered allmulticast mode [ 244.313781][T10626] syzkaller1: entered promiscuous mode [ 244.332007][T10626] syzkaller1: entered allmulticast mode [ 244.342996][T10628] /dev/rnullb0: Can't open blockdev [ 244.344997][T10626] netlink: 'syz.3.1278': attribute type 4 has an invalid length. [ 244.395589][ T5902] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 244.416460][T10635] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.1278'. [ 244.574836][ T5902] usb 6-1: device descriptor read/64, error -71 [ 244.784947][ T5923] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 244.802214][T10646] cgroup: Bad value for 'name' [ 244.810690][T10646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 244.814847][ T5902] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 244.821975][T10646] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 244.954816][ T5902] usb 6-1: device descriptor read/64, error -71 [ 244.962480][ T5923] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 244.973425][ T5923] usb 3-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 244.982517][ T5923] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.992139][ T5923] usb 3-1: config 0 descriptor?? [ 245.064799][ T5902] usb usb6-port1: attempt power cycle [ 245.302651][T10655] syzkaller1: entered promiscuous mode [ 245.308556][T10655] syzkaller1: entered allmulticast mode [ 245.381301][T10657] /dev/rnullb0: Can't open blockdev [ 245.402843][ T5923] steelseries 0003:1038:12B6.0012: unknown main item tag 0x2 [ 245.411993][ T5923] steelseries 0003:1038:12B6.0012: item fetching failed at offset 6/7 [ 245.424853][ T5923] steelseries 0003:1038:12B6.0012: probe with driver steelseries failed with error -22 [ 245.435629][ T5902] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 245.475393][ T5902] usb 6-1: device descriptor read/8, error -71 [ 245.615075][T10669] /dev/rnullb0: Can't open blockdev [ 245.619526][ T10] usb 3-1: USB disconnect, device number 68 [ 245.646893][T10671] /dev/rnullb0: Can't open blockdev [ 245.653101][T10671] tmpfs: Unknown parameter 'indo64' [ 245.724848][ T5902] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 245.744840][ T5902] usb 6-1: device descriptor read/8, error -71 [ 245.764762][T10676] /dev/rnullb0: Can't open blockdev [ 245.864621][ T5902] usb usb6-port1: unable to enumerate USB device [ 245.964221][ T5186] Bluetooth: hci0: command 0x0406 tx timeout [ 246.100674][T10680] syzkaller1: entered promiscuous mode [ 246.106334][T10680] syzkaller1: entered allmulticast mode [ 246.386745][T10694] /dev/rnullb0: Can't open blockdev [ 246.511711][T10686] /dev/rnullb0: Can't open blockdev [ 246.587270][T10699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 246.597696][T10699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 246.674247][ T5902] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 246.748070][T10708] IPVS: set_ctl: invalid protocol: 43 172.20.20.24:20000 [ 246.769927][T10705] syzkaller1: entered promiscuous mode [ 246.782127][T10705] syzkaller1: entered allmulticast mode [ 246.806912][T10710] syzkaller1: entered promiscuous mode [ 246.812533][T10710] syzkaller1: entered allmulticast mode [ 246.843699][ T5902] usb 3-1: Using ep0 maxpacket: 16 [ 246.852782][ T5902] usb 3-1: New USB device found, idVendor=046d, idProduct=08b2, bcdDevice=80.59 [ 246.862516][ T5902] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.872150][ T5902] usb 3-1: Product: syz [ 246.883633][ T5902] usb 3-1: Manufacturer: syz [ 246.888345][ T5902] usb 3-1: SerialNumber: syz [ 246.904064][ T5902] usb 3-1: config 0 descriptor?? [ 246.918223][ T5902] pwc: Logitech QuickCam 4000 Pro USB webcam detected. [ 247.121016][T10696] /dev/rnullb0: Can't open blockdev [ 247.136955][ T5902] pwc: Failed to set LED on/off time (-71) [ 247.146860][ T5902] pwc: send_video_command error -71 [ 247.152116][ T5902] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 247.160254][ T5902] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 247.179940][ T5902] usb 3-1: USB disconnect, device number 69 [ 247.208032][T10725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 247.218173][T10725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 247.234454][ T10] usb 6-1: new full-speed USB device number 19 using dummy_hcd [ 247.245336][T10725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 247.258173][T10725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 247.268595][T10725] /dev/rnullb0: Can't open blockdev [ 247.383414][ T10] usb 6-1: device descriptor read/64, error -71 [ 247.623421][ T10] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 247.707208][T10727] /dev/rnullb0: Can't open blockdev [ 247.763314][ T10] usb 6-1: device descriptor read/64, error -71 [ 247.885710][ T10] usb usb6-port1: attempt power cycle [ 247.966868][T10733] syzkaller1: entered promiscuous mode [ 247.972395][T10733] syzkaller1: entered allmulticast mode [ 248.043156][ T5869] Bluetooth: hci0: command 0x0406 tx timeout [ 248.096168][T10737] Device name not specified. [ 248.096168][T10737] [ 248.109959][T10735] /dev/rnullb0: Can't open blockdev [ 248.113246][ T1219] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 248.155046][T10740] /dev/rnullb0: Can't open blockdev [ 248.237087][ T10] usb 6-1: new full-speed USB device number 21 using dummy_hcd [ 248.239841][T10744] /dev/rnullb0: Can't open blockdev [ 248.268588][ T10] usb 6-1: device descriptor read/8, error -71 [ 248.285320][ T1219] usb 3-1: Using ep0 maxpacket: 8 [ 248.303705][ T1219] usb 3-1: config 0 interface 0 altsetting 3 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 248.343029][ T1219] usb 3-1: config 0 interface 0 has no altsetting 0 [ 248.356730][ T1219] usb 3-1: New USB device found, idVendor=046d, idProduct=402d, bcdDevice= 0.00 [ 248.368985][ T1219] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.380042][ T1219] usb 3-1: config 0 descriptor?? [ 248.404083][T10755] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 248.416982][ T1219] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 248.522915][ T10] usb 6-1: new full-speed USB device number 22 using dummy_hcd [ 248.570204][ T10] usb 6-1: device descriptor read/8, error -71 [ 248.638900][T10769] syzkaller1: entered promiscuous mode [ 248.646379][T10769] syzkaller1: entered allmulticast mode [ 248.693206][ T10] usb usb6-port1: unable to enumerate USB device [ 248.759784][T10772] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 249.109406][T10796] syzkaller1: entered promiscuous mode [ 249.115316][T10796] syzkaller1: entered allmulticast mode [ 249.240488][T10798] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 249.252707][T10798] /dev/rnullb0: Can't open blockdev [ 249.315843][T10804] /dev/rnullb0: Can't open blockdev [ 249.683901][T10819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.704886][T10819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.716566][T10819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.729174][T10819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.744740][T10819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.766997][T10819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.790746][T10819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.818369][T10819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.839892][T10819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.862053][T10819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.883729][T10819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 249.904194][T10819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 250.070914][T10832] syzkaller1: entered promiscuous mode [ 250.078121][T10832] syzkaller1: entered allmulticast mode [ 250.086996][T10830] orangefs_devreq_write_iter: failed to copy head. [ 250.283529][T10840] /dev/rnullb0: Can't open blockdev [ 250.321574][T10844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 250.336006][T10844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 250.358386][T10844] program syz.3.1352 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 250.400663][T10853] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1355'. [ 250.585461][T10853] tmpfs: Bad value for 'mpol' [ 250.590328][T10854] tmpfs: Bad value for 'mpol' [ 250.865318][ T10] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 250.924490][ T1219] usb 3-1: USB disconnect, device number 70 [ 250.950252][T10865] syzkaller1: entered promiscuous mode [ 250.965244][T10865] syzkaller1: entered allmulticast mode [ 250.998850][T10862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.013755][T10862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 251.043639][T10872] /dev/rnullb0: Can't open blockdev [ 251.054262][ T10] usb 6-1: device descriptor read/64, error -71 [ 251.145640][T10880] /dev/rnullb0: Can't open blockdev [ 251.291606][ T10] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 251.381474][ T1219] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 251.421429][ T10] usb 6-1: device descriptor read/64, error -71 [ 251.512365][ T1219] usb 3-1: device descriptor read/64, error -71 [ 251.532937][ T10] usb usb6-port1: attempt power cycle [ 251.584207][T10889] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1367'. [ 251.593652][T10889] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1367'. [ 251.639793][T10889] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1367'. [ 251.649788][T10889] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1367'. [ 251.668211][T10895] /dev/rnullb0: Can't open blockdev [ 251.732682][T10889] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1367'. [ 251.741991][T10889] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1367'. [ 251.752034][ T1219] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 251.853661][T10905] syzkaller1: entered promiscuous mode [ 251.859191][T10905] syzkaller1: entered allmulticast mode [ 251.865279][T10907] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.875561][T10907] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 251.881585][ T10] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 251.886661][T10907] /dev/rnullb0: Can't open blockdev [ 251.891518][ T1219] usb 3-1: device descriptor read/64, error -71 [ 251.921915][ T10] usb 6-1: device descriptor read/8, error -71 [ 252.012559][ T1219] usb usb3-port1: attempt power cycle [ 252.161096][ T10] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 252.181436][ T10] usb 6-1: device descriptor read/8, error -71 [ 252.293632][ T10] usb usb6-port1: unable to enumerate USB device [ 252.351068][ T1219] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 252.372258][ T1219] usb 3-1: device descriptor read/8, error -71 [ 252.441854][T10911] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1373'. [ 252.454528][T10911] /dev/rnullb0: Can't open blockdev [ 252.532115][T10915] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1375'. [ 252.549674][T10915] /dev/rnullb0: Can't open blockdev [ 252.610923][ T1219] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 252.634223][T10917] netlink: 'syz.4.1376': attribute type 37 has an invalid length. [ 252.641554][ T1219] usb 3-1: device descriptor read/8, error -71 [ 252.752569][ T1219] usb usb3-port1: unable to enumerate USB device [ 252.855069][T10923] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 252.865470][T10923] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 253.719354][T10917] syz.4.1376 (10917): drop_caches: 1 [ 253.824932][T10946] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1384'. [ 253.886131][T10943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 253.899449][T10943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 253.918633][T10954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 253.927349][T10956] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 253.930474][T10954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 253.939150][T10956] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 253.983862][T10960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 253.994081][T10960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 254.184423][T10970] /dev/rnullb0: Can't open blockdev [ 254.369977][ T1568] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 254.452165][T10977] rdma_rxe: rxe_newlink: failed to add wlan1 [ 254.463213][T10977] /dev/rnullb0: Can't open blockdev [ 254.550072][ T1568] usb 6-1: config index 0 descriptor too short (expected 23569, got 27) [ 254.559685][T10985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 254.569118][ T1568] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 254.586755][ T1568] usb 6-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 254.597123][ T1568] usb 6-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 254.606133][T10985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 254.614142][ T1568] usb 6-1: Manufacturer: syz [ 254.620511][ T1568] usb 6-1: config 0 descriptor?? [ 254.625932][ T10] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 254.630696][ T1568] igorplugusb 6-1:0.0: incorrect number of endpoints [ 254.799846][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 254.809311][ T10] usb 3-1: config 0 has an invalid interface number: 207 but max is 0 [ 254.825896][T10997] /dev/rnullb0: Can't open blockdev [ 254.829706][ T10] usb 3-1: config 0 has no interface number 0 [ 254.848245][ T10] usb 3-1: config 0 interface 207 has no altsetting 0 [ 254.860808][ T5902] usb 6-1: USB disconnect, device number 27 [ 254.863448][ T10] usb 3-1: New USB device found, idVendor=041e, idProduct=4053, bcdDevice=ee.45 [ 254.879178][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.891510][ T10] usb 3-1: Product: syz [ 254.896071][ T10] usb 3-1: Manufacturer: syz [ 254.907820][ T10] usb 3-1: SerialNumber: syz [ 254.924469][ T10] usb 3-1: config 0 descriptor?? [ 254.934024][ T10] gspca_main: gspca_zc3xx-2.14.0 probing 041e:4053 [ 255.119871][T11006] syzkaller1: entered promiscuous mode [ 255.126904][T11006] syzkaller1: entered allmulticast mode [ 255.133299][T10972] /dev/rnullb0: Can't open blockdev [ 255.140742][ T10] gspca_zc3xx: reg_w_i err -71 [ 255.145599][ T10] gspca_zc3xx 3-1:0.207: probe with driver gspca_zc3xx failed with error -71 [ 255.173590][ T10] usb 3-1: USB disconnect, device number 75 [ 255.184503][T11009] binder: 11008:11009 ioctl c0306201 200000000080 returned -14 [ 255.505067][T11026] block nbd4: Attempted send on invalid socket [ 255.511668][T11026] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x1000 phys_seg 1 prio class 2 [ 255.522037][T11026] XFS (nbd4): SB validate failed with error -5. [ 255.581851][T11033] /dev/rnullb0: Can't open blockdev [ 255.649326][ T1568] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 255.689846][T11035] /dev/rnullb0: Can't open blockdev [ 255.830937][ T1568] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 255.850891][ T1568] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 255.893127][ T1568] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 255.904582][ T1568] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 255.922510][ T1568] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 255.926329][T11052] sctp: [Deprecated]: syz.2.1415 (pid 11052) Use of int in max_burst socket option deprecated. [ 255.926329][T11052] Use struct sctp_assoc_value instead [ 255.947306][ T1568] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 255.957762][ T1568] usb 6-1: Manufacturer: syz [ 255.963577][T11052] FAT-fs (nullb0): bogus number of reserved sectors [ 255.964894][ T1568] usb 6-1: config 0 descriptor?? [ 255.975715][T11052] FAT-fs (nullb0): Can't find a valid FAT filesystem [ 256.044324][T11057] binder: 11055:11057 ioctl c00c620f 0 returned -14 [ 256.389036][ T10] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 256.390626][ T1568] appleir 0003:05AC:8243.0013: unknown main item tag 0x0 [ 256.406411][ T1568] appleir 0003:05AC:8243.0013: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.5-1/input0 [ 256.548926][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 256.553987][T11066] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.558460][ T10] usb 3-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2 [ 256.572498][T11066] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.574496][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.591563][ T10] usb 3-1: Product: syz [ 256.595921][ T10] usb 3-1: Manufacturer: syz [ 256.601344][ T10] usb 3-1: SerialNumber: syz [ 256.611593][ T10] usb 3-1: config 0 descriptor?? [ 256.661168][ T1568] usb 6-1: USB disconnect, device number 28 [ 256.819018][T11061] __nla_validate_parse: 1 callbacks suppressed [ 256.819041][T11061] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1418'. [ 256.837184][ T10] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 257.254382][T11061] /dev/rnullb0: Can't open blockdev [ 257.270273][ T10] gspca_sunplus: reg_w_riv err -71 [ 257.275849][ T10] sunplus 3-1:0.0: probe with driver sunplus failed with error -71 [ 257.298438][ T10] usb 3-1: USB disconnect, device number 76 [ 257.336711][T11074] syzkaller1: entered promiscuous mode [ 257.347022][T11074] syzkaller1: entered allmulticast mode [ 257.974223][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 257.981538][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 257.988579][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 257.997289][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.004324][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.011843][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.018879][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.025934][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.032964][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.039944][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.047263][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.054295][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.061281][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.068248][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.075191][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.082597][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.089641][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.096514][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.103581][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.110704][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.117641][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.124742][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.131961][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.138906][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.145837][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.152778][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.159800][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.166660][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.173661][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.180607][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.187561][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.194591][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.202289][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.209276][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.216271][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.223218][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.229038][ T5902] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 258.230488][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.244807][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.251831][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.258792][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.265670][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.272692][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.279704][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.286628][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.293614][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.301085][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.308099][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.315085][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.322057][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.329031][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.336165][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.343422][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.350616][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.357490][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.364458][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.371386][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.378585][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.385495][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.392460][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.397921][ T5902] usb 3-1: device descriptor read/64, error -71 [ 258.399656][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.412596][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.419667][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.430054][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.437397][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.444364][ T5869] Bluetooth: hci2: unexpected event for opcode 0x0804 [ 258.560471][T11106] syzkaller1: entered promiscuous mode [ 258.566505][T11106] syzkaller1: entered allmulticast mode [ 258.688023][ T5902] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 258.770410][T11116] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.797979][T11116] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.827764][ T5902] usb 3-1: device descriptor read/64, error -71 [ 258.948547][ T5902] usb usb3-port1: attempt power cycle [ 259.297442][ T5902] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 259.335812][ T5902] usb 3-1: device descriptor read/8, error -71 [ 259.368452][T11131] syzkaller1: entered promiscuous mode [ 259.373978][T11131] syzkaller1: entered allmulticast mode [ 259.405437][T11134] /dev/rnullb0: Can't open blockdev [ 259.506478][T11140] /dev/rnullb0: Can't open blockdev [ 259.607430][ T5902] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 259.644880][ T5902] usb 3-1: device descriptor read/8, error -71 [ 259.757589][ T5902] usb usb3-port1: unable to enumerate USB device [ 259.779183][ T10] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 259.937148][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 259.944169][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 259.953377][ T10] usb 6-1: config 4 interface 0 has no altsetting 0 [ 259.962569][ T10] usb 6-1: string descriptor 0 read error: -22 [ 259.969185][ T10] usb 6-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 259.978305][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.993826][ T10] usb 6-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 260.003751][ T10] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 260.014544][ T10] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 260.022501][ T10] usb 6-1: media controller created [ 260.036369][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 260.254989][T11149] /dev/rnullb0: Can't open blockdev [ 260.303255][T11151] /dev/rnullb0: Can't open blockdev [ 260.326163][T11153] /dev/rnullb0: Can't open blockdev [ 260.608715][T11164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 260.622054][T11164] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 260.649523][T11166] syzkaller1: entered promiscuous mode [ 260.655124][T11166] syzkaller1: entered allmulticast mode [ 260.668265][T11164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 260.678184][T11164] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 260.904427][T11170] /dev/rnullb0: Can't open blockdev [ 260.945065][T11173] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 260.954154][T11173] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.080804][T11142] usb 6-1: dvb_usb_au6610: wlen=0, aborting [ 261.086878][ T10] zl10353_read_register: readreg error (reg=127, ret==0) [ 261.113876][ T10] usb 6-1: USB disconnect, device number 29 [ 261.159145][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 261.165602][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.531701][T11186] syzkaller1: entered promiscuous mode [ 261.538007][T11186] syzkaller1: entered allmulticast mode [ 261.693217][T11196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 261.718614][T11196] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 261.790144][T11204] /dev/rnullb0: Can't open blockdev [ 262.020142][T11221] /dev/rnullb0: Can't open blockdev [ 262.062527][T11223] syzkaller1: entered promiscuous mode [ 262.068512][T11223] syzkaller1: entered allmulticast mode [ 262.289333][T11232] MTD: Attempt to mount non-MTD device "/dev/rnullb0" [ 262.469238][T11245] syzkaller1: entered promiscuous mode [ 262.488753][T11245] syzkaller1: entered allmulticast mode [ 262.663485][T11251] netlink: 'syz.5.1488': attribute type 4 has an invalid length. [ 262.681979][T11251] /dev/rnullb0: Can't open blockdev [ 262.689233][T11251] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 262.859412][T11264] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 262.890803][T11264] overlayfs: missing 'lowerdir' [ 262.915064][T11267] /dev/rnullb0: Can't open blockdev [ 262.941263][T11267] tmpfs: Unknown parameter 'indo64' [ 263.000453][T11272] syzkaller1: entered promiscuous mode [ 263.018316][T11272] syzkaller1: entered allmulticast mode [ 263.127022][T11279] GUP no longer grows the stack in syz.5.1498 (11279): 200000005000-200000008000 (200000004000) [ 263.137750][T11279] CPU: 1 UID: 0 PID: 11279 Comm: syz.5.1498 Not tainted syzkaller #0 PREEMPT(full) [ 263.137777][T11279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 263.137796][T11279] Call Trace: [ 263.137803][T11279] [ 263.137810][T11279] dump_stack_lvl+0x189/0x250 [ 263.137846][T11279] ? __pfx_dump_stack_lvl+0x10/0x10 [ 263.137877][T11279] ? __pfx__printk+0x10/0x10 [ 263.137904][T11279] ? find_vma+0xe7/0x160 [ 263.137939][T11279] fixup_user_fault+0x661/0x720 [ 263.137970][T11279] fault_in_user_writeable+0x72/0xe0 [ 263.137996][T11279] futex_lock_pi+0x773/0xa90 [ 263.138019][T11279] ? __pfx_futex_lock_pi+0x10/0x10 [ 263.138036][T11279] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 263.138105][T11279] ? futex_private_hash_put+0x4b/0x280 [ 263.138132][T11279] ? __pfx_futex_wake_mark+0x10/0x10 [ 263.138153][T11279] ? __pfx_futex_wake+0x10/0x10 [ 263.138169][T11279] ? userfaultfd_unmap_complete+0x278/0x2d0 [ 263.138195][T11279] ? __pfx_userfaultfd_unmap_complete+0x10/0x10 [ 263.138220][T11279] do_futex+0x292/0x420 [ 263.138250][T11279] ? __pfx_do_futex+0x10/0x10 [ 263.138278][T11279] ? __vm_munmap+0x301/0x3d0 [ 263.138307][T11279] __se_sys_futex+0x36f/0x400 [ 263.138338][T11279] ? __pfx___se_sys_futex+0x10/0x10 [ 263.138370][T11279] ? __x64_sys_futex+0x21/0xf0 [ 263.138399][T11279] do_syscall_64+0xfa/0xfa0 [ 263.138426][T11279] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.138447][T11279] ? clear_bhb_loop+0x60/0xb0 [ 263.138469][T11279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.138488][T11279] RIP: 0033:0x7f91b958ebe9 [ 263.138514][T11279] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 263.138532][T11279] RSP: 002b:00007f91b77f6038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 263.138564][T11279] RAX: ffffffffffffffda RBX: 00007f91b97c5fa0 RCX: 00007f91b958ebe9 [ 263.138579][T11279] RDX: 0000000000000000 RSI: 000000000000008d RDI: 0000200000004000 [ 263.138592][T11279] RBP: 00007f91b9611e19 R08: 0000000000000000 R09: 0000000000000000 [ 263.138604][T11279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 263.138615][T11279] R13: 00007f91b97c6038 R14: 00007f91b97c5fa0 R15: 00007ffca6804c98 [ 263.138639][T11279] [ 263.383886][T11282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.392595][T11282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.432272][T11287] virtio-fs: tag not found [ 263.492525][T11288] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.507826][T11288] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.568946][T11290] rdma_rxe: rxe_newlink: failed to add wlan1 [ 263.629000][T11290] /dev/rnullb0: Can't open blockdev [ 263.644856][T11294] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.657219][T11294] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.782166][T11303] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1506'. [ 263.852703][T11303] /dev/rnullb0: Can't open blockdev [ 263.901028][T11305] syzkaller1: entered promiscuous mode [ 263.908328][T11305] syzkaller1: entered allmulticast mode [ 263.975112][ T5940] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 264.086273][T11312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 264.094912][T11312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 264.117249][ T5940] usb 6-1: device descriptor read/64, error -71 [ 264.379887][ T5940] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 264.534876][ T5940] usb 6-1: device descriptor read/64, error -71 [ 264.644912][ T5940] usb usb6-port1: attempt power cycle [ 264.691637][T11332] tipc: Can't bind to reserved service type 1 [ 264.735089][T11334] syzkaller1: entered promiscuous mode [ 264.740716][T11334] syzkaller1: entered allmulticast mode [ 264.966652][T11341] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 264.978519][T11341] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 264.986923][ T5940] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 265.016652][ T5940] usb 6-1: device descriptor read/8, error -71 [ 265.033291][T11347] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 265.044211][T11347] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 265.264593][ T5940] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 265.296156][ T5940] usb 6-1: device descriptor read/8, error -71 [ 265.405141][ T5940] usb usb6-port1: unable to enumerate USB device [ 265.496050][ T1568] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 265.569577][T11360] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 265.584800][T11360] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 265.646084][T11362] syzkaller1: entered promiscuous mode [ 265.651691][T11362] syzkaller1: entered allmulticast mode [ 265.666805][ T1568] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 265.677230][ T1568] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 265.688018][ T1568] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 265.703255][ T1568] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.00 [ 265.712789][ T1568] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.729677][ T1568] usb 3-1: config 0 descriptor?? [ 265.739153][ T1568] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 266.362583][T11367] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.372680][T11367] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 266.382450][T11368] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.393154][T11368] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 266.434971][T11372] netlink: 65051 bytes leftover after parsing attributes in process `syz.4.1529'. [ 266.536609][T11376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.546008][T11376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 267.048249][T11396] syzkaller1: entered promiscuous mode [ 267.055111][T11396] syzkaller1: entered allmulticast mode [ 267.073901][ T5918] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 267.125174][T11398] /dev/rnullb0: Can't open blockdev [ 267.215499][T11403] netlink: 14556 bytes leftover after parsing attributes in process `syz.3.1538'. [ 267.228276][ T5918] usb 6-1: config 0 has an invalid interface number: 130 but max is 0 [ 267.239292][ T5918] usb 6-1: config 0 has no interface number 0 [ 267.248892][ T5918] usb 6-1: config 0 interface 130 altsetting 20 has 0 endpoint descriptors, different from the interface descriptor's value: 20 [ 267.262693][ T5918] usb 6-1: config 0 interface 130 has no altsetting 0 [ 267.273348][ T5918] usb 6-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=a0.b5 [ 267.282505][ T5918] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.300899][ T5918] usb 6-1: config 0 descriptor?? [ 267.489242][T11413] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 267.515972][T11385] /dev/rnullb0: Can't open blockdev [ 267.520211][T11415] program syz.4.1543 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 267.525331][T11413] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 267.535844][ T5918] usb 6-1: string descriptor 0 read error: -71 [ 267.565881][ T5918] asix 6-1:0.130 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 267.576836][ T5918] asix 6-1:0.130: probe with driver asix failed with error -71 [ 267.589160][ T5918] usb 6-1: USB disconnect, device number 34 [ 267.933003][T11432] bridge0: entered allmulticast mode [ 267.972633][T11435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 267.981590][T11435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 267.992064][T11435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.001915][T11435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 268.011332][T11435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.020244][T11435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 268.029541][T11435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.038450][T11435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 268.047385][T11435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.058184][T11435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 268.066989][T11435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.078807][T11435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 268.167123][T11441] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1550'. [ 268.302463][ T1568] usb 3-1: USB disconnect, device number 81 [ 268.592202][T11467] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI [ 268.604161][T11467] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 268.612601][T11467] CPU: 0 UID: 0 PID: 11467 Comm: syz.5.1559 Not tainted syzkaller #0 PREEMPT(full) [ 268.621996][T11467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 268.632073][T11467] RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 [ 268.637641][T11467] Code: 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 d9 85 2b f9 48 8b 03 48 89 04 24 49 83 c4 28 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 b8 85 2b f9 4d 8b 24 24 48 83 c3 [ 268.657266][T11467] RSP: 0018:ffffc9000b79fa40 EFLAGS: 00010206 [ 268.663368][T11467] RAX: 0000000000000005 RBX: ffff888053bf0b00 RCX: ffff88802f089e00 [ 268.671353][T11467] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88814c6e8000 [ 268.679345][T11467] RBP: 0000000000000000 R08: ffff88814c6e812f R09: 1ffff110298dd025 [ 268.687332][T11467] R10: dffffc0000000000 R11: ffffffff88f8cd30 R12: 0000000000000028 [ 268.695316][T11467] R13: dffffc0000000000 R14: ffff88814c6e8000 R15: dffffc0000000000 [ 268.703388][T11467] FS: 00007f91b77f66c0(0000) GS:ffff8881257c4000(0000) knlGS:0000000000000000 [ 268.712326][T11467] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 268.718916][T11467] CR2: 00007fdca0a56f98 CR3: 0000000073d8a000 CR4: 00000000003526f0 [ 268.726899][T11467] Call Trace: [ 268.730185][T11467] [ 268.733120][T11467] pcl818_detach+0x66/0xd0 [ 268.737550][T11467] comedi_device_detach_locked+0x175/0x750 [ 268.743366][T11467] ? security_capable+0x7e/0x2e0 [ 268.748313][T11467] comedi_unlocked_ioctl+0xcde/0x1020 [ 268.753703][T11467] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 268.759517][T11467] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 268.765169][T11467] ? do_futex+0x333/0x420 [ 268.769517][T11467] ? __se_sys_futex+0x36f/0x400 [ 268.774399][T11467] ? __fget_files+0x3a0/0x420 [ 268.779100][T11467] ? __fget_files+0x2a/0x420 [ 268.783706][T11467] ? bpf_lsm_file_ioctl+0x9/0x20 [ 268.788656][T11467] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 268.794479][T11467] __se_sys_ioctl+0xf9/0x170 [ 268.799084][T11467] do_syscall_64+0xfa/0xfa0 [ 268.803598][T11467] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.809678][T11467] ? clear_bhb_loop+0x60/0xb0 [ 268.814367][T11467] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.820273][T11467] RIP: 0033:0x7f91b958ebe9 [ 268.824703][T11467] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 268.844312][T11467] RSP: 002b:00007f91b77f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 268.852996][T11467] RAX: ffffffffffffffda RBX: 00007f91b97c5fa0 RCX: 00007f91b958ebe9 [ 268.860979][T11467] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 0000000000000005 [ 268.868953][T11467] RBP: 00007f91b9611e19 R08: 0000000000000000 R09: 0000000000000000 [ 268.876929][T11467] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 268.884906][T11467] R13: 00007f91b97c6038 R14: 00007f91b97c5fa0 R15: 00007ffca6804c98 [ 268.892887][T11467] [ 268.895921][T11467] Modules linked in: [ 268.901103][T11467] ---[ end trace 0000000000000000 ]--- [ 268.917810][T11467] RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 [ 268.929145][T11467] Code: 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 d9 85 2b f9 48 8b 03 48 89 04 24 49 83 c4 28 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 b8 85 2b f9 4d 8b 24 24 48 83 c3 [ 268.950735][T11467] RSP: 0018:ffffc9000b79fa40 EFLAGS: 00010206 [ 268.959145][T11467] RAX: 0000000000000005 RBX: ffff888053bf0b00 RCX: ffff88802f089e00 [ 268.967759][T11467] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88814c6e8000 [ 268.979070][T11467] RBP: 0000000000000000 R08: ffff88814c6e812f R09: 1ffff110298dd025 [ 268.987923][T11467] R10: dffffc0000000000 R11: ffffffff88f8cd30 R12: 0000000000000028 [ 268.996157][T11467] R13: dffffc0000000000 R14: ffff88814c6e8000 R15: dffffc0000000000 [ 269.004669][T11467] FS: 00007f91b77f66c0(0000) GS:ffff8881258c4000(0000) knlGS:0000000000000000 [ 269.017817][T11467] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 269.026242][T11467] CR2: 000000110c3027cd CR3: 0000000073d8a000 CR4: 00000000003526f0 [ 269.036386][T11467] Kernel panic - not syncing: Fatal exception [ 269.042807][T11467] Kernel Offset: disabled [ 269.047136][T11467] Rebooting in 86400 seconds..