last executing test programs: 6.851180767s ago: executing program 1 (id=733): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) (fail_nth: 3) 6.765325127s ago: executing program 3 (id=734): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a0b04000000000000000002006a000900020073797a3200000000090001"], 0x80}}, 0x0) (fail_nth: 3) 6.160635949s ago: executing program 3 (id=735): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r3, 0x0, 0x18) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) add_key$keyring(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffb) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="d80000001b0001000000000000000000fc00000000000000", @ANYRESHEX=r0], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)={0x78, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @mcast1}}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x2}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x78}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) syz_emit_ethernet(0x10b, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000040)=0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r7, &(0x7f0000000540)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c, 0x0}}, {{&(0x7f0000000000)={0xa, 0x4e21, 0x3, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=[@rthdrdstopts={{0x14, 0x29, 0x37, {0x2b}}}], 0x14}}], 0x2, 0x4000001) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000ff000000bfa300000000000007030000f0ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000000000001d440000000000007a0a00fe00ffffffc3030000f1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840b08000000f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e82623951743283070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00a5b4f7e9ad0500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd64}, 0x48) io_setup(0x2, &(0x7f0000000000)=0x0) r9 = eventfd(0x0) io_submit(r8, 0x3, &(0x7f00000023c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x100, r9, &(0x7f0000000100)="0000fd6000000000", 0x8, 0x3}, 0x0, 0x0]) 6.149115974s ago: executing program 1 (id=736): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ipvlan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x215}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}, 0x1, 0xba01}, 0x0) (fail_nth: 1) 5.547902445s ago: executing program 1 (id=737): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), 0x0, 0x2010404, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="8add03e001dca42b2fe51ab6166156141ddb2fafb5d5abaf966d3661e2d15290b39d4403bd04982523264074906bf7c7a1652df576fc290817621d860eee412d6def1064ab4226654a99"], 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010400000000000000000a0000000900010073797a31000000000900030073797a310000000034000000030a010400000000000000000a0000000900010073797a31000000000900030073797a320000000008000a000000000440000000060a010400000000000000000a0000000900010073797a31000000000900020073797a320000000014000480100001800c000100636f756e746572006c000000060a010400000000000000000a0000000900010073797a31000000000900020073797a3100000000400004803c0001800e000100696d6d6564696174650000002800028008000100000000001c0002801800028008000100fffffffd0900020073797a32"], 0x15c}}, 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x104000, 0x0) r2 = openat$autofs(0xffffff9c, &(0x7f00000000c0), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r2, 0xc018937e, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) socket(0x40000000015, 0x5, 0x0) close(r3) 5.415253503s ago: executing program 2 (id=738): r0 = userfaultfd(0x80001) readv(r0, &(0x7f0000000200)=[{&(0x7f0000000480)=""/198, 0xc6}], 0x1) 5.401630191s ago: executing program 1 (id=739): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_io_uring_complete(0x0, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r2, 0x29, 0x3e, &(0x7f00000000c0), 0x4) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r3 = socket(0x840000000002, 0x3, 0x100) sendmmsg$inet(r3, &(0x7f000000b4c0)=[{{&(0x7f0000000900)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000003480)=[@ip_pktinfo={{0x18, 0x0, 0x34, {0x0, @local, @broadcast}}}], 0x18}}], 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f0000000340)={0x5, 0x77, 0x4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000040)="290000002000190f00003fff", 0xc}], 0x1) syz_usb_connect$uac3(0x0, 0x9f, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040410e613040000102030109028d000301ffc00c080b0002010130070904000000010130000a2401102900120d00000c240b06000000005743a804132403020006"], 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000002f00090018876aee1215ddd9040000000c00180006ac0f"], 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', r7, &(0x7f0000000300)='./file0\x00', 0x0) r8 = openat$vicodec0(0xffffff9c, &(0x7f0000000440), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) set_mempolicy_home_node(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x0) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$VIDIOC_G_EXT_CTRLS(r8, 0xc0185648, &(0x7f0000000080)={0x980000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f908, 0x80008002, '\x00', @p_u16=&(0x7f00000010c0)=0xa5b}}) setsockopt$netlink_NETLINK_PKTINFO(r5, 0x10e, 0xc, &(0x7f0000000200)=0x5, 0x4) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="180000003a00290900000000000000250a00000004"], 0x18}}, 0x8000) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={r7, 0x58, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=@newqdisc={0xb4, 0x24, 0x302, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x2, 0xd}, {0xb, 0x4}, {0x2, 0xf}}, [@TCA_RATE={0x6, 0x5, {0x7, 0x15}}, @TCA_RATE={0x6, 0x5, {0xce, 0x6}}, @TCA_STAB={0x70, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x7, 0x0, 0xa83, 0x0, 0x2, 0x0, 0x1}}, {0x6, 0x2, [0x2]}}, {{0x1c, 0x1, {0x9, 0x6, 0x7, 0x80, 0x1, 0x8, 0xfffffaed, 0x4}}, {0xc, 0x2, [0x400, 0xdaa, 0x5, 0x1]}}, {{0x1c, 0x1, {0xb, 0x7, 0x5, 0x280, 0x0, 0x9, 0x2}}, {0x4}}]}, @TCA_EGRESS_BLOCK={0x8}, @TCA_RATE={0x6, 0x5, {0x8, 0x9}}]}, 0xb4}}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xe, 0xf, &(0x7f0000000380)) 5.327371919s ago: executing program 4 (id=740): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r3, 0x0, 0x18) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) add_key$keyring(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffb) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="d80000001b0001000000000000000000fc00000000000000", @ANYRESHEX=r0], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)={0x78, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @mcast1}}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x2}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x78}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) syz_emit_ethernet(0x10b, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000040)=0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r7, &(0x7f0000000540)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c, 0x0}}, {{&(0x7f0000000000)={0xa, 0x4e21, 0x3, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=[@rthdrdstopts={{0x14, 0x29, 0x37, {0x2b}}}], 0x14}}], 0x2, 0x4000001) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000ff000000bfa300000000000007030000f0ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000000000001d440000000000007a0a00fe00ffffffc3030000f1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840b08000000f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e82623951743283070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00a5b4f7e9ad0500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd64}, 0x48) r8 = eventfd(0x0) io_submit(0x0, 0x3, &(0x7f00000023c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x100, r8, &(0x7f0000000100)="0000fd6000000000", 0x8, 0x3}, 0x0, 0x0]) 5.262651555s ago: executing program 2 (id=741): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$FUSE_WRITE(r2, &(0x7f0000000180)={0x18, 0x0, 0x0, {0xffffffc0}}, 0x18) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) ioctl$XFS_IOC_FSGETXATTRA(r1, 0x801c582d, &(0x7f0000000080)) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r4 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x8, 0xfe, 0x7fff0006}]}) r7 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) close(0x3) ioctl$DMA_HEAP_IOCTL_ALLOC(r7, 0xc0184800, &(0x7f0000000340)={0xe939, r6}) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x13, r5, 0x100000000) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r4, 0x0) ioctl$USBDEVFS_SUBMITURB(r4, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x20020009, 0x0, &(0x7f0000000240)={0x20, 0x0, 0xfffc, 0x360, 0x7}, 0x1a, 0x7, 0x60000000, 0x0, 0x4, 0x101, 0x0}) syz_emit_ethernet(0x42, &(0x7f0000000280)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @void, {@ipv4={0x800, @tcp={{0x8, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa210104, @local, {[@timestamp_addr={0x44, 0x4, 0x4a}, @generic={0x7, 0x7, "04030e004b"}]}}, {{0x0, 0xfffc, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x0, 0x0, 0x0, 0xfffe}}}}}}, 0x0) setpriority(0x3, 0x0, 0x4) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) futex(0x0, 0x5, 0x0, 0x0, 0x0, 0xc4fffffe) bind$inet6(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) ioctl(r3, 0x40047438, &(0x7f0000000040)) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="01003a0003000400"/21], 0x1c}, 0x1, 0x0, 0x0, 0x20005815}, 0x24000084) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 4.301960602s ago: executing program 2 (id=743): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000001a00010027bd7000fbdbdf25810080000115b7039b0000003a758fadf3a5ab3470b0927350786ae2423131864963c655ea3ac0213dcb8af8d40dce54fc7aee354605d96d2a71903de09ecf1d3ddef033432395dce0b0a5"], 0x1c}, 0x1, 0x0, 0x0, 0x20000880}, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x6cce86, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x10006, 0x2, 0x80}]}) socket$kcm(0x29, 0x2, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x2, 0x80, 0x1, 0x0, 0x0, 0x6, 0x0, 0x2, 0x2, 0x3, 0x0, 0x6, 0x6, 0xffffffffffffffff, 0x200000], 0xeeee0000, 0x28340}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000001280)=@mangle={'mangle\x00', 0x2, 0x6, 0x630, 0x350, 0x280, 0x1b0, 0x280, 0x560, 0x560, 0x560, 0x560, 0x560, 0x560, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'pimreg0\x00', 'macvtap0\x00', {}, {}, 0x21}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x18}, @local, @private2}}, @common=@inet=@multiport={{0x50}}]}, @HL={0x28}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x2a}, @dev, [], [], 'veth1_macvtap\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x5, 0x0, 0x52}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x2, 0xf}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'netdevsim0\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv4=@loopback, 0xfc}}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}, {0x5}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x690) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f00000000c0)={0x2afc0, 0x1c1, 0x6}, 0x18) r6 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000001900)={0x2020}, 0x2020) write$binfmt_register(r6, &(0x7f0000000440)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x9, 0x3a, '\xe2\xbf\xd9\xafk\xd3~a3\xd0\x94', 0x3a, '^', 0x3a, './file0'}, 0x33) truncate(&(0x7f0000000400)='./file0\x00', 0x10) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, &(0x7f0000000380)={0x2, 0x34000, 0x1}) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, &(0x7f0000000040)={0x0, 0x12000, 0x1}) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x700) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(r8, 0x6f2d, 0x2000001) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r9, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r1, @ANYBLOB="0600cd00000000006c003300"], 0x90}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 2.921430933s ago: executing program 3 (id=745): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b00010000100009045507010349020009058203"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00N'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.902812603s ago: executing program 2 (id=746): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) 2.79634363s ago: executing program 2 (id=747): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002680)=[{{&(0x7f0000000580)={0xa, 0x0, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000340)="18", 0x1}], 0x1}}, {{&(0x7f0000000140)={0xa, 0x4e20, 0x0, @private0, 0x80000001}, 0x1c, &(0x7f0000000800)=[{&(0x7f0000000180)="ed", 0x1}], 0x1}}], 0x2, 0x4008040) openat$iommufd(0xffffffffffffff9c, 0x0, 0x20400, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x0, 0x9, 0x8001, 0x0, 0x9, 0x8000000000, 0xffffffff, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="3800000010001ffffcfffffffddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="000001000000000008002800f936000008000a00", @ANYRES32=r5, @ANYBLOB="08000500", @ANYRES32=r5, @ANYBLOB="fe590d1504e8a9af7a64b4d0e47e1f0346a1e2e7ce71895f076b18cb2d88ed75f3cb920ee925ad91ea3ba8ca76159f0b58f80f7039abb5e1c24550e88afd1d05ff7775e7a78f8e46c03f78c96607996e192ef88574df19e588434167006b473136f65ef6b8d1d05e688a45c67efee0ad6102e98f312bb3d59563cb50f8339fb3cb84"], 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000b40)=ANY=[@ANYBLOB="f0f4ffff0f000000008400"/20, @ANYRES32=0x0, @ANYBLOB="00a3000000000000c8051680340001800c00070006000000e20000000c000500d60000008c1d00000c000400060000007d0000000c00050007000000f8ffffffe00001800c000400010000000200000010000b000200000000000000000000001000060004000000000000000b0000000c000500010000000900000040000c80140001000b0000006d0d000001000000810000001400010005000000100d0000da00000088a8000014000100080000009e0f00000500000088a800000c000700060000007f0000002800010000000000427584f72b9b000000000000000000000000000000000000000000000000000010000a0000040000ed0000000000000010000600800000000300000000000000100006006100000007000000080000005001018010000b0007000000fbffffffffffffff54000c801400010080000000d70200000900000088a8000014000100040000007a0e000002000000810000001400010005000000e704000009000000810000001400010008000000ef0a00005500000088a80000b8000c801400010000000100750f000005000000810000001400010008000000520a00000100010088a800001400010008000000000300000200000088a8000014000100ff030000b20a0000070000008100000014000100d38a000083060000ff0f00008100000014000100010100001308000009000000810000001400010000200000ce0d000000000020810000001400010008000000660a0000320f0000810000001400010005000000f80f0000940000008100000010000a0002000000000000000100000010000a0008000000f9ffffffffffffff10000b00060000000008000000000000540001800c00070002000000030000000c000700000000000600000010000a003dab00005c060000000000001000020001000100420c0000050000000c00030006000000040000000c0003008e0f000003000000040001805c00018010000a00060000008c09000000000000100006000400000001000000050000002800010008000000aaaaaaaaaa22000000000000000000000000000000000000000000000000000010000a0008000000fb0e0000000000002c000180100002000e000000300d0000000100000c0003007f0c0000008000000c00050006000000090000005001018028000100090000000180c200000000000000000000000000000000000000000000000000000000000c000700f4ffffff01000000100006000010000004000000010000000c000500de00000001000000b8000c8014000100400000000e040000f9070000810000001400010003000000d20c0000652b00008100000014000100070000005c0800000800000009a8000014000100010001007b090000ca0000000000000014000100ff0f00005a0500000000000088a8000014000100060000000f04000007000000810000001400010000000000940f0000f8ffffff88a800001400010002000000980b00000200000088a800001400010003000000b60a00000000000088a800000c000700070000000300000010000600c4000000ff000000080000000c00030005000000040000000c000300040000000500000010000a002fcd33600700000000000000040001802c01018010000a0008000000ff0f0000000000000c000700040000000400000010000b000100000071000000000000000c00070002000000e000000010000a008000000000000080ffffffff10000600010e0000070000000500000010000200060000008007000008000000a4000c8014000100f8ffffff7a0e00000700000088a800001400010009000000350b00000f0000008100000014000100030000007c0700000000000088a800001400010000000020e40c0000ff0f00008100000014000100400000007c0a00000c00000088a800001400010007000000250500000f000000810000001400010001000000630c00006549000088a800001400010004000000e503000004000000810000000c000400090000009e0a000010000200050000000b0500000000000008000500", @ANYRES32=0x0, @ANYBLOB], 0x5f0}, 0x1, 0x0, 0x0, 0x24008000}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r6 = syz_mount_image$fuse(&(0x7f0000000100), &(0x7f0000000200)='./file0/file0\x00', 0x100000, 0x0, 0x1, 0x0, 0x0) statx(r6, 0x0, 0x6000, 0x20, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r7, 0x7a7, &(0x7f0000000100)=0x80000) bind$rxrpc(r4, &(0x7f0000000140)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e21, @private=0xa010101}}, 0x24) ioctl$DRM_IOCTL_PANTHOR_GROUP_CREATE(0xffffffffffffffff, 0xc0386447, &(0x7f00000003c0)={{0x8, 0x0, &(0x7f0000000340)}, 0xb9, 0x16, 0x9, 0x5, 0x0, 0x7, 0x2, 0x2}) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f00000002c0)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r7, 0x7a8, &(0x7f0000000200)={{@host}, @host, 0x0, 0x0, 0x2449, 0x0, 0x2000000000000000, 0x0, 0x100000}) ioctl$IOCTL_VMCI_VERSION2(r7, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r7, 0x7a4, &(0x7f0000000180)={{@host}, 0xfffffffffffffffc, 0x800000000000002, 0x1000000, 0x8}) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) 2.782140895s ago: executing program 0 (id=748): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) 2.676407421s ago: executing program 0 (id=749): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), 0x0, 0x2010404, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="8add03e001dca42b2fe51ab6166156141ddb2fafb5d5abaf966d3661e2d15290b39d4403bd04982523264074906bf7c7a1652df576fc290817621d860eee412d6def1064ab4226654a99"], 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010400000000000000000a0000000900010073797a31000000000900030073797a310000000034000000030a010400000000000000000a0000000900010073797a31000000000900030073797a320000000008000a000000000440000000060a010400000000000000000a0000000900010073797a31000000000900020073797a320000000014000480100001800c000100636f756e746572006c000000060a010400000000000000000a0000000900010073797a31000000000900020073797a3100000000400004803c0001800e000100696d6d6564696174650000002800028008000100000000001c0002801800028008000100fffffffd0900020073797a32"], 0x15c}}, 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x104000, 0x0) r2 = openat$autofs(0xffffff9c, &(0x7f00000000c0), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r2, 0xc018937e, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) socket(0x40000000015, 0x5, 0x0) close(r3) 2.625513633s ago: executing program 1 (id=750): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) (async) r2 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905811765"], 0x0) (async) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x2) (async) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f00000003c0)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2000, 0x10000004, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x1, 0x0, 0x21c}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x20, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) (async) ioctl$VIDIOC_S_EXT_CTRLS(r10, 0xc0185648, &(0x7f0000000640)={0x9b0000, 0x65, 0x6db, 0xffffffffffffffff, 0x0, &(0x7f0000000600)={0x9f0903, 0x80000000, '\x00', @string=&(0x7f00000001c0)=0x8}}) (async) ioctl$EVIOCGMASK(r3, 0x541b, 0x0) syz_usb_control_io$cdc_ncm(r2, &(0x7f0000000180)={0xc, &(0x7f0000000040)={0x0, 0x5, 0xf4, {0xf4, 0x7, "b1d7cea0e89988e50554e38d370fd79336d47e326faee47e58c94a53f0b20a1a88cb66ef0bb68003b4c370e32946597d9b3c11e5e5d60d40c518fd8943117d5aaee87c90fec80325e6b8c6e7ac5efe548367bd7f9efbcd9e9edb2d437314f7847ec32c61edb28d03ef84580c6b9208ff84e7b72dd7f5e620a081771bf262cddb33672d0a612a4cae3b1c83162d880ca4b58d6d070a239ef136be90e6e2b7f955ff041f2e26b62a30de974add16eb143bfe28d30bcf8396388ace9b234fbb74cd27ae6cd8f2f43c839fc425448e98f3686682e5f981504601ce0a908b624ff66f36008a6270601488c36dc6fedfc0327ca520"}}, &(0x7f0000000140)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000005c0)={0x24, &(0x7f0000000240)={0x40, 0x10, 0xdf, "78524ef77c6827005c4a3486cad64ed3f36d311929b4895c617bc75c977b8d64773ade60d743372a4f9fd5e3c77a4f9599bad7e31223b9ed271719cab3fc6d93ec7ab0c6b3e608ae6f7ac2b8a22dfc3303cd79bc5dc9368f1983b8e05657e16d024320f2cdd11ed08c7a00efdc24d429afdcf688a1326be43af30ac45be47ccb81f11630afac72c1bb68f02c957af90dd7ab172cf238e049dfdfa63803fdb6e4b4f33c33c689656eaabcda3ad8185f35b45bd67a40992de4ac31909cf297e799fbe7d84be374a3f7e0b5b433cc1bfc6089761f695496efbc3586237809a474"}, &(0x7f0000000340)={0x0, 0xa, 0x1, 0xdb}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x4}, &(0x7f00000003c0)={0x20, 0x80, 0x1c, {0x8, 0x8, 0x17b, 0x6c3, 0x1, 0x25b, 0x1, 0x0, 0x1, 0x8, 0x8, 0xff}}, &(0x7f00000004c0)={0x20, 0x85, 0x4, 0x80000000}, &(0x7f0000000500)={0x20, 0x83, 0x2}, &(0x7f0000000540)={0x20, 0x87, 0x2, 0x4}, &(0x7f0000000580)={0x20, 0x89, 0x2, 0x1}}) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000010000000000000001410000001800170000000000000000b36e683a74"], 0x34}}, 0x0) 2.542495814s ago: executing program 0 (id=751): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x2) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) sendmsg$NFT_MSG_GETGEN(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, 0x10, 0xa, 0x500, 0x0, 0x0, {0x1, 0x0, 0xa}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24000040}, 0x880) 2.533711116s ago: executing program 4 (id=752): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x50241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000200)={@my=0x0, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f00000000c0)={{@my=0x0}, 0x1}) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r2, 0x7a6, &(0x7f00000001c0)={0x7ff0000000000000, 0x7, 0xe, 0x40, 0x27, 0x8}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRESDEC=r1, @ANYBLOB="00be54c7a70002800800010000000000000000000000000000000000ed7c215f8c4298adaec520ad2535f5ccf9c7b0019476738963be696f1defce5e80092ea592bcb1b2c8fefa2ed64e5bfe297f2cec56c9957755e56cf1e25e6b735f37296c59b213d81674917e7426d40add0f44f96b9b09c5afbcd6530d40a4551391bb506aecf0d260b7a0dd4923b0", @ANYRES8=r3], 0x78}}, 0x400c004) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r4 = socket$kcm(0x2, 0x3, 0x2) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x5, 0x74, 0x43, 0x2}, 0x50) bpf$BPF_GET_PROG_INFO(0x4, &(0x7f00000001c0)={r5, 0xe0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000007c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x75, 0x8, 0x0, 0x0}}, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000880)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x2b}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0x30, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}}, {0x4e20, 0x4e20, 0x1c, 0x0, @opaque="7735a53655074c9c043b03eaa092881a25a70eda"}}}, 0x3e) 2.393339233s ago: executing program 1 (id=753): preadv2(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f00000003c0)=""/4096, 0x1000}], 0x1, 0x0, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x3, 0x6, 0x7fff7ffc}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) io_uring_setup(0x267a, &(0x7f0000000140)={0x0, 0x52a0, 0x8000, 0x1, 0x8e}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b19, &(0x7f0000000140)={'wlan1\x00', @random="0100eb00"}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={0x0, 0xfc}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) bind$tipc(0xffffffffffffffff, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81e8943c, &(0x7f0000000680)) r4 = creat(&(0x7f0000000300)='./file0\x00', 0x68) landlock_restrict_self(r4, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x0) renameat2(r5, &(0x7f00000001c0)='./file0\x00', r5, &(0x7f0000000200)='.\x02\x00', 0x4) renameat2(0xffffffffffffff9c, &(0x7f0000000100)='.\x02\x00', r5, &(0x7f0000000000)='./file0\x00', 0x2) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) bind$tipc(r2, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000580)='/proc/tty/drivers\x00', 0x0, 0x0) fcntl$lock(r6, 0x5, &(0x7f0000000000)={0x0, 0x2, 0x7fffffffffffffff, 0xb}) syz_usb_connect$cdc_ncm(0x3, 0x0, 0x0, 0xffffffffffffffff) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/profiling', 0xdb3f6ad56b18b604, 0x40) sendfile(r7, r7, 0x0, 0x8) 2.22578326s ago: executing program 4 (id=754): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000001d40)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0x6a144b89, @private2, 0x5}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000200)="fe86b7", 0x3}], 0x1}}], 0x1, 0x931766f6319eed40) r1 = socket$inet6(0xa, 0x5, 0x0) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c) r2 = socket$inet6(0xa, 0x5, 0x0) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e23, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000001340)=[{&(0x7f0000004940)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) 2.163977885s ago: executing program 0 (id=755): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r3, 0x0, 0x18) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) add_key$keyring(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffb) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="d80000001b0001000000000000000000fc00000000000000", @ANYRESHEX=r0], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)={0x78, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @mcast1}}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x2}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x78}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) syz_emit_ethernet(0x10b, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000040)=0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x44, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r7, &(0x7f0000000540)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c, 0x0}}, {{&(0x7f0000000000)={0xa, 0x4e21, 0x3, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=[@rthdrdstopts={{0x14, 0x29, 0x37, {0x2b}}}], 0x14}}], 0x2, 0x4000001) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000ff000000bfa300000000000007030000f0ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000000000001d440000000000007a0a00fe00ffffffc3030000f1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840b08000000f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e82623951743283070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00a5b4f7e9ad0500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd64}, 0x48) io_setup(0x2, &(0x7f0000000000)=0x0) r9 = eventfd(0x0) io_submit(r8, 0x3, &(0x7f00000023c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x100, r9, &(0x7f0000000100)="0000fd6000000000", 0x8, 0x3}, 0x0, 0x0]) 1.243055754s ago: executing program 4 (id=756): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000001a00010027bd7000fbdbdf25810080000115b7039b0000003a758fadf3a5ab3470b0927350786ae2423131864963c655ea3ac0213dcb8af8d40dce54fc7aee354605d96d2a71903de09ecf1d3ddef033432395dce0b0a5"], 0x1c}, 0x1, 0x0, 0x0, 0x20000880}, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x6cce86, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x10006, 0x2, 0x80}]}) socket$kcm(0x29, 0x2, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x2, 0x80, 0x1, 0x0, 0x0, 0x6, 0x0, 0x2, 0x2, 0x3, 0x0, 0x6, 0x6, 0xffffffffffffffff, 0x200000], 0xeeee0000, 0x28340}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000001280)=@mangle={'mangle\x00', 0x2, 0x6, 0x630, 0x350, 0x280, 0x1b0, 0x280, 0x560, 0x560, 0x560, 0x560, 0x560, 0x560, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'pimreg0\x00', 'macvtap0\x00', {}, {}, 0x21}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x18}, @local, @private2}}, @common=@inet=@multiport={{0x50}}]}, @HL={0x28}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x2a}, @dev, [], [], 'veth1_macvtap\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x5, 0x0, 0x52}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x2, 0xf}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'netdevsim0\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv4=@loopback, 0xfc}}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}, {0x5}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x690) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f00000000c0)={0x2afc0, 0x1c1, 0x6}, 0x18) r6 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000001900)={0x2020}, 0x2020) write$binfmt_register(r6, &(0x7f0000000440)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x9, 0x3a, '\xe2\xbf\xd9\xafk\xd3~a3\xd0\x94', 0x3a, '^', 0x3a, './file0'}, 0x33) truncate(&(0x7f0000000400)='./file0\x00', 0x10) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, &(0x7f0000000380)={0x2, 0x34000, 0x1}) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, &(0x7f0000000040)={0x0, 0x12000, 0x1}) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x700) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(r8, 0x6f2d, 0x2000001) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r9, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r1, @ANYBLOB="0600cd00000000006c003300"], 0x90}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 1.240505292s ago: executing program 2 (id=757): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0xa9, 0x8000000000000000, 0x8, 0x7, 0x6}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x1, 0x2, &(0x7f0000000480)=ANY=[@ANYBLOB="91100400000000009500000000000000ab89becd60798ba0c7b340b02956c1c3822c3f572da76a3b992d243e0b89f6b734d5fdf6cb7955ac9702e4a18821040f9856a1bf21bf5e9b77a91e739c3ee223bb727fb18bc991da02854893b585f4465da763f2ac1d5e22ab728ef23681fe8fdf16f570082bdfadcd7f48aa86c2c12a78db90a7781fa547451f272ad46f8e5733fb606f040417634328cbf1b47957851ce3cbc4eb683cc45e48df30ead552a32564e7d1ab13b4aa22e4dd4970134ec08873d32468bed08369a2ec7cef09ea5af2dfc3dbf2f13954a41a3e02b5e2fd65c37b0f22ce8f18ef"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) pipe2$watch_queue(0x0, 0x80) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$evdev(0x0, 0x2, 0x862b01) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000100)={0x51, 0x0, 0x0, {0xffff, 0x1}, {0x24, 0x8002}, @cond=[{0x8, 0x5388, 0x7, 0x800, 0x0, 0x7}, {0x0, 0x5, 0x1, 0x0, 0x8000, 0x9}]}) setrlimit(0x8, &(0x7f0000000300)={0x4, 0x7}) setsockopt$sock_int(r3, 0x1, 0x12, &(0x7f00000000c0)=0x387, 0x41) sendto$inet(r3, 0x0, 0x2c, 0x24044000, &(0x7f0000000380)={0x2, 0x4e22, @remote}, 0x10) r4 = shmget$private(0x0, 0x800000, 0x880, &(0x7f0000173000/0x800000)=nil) socket(0x2d, 0x2, 0x0) shmctl$IPC_RMID(r4, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='net/fib_triestat\x00') r5 = socket$inet6_tcp(0xa, 0x1, 0x0) memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) syz_usb_connect(0x2, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8=r2, @ANYBLOB="79a9"], 0x0) syz_open_dev$usbmon(&(0x7f0000000080), 0x8002, 0xa2000) r6 = syz_open_dev$audion(&(0x7f00000002c0), 0x3, 0x1) write$P9_RVERSION(r6, &(0x7f0000002200)=ANY=[], 0xfffffcd9) close_range(r5, 0xffffffffffffffff, 0x0) openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) 1.231930512s ago: executing program 3 (id=758): r0 = syz_io_uring_setup(0x34bb, &(0x7f0000000540)={0x0, 0x2730, 0x800, 0x2, 0x39a}, &(0x7f0000000180)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000240)=0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x22040, 0x1) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_i', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000040)={0x50, 0x0, r5, {0x7, 0x1f, 0x0, 0x10400, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4}}, 0x50) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000040)={0x22, 0x0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r0}) io_uring_enter(r0, 0x1, 0x2, 0x1, 0x0, 0x0) 465.168898ms ago: executing program 4 (id=759): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0x9, 0xfffffffffffff001, 0xff, 0xffff, 0x7f}, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x161140, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async, rerun: 32) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) sendmmsg$unix(r4, &(0x7f000000bbc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000001180)="dd9e", 0x2}], 0x1, &(0x7f0000000540)=ANY=[@ANYBLOB="1000000001884e99d93f99106b9741f8c683df619863495211000000010000000ec80d4cb093245d5247ff2b418effa25d211e04872f18d26c802c8d2d157972d8f0a1b3c3f9defcbbe2300884f442b2f5a20f40286fc5db7c028b6983f958ea55433349852adf05933811ad7fb9c774e35c8fb6ddb23ae0ac7e0b9f7407e834756c"], 0x10, 0x20000041}}], 0x1, 0xc004) (async, rerun: 64) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) pipe2(&(0x7f0000002300)={0xffffffffffffffff}, 0x0) splice(r7, 0x0, r6, 0x0, 0x90, 0x0) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000000000)={0x90, 0xffffffffffffffd9, 0x0, {0x7, 0x2, 0x8, 0x8000005, 0xfffefffa, 0x6, {0x8, 0x807, 0x2, 0x7, 0x8a, 0x80000001, 0x101, 0x0, 0x6, 0xa000, 0x80000, 0x0, 0x0, 0x6704, 0x30301811}}}, 0x90) recvmmsg(r5, &(0x7f0000006d00)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000003c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, 0x80, &(0x7f00000021c0)=[{&(0x7f0000000600)=""/186, 0xba}, {&(0x7f00000006c0)=""/219, 0xdb}, {&(0x7f00000007c0)=""/33, 0x21}, {&(0x7f0000000800)=""/241, 0xf1}, {&(0x7f0000000900)=""/194, 0xc2}, {&(0x7f0000006e40)=""/4091, 0xffb}], 0x6, &(0x7f0000000c00)=""/138, 0x86}}, {{0x0, 0x0, &(0x7f0000003640)=[{&(0x7f0000002340)=""/149, 0x95}, {&(0x7f0000002400)=""/72, 0x48}, {&(0x7f0000002480)=""/6, 0x6}, {&(0x7f00000024c0)=""/4087, 0xff7}, {&(0x7f00000034c0)=""/132, 0x84}, {&(0x7f0000003580)=""/187, 0xbb}], 0x6}, 0x6}, {{&(0x7f0000003680)=@l2tp6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000000b00)=[{&(0x7f0000003700)=""/194, 0xc2}, {&(0x7f0000000a00)=""/201, 0xc9}], 0x2, &(0x7f0000000d40)=""/112, 0x70}, 0x2}, {{&(0x7f00000038c0)=@nfc_llcp, 0x80, &(0x7f0000003ac0)=[{&(0x7f0000003940)=""/224, 0xe0}, {&(0x7f0000003a40)=""/70, 0x4f}], 0x2, &(0x7f0000000cc0)=""/121, 0x79}, 0x4}, {{&(0x7f0000003b80)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000004d40)=[{&(0x7f0000003c00)=""/23, 0x17}, {&(0x7f0000003c40)=""/137, 0x89}, {&(0x7f0000003d00)=""/40, 0x28}, {&(0x7f0000003d40)=""/4096, 0x1000}], 0x4, &(0x7f0000004d80)=""/254, 0xfe}, 0x3}, {{&(0x7f0000004e80)=@hci, 0x80, &(0x7f0000005200)=[{&(0x7f0000004f00)=""/19, 0x13}, {&(0x7f0000004f40)=""/199, 0xc7}, {&(0x7f0000005040)=""/169, 0xa9}, {&(0x7f0000005100)=""/165, 0xa5}, {&(0x7f0000000b40)=""/42, 0x2a}], 0x5, &(0x7f0000005240)=""/164, 0xa4}, 0xfffffeff}, {{&(0x7f0000005300)=@generic, 0xfffffffffffffe8c, &(0x7f00000055c0)=[{&(0x7f0000005380)=""/77, 0x4d}, {&(0x7f0000005400)=""/103, 0x67}, {&(0x7f0000005480)=""/47, 0x2f}, {&(0x7f00000054c0)=""/20, 0x14}, {&(0x7f0000005500)=""/182, 0xb6}, {0x0}], 0x6, &(0x7f0000005600)=""/68, 0x44}, 0x3}, {{&(0x7f0000005680)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000000b80)=[{&(0x7f0000005700)=""/116, 0x74}, {&(0x7f0000005780)=""/56, 0x38}, {&(0x7f00000057c0)=""/61, 0x3d}, {&(0x7f0000005800)=""/190, 0xbe}, {&(0x7f00000058c0)=""/228, 0xe4}, {&(0x7f00000059c0)=""/136, 0x88}, {&(0x7f0000005a80)=""/85, 0x55}, {&(0x7f0000005b00)=""/169, 0xa9}, {&(0x7f0000005bc0)=""/4096, 0x1000}, {&(0x7f0000006bc0)=""/76, 0x4c}], 0xa, &(0x7f0000006cc0)=""/52, 0x34}, 0x39}], 0x9, 0x2, 0x0) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x7fff, 0x0, 0x0, 0x41100, 0x47, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) (async, rerun: 32) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (rerun: 32) stat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl$Q_QUOTAOFF(0xffffffff80000300, &(0x7f00000000c0)=@filename='./file0\x00', r8, 0x0) gettid() (async, rerun: 32) r9 = socket$alg(0x26, 0x5, 0x0) (rerun: 32) bind$alg(r9, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) (async, rerun: 32) r10 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) (rerun: 32) ioctl$SNDCTL_DSP_SETFRAGMENT(r10, 0xc004500a, &(0x7f0000000000)=0xffff0018) (async) ioctl$SOUND_PCM_READ_RATE(r10, 0x80045002, 0x0) (async) r11 = accept4(r9, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f00000001c0)="00940a37", 0x4) sendto$unix(r11, &(0x7f0000000440)="36d9a32e92c131d730b1abaedb51eb66fd2d5b1f7eda4f0e859fdaf294bad70673813533d8bf1c6a77b65a7afdc01b29e73571071a68d5def5d7df839810da130b9348f4d9d407eb478d5bfb298c552a498271af70914e14ba9476fd2a0e47984c25ea20afab3064a748add27a7149e9c4705475bda2ecec9ec30214f28c5e16fd3f50f604f20232c534409e52bff64fc6ca0f5e254083aec2794b7216e002e87caf3d0fa7d04ff9e3b03e81595a04979594ff6ea888bf13de8e8f74c6178e31e47593732ae1a501ad3641d423195a788efdb643f50a8c8b9794a62f7b8dfa0fa7da9d391b92ce2a7f9fe0f9d584a3775f", 0xf1, 0x20004003, 0x0, 0x0) (async) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000180)=0x2) 380.430134ms ago: executing program 0 (id=760): r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x7, 0x7, 0x4, 0x20, 0x80, 0x3, 0x1d, 0x7, 0x2, 0x71, 0xa0, 0xf, 0x9, 0x4}, 0xe) sendto$inet6(r1, &(0x7f0000000500)="a4", 0x34000, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) close(r1) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='gid_map\x00') getdents(r3, &(0x7f0000000100)=""/64, 0x40) ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f00000002c0)={0x1}) io_setup(0x4d6, &(0x7f0000000000)=0x0) r5 = syz_open_dev$rtc(&(0x7f0000000780), 0x5, 0x402001) io_submit(r4, 0x6, &(0x7f0000000940)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x7, 0x401, r0, &(0x7f00000001c0)="88a0c6777e4af1b7201111ce82624914d0a7518934eb7e8d3fdbd03eb4841889fea562d81e47beb01c878e88104d90212e6cd6795f1f0839bf6d42bdbe0f90ff4e2564a8b7c5bc259478122a2dab2f19af1e0eda13c85ca14c1ac02372ec5bf04d216b5d29af115d7025d9aecb4dc9ff7492775d5867d89fa922ffb74733a56581648b110f1f8472d4", 0x89, 0x3, 0x0, 0x6}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x5, 0x3, r0, &(0x7f00000003c0)="f11c709904adf51e0809c59cab5de6f9e81c6c551234d9749c72ee64f3e106bf2834f4348235ad848cfbbaa947e09dc7928a83d367356ae29360addaa06b8ba00f1cd5c1c713d877296b8d112210d53f8ba08b26e5c0f9c65a5858c127bde9e6c29c0ef223847754d03d891fee06d89cce02f3e9699c9d85d9ff6a40b942981595bcefa0dbaff6e68144254cd6349161605e191fc2", 0x95, 0xfffffffffffffffc}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x2, 0xffff, r2, &(0x7f00000004c0)="500fe1f9ebb07b95e6075ae3c8e100291d46f4f6c2a7fea6ee66adeb815654fde2d994fe6d141d813ec1816937366b7ea3ebaa4253ad4d7de8f3aee3aac5b7404bf651a924940e39a353d203ea6d31210eaeb6dcd2497e44a8d9c7418e35383cee83e33bf734f9c2d6822d77de5660299c71a5a282f06577896f5e320573011c227e4ff2f6c1d664", 0x88}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x9a, r3, &(0x7f00000005c0)="90253b7383c9b85b35fa3ea908755c04d3198f78f5d7688e8fdedbc9111c5771c0562054b0d9b126e0e275171e15906664eb06df0dd4ba0b8d795766e65d25b6c0343787bd3c26a4e9e6b9e539d72514debe6cdc8045dcf58e641fd42302695dae88c6d766484dcb114fb443d10af83945028e", 0x73, 0x286, 0x0, 0x2, r3}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x1, 0xff, r3, &(0x7f0000000680)="5209b91d6776aa1f340d6f071db212319817bd064d431f971378abb2b6bafa2083412e3a2bb056e451fbc6f8d668dda16fe86e4c06547d35ab041b17acf35ed1834289756464afa93c4cbe3bc282620d9d18638ab0020777fc482ea6d513c3e8dbe455b6d56c0a8e3b8feed4f32c9b990d558352271dfc382cd098597cb2d5c88b0c73827c11cef3380c707eb4009c83c361107696a852", 0x97, 0x5, 0x0, 0x0, r3}, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x8, 0x5, r5, &(0x7f0000000800)="2ac6670878048188a34b77d3a7e7ce77cdaf03164fbffab951e156e3f7a385bcd181806eeb80ec2762c156a30b2c2c8308820a9fc3fe1cf358d3ca4b77347385fc0d40de751219edd738fd89bf94265ca138baa503221292036d82e22a26f1f6418cb2e0d841157903d538d19fbd923d7d1c4cd34ab7366e55826a88923fb6153b51822a964a7bc69637c3e24da25820f783f303cd585f463cf899eaa55b4aff339cd7f622719fb7b69f341915e3557c1e230c301a1f7d484db84ce9f37f65a3afefbaa64f466d2d8e63e7f49b3d516a12e480d0221ad3b657d24dfa8cf317222637fea016ab", 0xe6, 0xc3, 0x0, 0x1, r3}]) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000003880)={'dummy0\x00', &(0x7f0000003840)=@ethtool_channels={0x3c, 0x4, 0xc4, 0x10001, 0x10000, 0xb4a0, 0xfe0, 0x73, 0xfffffffc}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x3b, 0x301, 0x70bd29, 0x25dfdbfb, {0x10}}, 0x14}, 0x1, 0x0, 0x0, 0x200448c2}, 0x2004c844) r7 = socket$kcm(0x29, 0x2, 0x0) ioctl$KVM_GET_MSRS_cpu(r3, 0xc008ae88, &(0x7f00000007c0)={0x1, 0x0, [{0x119, 0x0, 0x7}]}) r8 = eventfd2(0x1, 0x80001) io_submit(r4, 0x4, &(0x7f0000000bc0)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0xf811, r7, &(0x7f0000000300)="a14f0542e9366dda31ed10d9a15b37485bfdc3ea8685b753d755640d66bc282db5da6219bb432c24f5e0e9259c3fb14c9182e6bc8232", 0x36, 0x7fff, 0x0, 0x0, r3}, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x1, 0x40, r1, &(0x7f0000000380)="b881b8d4f5b1ea57d217a5b2cdf1e2508bfe66df1c74f48cead28907eb95540cca1f9e8381ba5ce21977d389f6a3f3c7969dd88a10a6d566e3dec0", 0x3b, 0x5, 0x0, 0x0, r3}, &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x9, r0, &(0x7f00000009c0)="729d2e094386189e56c3e92189cde23c51000af73ea36d979002cc795bb8f1c13069f515fd9c0913a0139cd3aa7bdf93d71062d0886e1bcf7989146d4aa643926b4677513597ab103e0d70df987531e12c62774bc91ccb166c4a613aef62d43888ac494205bf28acc601d544b20c2837bbf15d5faee9865ce388a6c4184c57a140c8a86bded09905f15c4530ec6e0f03e0c5d378a3ea7556e97ea82fdbd62b6ce0876d0227de5001e1b9392846f9748acf6d66de72af158164ca30142c1fb6a22ab3ef4891a45c39c1c8d7a108f75d6effdd9e09d5b4bed33d877963f3991f2d66d51538f5f8819499d8343b3d06702fdaf279b0bc886fe3a0f16e3328a9", 0xfe, 0x4, 0x0, 0x0, r8}, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x5, 0x0, r6, &(0x7f0000000b00)="1210c30f2af5e82d1fc24012412947f3454f491a32bdff8c5d58c7b950e03d24f5f1c4c43c5d2dd07a71bc25970b324e524a201d31670e47e1f8cd4562e2b91a39fd94db7140484b27e7cf0d", 0x4c, 0x40, 0x0, 0x5, r3}]) mknodat$null(r3, &(0x7f0000000040)='./file0\x00', 0x8, 0x103) r9 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r9, 0x8936, &(0x7f0000000000)) 253.904845ms ago: executing program 3 (id=761): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), 0x0, 0x2010404, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="8add03e001dca42b2fe51ab6166156141ddb2fafb5d5abaf966d3661e2d15290b39d4403bd04982523264074906bf7c7a1652df576fc290817621d860eee412d6def1064ab4226654a99"], 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010400000000000000000a0000000900010073797a31000000000900030073797a310000000034000000030a010400000000000000000a0000000900010073797a31000000000900030073797a320000000008000a000000000440000000060a010400000000000000000a0000000900010073797a31000000000900020073797a320000000014000480100001800c000100636f756e746572006c000000060a010400000000000000000a0000000900010073797a31000000000900020073797a3100000000400004803c0001800e000100696d6d6564696174650000002800028008000100000000001c0002801800028008000100fffffffd0900020073797a32"], 0x15c}}, 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x104000, 0x0) r2 = openat$autofs(0xffffff9c, &(0x7f00000000c0), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r2, 0xc018937e, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) socket(0x40000000015, 0x5, 0x0) close(r3) 143.735591ms ago: executing program 4 (id=762): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r8 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=@newtfilter={0x16c, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xb}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x13c, 0x2, [@TCA_BASIC_ACT={0x138, 0x3, [@m_simple={0x134, 0x6, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_DEF_PARMS={0x18, 0x2, {0x5, 0x0, 0x0, 0x0, 0xf}}, @TCA_DEF_DATA={0x8, 0x3, 'htb\x00'}]}, {0xe7, 0x6, "34b60819ef809efd6bc24d36685596288be1712df0174004a7680ec8b396b5ebc04b7834887a5d1bb642689862424fcefc9c719c727f373814e9df2f82511f6589ca4ef966d8365cc6bad9fd904bcc450d95ce86b1ee1bce5e1a3fb56a6f458c39a9273a3a3b10c71c5e9f6d7469536aa3a969d0c53f483c5278646e5aa46128ce6ee622e113cb4a48b8d3c3baeeb67160d40a43d1ae7a87ae568636a6ff16b5fa7719dca98d73573782424d957ca5de61920ad8b5ece9f816fa040d957b1c228190ab5c4d7694ac27f868e66fc5993bcd1d75dfd2a100deb87d025345cdf74e5f1272"}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}]}]}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x10}, 0x8080) r9 = socket$kcm(0x11, 0x3, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r11, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18}}], 0x18, 0x4008800}, 0x40800) setsockopt$SO_ATTACH_FILTER(r12, 0x1, 0x4c, &(0x7f000002eff0)={0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x2}]}, 0x10) recvmmsg(r12, &(0x7f0000007340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/61, 0x3d}, 0xff7ffffe}], 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r15 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="050000000000fcdbdf214400000008000300", @ANYRES32=r13, @ANYBLOB="1400238005000000"], 0x30}, 0x1, 0x0, 0x0, 0x20004044}, 0x0) sendmsg$kcm(r9, &(0x7f0000000340)={&(0x7f0000000140)=@xdp={0x2c, 0x8, r3, 0x3c}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000380)='\x00', 0x14}], 0x1}, 0x4011) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000940)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f00000011c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 67.754962ms ago: executing program 3 (id=763): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r3, 0x0, 0x18) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) add_key$keyring(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffb) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="d80000001b0001000000000000000000fc00000000000000", @ANYRESHEX=r0], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)={0x78, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x30, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @mcast1}}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x2}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x78}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) syz_emit_ethernet(0x10b, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000040)=0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r7, &(0x7f0000000540)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c, 0x0}}, {{&(0x7f0000000000)={0xa, 0x4e21, 0x3, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=[@rthdrdstopts={{0x14, 0x29, 0x37, {0x2b}}}], 0x14}}], 0x2, 0x4000001) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) io_setup(0x2, &(0x7f0000000000)=0x0) r9 = eventfd(0x0) io_submit(r8, 0x3, &(0x7f00000023c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x100, r9, &(0x7f0000000100)="0000fd6000000000", 0x8, 0x3}, 0x0, 0x0]) 0s ago: executing program 0 (id=764): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r2, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) write$tun(r0, &(0x7f00000004c0)={@val={0x0, 0x86dd}, @val={0x0, 0x1, 0x9, 0x4, 0x0, 0xca6}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0xff, @local, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0xa888, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x3, 0x5}, 0x1, {0x88a8}}}, {0x8, 0x22eb, 0x20000, {{0x0, 0x2, 0xc, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) r3 = syz_usb_connect$hid(0x1, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x458, 0x5019, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x20, "", [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x8, 0x7, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x0, 0x13, 0xff}}}}}]}}]}}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r4, 0x0, 0x50, 0x0, &(0x7f0000000040)=0xa4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000000)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="000429"], 0x0, 0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): ][ T985] usb 2-1: Manufacturer: syz [ 206.727989][ T985] usb 2-1: SerialNumber: syz [ 207.001329][ T985] usb 2-1: Focusrite Clarett USB Mixer Driver enabled (pid=0x8207); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 207.018570][ T985] usb 2-1: Error initialising Clarett USB Mixer Driver: -22 [ 207.115907][ T985] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 207.140399][ T985] usb 2-1: USB disconnect, device number 32 [ 207.231939][ T5749] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 207.259005][ T5685] udevd[5685]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 207.349432][ T7398] FAULT_INJECTION: forcing a failure. [ 207.349432][ T7398] name failslab, interval 1, probability 0, space 0, times 0 [ 207.384912][ T7398] CPU: 0 UID: 0 PID: 7398 Comm: syz.0.505 Tainted: G L syzkaller #0 PREEMPT(full) [ 207.384945][ T7398] Tainted: [L]=SOFTLOCKUP [ 207.384951][ T7398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 207.384959][ T7398] Call Trace: [ 207.384966][ T7398] [ 207.384973][ T7398] dump_stack_lvl+0xe8/0x150 [ 207.385002][ T7398] should_fail_ex+0x40c/0x560 [ 207.385023][ T7398] should_failslab+0xa8/0x100 [ 207.385046][ T7398] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 207.385064][ T7398] ? local_lock_release+0x9c/0x160 [ 207.385088][ T7398] ? __alloc_skb+0x1d7/0x7a0 [ 207.385099][ T7398] ? __alloc_skb+0x1d7/0x7a0 [ 207.385116][ T7398] __alloc_skb+0x1d7/0x7a0 [ 207.385133][ T7398] netlink_sendmsg+0x5d4/0xb40 [ 207.385157][ T7398] ? __pfx_netlink_sendmsg+0x10/0x10 [ 207.385177][ T7398] ? aa_sock_msg_perm+0xf1/0x1b0 [ 207.385195][ T7398] ? __pfx_netlink_sendmsg+0x10/0x10 [ 207.385210][ T7398] sock_sendmsg_nosec+0x13a/0x180 [ 207.385233][ T7398] ____sys_sendmsg+0x54e/0x850 [ 207.385253][ T7398] ? __pfx_____sys_sendmsg+0x10/0x10 [ 207.385280][ T7398] ___sys_sendmsg+0x2a5/0x360 [ 207.385295][ T7398] ? __lock_acquire+0x683/0x2cf0 [ 207.385317][ T7398] ? __pfx____sys_sendmsg+0x10/0x10 [ 207.385354][ T7398] ? get_pid_task+0x20/0x1f0 [ 207.385381][ T7398] ? get_pid_task+0x20/0x1f0 [ 207.385406][ T7398] ? get_pid_task+0x20/0x1f0 [ 207.385452][ T7398] ? __fget_files+0x2a/0x420 [ 207.385470][ T7398] ? __fget_files+0x3a2/0x420 [ 207.385500][ T7398] __sys_sendmsg+0x177/0x240 [ 207.385518][ T7398] ? __pfx___sys_sendmsg+0x10/0x10 [ 207.385547][ T7398] __do_fast_syscall_32+0x23e/0x6f0 [ 207.385570][ T7398] ? do_fast_syscall_32+0x33/0x70 [ 207.385590][ T7398] ? lockdep_hardirqs_on+0x7a/0x110 [ 207.385609][ T7398] ? asm_int80_emulation+0x1a/0x20 [ 207.385623][ T7398] ? do_int80_emulation+0x29f/0x550 [ 207.385643][ T7398] ? trace_irq_disable+0x3b/0x140 [ 207.385663][ T7398] do_fast_syscall_32+0x33/0x70 [ 207.385685][ T7398] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 207.385703][ T7398] RIP: 0023:0xf6fef0ec [ 207.385716][ T7398] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 207.385729][ T7398] RSP: 002b:00000000f53bc50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 207.385745][ T7398] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000400 [ 207.385755][ T7398] RDX: 0000000004000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 207.385764][ T7398] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 207.385772][ T7398] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 207.385780][ T7398] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 207.385801][ T7398] [ 207.395147][ T5749] usb 4-1: Using ep0 maxpacket: 32 [ 207.703014][ T5749] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 207.720663][ T5749] usb 4-1: config 0 has an invalid interface number: 85 but max is 0 [ 207.728867][ T5749] usb 4-1: config 0 has no interface number 0 [ 207.735284][ T5749] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 207.746987][ T5749] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 207.759219][ T5749] usb 4-1: config 0 interface 85 has no altsetting 0 [ 207.830195][ T5749] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 207.865926][ T5749] usb 4-1: Product: syz [ 207.879335][ T5749] usb 4-1: Manufacturer: syz [ 207.904088][ T5749] usb 4-1: SerialNumber: syz [ 207.936422][ T5749] usb 4-1: config 0 descriptor?? [ 208.176747][ T5749] appletouch 4-1:0.85: Failed to read mode from device. [ 208.200759][ T5749] appletouch 4-1:0.85: probe with driver appletouch failed with error -5 [ 208.236032][ T5749] usb 4-1: USB disconnect, device number 31 [ 208.371888][ T985] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 208.522119][ T985] usb 3-1: Using ep0 maxpacket: 16 [ 208.534562][ T985] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 208.548643][ T29] audit: type=1326 audit(1786711899.099:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7420 comm="syz.1.513" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f0ec code=0x7ffc0000 [ 208.573961][ T985] usb 3-1: config 0 has no interfaces? [ 208.573990][ T29] audit: type=1326 audit(1786711899.099:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7420 comm="syz.1.513" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=29 compat=1 ip=0xf704f0ec code=0x7ffc0000 [ 208.603927][ T985] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 208.612119][ T985] usb 3-1: Manufacturer: syz [ 208.620032][ T985] usb 3-1: config 0 descriptor?? [ 208.741847][ T188] usb 5-1: new full-speed USB device number 21 using dummy_hcd [ 208.846837][ T7409] netlink: 4 bytes leftover after parsing attributes in process `syz.2.507'. [ 208.863025][ T985] usb 3-1: USB disconnect, device number 31 [ 208.896744][ T7425] netlink: 32 bytes leftover after parsing attributes in process `syz.3.514'. [ 208.914809][ T188] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 208.934095][ T188] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 208.950792][ T188] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 208.970020][ T188] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 208.980085][ T188] usb 5-1: Product: syz [ 208.986525][ T188] usb 5-1: Manufacturer: syz [ 208.993869][ T188] usb 5-1: SerialNumber: syz [ 209.012769][ T188] usb 5-1: 0:2 : does not exist [ 209.218212][ T188] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 209.327684][ T188] usb 5-1: USB disconnect, device number 21 [ 209.385890][ T5685] udevd[5685]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 209.732014][ T7435] FAULT_INJECTION: forcing a failure. [ 209.732014][ T7435] name failslab, interval 1, probability 0, space 0, times 0 [ 209.807063][ T7437] netlink: 48 bytes leftover after parsing attributes in process `syz.2.519'. [ 209.827413][ T7435] CPU: 1 UID: 0 PID: 7435 Comm: syz.0.517 Tainted: G L syzkaller #0 PREEMPT(full) [ 209.827445][ T7435] Tainted: [L]=SOFTLOCKUP [ 209.827453][ T7435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 209.827465][ T7435] Call Trace: [ 209.827473][ T7435] [ 209.827482][ T7435] dump_stack_lvl+0xe8/0x150 [ 209.827516][ T7435] should_fail_ex+0x40c/0x560 [ 209.827546][ T7435] should_failslab+0xa8/0x100 [ 209.827575][ T7435] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 209.827596][ T7435] ? local_lock_release+0x9c/0x160 [ 209.827625][ T7435] ? __alloc_skb+0x1d7/0x7a0 [ 209.827640][ T7435] ? __alloc_skb+0x1d7/0x7a0 [ 209.827662][ T7435] __alloc_skb+0x1d7/0x7a0 [ 209.827682][ T7435] netlink_sendmsg+0x5d4/0xb40 [ 209.827716][ T7435] ? __pfx_netlink_sendmsg+0x10/0x10 [ 209.827740][ T7435] ? aa_sock_msg_perm+0xf1/0x1b0 [ 209.827764][ T7435] ? __pfx_netlink_sendmsg+0x10/0x10 [ 209.827784][ T7435] sock_sendmsg_nosec+0x13a/0x180 [ 209.827811][ T7435] ____sys_sendmsg+0x54e/0x850 [ 209.827835][ T7435] ? __pfx_____sys_sendmsg+0x10/0x10 [ 209.827869][ T7435] ___sys_sendmsg+0x2a5/0x360 [ 209.827887][ T7435] ? __lock_acquire+0x683/0x2cf0 [ 209.827915][ T7435] ? __pfx____sys_sendmsg+0x10/0x10 [ 209.827934][ T7435] ? get_pid_task+0x20/0x1f0 [ 209.827957][ T7435] ? get_pid_task+0x20/0x1f0 [ 209.827978][ T7435] ? get_pid_task+0x20/0x1f0 [ 209.828026][ T7435] ? __fget_files+0x2a/0x420 [ 209.828049][ T7435] ? __fget_files+0x3a2/0x420 [ 209.828083][ T7435] __sys_sendmsg+0x177/0x240 [ 209.828108][ T7435] ? __pfx___sys_sendmsg+0x10/0x10 [ 209.828147][ T7435] __do_fast_syscall_32+0x23e/0x6f0 [ 209.828177][ T7435] ? do_fast_syscall_32+0x33/0x70 [ 209.828205][ T7435] ? lockdep_hardirqs_on+0x7a/0x110 [ 209.828231][ T7435] ? asm_int80_emulation+0x1a/0x20 [ 209.828251][ T7435] ? do_int80_emulation+0x29f/0x550 [ 209.828294][ T7435] do_fast_syscall_32+0x33/0x70 [ 209.828324][ T7435] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 209.828349][ T7435] RIP: 0023:0xf6fef0ec [ 209.828367][ T7435] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 209.828385][ T7435] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 209.828407][ T7435] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800001c0 [ 209.828421][ T7435] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 209.828433][ T7435] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 209.828445][ T7435] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 209.828457][ T7435] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 209.828486][ T7435] [ 210.098840][ T5620] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 210.342714][ T5620] usb 2-1: Using ep0 maxpacket: 32 [ 210.351342][ T5620] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 210.375304][ T5620] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 210.387896][ T5620] usb 2-1: config 0 has no interface number 0 [ 210.413338][ T7439] netlink: 'syz.0.521': attribute type 2 has an invalid length. [ 210.436859][ T5620] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.445771][ T5620] usb 2-1: Product: syz [ 210.456588][ T5620] usb 2-1: Manufacturer: syz [ 210.461325][ T5620] usb 2-1: SerialNumber: syz [ 210.478815][ T5620] usb 2-1: config 0 descriptor?? [ 210.556359][ T5716] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 210.722620][ T5716] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 210.733887][ T5716] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 210.743951][ T5716] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 210.758332][ T5716] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 210.772220][ T5716] usb 3-1: Product: syz [ 210.776511][ T5716] usb 3-1: Manufacturer: syz [ 210.781867][ T5716] usb 3-1: SerialNumber: syz [ 210.796144][ T5716] usb 3-1: config 0 descriptor?? [ 210.807015][ T5716] usb 3-1: 0:0 : invalid sync pipe. bmAttributes 00, bLength 9, bSynchAddress 00 [ 210.901406][ T5620] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 210.916765][ T5620] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 210.976533][ T7445] fuse: Bad value for 'group_id' [ 210.981832][ T7445] fuse: Bad value for 'group_id' [ 211.133850][ T5620] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 211.146212][ T5620] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -61 [ 211.221305][ T7437] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 211.233397][ T7437] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 211.245343][ T5620] usb 3-1: USB disconnect, device number 32 [ 211.391090][ T7456] netlink: 4 bytes leftover after parsing attributes in process `syz.4.526'. [ 211.423530][ T985] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 211.539933][ T7462] netlink: 4 bytes leftover after parsing attributes in process `syz.4.526'. [ 211.550631][ T7462] netlink: 4 bytes leftover after parsing attributes in process `syz.4.526'. [ 211.560784][ T7462] netlink: 4 bytes leftover after parsing attributes in process `syz.4.526'. [ 211.593947][ T985] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 211.606196][ T985] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 211.615352][ T985] usb 4-1: Product: syz [ 211.619670][ T985] usb 4-1: SerialNumber: syz [ 211.626787][ T985] usb 4-1: config 0 descriptor?? [ 211.638274][ T985] hso 4-1:0.0: Not our interface [ 211.812942][ T5716] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 211.859237][ T7473] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 211.989923][ T7462] netlink: 4 bytes leftover after parsing attributes in process `syz.4.526'. [ 212.000327][ T7462] netlink: 8 bytes leftover after parsing attributes in process `syz.4.526'. [ 212.009306][ T7462] netlink: 8 bytes leftover after parsing attributes in process `syz.4.526'. [ 212.091950][ T5620] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 212.251894][ T5620] usb 3-1: Using ep0 maxpacket: 32 [ 212.258488][ T5620] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 212.269439][ T5620] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 212.277853][ T5620] usb 3-1: config 0 has no interface number 0 [ 212.284211][ T5620] usb 3-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 212.294209][ T5620] usb 3-1: config 0 interface 89 has no altsetting 0 [ 212.303600][ T5620] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.317490][ T5620] usb 3-1: Product: syz [ 212.321688][ T5620] usb 3-1: Manufacturer: syz [ 212.326441][ T5620] usb 3-1: SerialNumber: syz [ 212.334907][ T5620] usb 3-1: config 0 descriptor?? [ 212.346031][ T5620] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 212.355639][ T5620] em28xx 3-1:0.89: Video interface 89 found: [ 212.607679][ T5347] usb 2-1: USB disconnect, device number 33 [ 212.729425][ T7480] fuse: Bad value for 'group_id' [ 212.734849][ T7480] fuse: Bad value for 'group_id' [ 212.797689][ T7481] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 212.820902][ T7484] FAULT_INJECTION: forcing a failure. [ 212.820902][ T7484] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 212.835494][ T7484] CPU: 0 UID: 0 PID: 7484 Comm: syz.0.534 Tainted: G L syzkaller #0 PREEMPT(full) [ 212.835516][ T7484] Tainted: [L]=SOFTLOCKUP [ 212.835521][ T7484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 212.835530][ T7484] Call Trace: [ 212.835535][ T7484] [ 212.835541][ T7484] dump_stack_lvl+0xe8/0x150 [ 212.835565][ T7484] should_fail_ex+0x40c/0x560 [ 212.835585][ T7484] _copy_to_user+0x31/0xb0 [ 212.835611][ T7484] simple_read_from_buffer+0xe1/0x170 [ 212.835634][ T7484] proc_fail_nth_read+0x1bb/0x230 [ 212.835662][ T7484] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 212.835685][ T7484] ? rw_verify_area+0x24a/0x4c0 [ 212.835707][ T7484] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 212.835726][ T7484] vfs_read+0x213/0xa80 [ 212.835750][ T7484] ? __pfx___mutex_lock+0x10/0x10 [ 212.835772][ T7484] ? __pfx_vfs_read+0x10/0x10 [ 212.835793][ T7484] ? __fget_files+0x2a/0x420 [ 212.835814][ T7484] ? __fget_files+0x3a2/0x420 [ 212.835831][ T7484] ? __fget_files+0x2a/0x420 [ 212.835855][ T7484] ksys_read+0x150/0x270 [ 212.835877][ T7484] ? __pfx_ksys_read+0x10/0x10 [ 212.835901][ T7484] ? asm_int80_emulation+0x1a/0x20 [ 212.835918][ T7484] do_int80_emulation+0x19a/0x550 [ 212.835939][ T7484] ? trace_irq_disable+0x3b/0x140 [ 212.835955][ T7484] ? asm_int80_emulation+0x1a/0x20 [ 212.835968][ T7484] ? clear_bhb_loop+0x70/0xc0 [ 212.835982][ T7484] ? clear_bhb_loop+0x70/0xc0 [ 212.835999][ T7484] asm_int80_emulation+0x1a/0x20 [ 212.836013][ T7484] RIP: 0023:0xf71274eb [ 212.836026][ T7484] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 212.836038][ T7484] RSP: 002b:00000000f53dd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 212.836056][ T7484] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f53dd5d0 [ 212.836065][ T7484] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 212.836074][ T7484] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 212.836081][ T7484] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 212.836090][ T7484] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 212.836130][ T7484] [ 213.099799][ T7486] tipc: New replicast peer: 0.0.0.0 [ 213.106742][ T7486] tipc: Enabled bearer , priority 10 [ 213.176687][ T5620] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 213.247041][ T5620] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 213.256763][ T5620] em28xx 3-1:0.89: board has no eeprom [ 213.321859][ T5620] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 213.329221][ T5620] em28xx 3-1:0.89: analog set to bulk mode. [ 213.342170][ T5347] em28xx 3-1:0.89: Registering V4L2 extension [ 213.369048][ T5620] usb 3-1: USB disconnect, device number 33 [ 213.390153][ T5620] em28xx 3-1:0.89: Disconnecting em28xx [ 213.417084][ T5347] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 213.429854][ T5347] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 213.436951][ T7490] netlink: 32 bytes leftover after parsing attributes in process `syz.0.536'. [ 213.451867][ T5347] em28xx 3-1:0.89: No AC97 audio processor [ 213.463353][ T5347] usb 3-1: Decoder not found [ 213.468020][ T5347] em28xx 3-1:0.89: failed to create media graph [ 213.475134][ T5347] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 213.489806][ T5347] em28xx 3-1:0.89: Registering snapshot button... [ 213.498466][ T5347] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input23 [ 213.517007][ T5347] em28xx 3-1:0.89: Remote control support is not available for this card. [ 213.527171][ T5620] em28xx 3-1:0.89: Closing input extension [ 213.533871][ T5620] em28xx 3-1:0.89: Deregistering snapshot button [ 213.589966][ T5620] em28xx 3-1:0.89: Freeing device [ 213.872939][ T7495] oom_control is deprecated and will be removed. Please report your usecase to linux-mm-@kvack.org if you depend on this functionality. [ 213.938253][ T7495] IPVS: length: 248 != 24 [ 214.067148][ T7497] FAULT_INJECTION: forcing a failure. [ 214.067148][ T7497] name failslab, interval 1, probability 0, space 0, times 0 [ 214.080169][ T7497] CPU: 1 UID: 0 PID: 7497 Comm: syz.2.538 Tainted: G L syzkaller #0 PREEMPT(full) [ 214.080201][ T7497] Tainted: [L]=SOFTLOCKUP [ 214.080209][ T7497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 214.080222][ T7497] Call Trace: [ 214.080230][ T7497] [ 214.080239][ T7497] dump_stack_lvl+0xe8/0x150 [ 214.080273][ T7497] should_fail_ex+0x40c/0x560 [ 214.080303][ T7497] should_failslab+0xa8/0x100 [ 214.080336][ T7497] __kmalloc_node_track_caller_noprof+0x100/0x730 [ 214.080364][ T7497] ? __pfx_netlink_table_grab+0x10/0x10 [ 214.080397][ T7497] ? netlink_realloc_groups+0x126/0x350 [ 214.080421][ T7497] ? netlink_realloc_groups+0x126/0x350 [ 214.080451][ T7497] ? netlink_realloc_groups+0x126/0x350 [ 214.080485][ T7497] krealloc_node_align_noprof+0x19a/0x390 [ 214.080513][ T7497] ? apparmor_capable+0x126/0x170 [ 214.080544][ T7497] netlink_realloc_groups+0x126/0x350 [ 214.080577][ T7497] netlink_setsockopt+0x367/0x710 [ 214.080609][ T7497] ? __pfx_netlink_setsockopt+0x10/0x10 [ 214.080633][ T7497] ? aa_sock_opt_perm+0xff/0x1a0 [ 214.080657][ T7497] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 214.080677][ T7497] ? __pfx_netlink_setsockopt+0x10/0x10 [ 214.080703][ T7497] do_sock_setsockopt+0x17c/0x1b0 [ 214.080730][ T7497] __ia32_sys_setsockopt+0x13d/0x1b0 [ 214.080759][ T7497] __do_fast_syscall_32+0x23e/0x6f0 [ 214.080790][ T7497] ? do_fast_syscall_32+0x33/0x70 [ 214.080819][ T7497] ? lockdep_hardirqs_on+0x7a/0x110 [ 214.080847][ T7497] ? asm_int80_emulation+0x1a/0x20 [ 214.080866][ T7497] ? do_int80_emulation+0x29f/0x550 [ 214.080896][ T7497] ? trace_irq_disable+0x3b/0x140 [ 214.080924][ T7497] do_fast_syscall_32+0x33/0x70 [ 214.080955][ T7497] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 214.080981][ T7497] RIP: 0023:0xf70bf0ec [ 214.080999][ T7497] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 214.081018][ T7497] RSP: 002b:00000000f54ad50c EFLAGS: 00000206 ORIG_RAX: 000000000000016e [ 214.081040][ T7497] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000010e [ 214.081054][ T7497] RDX: 0000000000000002 RSI: 0000000080000000 RDI: 0000000000000004 [ 214.081066][ T7497] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 214.081078][ T7497] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 214.081091][ T7497] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 214.081121][ T7497] [ 214.613328][ T985] usb 4-1: USB disconnect, device number 32 [ 214.711582][ T5716] usb 5-1: unable to get BOS descriptor or descriptor too short [ 214.749686][ T5716] usb 5-1: New USB device found, idVendor=045e, idProduct=076f, bcdDevice=d8.a1 [ 214.785742][ T5716] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 214.824135][ T5716] usb 5-1: can't read configurations, error -71 [ 215.346825][ T7524] FAULT_INJECTION: forcing a failure. [ 215.346825][ T7524] name fail_futex, interval 1, probability 0, space 0, times 1 [ 215.391933][ T7524] CPU: 1 UID: 0 PID: 7524 Comm: syz.4.544 Tainted: G L syzkaller #0 PREEMPT(full) [ 215.391967][ T7524] Tainted: [L]=SOFTLOCKUP [ 215.391974][ T7524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 215.391986][ T7524] Call Trace: [ 215.391995][ T7524] [ 215.392003][ T7524] dump_stack_lvl+0xe8/0x150 [ 215.392039][ T7524] should_fail_ex+0x40c/0x560 [ 215.392068][ T7524] get_futex_key+0x1b3/0x1580 [ 215.392100][ T7524] ? perf_lock_task_context+0x79b/0x850 [ 215.392133][ T7524] ? perf_lock_task_context+0xfe/0x850 [ 215.392162][ T7524] ? __pfx_get_futex_key+0x10/0x10 [ 215.392188][ T7524] ? __lock_acquire+0x683/0x2cf0 [ 215.392218][ T7524] futex_wake+0x119/0x5f0 [ 215.392240][ T7524] ? __pfx_futex_wake+0x10/0x10 [ 215.392264][ T7524] ? exit_mm_release+0x1a/0x30 [ 215.392284][ T7524] do_futex+0x458/0x4e0 [ 215.392313][ T7524] ? __pfx_do_futex+0x10/0x10 [ 215.392348][ T7524] ? __might_fault+0xaf/0x130 [ 215.392368][ T7524] mm_release+0x101/0x290 [ 215.392387][ T7524] exit_mm+0x4d/0x2d0 [ 215.392412][ T7524] do_exit+0x6cd/0x2360 [ 215.392438][ T7524] ? lockdep_hardirqs_on+0x7a/0x110 [ 215.392460][ T7524] ? tcp_recvmsg+0x213/0x7f0 [ 215.392483][ T7524] ? __pfx_do_exit+0x10/0x10 [ 215.392508][ T7524] ? do_raw_spin_lock+0x12b/0x2f0 [ 215.392532][ T7524] do_group_exit+0x22d/0x2f0 [ 215.392554][ T7524] ? _raw_spin_unlock_irq+0x23/0x50 [ 215.392577][ T7524] get_signal+0x121b/0x12c0 [ 215.392610][ T7524] arch_do_signal_or_restart+0xbb/0x860 [ 215.392633][ T7524] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 215.392669][ T7524] exit_to_user_mode_loop+0x104/0x730 [ 215.392689][ T7524] ? rcu_is_watching+0x15/0xb0 [ 215.392714][ T7524] ? do_fast_syscall_32+0x33/0x70 [ 215.392739][ T7524] __do_fast_syscall_32+0x45b/0x6f0 [ 215.392763][ T7524] ? do_fast_syscall_32+0x33/0x70 [ 215.392807][ T7524] ? lockdep_hardirqs_on+0x7a/0x110 [ 215.392830][ T7524] ? asm_int80_emulation+0x1a/0x20 [ 215.392846][ T7524] ? do_int80_emulation+0x29f/0x550 [ 215.392868][ T7524] ? trace_irq_disable+0x3b/0x140 [ 215.392891][ T7524] do_fast_syscall_32+0x33/0x70 [ 215.392915][ T7524] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 215.392935][ T7524] RIP: 0023:0xf70af0ec [ 215.392950][ T7524] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 215.392964][ T7524] RSP: 002b:00000000f545b50c EFLAGS: 00000206 ORIG_RAX: 0000000000000173 [ 215.392981][ T7524] RAX: fffffffffffffe00 RBX: 0000000000000004 RCX: 0000000080000480 [ 215.392992][ T7524] RDX: 000000000000006e RSI: 0000000040000716 RDI: 0000000000000000 [ 215.393002][ T7524] RBP: 00000000fffffe97 R08: 0000000000000000 R09: 0000000000000000 [ 215.393012][ T7524] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 215.393022][ T7524] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 215.393044][ T7524] [ 215.708482][ T7499] netlink: 8 bytes leftover after parsing attributes in process `syz.3.539'. [ 215.809890][ T7530] syzkaller0: entered promiscuous mode [ 215.815479][ T7530] syzkaller0: entered allmulticast mode [ 215.892181][ T7535] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 216.281905][ T5687] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 216.295383][ T5620] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 216.313891][ T7551] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 216.432499][ T5687] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 216.455486][ T5687] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 216.466471][ T5687] usb 2-1: Product: syz [ 216.470711][ T5687] usb 2-1: SerialNumber: syz [ 216.481829][ T5620] usb 4-1: Using ep0 maxpacket: 16 [ 216.487020][ T5687] usb 2-1: config 0 descriptor?? [ 216.497362][ T5687] hso 2-1:0.0: Not our interface [ 216.498691][ T5620] usb 4-1: unable to get BOS descriptor or descriptor too short [ 216.516845][ T5620] usb 4-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=28.0e [ 216.553504][ T5620] usb 4-1: config 6 has an invalid interface number: 149 but max is 0 [ 216.563900][ T7557] netlink: 64 bytes leftover after parsing attributes in process `syz.2.556'. [ 216.576415][ T5620] usb 4-1: config 6 has no interface number 0 [ 216.587154][ T5620] usb 4-1: config 6 interface 149 altsetting 0 endpoint 0x6 has an invalid bInterval 240, changing to 11 [ 216.610857][ T5620] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.612692][ T7557] syzkaller1: entered promiscuous mode [ 216.626018][ T5620] usb 4-1: Product: syz [ 216.633259][ T5620] usb 4-1: Manufacturer: syz [ 216.641266][ T7557] syzkaller1: entered allmulticast mode [ 216.647947][ T5620] usb 4-1: SerialNumber: syz [ 216.659018][ T7557] FAULT_INJECTION: forcing a failure. [ 216.659018][ T7557] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 216.672636][ T7557] CPU: 1 UID: 0 PID: 7557 Comm: syz.2.556 Tainted: G L syzkaller #0 PREEMPT(full) [ 216.672666][ T7557] Tainted: [L]=SOFTLOCKUP [ 216.672686][ T7557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 216.672698][ T7557] Call Trace: [ 216.672706][ T7557] [ 216.672733][ T7557] dump_stack_lvl+0xe8/0x150 [ 216.672767][ T7557] should_fail_ex+0x40c/0x560 [ 216.672796][ T7557] _copy_from_iter+0x1d3/0x1660 [ 216.672833][ T7557] ? __lock_acquire+0x683/0x2cf0 [ 216.672861][ T7557] ? __pfx__copy_from_iter+0x10/0x10 [ 216.672905][ T7557] tun_get_user+0x50c/0x4370 [ 216.672949][ T7557] ? aa_file_perm+0x18b/0x15f0 [ 216.672976][ T7557] ? aa_file_perm+0x4ed/0x15f0 [ 216.672997][ T7557] ? __pfx_tun_get_user+0x10/0x10 [ 216.673028][ T7557] ? __lock_acquire+0x683/0x2cf0 [ 216.673060][ T7557] ? kstrtoull+0x12f/0x1d0 [ 216.673089][ T7557] ? ref_tracker_alloc+0x341/0x4b0 [ 216.673117][ T7557] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 216.673144][ T7557] ? tun_get+0x1c/0x2f0 [ 216.673170][ T7557] ? tun_get+0x1c/0x2f0 [ 216.673210][ T7557] ? tun_get+0x1c/0x2f0 [ 216.673238][ T7557] ? tun_get+0x1c/0x2f0 [ 216.673270][ T7557] tun_chr_write_iter+0x113/0x200 [ 216.673301][ T7557] vfs_write+0x612/0xba0 [ 216.673342][ T7557] ? __pfx_vfs_write+0x10/0x10 [ 216.673382][ T7557] ? __fget_files+0x2a/0x420 [ 216.673419][ T7557] ksys_write+0x150/0x270 [ 216.673453][ T7557] ? __pfx_ksys_write+0x10/0x10 [ 216.673494][ T7557] __do_fast_syscall_32+0x23e/0x6f0 [ 216.673526][ T7557] ? do_fast_syscall_32+0x33/0x70 [ 216.673559][ T7557] ? lockdep_hardirqs_on+0x7a/0x110 [ 216.673586][ T7557] ? asm_int80_emulation+0x1a/0x20 [ 216.673606][ T7557] ? do_int80_emulation+0x29f/0x550 [ 216.673635][ T7557] ? trace_irq_disable+0x3b/0x140 [ 216.673663][ T7557] do_fast_syscall_32+0x33/0x70 [ 216.673693][ T7557] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 216.673719][ T7557] RIP: 0023:0xf70bf0ec [ 216.673737][ T7557] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 216.673755][ T7557] RSP: 002b:00000000f54ad50c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 216.673777][ T7557] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000880 [ 216.673791][ T7557] RDX: 000000000000003b RSI: 0000000000000000 RDI: 0000000000000000 [ 216.673803][ T7557] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 216.673815][ T7557] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 216.673826][ T7557] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 216.673855][ T7557] [ 217.280004][ T5620] usb 4-1: USB disconnect, device number 33 [ 217.545331][ T7565] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 217.932006][ T5687] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 218.103523][ T5687] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 218.123206][ T5687] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 218.134694][ T5687] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.145936][ T5687] usb 1-1: config 0 descriptor?? [ 218.222377][ T5620] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 218.358807][ T5687] usbhid 1-1:0.0: can't add hid device: -71 [ 218.365333][ T5687] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 218.378463][ T5687] usb 1-1: USB disconnect, device number 22 [ 218.393007][ T5620] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 218.403326][ T5620] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 218.420084][ T5620] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.436872][ T5620] usb 4-1: config 0 descriptor?? [ 218.571873][ T5347] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 218.651982][ T5620] usbhid 4-1:0.0: can't add hid device: -71 [ 218.659260][ T5620] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 218.670235][ T5620] usb 4-1: USB disconnect, device number 34 [ 218.722782][ T5347] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 218.734318][ T5347] usb 3-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 218.746155][ T5347] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 218.757193][ T5347] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 218.768901][ T5347] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.781716][ T7579] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 218.832347][ T5687] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 218.982570][ T5687] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 218.993962][ T5687] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 219.005469][ T5687] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.018205][ T5687] usb 1-1: config 0 descriptor?? [ 219.066465][ T5620] usb 2-1: USB disconnect, device number 34 [ 219.101938][ T985] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 219.152288][ T7583] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 219.295124][ T985] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 219.314747][ T985] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 219.339530][ T985] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.368876][ T985] usb 4-1: config 0 descriptor?? [ 219.413039][ T7588] 8021q: adding VLAN 0 to HW filter on device bond0 [ 219.424242][ T7588] 8021q: adding VLAN 0 to HW filter on device team0 [ 219.437830][ T7588] batman_adv: batadv0: Interface activated: dummy0 [ 219.450133][ T7588] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 219.539471][ T7588] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 219.559258][ T7588] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 219.585881][ T7588] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 219.610816][ T7588] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 219.614017][ T5347] aiptek 3-1:17.0: Aiptek using 400 ms programming speed [ 219.646456][ T5347] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:17.0/input/input24 [ 219.649304][ T7588] veth1_vlan: left promiscuous mode [ 219.677404][ T7588] veth0_vlan: left promiscuous mode [ 219.685455][ T7588] veth0_vlan: entered promiscuous mode [ 219.726810][ T7588] veth1_vlan: entered promiscuous mode [ 219.765267][ T7588] veth1_macvtap: left promiscuous mode [ 219.785296][ T7588] veth0_macvtap: left promiscuous mode [ 219.795737][ T7588] veth0_macvtap: entered promiscuous mode [ 219.805266][ T7588] veth1_macvtap: entered promiscuous mode [ 219.818109][ T7588] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 219.827347][ T7588] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 219.842367][ T7588] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 219.853302][ T5687] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 219.864277][ T7588] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 219.876836][ T5687] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input25 [ 219.899549][ T7588] 8021q: adding VLAN 0 to HW filter on device bond1 [ 219.944255][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.951517][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.968241][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.975515][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 220.067381][ T5687] usb 1-1: USB disconnect, device number 23 [ 220.073649][ C1] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 220.133641][ T35] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.145155][ T35] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.157380][ T7588] syz.1.567 (7588) used greatest stack depth: 19408 bytes left [ 220.212824][ T1152] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.222376][ T985] aiptek 4-1:0.0: Aiptek using 400 ms programming speed [ 220.234279][ T1152] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.261721][ T985] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input26 [ 220.469236][ T7600] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 220.497440][ T5347] usb 4-1: USB disconnect, device number 35 [ 220.497677][ C1] aiptek 4-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 220.812177][ T5687] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 220.971982][ T5620] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 220.981814][ T5687] usb 2-1: Using ep0 maxpacket: 32 [ 220.993085][ T5687] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 221.008863][ T5687] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 221.024014][ T5687] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 221.045699][ T5687] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 221.068269][ T5687] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 221.077875][ T5687] usb 2-1: config 1 has no interface number 0 [ 221.085264][ T5687] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 221.110988][ T5687] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 221.171984][ T5620] usb 1-1: Using ep0 maxpacket: 16 [ 221.182509][ T5620] usb 1-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 221.214203][ T5620] usb 1-1: config 166 has an invalid interface number: 177 but max is 1 [ 221.224859][ T5620] usb 1-1: config 166 has an invalid descriptor of length 0, skipping remainder of the config [ 221.235697][ T5620] usb 1-1: config 166 has 1 interface, different from the descriptor's value: 2 [ 221.248360][ T5620] usb 1-1: config 166 has no interface number 0 [ 221.256639][ T5620] usb 1-1: config 166 interface 177 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 221.275348][ T5620] usb 1-1: config 166 interface 177 has no altsetting 0 [ 221.287089][ T5620] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.296779][ T5620] usb 1-1: Product: syz [ 221.301142][ T5620] usb 1-1: Manufacturer: syz [ 221.306532][ T5620] usb 1-1: SerialNumber: syz [ 221.313923][ T5749] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 221.324258][ T5687] snd_usb_pod 2-1:1.1: endpoint not available, using fallback values [ 221.348775][ T5687] snd_usb_pod 2-1:1.1: invalid control EP [ 221.362722][ T5687] snd_usb_pod 2-1:1.1: cannot start listening: -22 [ 221.380704][ T5687] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 221.392751][ T5687] snd_usb_pod 2-1:1.1: probe with driver snd_usb_pod failed with error -22 [ 221.429248][ T5687] usb 3-1: USB disconnect, device number 34 [ 221.429359][ C0] aiptek 3-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 221.492914][ T5749] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 221.527458][ T5749] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 221.538946][ T5749] usb 5-1: Product: syz [ 221.544679][ T5749] usb 5-1: SerialNumber: syz [ 221.562690][ T5749] usb 5-1: config 0 descriptor?? [ 221.576557][ T5749] hso 5-1:0.0: Not our interface [ 221.598225][ T5620] ums-realtek 1-1:166.177: USB Mass Storage device detected [ 221.661971][ T985] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 221.822888][ T985] usb 4-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=68.50 [ 221.843059][ T985] usb 4-1: config 1 has an invalid interface number: 173 but max is 0 [ 221.861862][ T985] usb 4-1: config 1 has an invalid descriptor of length 47, skipping remainder of the config [ 221.881812][ T985] usb 4-1: config 1 has no interface number 0 [ 221.889757][ T985] usb 4-1: config 1 interface 173 altsetting 0 endpoint 0x81 has invalid maxpacket 53660, setting to 64 [ 221.901343][ T985] usb 4-1: config 1 interface 173 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 221.925798][ T985] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.934901][ T985] usb 4-1: Product: syz [ 221.940672][ T985] usb 4-1: Manufacturer: syz [ 221.946033][ T985] usb 4-1: SerialNumber: syz [ 222.028511][ T7603] fuse: Bad value for 'rootmode' [ 222.050030][ T5347] usb 2-1: USB disconnect, device number 35 [ 222.164943][ T7616] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 222.174806][ T7616] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.205490][ T985] peak_usb 4-1:1.173 can0: unable to request usb[type=0 value=1] err=-71 [ 222.214662][ T985] peak_usb 4-1:1.173: unable to read PCAN-USB X6 firmware info (err -71) [ 222.274705][ T985] peak_usb 4-1:1.173: probe with driver peak_usb failed with error -71 [ 222.288734][ T985] usb 4-1: USB disconnect, device number 36 [ 222.393463][ T5686] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 222.573477][ T5686] usb 3-1: Using ep0 maxpacket: 16 [ 222.581530][ T5686] usb 3-1: unable to get BOS descriptor or descriptor too short [ 222.590171][ T5686] usb 3-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=28.0e [ 222.601343][ T5686] usb 3-1: config 6 has an invalid interface number: 149 but max is 0 [ 222.610869][ T5686] usb 3-1: config 6 has no interface number 0 [ 222.617516][ T5686] usb 3-1: config 6 interface 149 altsetting 0 endpoint 0x6 has an invalid bInterval 240, changing to 11 [ 222.632729][ T5686] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.641265][ T5686] usb 3-1: Product: syz [ 222.647836][ T5686] usb 3-1: Manufacturer: syz [ 222.653132][ T5686] usb 3-1: SerialNumber: syz [ 222.839806][ T7631] openvswitch: netlink: Missing key (keys=c0, expected=20080) [ 222.847913][ T7632] openvswitch: netlink: Missing key (keys=c0, expected=20080) [ 222.877700][ T7633] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 222.937527][ T5686] usb 3-1: USB disconnect, device number 35 [ 222.996329][ T7637] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 223.331841][ T5347] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 223.482874][ T5347] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 223.498373][ T5347] usb 4-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 223.514139][ T5347] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 223.525485][ T5347] usb 4-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 223.537302][ T5347] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.556367][ T7640] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 223.769075][ T7646] FAULT_INJECTION: forcing a failure. [ 223.769075][ T7646] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 223.786597][ T7646] CPU: 1 UID: 0 PID: 7646 Comm: syz.2.588 Tainted: G L syzkaller #0 PREEMPT(full) [ 223.786632][ T7646] Tainted: [L]=SOFTLOCKUP [ 223.786639][ T7646] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 223.786651][ T7646] Call Trace: [ 223.786659][ T7646] [ 223.786667][ T7646] dump_stack_lvl+0xe8/0x150 [ 223.786710][ T7646] should_fail_ex+0x40c/0x560 [ 223.786739][ T7646] _copy_to_user+0x31/0xb0 [ 223.786771][ T7646] simple_read_from_buffer+0xe1/0x170 [ 223.786805][ T7646] proc_fail_nth_read+0x1bb/0x230 [ 223.786837][ T7646] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 223.786870][ T7646] ? rw_verify_area+0x24a/0x4c0 [ 223.786903][ T7646] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 223.786931][ T7646] vfs_read+0x213/0xa80 [ 223.786964][ T7646] ? __pfx___mutex_lock+0x10/0x10 [ 223.786994][ T7646] ? __pfx_vfs_read+0x10/0x10 [ 223.787026][ T7646] ? __fget_files+0x2a/0x420 [ 223.787058][ T7646] ? __fget_files+0x3a2/0x420 [ 223.787083][ T7646] ? __fget_files+0x2a/0x420 [ 223.787119][ T7646] ksys_read+0x150/0x270 [ 223.787151][ T7646] ? __pfx_ksys_read+0x10/0x10 [ 223.787186][ T7646] ? asm_int80_emulation+0x1a/0x20 [ 223.787213][ T7646] do_int80_emulation+0x19a/0x550 [ 223.787243][ T7646] ? trace_irq_disable+0x3b/0x140 [ 223.787266][ T7646] ? asm_int80_emulation+0x1a/0x20 [ 223.787285][ T7646] ? clear_bhb_loop+0x70/0xc0 [ 223.787305][ T7646] ? clear_bhb_loop+0x70/0xc0 [ 223.787330][ T7646] asm_int80_emulation+0x1a/0x20 [ 223.787349][ T7646] RIP: 0023:0xf71f74eb [ 223.787367][ T7646] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 223.787384][ T7646] RSP: 002b:00000000f54ad4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 223.787405][ T7646] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54ad5d0 [ 223.787419][ T7646] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 223.787430][ T7646] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 223.787441][ T7646] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 223.787453][ T7646] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 223.787483][ T7646] [ 223.829976][ T5708] usb 1-1: USB disconnect, device number 24 [ 224.012119][ T985] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 224.089858][ T5686] usb 5-1: USB disconnect, device number 24 [ 224.163172][ T7653] sg_write: data in/out 31779/14 bytes for SCSI command 0x0-- guessing data in; [ 224.163172][ T7653] program syz.4.591 not setting count and/or reply_len properly [ 224.202931][ T985] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 224.214297][ T985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 224.226500][ T985] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 224.250834][ T985] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.285523][ T985] usb 2-1: config 0 descriptor?? [ 224.442658][ T5347] aiptek 4-1:17.0: Aiptek using 400 ms programming speed [ 224.452401][ T5347] input: Aiptek as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:17.0/input/input27 [ 224.520353][ T7644] fuse: Unknown parameter '–' [ 225.293589][ T7671] fuse: Bad value for 'group_id' [ 225.338714][ T7671] fuse: Bad value for 'group_id' [ 225.674535][ T985] usbhid 2-1:0.0: can't add hid device: -71 [ 225.692507][ T985] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 225.738605][ T985] usb 2-1: USB disconnect, device number 36 [ 226.051896][ T5620] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 226.214388][ T5620] usb 5-1: unable to get BOS descriptor or descriptor too short [ 226.253997][ T5620] usb 5-1: New USB device found, idVendor=04fa, idProduct=4201, bcdDevice= 0.40 [ 226.297980][ T5620] usb 5-1: config 1 has an invalid descriptor of length 118, skipping remainder of the config [ 226.324818][ T5347] usb 4-1: USB disconnect, device number 37 [ 226.330826][ C0] aiptek 4-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 226.352868][ T5620] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 226.379312][ T5620] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 115, changing to 7 [ 226.414538][ T7679] FAULT_INJECTION: forcing a failure. [ 226.414538][ T7679] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 226.433536][ T5620] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 18431, setting to 1024 [ 226.455162][ T7679] CPU: 0 UID: 0 PID: 7679 Comm: syz.0.594 Tainted: G L syzkaller #0 PREEMPT(full) [ 226.455188][ T7679] Tainted: [L]=SOFTLOCKUP [ 226.455193][ T7679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 226.455202][ T7679] Call Trace: [ 226.455209][ T7679] [ 226.455215][ T7679] dump_stack_lvl+0xe8/0x150 [ 226.455240][ T7679] should_fail_ex+0x40c/0x560 [ 226.455261][ T7679] _copy_to_user+0x31/0xb0 [ 226.455284][ T7679] simple_read_from_buffer+0xe1/0x170 [ 226.455307][ T7679] proc_fail_nth_read+0x1bb/0x230 [ 226.455331][ T7679] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 226.455354][ T7679] ? rw_verify_area+0x24a/0x4c0 [ 226.455376][ T7679] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 226.455396][ T7679] vfs_read+0x213/0xa80 [ 226.455424][ T7679] ? __pfx_vfs_read+0x10/0x10 [ 226.455444][ T7679] ? set_compat_user_sigmask+0xc7/0x1c0 [ 226.455461][ T7679] ? __pfx_set_compat_user_sigmask+0x10/0x10 [ 226.455478][ T7679] ? do_sys_openat2+0x14e/0x200 [ 226.455495][ T7679] ? kmem_cache_free+0x182/0x650 [ 226.455524][ T7679] ksys_read+0x150/0x270 [ 226.455547][ T7679] ? __pfx_ksys_read+0x10/0x10 [ 226.455571][ T7679] ? asm_int80_emulation+0x1a/0x20 [ 226.455589][ T7679] do_int80_emulation+0x19a/0x550 [ 226.455611][ T7679] ? trace_irq_disable+0x3b/0x140 [ 226.455627][ T7679] ? asm_int80_emulation+0x1a/0x20 [ 226.455640][ T7679] ? clear_bhb_loop+0x70/0xc0 [ 226.455655][ T7679] ? clear_bhb_loop+0x70/0xc0 [ 226.455672][ T7679] asm_int80_emulation+0x1a/0x20 [ 226.455686][ T7679] RIP: 0023:0xf71274eb [ 226.455699][ T7679] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 226.455711][ T7679] RSP: 002b:00000000f53dd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 226.455726][ T7679] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f53dd5d0 [ 226.455737][ T7679] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 226.455745][ T7679] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 226.455753][ T7679] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 226.455761][ T7679] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 226.455782][ T7679] [ 226.724334][ T5620] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.732496][ T5620] usb 5-1: Product: syz [ 226.736701][ T5620] usb 5-1: Manufacturer: syz [ 226.741292][ T5620] usb 5-1: SerialNumber: syz [ 226.916917][ T7684] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 227.014643][ T7676] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 227.039954][ T7676] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 227.063699][ T7674] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 227.099838][ T7674] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 227.173808][ T5620] usb 5-1: 1:1 : no or invalid class specific endpoint descriptor [ 227.201364][ T5620] usb 5-1: 1:1 : sample bitwidth 62 in over sample bytes 2 [ 227.219636][ T5620] usb 5-1: 1:1 : unsupported format bits 0x7b6c0006 [ 227.228468][ T5620] usb 5-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 227.276348][ T5620] usb 5-1: unit 2 not found! [ 227.294985][ T5620] usb 5-1: unit 236 not found! [ 227.330593][ T7693] vxcan1: tx drop: invalid da for name 0x0000000000000003 [ 227.368819][ T7693] netlink: 4 bytes leftover after parsing attributes in process `syz.3.600'. [ 227.390967][ T7692] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 227.427518][ T7693] bridge0: port 3(macvlan2) entered blocking state [ 227.444969][ T7693] bridge0: port 3(macvlan2) entered disabled state [ 227.459557][ T7693] macvlan2: entered allmulticast mode [ 227.471545][ T7693] bridge0: entered allmulticast mode [ 227.485776][ T7693] bridge0: entered promiscuous mode [ 227.501669][ T5620] usb 5-1: USB disconnect, device number 25 [ 227.525090][ T7693] macvlan2: left allmulticast mode [ 227.547273][ T7693] bridge0: left allmulticast mode [ 227.690032][ T985] bridge0: left promiscuous mode [ 227.814823][ T7699] fuse: Bad value for 'fd' [ 228.051913][ T7706] netlink: 32 bytes leftover after parsing attributes in process `syz.4.603'. [ 228.262500][ T7714] netlink: 32 bytes leftover after parsing attributes in process `syz.1.605'. [ 228.591948][ T985] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 228.761865][ T985] usb 1-1: Using ep0 maxpacket: 16 [ 228.785069][ T985] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 228.820374][ T985] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 228.854192][ T985] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 228.891068][ T985] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 228.922059][ T985] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.955775][ T985] usb 1-1: config 0 descriptor?? [ 229.615644][ T985] usbhid 1-1:0.0: can't add hid device: -71 [ 229.623402][ T985] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 229.672557][ T985] usb 1-1: USB disconnect, device number 25 [ 230.460448][ T7729] netlink: 4 bytes leftover after parsing attributes in process `syz.1.610'. [ 230.478923][ T7727] A link change request failed with some changes committed already. Interface veth1_to_hsr may have been left with an inconsistent configuration, please check. [ 230.599082][ T7729] syzkaller1: entered promiscuous mode [ 230.610460][ T7729] syzkaller1: entered allmulticast mode [ 230.777613][ T29] audit: type=1326 audit(1786711921.329:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7735 comm="syz.3.612" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f0ec code=0x7ffc0000 [ 230.869644][ T29] audit: type=1326 audit(1786711921.329:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7735 comm="syz.3.612" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704f0ec code=0x7ffc0000 [ 230.967724][ T29] audit: type=1326 audit(1786711921.329:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7735 comm="syz.3.612" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=29 compat=1 ip=0xf704f0ec code=0x7ffc0000 [ 231.053074][ T29] audit: type=1326 audit(1786711921.609:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7742 comm="syz.4.614" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70af0ec code=0x7ffc0000 [ 231.100859][ T29] audit: type=1326 audit(1786711921.609:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7742 comm="syz.4.614" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70af0ec code=0x7ffc0000 [ 231.174353][ T7745] syzkaller0: entered promiscuous mode [ 231.193069][ T29] audit: type=1326 audit(1786711921.639:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7742 comm="syz.4.614" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=29 compat=1 ip=0xf70af0ec code=0x7ffc0000 [ 231.193869][ T7745] syzkaller0: entered allmulticast mode [ 231.292980][ T29] audit: type=1326 audit(1786711921.799:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7735 comm="syz.3.612" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704f108 code=0x7ffc0000 [ 231.408502][ T29] audit: type=1326 audit(1786711921.799:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7735 comm="syz.3.612" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704f108 code=0x7ffc0000 [ 231.551515][ T29] audit: type=1326 audit(1786711921.849:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7735 comm="syz.3.612" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704f108 code=0x7ffc0000 [ 231.681563][ T29] audit: type=1326 audit(1786711921.849:107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7735 comm="syz.3.612" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf704f108 code=0x7ffc0000 [ 231.861836][ T5749] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 231.872085][ T985] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 232.001913][ T5749] usb 2-1: device descriptor read/64, error -71 [ 232.032162][ T985] usb 1-1: Using ep0 maxpacket: 32 [ 232.046638][ T985] usb 1-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 232.071253][ T985] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 232.098686][ T985] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 232.131828][ T985] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 232.157080][ T985] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 232.187884][ T985] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 232.222376][ T985] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.243065][ T985] usb 1-1: Product: syz [ 232.261946][ T5749] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 232.271317][ T985] usb 1-1: Manufacturer: syz [ 232.276784][ T985] usb 1-1: SerialNumber: syz [ 232.305988][ T985] usb 1-1: config 0 descriptor?? [ 232.411941][ T5749] usb 2-1: device descriptor read/64, error -71 [ 232.542233][ T5749] usb usb2-port1: attempt power cycle [ 232.710246][ T7769] netlink: 32 bytes leftover after parsing attributes in process `syz.3.620'. [ 232.765133][ T985] input input29: Device does not respond to id packet M [ 232.902420][ T5749] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 232.942767][ T5749] usb 2-1: device descriptor read/8, error -71 [ 232.966813][ T7758] netlink: 4 bytes leftover after parsing attributes in process `syz.0.617'. [ 233.181859][ T5749] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 233.213036][ T5749] usb 2-1: device descriptor read/8, error -71 [ 233.336061][ T7774] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 233.336374][ T7774] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 233.344227][ T5749] usb usb2-port1: unable to enumerate USB device [ 233.531854][ T7774] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 233.576116][ T7774] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 233.616462][ T7774] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 233.644473][ T7774] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 233.678869][ T7774] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 233.699034][ T7774] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 233.833354][ T985] iforce 1-1:0.0: usb_submit_urb failed: -110 [ 233.847182][ T985] input input29: Device does not respond to id packet P [ 233.875602][ T985] input input29: Device does not respond to id packet B [ 234.105041][ T985] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 234.123955][ T985] input input29: Device does not respond to id packet N [ 234.153392][ T985] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 234.167789][ T985] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 234.182560][ T985] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 234.192968][ T985] iforce 1-1:0.0: usb_submit_urb failed: -71 [ 234.217623][ T985] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input29 [ 234.247290][ T985] usb 1-1: USB disconnect, device number 26 [ 234.497793][ T7786] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 234.512508][ T7786] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 234.524409][ T7789] netlink: 16 bytes leftover after parsing attributes in process `syz.4.626'. [ 234.535653][ T7786] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 234.542446][ T7786] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 234.703082][ T7794] fuse: Bad value for 'fd' [ 235.186594][ T7812] tipc: Started in network mode [ 235.217064][ T7812] tipc: Node identity ac14142f, cluster identity 4711 [ 235.250042][ T7812] tipc: New replicast peer: 0.0.0.0 [ 235.291833][ T985] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 235.292271][ T7812] tipc: Enabled bearer , priority 10 [ 235.378257][ T7817] tipc: Enabling of bearer rejected, already enabled [ 235.472588][ T985] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 235.496356][ T985] usb 1-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 235.507150][ T985] usb 1-1: Product: syz [ 235.523458][ T985] usb 1-1: SerialNumber: syz [ 235.550523][ T985] usb 1-1: config 0 descriptor?? [ 235.772517][ T985] hso 1-1:0.0: Failed to find BULK eps [ 235.831919][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 236.062895][ T5620] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 236.151682][ T7825] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 236.232029][ T5620] usb 4-1: Using ep0 maxpacket: 32 [ 236.250685][ T5620] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 236.278884][ T5620] usb 4-1: config 0 has no interfaces? [ 236.299036][ T5620] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.320656][ T5620] usb 4-1: Product: syz [ 236.335518][ T5620] usb 4-1: Manufacturer: syz [ 236.350483][ T5620] usb 4-1: SerialNumber: syz [ 236.377616][ T5620] usb 4-1: config 0 descriptor?? [ 236.395628][ T5708] tipc: Node number set to 2886997039 [ 236.530918][ T7831] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 236.552321][ T5617] Bluetooth: hci4: command 0x0406 tx timeout [ 236.552404][ T5627] Bluetooth: hci1: command 0x0406 tx timeout [ 236.558444][ T5617] Bluetooth: hci3: command 0x0406 tx timeout [ 236.564824][ T5616] Bluetooth: hci2: command 0x0406 tx timeout [ 236.585615][ T985] usb 1-1: USB disconnect, device number 27 [ 236.691100][ T7834] FAULT_INJECTION: forcing a failure. [ 236.691100][ T7834] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 236.705986][ T7834] CPU: 0 UID: 0 PID: 7834 Comm: syz.0.640 Tainted: G L syzkaller #0 PREEMPT(full) [ 236.706018][ T7834] Tainted: [L]=SOFTLOCKUP [ 236.706025][ T7834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 236.706036][ T7834] Call Trace: [ 236.706043][ T7834] [ 236.706051][ T7834] dump_stack_lvl+0xe8/0x150 [ 236.706083][ T7834] should_fail_ex+0x40c/0x560 [ 236.706109][ T7834] _copy_from_user+0x2d/0xb0 [ 236.706137][ T7834] get_compat_msghdr+0xb3/0x4c0 [ 236.706162][ T7834] ? __pfx_get_compat_msghdr+0x10/0x10 [ 236.706194][ T7834] ___sys_sendmsg+0x201/0x360 [ 236.706213][ T7834] ? __lock_acquire+0x683/0x2cf0 [ 236.706241][ T7834] ? __pfx____sys_sendmsg+0x10/0x10 [ 236.706265][ T7834] ? kstrtoull+0x12f/0x1d0 [ 236.706311][ T7834] ? __fget_files+0x2a/0x420 [ 236.706334][ T7834] ? __fget_files+0x3a2/0x420 [ 236.706365][ T7834] __sys_sendmmsg+0x2de/0x4d0 [ 236.706390][ T7834] ? __pfx___sys_sendmmsg+0x10/0x10 [ 236.706433][ T7834] ? fput+0xa0/0xd0 [ 236.706454][ T7834] ? ksys_write+0x242/0x270 [ 236.706487][ T7834] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 236.706512][ T7834] __do_fast_syscall_32+0x23e/0x6f0 [ 236.706539][ T7834] ? do_fast_syscall_32+0x33/0x70 [ 236.706563][ T7834] ? lockdep_hardirqs_on+0x7a/0x110 [ 236.706586][ T7834] ? asm_int80_emulation+0x1a/0x20 [ 236.706603][ T7834] ? do_int80_emulation+0x29f/0x550 [ 236.706635][ T7834] ? trace_irq_disable+0x3b/0x140 [ 236.706659][ T7834] do_fast_syscall_32+0x33/0x70 [ 236.706685][ T7834] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 236.706707][ T7834] RIP: 0023:0xf6fef0ec [ 236.706724][ T7834] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 236.706739][ T7834] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 236.706759][ T7834] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080008280 [ 236.706771][ T7834] RDX: 0000000000000002 RSI: 00000000000400c0 RDI: 0000000000000000 [ 236.706783][ T7834] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 236.706793][ T7834] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 236.706804][ T7834] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 236.706829][ T7834] [ 237.049506][ T5620] usb 4-1: USB disconnect, device number 38 [ 237.144021][ T7837] fuse: Bad value for 'fd' [ 237.341380][ T7843] netlink: 336 bytes leftover after parsing attributes in process `syz.0.644'. [ 237.355749][ T7843] netlink: 336 bytes leftover after parsing attributes in process `syz.0.644'. [ 237.463460][ T7847] netlink: 32 bytes leftover after parsing attributes in process `syz.1.642'. [ 237.523323][ T7852] tipc: Enabling of bearer rejected, already enabled [ 237.552414][ T7849] netlink: 8 bytes leftover after parsing attributes in process `syz.4.646'. [ 237.563182][ T7849] netlink: 48 bytes leftover after parsing attributes in process `syz.4.646'. [ 238.057486][ T7865] netlink: 32 bytes leftover after parsing attributes in process `syz.3.651'. [ 238.184791][ T985] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 238.233467][ T29] kauditd_printk_skb: 133 callbacks suppressed [ 238.233486][ T29] audit: type=1326 audit(1786711928.779:241): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7868 comm="syz.0.653" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 238.275981][ T7867] netlink: 4 bytes leftover after parsing attributes in process `syz.4.652'. [ 238.311968][ T29] audit: type=1326 audit(1786711928.779:242): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7868 comm="syz.0.653" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 238.385027][ T29] audit: type=1326 audit(1786711928.779:243): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7868 comm="syz.0.653" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=29 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 238.445049][ T985] usb 3-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 238.477852][ T985] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 238.489541][ T985] usb 3-1: Product: syz [ 238.501024][ T985] usb 3-1: SerialNumber: syz [ 238.517078][ T985] usb 3-1: config 0 descriptor?? [ 238.664930][ T5616] Bluetooth: hci2: command 0x0406 tx timeout [ 238.674018][ T5616] Bluetooth: hci3: command 0x0406 tx timeout [ 238.680869][ T5616] Bluetooth: hci1: command 0x0406 tx timeout [ 238.688720][ T5616] Bluetooth: hci4: command 0x0406 tx timeout [ 238.747726][ T985] hso 3-1:0.0: Failed to find BULK eps [ 238.763756][ T29] audit: type=1326 audit(1786711929.309:244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7868 comm="syz.0.653" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 238.882344][ T29] audit: type=1326 audit(1786711929.309:245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7868 comm="syz.0.653" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 238.994417][ T29] audit: type=1326 audit(1786711929.319:246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7868 comm="syz.0.653" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 239.093720][ T29] audit: type=1326 audit(1786711929.319:247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7868 comm="syz.0.653" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 239.215413][ T29] audit: type=1326 audit(1786711929.319:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7868 comm="syz.0.653" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 239.284966][ T29] audit: type=1326 audit(1786711929.359:249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7868 comm="syz.0.653" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 239.381863][ T29] audit: type=1326 audit(1786711929.359:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7868 comm="syz.0.653" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fef0ec code=0x7ffc0000 [ 239.509667][ T5708] usb 3-1: USB disconnect, device number 36 [ 239.785335][ T7880] fuse: Bad value for 'fd' [ 239.874092][ T7878] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 240.489233][ T7890] netlink: 'syz.3.659': attribute type 10 has an invalid length. [ 240.500419][ T7890] netlink: 40 bytes leftover after parsing attributes in process `syz.3.659'. [ 240.511407][ T7890] team0: entered promiscuous mode [ 240.517540][ T7890] team_slave_0: entered promiscuous mode [ 240.560091][ T7890] team_slave_1: entered promiscuous mode [ 240.585960][ T7890] team0: entered allmulticast mode [ 240.601806][ T7890] team_slave_0: entered allmulticast mode [ 240.654720][ T7890] team_slave_1: entered allmulticast mode [ 240.720932][ T7890] bridge0: port 3(team0) entered blocking state [ 240.799492][ T7890] bridge0: port 3(team0) entered disabled state [ 240.897329][ T7890] bridge0: port 3(team0) entered blocking state [ 240.903959][ T7890] bridge0: port 3(team0) entered forwarding state [ 241.021829][ T5620] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 241.202676][ T188] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 241.223714][ T5620] usb 3-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 241.239356][ T5620] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.249939][ T5620] usb 3-1: Product: syz [ 241.254527][ T5620] usb 3-1: Manufacturer: syz [ 241.260496][ T5620] usb 3-1: SerialNumber: syz [ 241.284890][ T5620] usb-storage 3-1:1.0: USB Mass Storage device detected [ 241.305395][ T5620] usb-storage 3-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 241.323135][ T5620] scsi host1: usb-storage 3-1:1.0 [ 241.350438][ T7908] tipc: Enabling of bearer rejected, already enabled [ 241.392093][ T188] usb 5-1: Using ep0 maxpacket: 32 [ 241.405743][ T188] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 241.440812][ T188] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 241.479366][ T188] usb 5-1: config 0 has no interface number 0 [ 241.508570][ T188] usb 5-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 241.523898][ T7911] netlink: 'syz.3.664': attribute type 1 has an invalid length. [ 241.536793][ T188] usb 5-1: config 0 interface 89 has no altsetting 0 [ 241.563770][ T188] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.582164][ T7913] netlink: 48 bytes leftover after parsing attributes in process `syz.3.664'. [ 241.591453][ T188] usb 5-1: Product: syz [ 241.603678][ T188] usb 5-1: Manufacturer: syz [ 241.617749][ T188] usb 5-1: SerialNumber: syz [ 241.640645][ T188] usb 5-1: config 0 descriptor?? [ 241.661080][ T188] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 241.676601][ T7911] 8021q: adding VLAN 0 to HW filter on device bond1 [ 241.695573][ T188] em28xx 5-1:0.89: Video interface 89 found: [ 241.718850][ T7914] bond1: (slave veth0_to_bond): making interface the new active one [ 241.757509][ T7914] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 241.806695][ T7915] bond1: entered promiscuous mode [ 241.829185][ T7915] veth0_to_bond: entered promiscuous mode [ 241.861527][ T7915] bond1: entered allmulticast mode [ 241.880410][ T7915] veth0_to_bond: entered allmulticast mode [ 241.940487][ T7911] macvlan2: entered promiscuous mode [ 241.963522][ T7911] macvlan2: entered allmulticast mode [ 241.975665][ T7911] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 242.077977][ T7911] bond1: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 242.297905][ T7924] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 242.341506][ T7924] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 242.368733][ T7924] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 242.383705][ T7924] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 242.403291][ T7924] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 242.411869][ T7927] syzkaller0: entered promiscuous mode [ 242.417520][ T7924] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 242.429450][ T7927] syzkaller0: entered allmulticast mode [ 242.446149][ T7924] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 242.452695][ T7924] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 242.484889][ T7929] capability: warning: `syz.3.669' uses deprecated v2 capabilities in a way that may be insecure [ 242.506521][ T7929] FAULT_INJECTION: forcing a failure. [ 242.506521][ T7929] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 242.528709][ T7929] CPU: 0 UID: 0 PID: 7929 Comm: syz.3.669 Tainted: G L syzkaller #0 PREEMPT(full) [ 242.528738][ T7929] Tainted: [L]=SOFTLOCKUP [ 242.528745][ T7929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 242.528775][ T7929] Call Trace: [ 242.528783][ T7929] [ 242.528791][ T7929] dump_stack_lvl+0xe8/0x150 [ 242.528821][ T7929] should_fail_ex+0x40c/0x560 [ 242.528847][ T7929] _copy_from_iter+0x1d3/0x1660 [ 242.528870][ T7929] ? kmem_cache_alloc_node_noprof+0x1d1/0x610 [ 242.528893][ T7929] ? rcu_is_watching+0x15/0xb0 [ 242.528920][ T7929] ? trace_kmem_cache_alloc+0x29/0xe0 [ 242.528942][ T7929] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 242.528964][ T7929] ? __pfx__copy_from_iter+0x10/0x10 [ 242.528990][ T7929] ? __alloc_skb+0x276/0x7a0 [ 242.529009][ T7929] ? __alloc_skb+0x276/0x7a0 [ 242.529033][ T7929] ? netlink_sendmsg+0x650/0xb40 [ 242.529058][ T7929] ? skb_put+0x112/0x210 [ 242.529082][ T7929] netlink_sendmsg+0x6c0/0xb40 [ 242.529107][ T7929] ? aa_file_perm+0x18b/0x15f0 [ 242.529138][ T7929] ? __pfx_netlink_sendmsg+0x10/0x10 [ 242.529168][ T7929] ? aa_sock_msg_perm+0xf1/0x1b0 [ 242.529194][ T7929] ? __pfx_netlink_sendmsg+0x10/0x10 [ 242.529218][ T7929] sock_sendmsg_nosec+0x13a/0x180 [ 242.529251][ T7929] sock_write_iter+0x2de/0x3e0 [ 242.529280][ T7929] ? __pfx_sock_write_iter+0x10/0x10 [ 242.529315][ T7929] ? kstrtoull+0x12f/0x1d0 [ 242.529347][ T7929] do_iter_readv_writev+0x612/0x8c0 [ 242.529372][ T7929] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 242.529398][ T7929] ? bpf_lsm_file_permission+0x9/0x20 [ 242.529421][ T7929] ? security_file_permission+0x75/0x260 [ 242.529452][ T7929] ? rw_verify_area+0x203/0x4c0 [ 242.529486][ T7929] vfs_writev+0x343/0x990 [ 242.529521][ T7929] ? __pfx_vfs_writev+0x10/0x10 [ 242.529561][ T7929] ? __fget_files+0x2a/0x420 [ 242.529593][ T7929] ? __fget_files+0x3a2/0x420 [ 242.529619][ T7929] ? __fget_files+0x2a/0x420 [ 242.529655][ T7929] do_writev+0x154/0x2e0 [ 242.529682][ T7929] ? __pfx_do_writev+0x10/0x10 [ 242.529717][ T7929] __do_fast_syscall_32+0x23e/0x6f0 [ 242.529748][ T7929] ? do_fast_syscall_32+0x33/0x70 [ 242.529782][ T7929] ? lockdep_hardirqs_on+0x7a/0x110 [ 242.529809][ T7929] ? asm_int80_emulation+0x1a/0x20 [ 242.529828][ T7929] ? do_int80_emulation+0x29f/0x550 [ 242.529858][ T7929] ? trace_irq_disable+0x3b/0x140 [ 242.529888][ T7929] do_fast_syscall_32+0x33/0x70 [ 242.529919][ T7929] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 242.529946][ T7929] RIP: 0023:0xf704f0ec [ 242.529966][ T7929] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 242.529985][ T7929] RSP: 002b:00000000f543d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000092 [ 242.530007][ T7929] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800000c0 [ 242.530021][ T7929] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 242.530032][ T7929] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 242.530044][ T7929] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 242.530056][ T7929] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 242.530087][ T7929] [ 242.983987][ T188] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 243.067147][ T188] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 243.075407][ T188] em28xx 5-1:0.89: board has no eeprom [ 243.083680][ T7934] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 243.141879][ T188] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 243.149205][ T188] em28xx 5-1:0.89: analog set to bulk mode. [ 243.157423][ T5347] em28xx 5-1:0.89: Registering V4L2 extension [ 243.183239][ T188] usb 5-1: USB disconnect, device number 26 [ 243.191408][ T188] em28xx 5-1:0.89: Disconnecting em28xx [ 243.236252][ T5347] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 243.245452][ T5347] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 243.253199][ T5347] em28xx 5-1:0.89: No AC97 audio processor [ 243.267913][ T5347] usb 5-1: Decoder not found [ 243.290972][ T5347] em28xx 5-1:0.89: failed to create media graph [ 243.308301][ T5347] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 243.354839][ T5347] em28xx 5-1:0.89: Registering snapshot button... [ 243.385173][ T5347] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input30 [ 243.428160][ T5347] em28xx 5-1:0.89: Remote control support is not available for this card. [ 243.445746][ T188] em28xx 5-1:0.89: Closing input extension [ 243.454170][ T188] em28xx 5-1:0.89: Deregistering snapshot button [ 243.493525][ T29] kauditd_printk_skb: 148 callbacks suppressed [ 243.493542][ T29] audit: type=1326 audit(1786711934.049:399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7936 comm="syz.0.672" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 243.536468][ T188] em28xx 5-1:0.89: Freeing device [ 243.559594][ T29] audit: type=1326 audit(1786711934.079:400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7936 comm="syz.0.672" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 243.588901][ T29] audit: type=1326 audit(1786711934.089:401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7936 comm="syz.0.672" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 243.616797][ T29] audit: type=1326 audit(1786711934.089:402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7936 comm="syz.0.672" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 243.643420][ T29] audit: type=1326 audit(1786711934.089:403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7936 comm="syz.0.672" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 243.668931][ T29] audit: type=1326 audit(1786711934.089:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7936 comm="syz.0.672" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 243.693397][ T5708] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 243.841896][ T5749] usb 3-1: USB disconnect, device number 37 [ 243.852723][ T5708] usb 4-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 243.928602][ T29] audit: type=1326 audit(1786711934.089:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7936 comm="syz.0.672" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 243.958336][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 243.988518][ T5708] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 244.002185][ T5708] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 244.014673][ T29] audit: type=1326 audit(1786711934.089:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7936 comm="syz.0.672" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 244.056965][ T985] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 244.110481][ T5708] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 244.152205][ T7953] tipc: Enabling of bearer rejected, already enabled [ 244.157658][ T5708] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.178957][ T985] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz1] on syz0 [ 244.195158][ T7955] FAULT_INJECTION: forcing a failure. [ 244.195158][ T7955] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 244.211578][ T29] audit: type=1326 audit(1786711934.089:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7936 comm="syz.0.672" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 244.243952][ T5708] usb 4-1: config 0 descriptor?? [ 244.257964][ T7955] CPU: 0 UID: 0 PID: 7955 Comm: syz.1.677 Tainted: G L syzkaller #0 PREEMPT(full) [ 244.257995][ T7955] Tainted: [L]=SOFTLOCKUP [ 244.258003][ T7955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 244.258014][ T7955] Call Trace: [ 244.258023][ T7955] [ 244.258031][ T7955] dump_stack_lvl+0xe8/0x150 [ 244.258065][ T7955] should_fail_ex+0x40c/0x560 [ 244.258095][ T7955] _copy_to_user+0x31/0xb0 [ 244.258125][ T7955] simple_read_from_buffer+0xe1/0x170 [ 244.258156][ T7955] proc_fail_nth_read+0x1bb/0x230 [ 244.258187][ T7955] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 244.258216][ T7955] ? rw_verify_area+0x24a/0x4c0 [ 244.258243][ T7955] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 244.258266][ T7955] vfs_read+0x213/0xa80 [ 244.258297][ T7955] ? __pfx___mutex_lock+0x10/0x10 [ 244.258326][ T7955] ? __pfx_vfs_read+0x10/0x10 [ 244.258355][ T7955] ? __fget_files+0x2a/0x420 [ 244.258383][ T7955] ? __fget_files+0x3a2/0x420 [ 244.258407][ T7955] ? __fget_files+0x2a/0x420 [ 244.258442][ T7955] ksys_read+0x150/0x270 [ 244.258473][ T7955] ? __pfx_ksys_read+0x10/0x10 [ 244.258506][ T7955] ? asm_int80_emulation+0x1a/0x20 [ 244.258531][ T7955] do_int80_emulation+0x19a/0x550 [ 244.258569][ T7955] ? trace_irq_disable+0x3b/0x140 [ 244.258587][ T7955] ? asm_int80_emulation+0x1a/0x20 [ 244.258602][ T7955] ? clear_bhb_loop+0x70/0xc0 [ 244.258618][ T7955] ? clear_bhb_loop+0x70/0xc0 [ 244.258638][ T7955] asm_int80_emulation+0x1a/0x20 [ 244.258654][ T7955] RIP: 0023:0xf71874eb [ 244.258670][ T7955] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 244.258686][ T7955] RSP: 002b:00000000f543d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 244.258703][ T7955] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f543d5d0 [ 244.258715][ T7955] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 244.258725][ T7955] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 244.258735][ T7955] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 244.258746][ T7955] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 244.258773][ T7955] [ 244.652824][ T29] audit: type=1326 audit(1786711934.089:408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7936 comm="syz.0.672" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fef108 code=0x7ffc0000 [ 244.697702][ T5708] hdpvr 4-1:0.0: firmware version 0x8 dated 5 [ 245.136255][ T985] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 245.293245][ T985] usb 2-1: New USB device found, idVendor=0079, idProduct=0011, bcdDevice= 0.00 [ 245.320367][ T985] usb 2-1: too many endpoints for config 0 interface 0 altsetting 18: 254, using maximum allowed: 30 [ 245.369219][ T985] usb 2-1: config 0 interface 0 altsetting 18 endpoint 0x81 has an invalid bInterval 180, changing to 11 [ 245.401814][ T985] usb 2-1: config 0 interface 0 altsetting 18 endpoint 0x81 has invalid maxpacket 1056, setting to 1024 [ 245.437326][ T985] usb 2-1: config 0 interface 0 altsetting 18 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 245.464547][ T5708] hdpvr 4-1:0.0: Could not setup controls [ 245.471087][ T5708] hdpvr 4-1:0.0: registering videodev failed [ 245.488308][ T985] usb 2-1: config 0 interface 0 has no altsetting 0 [ 245.504246][ T985] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 245.534929][ T985] usb 2-1: config 0 descriptor?? [ 245.549439][ T7960] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 245.561967][ T5708] hdpvr 4-1:0.0: probe with driver hdpvr failed with error -71 [ 245.588603][ T5708] usb 4-1: USB disconnect, device number 39 [ 245.868537][ T7977] syzkaller0: entered promiscuous mode [ 245.874522][ T7977] syzkaller0: entered allmulticast mode [ 245.951163][ T7979] FAULT_INJECTION: forcing a failure. [ 245.951163][ T7979] name failslab, interval 1, probability 0, space 0, times 0 [ 245.965659][ T7979] CPU: 0 UID: 0 PID: 7979 Comm: syz.3.683 Tainted: G L syzkaller #0 PREEMPT(full) [ 245.965693][ T7979] Tainted: [L]=SOFTLOCKUP [ 245.965700][ T7979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 245.965716][ T7979] Call Trace: [ 245.965723][ T7979] [ 245.965729][ T7979] dump_stack_lvl+0xe8/0x150 [ 245.965754][ T7979] should_fail_ex+0x40c/0x560 [ 245.965788][ T7979] should_failslab+0xa8/0x100 [ 245.965821][ T7979] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 245.965844][ T7979] ? look_up_lock_class+0x57/0x110 [ 245.965876][ T7979] ? sctp_get_port_local+0x6bd/0x1700 [ 245.965897][ T7979] ? sctp_get_port_local+0x6bd/0x1700 [ 245.965923][ T7979] sctp_get_port_local+0x6bd/0x1700 [ 245.965974][ T7979] ? __pfx_sctp_get_port_local+0x10/0x10 [ 245.966004][ T7979] ? sctp_bind_addr_match+0x30/0x2b0 [ 245.966029][ T7979] ? sctp_bind_addr_match+0x28b/0x2b0 [ 245.966051][ T7979] sctp_do_bind+0x4d9/0x9a0 [ 245.966099][ T7979] sctp_connect_new_asoc+0x270/0x6b0 [ 245.966132][ T7979] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 245.966168][ T7979] ? __local_bh_enable_ip+0xd0/0x130 [ 245.966194][ T7979] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 245.966210][ T7979] ? security_sctp_bind_connect+0x7e/0x2c0 [ 245.966233][ T7979] sctp_sendmsg+0x159b/0x2d00 [ 245.966288][ T7979] ? __pfx_sctp_sendmsg+0x10/0x10 [ 245.966328][ T7979] ? aa_sk_perm+0x6d5/0x900 [ 245.966365][ T7979] ? sock_rps_record_flow+0x19/0x350 [ 245.966390][ T7979] ? inet_sendmsg+0x298/0x320 [ 245.966428][ T7979] ? __pfx_inet_sendmsg+0x10/0x10 [ 245.966449][ T7979] sock_sendmsg_nosec+0x10e/0x180 [ 245.966479][ T7979] ____sys_sendmsg+0x54e/0x850 [ 245.966507][ T7979] ? __pfx_____sys_sendmsg+0x10/0x10 [ 245.966535][ T7979] ___sys_sendmsg+0x2a5/0x360 [ 245.966563][ T7979] ? __lock_acquire+0x683/0x2cf0 [ 245.966596][ T7979] ? __pfx____sys_sendmsg+0x10/0x10 [ 245.966623][ T7979] ? kstrtoull+0x12f/0x1d0 [ 245.966668][ T7979] ? __fget_files+0x2a/0x420 [ 245.966687][ T7979] ? __fget_files+0x3a2/0x420 [ 245.966729][ T7979] __sys_sendmmsg+0x2de/0x4d0 [ 245.966759][ T7979] ? __pfx___sys_sendmmsg+0x10/0x10 [ 245.966810][ T7979] ? fput+0xa0/0xd0 [ 245.966828][ T7979] ? ksys_write+0x242/0x270 [ 245.966856][ T7979] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 245.966897][ T7979] __do_fast_syscall_32+0x23e/0x6f0 [ 245.966927][ T7979] ? do_fast_syscall_32+0x33/0x70 [ 245.966953][ T7979] ? lockdep_hardirqs_on+0x7a/0x110 [ 245.966979][ T7979] ? asm_int80_emulation+0x1a/0x20 [ 245.966993][ T7979] ? do_int80_emulation+0x29f/0x550 [ 245.967013][ T7979] ? trace_irq_disable+0x3b/0x140 [ 245.967053][ T7979] do_fast_syscall_32+0x33/0x70 [ 245.967082][ T7979] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 245.967106][ T7979] RIP: 0023:0xf704f0ec [ 245.967125][ T7979] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 245.967139][ T7979] RSP: 002b:00000000f543d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 245.967154][ T7979] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080002680 [ 245.967165][ T7979] RDX: 0000000000000002 RSI: 0000000004008040 RDI: 0000000000000000 [ 245.967174][ T7979] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 245.967197][ T7979] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 245.967209][ T7979] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 245.967239][ T7979] [ 246.609139][ T985] usbhid 2-1:0.0: can't add hid device: -71 [ 246.631878][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 246.668203][ T985] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 246.740019][ T985] usb 2-1: USB disconnect, device number 41 [ 246.838686][ T7992] netlink: 2088 bytes leftover after parsing attributes in process `syz.1.687'. [ 246.931854][ T5749] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 247.012140][ T5708] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 247.103064][ T5749] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 247.123161][ T5749] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.146606][ T5749] usb 1-1: config 0 descriptor?? [ 247.191789][ T5708] usb 5-1: Using ep0 maxpacket: 32 [ 247.206370][ T5708] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 247.232802][ T5708] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 247.247016][ T5708] usb 5-1: config 0 has no interface number 0 [ 247.272366][ T5708] usb 5-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 247.300347][ T5708] usb 5-1: config 0 interface 89 has no altsetting 0 [ 247.322559][ T5708] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.340864][ T5708] usb 5-1: Product: syz [ 247.349644][ T5708] usb 5-1: Manufacturer: syz [ 247.357498][ T5708] usb 5-1: SerialNumber: syz [ 247.365439][ T5708] usb 5-1: config 0 descriptor?? [ 247.383611][ T5708] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 247.402253][ T5708] em28xx 5-1:0.89: Video interface 89 found: [ 247.474012][ T7999] netlink: 32 bytes leftover after parsing attributes in process `syz.3.688'. [ 247.561796][ T8001] tipc: Enabling of bearer rejected, already enabled [ 247.591282][ T7989] input: syz0 as /devices/virtual/input/input31 [ 247.668169][ T5749] ath6kl: Unsupported hardware version: 0x0 [ 247.713695][ T5749] ath6kl: Failed to init ath6kl core: -22 [ 247.743341][ T5749] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -22 [ 247.890925][ T985] usb 1-1: USB disconnect, device number 28 [ 248.033129][ T5686] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 248.174856][ T5708] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 248.191849][ T5686] usb 2-1: Using ep0 maxpacket: 8 [ 248.208494][ T5686] usb 2-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 248.230813][ T5686] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 248.249117][ T5686] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 248.270673][ T5708] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 248.279975][ T5708] em28xx 5-1:0.89: board has no eeprom [ 248.288131][ T5686] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 248.307719][ T5686] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 248.329912][ T5686] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.338886][ T5686] usb 2-1: Product: syz [ 248.345262][ T5686] usb 2-1: Manufacturer: syz [ 248.351475][ T5686] usb 2-1: SerialNumber: syz [ 248.351956][ T5708] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 248.369975][ T5686] usb 2-1: config 0 descriptor?? [ 248.379086][ T5708] em28xx 5-1:0.89: analog set to bulk mode. [ 248.382979][ T8006] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 248.396867][ T5620] em28xx 5-1:0.89: Registering V4L2 extension [ 248.448468][ T5708] usb 5-1: USB disconnect, device number 27 [ 248.467551][ T985] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 248.516416][ T5708] em28xx 5-1:0.89: Disconnecting em28xx [ 248.591330][ T5620] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 248.621343][ T5686] powermate: Expected payload of 3--6 bytes, found 1024 bytes! [ 248.624218][ T5620] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 248.637098][ T985] usb 3-1: Using ep0 maxpacket: 8 [ 248.647052][ T985] usb 3-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 248.657542][ T5620] em28xx 5-1:0.89: No AC97 audio processor [ 248.663946][ T8014] kvm: user requested TSC rate below hardware speed [ 248.673665][ T5686] input: Griffin SoundKnob as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input32 [ 248.696845][ T5620] usb 5-1: Decoder not found [ 248.701235][ T985] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 248.727443][ T5620] em28xx 5-1:0.89: failed to create media graph [ 248.733041][ T985] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 248.758889][ T985] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 248.765896][ T5620] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 248.771174][ T985] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 248.839072][ T5620] em28xx 5-1:0.89: Registering snapshot button... [ 248.889398][ T5620] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input33 [ 248.900755][ T985] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.973748][ T5620] em28xx 5-1:0.89: Remote control support is not available for this card. [ 249.016609][ T5708] em28xx 5-1:0.89: Closing input extension [ 249.022071][ T985] usb 3-1: Product: syz [ 249.055430][ T5708] em28xx 5-1:0.89: Deregistering snapshot button [ 249.075073][ T985] usb 3-1: Manufacturer: syz [ 249.089151][ T8014] netlink: 8 bytes leftover after parsing attributes in process `syz.0.692'. [ 249.101760][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 249.111757][ T0] NOHZ tick-stop error: local softirq work is pending, handler #282!!! [ 249.142873][ T8014] netlink: 8 bytes leftover after parsing attributes in process `syz.0.692'. [ 249.206122][ T985] usb 3-1: SerialNumber: syz [ 249.245879][ T985] usb 3-1: config 0 descriptor?? [ 249.256624][ C1] powermate: config urb returned -71 [ 249.263978][ C1] powermate: config urb returned -71 [ 249.269565][ C1] powermate: config urb returned -71 [ 249.276023][ C1] powermate: config urb returned -71 [ 249.281671][ C1] powermate: config urb returned -71 [ 249.303380][ T5686] usb 2-1: USB disconnect, device number 42 [ 249.309367][ C1] powermate 2-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 249.316474][ T8010] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 249.357280][ T5708] em28xx 5-1:0.89: Freeing device [ 249.584606][ T985] powermate: Expected payload of 3--6 bytes, found 1024 bytes! [ 249.626974][ T985] input: Griffin SoundKnob as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input34 [ 249.887213][ C1] powermate: config urb returned -71 [ 249.888647][ T5708] usb 3-1: USB disconnect, device number 38 [ 249.892565][ C1] powermate: usb_submit_urb(config) failed [ 249.892667][ C1] powermate 3-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 250.148450][ T8032] fuse: fd is not a fuse device [ 250.281874][ T985] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 250.325597][ T8039] fuse: Bad value for 'rootmode' [ 250.451851][ T985] usb 5-1: Using ep0 maxpacket: 16 [ 250.459568][ T985] usb 5-1: New USB device found, idVendor=0644, idProduct=8021, bcdDevice=38.b7 [ 250.477676][ T985] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 250.487955][ T985] usb 5-1: Product: syz [ 250.493915][ T985] usb 5-1: Manufacturer: syz [ 250.499414][ T985] usb 5-1: SerialNumber: syz [ 250.512350][ T985] usb 5-1: config 0 descriptor?? [ 250.528895][ T985] hub 5-1:0.0: bad descriptor, ignoring hub [ 250.535594][ T985] hub 5-1:0.0: probe with driver hub failed with error -5 [ 250.823366][ T5686] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 250.991813][ T5686] usb 3-1: Using ep0 maxpacket: 8 [ 251.010609][ T5686] usb 3-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 251.057220][ T5686] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 251.094006][ T8046] : renamed from veth0_to_bond (while UP) [ 251.102267][ T5686] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 251.149667][ T5686] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 251.171031][ T5686] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 251.240811][ T5686] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.275874][ T5686] usb 3-1: Product: syz [ 251.294515][ T5686] usb 3-1: Manufacturer: syz [ 251.310074][ T5686] usb 3-1: SerialNumber: syz [ 251.335541][ T5686] usb 3-1: config 0 descriptor?? [ 251.355080][ T8043] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 251.512036][ T5708] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 251.584003][ T5686] powermate: Expected payload of 3--6 bytes, found 1024 bytes! [ 251.607226][ T5686] input: Griffin SoundKnob as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input35 [ 251.696406][ T5708] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 251.729158][ T5708] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 251.754779][ T5708] usb 2-1: Product: syz [ 251.769823][ T5708] usb 2-1: SerialNumber: syz [ 251.792234][ T5708] usb 2-1: config 0 descriptor?? [ 251.805210][ T8043] FAULT_INJECTION: forcing a failure. [ 251.805210][ T8043] name failslab, interval 1, probability 0, space 0, times 0 [ 251.871618][ T8043] CPU: 1 UID: 0 PID: 8043 Comm: syz.2.702 Tainted: G L syzkaller #0 PREEMPT(full) [ 251.871653][ T8043] Tainted: [L]=SOFTLOCKUP [ 251.871660][ T8043] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 251.871672][ T8043] Call Trace: [ 251.871680][ T8043] [ 251.871688][ T8043] dump_stack_lvl+0xe8/0x150 [ 251.871723][ T8043] should_fail_ex+0x40c/0x560 [ 251.871752][ T8043] should_failslab+0xa8/0x100 [ 251.871783][ T8043] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 251.871808][ T8043] ? alloc_empty_file+0x5b/0x1d0 [ 251.871832][ T8043] ? alloc_empty_file+0x5b/0x1d0 [ 251.871864][ T8043] alloc_empty_file+0x5b/0x1d0 [ 251.871890][ T8043] alloc_file_pseudo+0x115/0x1e0 [ 251.871920][ T8043] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 251.871947][ T8043] ? _raw_spin_unlock+0x28/0x50 [ 251.871979][ T8043] anon_inode_getfile+0xc5/0x1a0 [ 251.872007][ T8043] do_epoll_create+0x2f7/0x440 [ 251.872031][ T8043] __ia32_sys_epoll_create+0x4e/0x70 [ 251.872061][ T8043] __do_fast_syscall_32+0x23e/0x6f0 [ 251.872092][ T8043] ? do_fast_syscall_32+0x33/0x70 [ 251.872121][ T8043] ? lockdep_hardirqs_on+0x7a/0x110 [ 251.872148][ T8043] ? asm_int80_emulation+0x1a/0x20 [ 251.872168][ T8043] ? do_int80_emulation+0x29f/0x550 [ 251.872202][ T8043] do_fast_syscall_32+0x33/0x70 [ 251.872232][ T8043] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 251.872258][ T8043] RIP: 0023:0xf70bf0ec [ 251.872277][ T8043] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 251.872295][ T8043] RSP: 002b:00000000f54ad50c EFLAGS: 00000206 ORIG_RAX: 00000000000000fe [ 251.872317][ T8043] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000000000 [ 251.872331][ T8043] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 251.872343][ T8043] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 251.872354][ T8043] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 251.872366][ T8043] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 251.872396][ T8043] [ 252.192372][ C1] powermate: config urb returned -71 [ 252.197328][ T5708] usb 3-1: USB disconnect, device number 39 [ 252.197739][ C1] powermate: usb_submit_urb(config) failed [ 252.203718][ C1] powermate 3-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 252.552375][ T985] usb 5-1: USB disconnect, device number 28 [ 252.682218][ T8064] netlink: 8 bytes leftover after parsing attributes in process `syz.3.708'. [ 252.710041][ T5708] usb 2-1: USB disconnect, device number 43 [ 253.051256][ T8075] FAULT_INJECTION: forcing a failure. [ 253.051256][ T8075] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 253.078614][ T8075] CPU: 1 UID: 0 PID: 8075 Comm: syz.3.711 Tainted: G L syzkaller #0 PREEMPT(full) [ 253.078650][ T8075] Tainted: [L]=SOFTLOCKUP [ 253.078657][ T8075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 253.078668][ T8075] Call Trace: [ 253.078677][ T8075] [ 253.078689][ T8075] dump_stack_lvl+0xe8/0x150 [ 253.078715][ T8075] should_fail_ex+0x40c/0x560 [ 253.078736][ T8075] _copy_from_iter+0x1d3/0x1660 [ 253.078754][ T8075] ? kmem_cache_alloc_node_noprof+0x1d1/0x610 [ 253.078773][ T8075] ? rcu_is_watching+0x15/0xb0 [ 253.078795][ T8075] ? trace_kmem_cache_alloc+0x29/0xe0 [ 253.078813][ T8075] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 253.078830][ T8075] ? __pfx__copy_from_iter+0x10/0x10 [ 253.078848][ T8075] ? __alloc_skb+0x276/0x7a0 [ 253.078867][ T8075] ? __alloc_skb+0x276/0x7a0 [ 253.078884][ T8075] ? netlink_sendmsg+0x650/0xb40 [ 253.078900][ T8075] ? skb_put+0x112/0x210 [ 253.078917][ T8075] netlink_sendmsg+0x6c0/0xb40 [ 253.078940][ T8075] ? __pfx_netlink_sendmsg+0x10/0x10 [ 253.078960][ T8075] ? aa_sock_msg_perm+0xf1/0x1b0 [ 253.078978][ T8075] ? __pfx_netlink_sendmsg+0x10/0x10 [ 253.078994][ T8075] sock_sendmsg_nosec+0x13a/0x180 [ 253.079017][ T8075] sock_write_iter+0x2de/0x3e0 [ 253.079037][ T8075] ? __pfx_sock_write_iter+0x10/0x10 [ 253.079061][ T8075] ? bpf_lsm_file_permission+0x9/0x20 [ 253.079077][ T8075] ? security_file_permission+0x75/0x260 [ 253.079102][ T8075] vfs_write+0x612/0xba0 [ 253.079130][ T8075] ? __pfx_vfs_write+0x10/0x10 [ 253.079158][ T8075] ? __fget_files+0x2a/0x420 [ 253.079183][ T8075] ksys_write+0x150/0x270 [ 253.079206][ T8075] ? __pfx_ksys_write+0x10/0x10 [ 253.079234][ T8075] __do_fast_syscall_32+0x23e/0x6f0 [ 253.079256][ T8075] ? do_fast_syscall_32+0x33/0x70 [ 253.079276][ T8075] ? lockdep_hardirqs_on+0x7a/0x110 [ 253.079295][ T8075] ? asm_int80_emulation+0x1a/0x20 [ 253.079309][ T8075] ? do_int80_emulation+0x29f/0x550 [ 253.079329][ T8075] ? trace_irq_disable+0x3b/0x140 [ 253.079348][ T8075] do_fast_syscall_32+0x33/0x70 [ 253.079372][ T8075] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 253.079390][ T8075] RIP: 0023:0xf704f0ec [ 253.079404][ T8075] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 253.079416][ T8075] RSP: 002b:00000000f53fb50c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 253.079431][ T8075] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080000000 [ 253.079441][ T8075] RDX: 0000000000000024 RSI: 0000000000000000 RDI: 0000000000000000 [ 253.079450][ T8075] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 253.079458][ T8075] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 253.079467][ T8075] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 253.079487][ T8075] [ 253.199719][ T5708] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 253.651984][ T5708] usb 2-1: Using ep0 maxpacket: 8 [ 253.663465][ T5708] usb 2-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 253.712341][ T5708] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 253.729723][ T5708] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 253.755643][ T5708] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.775096][ T5708] usb 2-1: Product: syz [ 253.789635][ T5708] usb 2-1: Manufacturer: syz [ 253.798573][ T5708] usb 2-1: SerialNumber: syz [ 253.827500][ T5708] usb 2-1: config 0 descriptor?? [ 253.846114][ T5708] powermate 2-1:0.0: probe with driver powermate failed with error -5 [ 254.066554][ T8087] fuse: Unknown parameter 'use00000000000000000000' [ 254.712102][ T5708] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 254.926393][ T5708] usb 5-1: Using ep0 maxpacket: 16 [ 254.949459][ T5708] usb 5-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 255.024088][ T5708] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 255.070074][ T5708] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 255.097011][ T5708] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 255.149752][ T5708] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.161341][ T5708] usb 5-1: Product: syz [ 255.169718][ T5708] usb 5-1: Manufacturer: syz [ 255.178067][ T5708] usb 5-1: SerialNumber: syz [ 255.191145][ T5708] usb 5-1: config 0 descriptor?? [ 255.216903][ T5708] mcba_usb 5-1:0.0: Can't find endpoints [ 255.282913][ T985] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 255.292262][ T5749] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 255.452002][ T985] usb 3-1: Using ep0 maxpacket: 16 [ 255.462924][ T985] usb 3-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 255.499937][ T985] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 255.520642][ T5749] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 255.539245][ T985] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 255.559869][ T5749] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 255.576192][ T5749] usb 4-1: Product: syz [ 255.580618][ T985] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 255.601890][ T5749] usb 4-1: SerialNumber: syz [ 255.621914][ T5708] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 255.638085][ T5749] usb 4-1: config 0 descriptor?? [ 255.666367][ T985] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.677853][ T1308] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.685627][ T1308] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.710462][ T985] usb 3-1: Product: syz [ 255.723581][ T985] usb 3-1: Manufacturer: syz [ 255.736851][ T985] usb 3-1: SerialNumber: syz [ 255.761384][ T985] usb 3-1: config 0 descriptor?? [ 255.786820][ T5708] usb 1-1: Using ep0 maxpacket: 16 [ 255.788174][ T985] mcba_usb 3-1:0.0: Can't find endpoints [ 255.824392][ T5708] usb 1-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 255.900574][ T5708] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 255.925100][ T5749] usb 2-1: USB disconnect, device number 44 [ 255.948998][ T5708] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 255.990084][ T5708] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 256.086142][ T5708] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.108487][ T5708] usb 1-1: Product: syz [ 256.122535][ T5708] usb 1-1: Manufacturer: syz [ 256.136765][ T5708] usb 1-1: SerialNumber: syz [ 256.164963][ T5708] usb 1-1: config 0 descriptor?? [ 256.202054][ T5708] mcba_usb 1-1:0.0: Can't find endpoints [ 256.423888][ T188] usb 4-1: USB disconnect, device number 40 [ 256.902209][ T188] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 257.081858][ T188] usb 4-1: Using ep0 maxpacket: 16 [ 257.097775][ T188] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 257.137589][ T188] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 257.181341][ T188] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 257.226559][ T188] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 257.263026][ T188] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 257.301837][ T188] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 257.349389][ T188] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 257.375598][ T188] usb 4-1: Manufacturer: syz [ 257.402866][ T188] usb 4-1: config 0 descriptor?? [ 257.466285][ T5708] usb 5-1: USB disconnect, device number 29 [ 257.595231][ T5749] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 257.621367][ T8120] bridge2: entered promiscuous mode [ 257.643477][ T8120] bridge2: entered allmulticast mode [ 257.733918][ T188] rc_core: IR keymap rc-hauppauge not found [ 257.751626][ T188] Registered IR keymap rc-empty [ 257.762157][ T5749] usb 2-1: Using ep0 maxpacket: 16 [ 257.770488][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 257.790209][ T5749] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 257.801915][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 257.821602][ T5749] usb 2-1: config 0 has no interfaces? [ 257.844161][ T5749] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 257.856959][ T188] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 257.859257][ T5749] usb 2-1: Manufacturer: syz [ 257.905908][ T5749] usb 2-1: config 0 descriptor?? [ 257.916048][ T188] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input36 [ 257.986759][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 258.044583][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 258.082021][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 258.122187][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 258.151929][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 258.181933][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 258.201382][ T5620] usb 3-1: USB disconnect, device number 40 [ 258.230003][ T8118] netlink: 4 bytes leftover after parsing attributes in process `syz.1.723'. [ 258.272143][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 258.322882][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 258.367026][ T5749] usb 2-1: USB disconnect, device number 45 [ 258.372967][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 258.391847][ T5708] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 258.400318][ T188] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 258.440324][ T188] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 258.468901][ T188] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 258.539179][ T188] usb 4-1: USB disconnect, device number 41 [ 258.562062][ T5708] usb 5-1: Using ep0 maxpacket: 16 [ 258.595133][ T5708] usb 5-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 258.662190][ T5708] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 258.710638][ T5708] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 258.771877][ T5708] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 258.850304][ T5749] usb 1-1: USB disconnect, device number 29 [ 258.941183][ T5708] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.976898][ T5708] usb 5-1: Product: syz [ 258.997881][ T5708] usb 5-1: Manufacturer: syz [ 259.025959][ T5708] usb 5-1: SerialNumber: syz [ 259.086000][ T5708] usb 5-1: config 0 descriptor?? [ 259.153378][ T8131] bridge2: entered promiscuous mode [ 259.184667][ T5708] mcba_usb 5-1:0.0: Can't find endpoints [ 259.219415][ T8137] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 259.225610][ T8136] fuse: Unknown parameter 'use00000000000000000000' [ 259.747624][ T8148] netlink: 32 bytes leftover after parsing attributes in process `syz.2.731'. [ 259.917485][ T8150] fuse: Bad value for 'fd' [ 260.064788][ T8153] FAULT_INJECTION: forcing a failure. [ 260.064788][ T8153] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 260.111308][ T8153] CPU: 1 UID: 0 PID: 8153 Comm: syz.1.733 Tainted: G L syzkaller #0 PREEMPT(full) [ 260.111331][ T8153] Tainted: [L]=SOFTLOCKUP [ 260.111337][ T8153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 260.111345][ T8153] Call Trace: [ 260.111351][ T8153] [ 260.111358][ T8153] dump_stack_lvl+0xe8/0x150 [ 260.111383][ T8153] should_fail_ex+0x40c/0x560 [ 260.111403][ T8153] _copy_from_user+0x2d/0xb0 [ 260.111425][ T8153] vhost_vsock_dev_ioctl+0x1e9/0xed0 [ 260.111449][ T8153] ? __pfx_vhost_vsock_dev_ioctl+0x10/0x10 [ 260.111469][ T8153] ? __fget_files+0x3a2/0x420 [ 260.111491][ T8153] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 260.111511][ T8153] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 260.111528][ T8153] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 260.111543][ T8153] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 260.111564][ T8153] ? __fget_files+0x3a2/0x420 [ 260.111586][ T8153] ? fput+0xa0/0xd0 [ 260.111603][ T8153] ? ksys_write+0x242/0x270 [ 260.111632][ T8153] __do_fast_syscall_32+0x23e/0x6f0 [ 260.111654][ T8153] ? do_fast_syscall_32+0x33/0x70 [ 260.111673][ T8153] ? lockdep_hardirqs_on+0x7a/0x110 [ 260.111692][ T8153] ? asm_int80_emulation+0x1a/0x20 [ 260.111726][ T8153] ? do_int80_emulation+0x29f/0x550 [ 260.111752][ T8153] ? trace_irq_disable+0x3b/0x140 [ 260.111778][ T8153] do_fast_syscall_32+0x33/0x70 [ 260.111806][ T8153] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.111830][ T8153] RIP: 0023:0xf704f0ec [ 260.111848][ T8153] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 260.111871][ T8153] RSP: 002b:00000000f543d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 260.111891][ T8153] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000004008af00 [ 260.111904][ T8153] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 260.111915][ T8153] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 260.111926][ T8153] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 260.111937][ T8153] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 260.111965][ T8153] [ 260.781819][ T8159] FAULT_INJECTION: forcing a failure. [ 260.781819][ T8159] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 260.800718][ T8159] CPU: 1 UID: 0 PID: 8159 Comm: syz.1.736 Tainted: G L syzkaller #0 PREEMPT(full) [ 260.800750][ T8159] Tainted: [L]=SOFTLOCKUP [ 260.800758][ T8159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 260.800773][ T8159] Call Trace: [ 260.800787][ T8159] [ 260.800796][ T8159] dump_stack_lvl+0xe8/0x150 [ 260.800821][ T8159] should_fail_ex+0x40c/0x560 [ 260.800842][ T8159] _copy_from_user+0x2d/0xb0 [ 260.800871][ T8159] get_compat_msghdr+0xb3/0x4c0 [ 260.800892][ T8159] ? __pfx_get_compat_msghdr+0x10/0x10 [ 260.800919][ T8159] ___sys_sendmsg+0x201/0x360 [ 260.800934][ T8159] ? __lock_acquire+0x683/0x2cf0 [ 260.800956][ T8159] ? __pfx____sys_sendmsg+0x10/0x10 [ 260.800972][ T8159] ? get_pid_task+0x20/0x1f0 [ 260.800991][ T8159] ? get_pid_task+0x20/0x1f0 [ 260.801008][ T8159] ? get_pid_task+0x20/0x1f0 [ 260.801047][ T8159] ? __fget_files+0x2a/0x420 [ 260.801065][ T8159] ? __fget_files+0x3a2/0x420 [ 260.801090][ T8159] __sys_sendmsg+0x177/0x240 [ 260.801107][ T8159] ? __pfx___sys_sendmsg+0x10/0x10 [ 260.801135][ T8159] __do_fast_syscall_32+0x23e/0x6f0 [ 260.801157][ T8159] ? do_fast_syscall_32+0x33/0x70 [ 260.801177][ T8159] ? lockdep_hardirqs_on+0x7a/0x110 [ 260.801195][ T8159] ? asm_int80_emulation+0x1a/0x20 [ 260.801209][ T8159] ? do_int80_emulation+0x29f/0x550 [ 260.801228][ T8159] ? trace_irq_disable+0x3b/0x140 [ 260.801248][ T8159] do_fast_syscall_32+0x33/0x70 [ 260.801269][ T8159] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 260.801286][ T8159] RIP: 0023:0xf704f0ec [ 260.801299][ T8159] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 260.801312][ T8159] RSP: 002b:00000000f543d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 260.801327][ T8159] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 260.801337][ T8159] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 260.801346][ T8159] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 260.801357][ T8159] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 260.801366][ T8159] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 260.801386][ T8159] [ 261.243736][ T8161] netlink: 32 bytes leftover after parsing attributes in process `syz.3.735'. [ 261.461617][ T5749] usb 5-1: USB disconnect, device number 30 [ 261.730389][ T8175] netlink: 32 bytes leftover after parsing attributes in process `syz.4.740'. [ 262.615494][ T8182] FAULT_INJECTION: forcing a failure. [ 262.615494][ T8182] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.633070][ T5749] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 262.666623][ T8182] CPU: 1 UID: 0 PID: 8182 Comm: syz.0.742 Tainted: G L syzkaller #0 PREEMPT(full) [ 262.666646][ T8182] Tainted: [L]=SOFTLOCKUP [ 262.666652][ T8182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 262.666661][ T8182] Call Trace: [ 262.666667][ T8182] [ 262.666673][ T8182] dump_stack_lvl+0xe8/0x150 [ 262.666698][ T8182] should_fail_ex+0x40c/0x560 [ 262.666719][ T8182] _copy_from_iter+0x1d3/0x1660 [ 262.666737][ T8182] ? kmem_cache_alloc_node_noprof+0x1d1/0x610 [ 262.666755][ T8182] ? rcu_is_watching+0x15/0xb0 [ 262.666778][ T8182] ? trace_kmem_cache_alloc+0x29/0xe0 [ 262.666796][ T8182] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 262.666813][ T8182] ? __pfx__copy_from_iter+0x10/0x10 [ 262.666832][ T8182] ? __alloc_skb+0x276/0x7a0 [ 262.666844][ T8182] ? __alloc_skb+0x276/0x7a0 [ 262.666861][ T8182] ? netlink_sendmsg+0x650/0xb40 [ 262.666878][ T8182] ? skb_put+0x112/0x210 [ 262.666894][ T8182] netlink_sendmsg+0x6c0/0xb40 [ 262.666917][ T8182] ? __pfx_netlink_sendmsg+0x10/0x10 [ 262.666937][ T8182] ? aa_sock_msg_perm+0xf1/0x1b0 [ 262.666955][ T8182] ? __pfx_netlink_sendmsg+0x10/0x10 [ 262.666971][ T8182] sock_sendmsg_nosec+0x13a/0x180 [ 262.666994][ T8182] ____sys_sendmsg+0x54e/0x850 [ 262.667014][ T8182] ? __pfx_____sys_sendmsg+0x10/0x10 [ 262.667043][ T8182] ___sys_sendmsg+0x2a5/0x360 [ 262.667058][ T8182] ? __lock_acquire+0x683/0x2cf0 [ 262.667081][ T8182] ? __pfx____sys_sendmsg+0x10/0x10 [ 262.667096][ T8182] ? get_pid_task+0x20/0x1f0 [ 262.667116][ T8182] ? get_pid_task+0x20/0x1f0 [ 262.667133][ T8182] ? get_pid_task+0x20/0x1f0 [ 262.667172][ T8182] ? __fget_files+0x2a/0x420 [ 262.667191][ T8182] ? __fget_files+0x3a2/0x420 [ 262.667216][ T8182] __sys_sendmsg+0x177/0x240 [ 262.667233][ T8182] ? __pfx___sys_sendmsg+0x10/0x10 [ 262.667284][ T8182] __do_fast_syscall_32+0x23e/0x6f0 [ 262.667317][ T8182] ? do_fast_syscall_32+0x33/0x70 [ 262.667337][ T8182] ? lockdep_hardirqs_on+0x7a/0x110 [ 262.667356][ T8182] ? asm_int80_emulation+0x1a/0x20 [ 262.667370][ T8182] ? do_int80_emulation+0x29f/0x550 [ 262.667390][ T8182] ? trace_irq_disable+0x3b/0x140 [ 262.667410][ T8182] do_fast_syscall_32+0x33/0x70 [ 262.667430][ T8182] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 262.667448][ T8182] RIP: 0023:0xf6fef0ec [ 262.667461][ T8182] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 262.667473][ T8182] RSP: 002b:00000000f53dd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 262.667489][ T8182] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 262.667499][ T8182] RDX: 0000000020004000 RSI: 0000000000000000 RDI: 0000000000000000 [ 262.667507][ T8182] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 262.667516][ T8182] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 262.667524][ T8182] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 262.667549][ T8182] [ 263.113338][ T5749] usb 2-1: New USB device found, idVendor=0e41, idProduct=3061, bcdDevice= 0.40 [ 263.124962][ T5749] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 263.135233][ T5749] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 263.148502][ T5749] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 263.156771][ T5749] usb 2-1: Product: syz [ 263.161027][ T5749] usb 2-1: Manufacturer: syz [ 263.165898][ T5749] usb 2-1: SerialNumber: syz [ 263.269145][ T8186] fuse: Unknown parameter 'use00000000000000000000' [ 263.548533][ T5749] usb 2-1: 0:1 : does not exist [ 263.566335][ T5749] usb 2-1: unit 0 not found! [ 263.578650][ T5749] usb 2-1: unit 63 not found! [ 263.682363][ T5749] usb 2-1: USB disconnect, device number 46 [ 263.811176][ T5685] udevd[5685]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 264.192120][ T188] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 264.372119][ T188] usb 4-1: Using ep0 maxpacket: 32 [ 264.444371][ T188] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 264.468720][ T188] usb 4-1: config 0 has an invalid interface number: 85 but max is 0 [ 264.480543][ T188] usb 4-1: config 0 has no interface number 0 [ 264.488567][ T188] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 264.500112][ T188] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 264.511300][ T188] usb 4-1: config 0 interface 85 has no altsetting 0 [ 264.543808][ T188] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.553717][ T188] usb 4-1: Product: syz [ 264.558957][ T188] usb 4-1: Manufacturer: syz [ 264.567952][ T188] usb 4-1: SerialNumber: syz [ 264.591052][ T188] usb 4-1: config 0 descriptor?? [ 264.815755][ T188] appletouch 4-1:0.85: Failed to read mode from device. [ 264.836207][ T8221] netlink: 32 bytes leftover after parsing attributes in process `syz.0.755'. [ 264.847072][ T188] appletouch 4-1:0.85: probe with driver appletouch failed with error -5 [ 265.031372][ T188] usb 4-1: USB disconnect, device number 42 [ 265.698457][ T8225] fuse: Unknown parameter 'user_i00000000000000000000' [ 266.251936][ T5749] usb 3-1: new full-speed USB device number 41 using dummy_hcd [ 266.428202][ T5749] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 266.454057][ T5749] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x6 has an invalid bInterval 0, changing to 4 [ 266.493654][ T5749] usb 3-1: config 0 interface 0 has no altsetting 0 [ 266.528740][ T5749] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 266.539001][ T5749] usb 3-1: Product: syz [ 266.544636][ T5749] usb 3-1: Manufacturer: syz [ 266.549589][ T5749] usb 3-1: SerialNumber: syz [ 266.608894][ T5749] usb 3-1: config 0 descriptor?? [ 266.674656][ T5749] usb 3-1: selecting invalid altsetting 0 [ 266.972048][ T5708] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 266.988767][ T8251] netlink: 32 bytes leftover after parsing attributes in process `syz.3.763'. [ 267.028077][ T8231] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 267.062587][ T8231] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 267.090816][ T5749] usb 3-1: USB disconnect, device number 41 [ 267.097704][ C1] ================================================================== [ 267.105792][ C1] BUG: KASAN: use-after-free in qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 267.113789][ C1] Read of size 2 at addr ffff88817b9e5734 by task syz.0.764/8252 [ 267.121507][ C1] [ 267.123834][ C1] CPU: 1 UID: 0 PID: 8252 Comm: syz.0.764 Tainted: G L syzkaller #0 PREEMPT(full) [ 267.123855][ C1] Tainted: [L]=SOFTLOCKUP [ 267.123861][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 267.123870][ C1] Call Trace: [ 267.123876][ C1] [ 267.123882][ C1] dump_stack_lvl+0xe8/0x150 [ 267.123904][ C1] print_address_description+0x55/0x1e0 [ 267.123925][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 267.123943][ C1] print_report+0x58/0x70 [ 267.123959][ C1] kasan_report+0x117/0x150 [ 267.123981][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 267.124001][ C1] qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 267.124024][ C1] __dev_queue_xmit+0x27f/0x3820 [ 267.124040][ C1] ? lock_acquire+0x106/0x350 [ 267.124060][ C1] ? __lock_acquire+0x683/0x2cf0 [ 267.124082][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 267.124101][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 267.124121][ C1] ? __pfx___dev_queue_xmit+0x10/0x10 [ 267.124140][ C1] ? __lock_acquire+0x683/0x2cf0 [ 267.124165][ C1] ? br_nf_post_routing+0xf0/0xee0 [ 267.124187][ C1] br_dev_queue_push_xmit+0x370/0x4b0 [ 267.124204][ C1] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 267.124220][ C1] NF_HOOK+0x360/0x3f0 [ 267.124234][ C1] ? net_generic+0x1e/0x240 [ 267.124251][ C1] ? NF_HOOK+0xa2/0x3f0 [ 267.124265][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 267.124280][ C1] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 267.124300][ C1] br_forward_finish+0xd3/0x130 [ 267.124315][ C1] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 267.124330][ C1] ? __pfx_br_forward_finish+0x10/0x10 [ 267.124346][ C1] NF_HOOK+0x360/0x3f0 [ 267.124362][ C1] ? NF_HOOK+0xa2/0x3f0 [ 267.124376][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 267.124391][ C1] ? __pfx_br_forward_finish+0x10/0x10 [ 267.124408][ C1] ? br_switchdev_frame_uses_tx_fwd_offload+0x14/0x70 [ 267.124429][ C1] ? br_handle_vlan+0x3dc/0x530 [ 267.124453][ C1] __br_forward+0x397/0x540 [ 267.124467][ C1] ? __pfx_br_forward_finish+0x10/0x10 [ 267.124484][ C1] br_flood+0x3e6/0x8d0 [ 267.124503][ C1] br_handle_frame_finish+0x1175/0x1990 [ 267.124526][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 267.124545][ C1] ? net_generic+0x1e/0x240 [ 267.124561][ C1] ? net_generic+0x1e/0x240 [ 267.124576][ C1] ? net_generic+0x1e/0x240 [ 267.124592][ C1] ? br_nf_pre_routing_finish_bridge+0x7d1/0xb60 [ 267.124612][ C1] ? br_nf_pre_routing+0xc41/0x14b0 [ 267.124645][ C1] br_handle_frame+0x81b/0x1510 [ 267.124665][ C1] ? __pfx_br_handle_frame+0x10/0x10 [ 267.124683][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 267.124703][ C1] ? __pfx_br_handle_frame+0x10/0x10 [ 267.124720][ C1] __netif_receive_skb_core+0x989/0x30b0 [ 267.124741][ C1] ? __kasan_check_byte+0x12/0x40 [ 267.124761][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 267.124784][ C1] ? rcu_is_watching+0x15/0xb0 [ 267.124803][ C1] ? __kasan_check_byte+0x12/0x40 [ 267.124823][ C1] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 267.124842][ C1] ? lock_release+0x4b/0x3c0 [ 267.124858][ C1] ? lock_release+0x4b/0x3c0 [ 267.124879][ C1] ? __lock_acquire+0x683/0x2cf0 [ 267.124897][ C1] ? __kernel_text_address+0xd/0x30 [ 267.124918][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 267.124937][ C1] __netif_receive_skb_list_core+0x24d/0x830 [ 267.124961][ C1] ? __pfx___netif_receive_skb_list_core+0x10/0x10 [ 267.124985][ C1] netif_receive_skb_list_internal+0x995/0xcf0 [ 267.125005][ C1] ? netif_receive_skb_list_internal+0x501/0xcf0 [ 267.125025][ C1] ? __pfx_netif_receive_skb_list_internal+0x10/0x10 [ 267.125064][ C1] ? dev_gro_receive+0x1097/0x2380 [ 267.125083][ C1] napi_complete_done+0x299/0x730 [ 267.125104][ C1] ? __pfx_napi_complete_done+0x10/0x10 [ 267.125125][ C1] ? gro_cell_poll+0x175/0x5d0 [ 267.125149][ C1] gro_cell_poll+0x5ab/0x5d0 [ 267.125174][ C1] ? gro_cell_poll+0x175/0x5d0 [ 267.125196][ C1] __napi_poll+0xaa/0x330 [ 267.125217][ C1] net_rx_action+0x61d/0xf50 [ 267.125242][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 267.125263][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 267.125285][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 267.125309][ C1] handle_softirqs+0x225/0x840 [ 267.125326][ C1] ? do_softirq+0x76/0xd0 [ 267.125342][ C1] ? tun_rx_batched+0x185/0x790 [ 267.125362][ C1] do_softirq+0x76/0xd0 [ 267.125377][ C1] [ 267.125382][ C1] [ 267.125387][ C1] __local_bh_enable_ip+0xf8/0x130 [ 267.125401][ C1] ? tun_rx_batched+0x185/0x790 [ 267.125420][ C1] tun_rx_batched+0x616/0x790 [ 267.125442][ C1] ? __pfx_tun_rx_batched+0x10/0x10 [ 267.125461][ C1] ? tun_get_user+0x2717/0x4370 [ 267.125481][ C1] ? tun_get_user+0x2717/0x4370 [ 267.125501][ C1] ? tun_get_user+0x23cb/0x4370 [ 267.125520][ C1] ? tun_get_user+0x23cb/0x4370 [ 267.125538][ C1] ? __local_bh_enable_ip+0xd0/0x130 [ 267.125553][ C1] ? tun_get_user+0x2717/0x4370 [ 267.125572][ C1] ? tun_get_user+0x2717/0x4370 [ 267.125590][ C1] tun_get_user+0x2b44/0x4370 [ 267.125615][ C1] ? aa_file_perm+0x18b/0x15f0 [ 267.125632][ C1] ? aa_file_perm+0x4ed/0x15f0 [ 267.125646][ C1] ? __pfx_tun_get_user+0x10/0x10 [ 267.125665][ C1] ? __lock_acquire+0x683/0x2cf0 [ 267.125685][ C1] ? __pfx___futex_wait+0x10/0x10 [ 267.125703][ C1] ? ref_tracker_alloc+0x341/0x4b0 [ 267.125722][ C1] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 267.125740][ C1] ? tun_get+0x1c/0x2f0 [ 267.125758][ C1] ? tun_get+0x1c/0x2f0 [ 267.125784][ C1] ? tun_get+0x1c/0x2f0 [ 267.125802][ C1] ? tun_get+0x1c/0x2f0 [ 267.125821][ C1] tun_chr_write_iter+0x113/0x200 [ 267.125842][ C1] vfs_write+0x612/0xba0 [ 267.125866][ C1] ? __pfx_vfs_write+0x10/0x10 [ 267.125890][ C1] ? __fget_files+0x2a/0x420 [ 267.125911][ C1] ksys_write+0x150/0x270 [ 267.125933][ C1] ? __pfx_ksys_write+0x10/0x10 [ 267.125957][ C1] __do_fast_syscall_32+0x23e/0x6f0 [ 267.125979][ C1] ? do_fast_syscall_32+0x33/0x70 [ 267.125999][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 267.126017][ C1] ? irqentry_exit+0x10f/0x8f0 [ 267.126036][ C1] ? trace_irq_disable+0x3b/0x140 [ 267.126054][ C1] do_fast_syscall_32+0x33/0x70 [ 267.126077][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 267.126095][ C1] RIP: 0023:0xf6fef0ec [ 267.126109][ C1] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 267.126121][ C1] RSP: 002b:00000000f53bc50c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 267.126137][ C1] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800004c0 [ 267.126147][ C1] RDX: 000000000000007a RSI: 0000000000000000 RDI: 0000000000000000 [ 267.126156][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 267.126164][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 267.126173][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 267.126188][ C1] [ 267.126193][ C1] [ 267.205186][ T5708] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 267.207529][ C1] The buggy address belongs to the physical page: [ 267.207556][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17b9e5 [ 267.828048][ C1] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 267.835286][ C1] raw: 057ff00000000000 ffffea0005ee7948 ffffea0005ee7948 0000000000000000 [ 267.843870][ C1] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 267.852448][ C1] page dumped because: kasan: bad access detected [ 267.858879][ C1] page_owner info is not present (never set?) [ 267.864936][ C1] [ 267.867255][ C1] Memory state around the buggy address: [ 267.872889][ C1] ffff88817b9e5600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 267.880945][ C1] ffff88817b9e5680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 267.889019][ C1] >ffff88817b9e5700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 267.897072][ C1] ^ [ 267.902700][ C1] ffff88817b9e5780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 267.910764][ C1] ffff88817b9e5800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 267.918820][ C1] ================================================================== [ 267.926970][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 267.934187][ C1] CPU: 1 UID: 0 PID: 8252 Comm: syz.0.764 Tainted: G L syzkaller #0 PREEMPT(full) [ 267.944976][ C1] Tainted: [L]=SOFTLOCKUP [ 267.949298][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 267.959354][ C1] Call Trace: [ 267.962662][ C1] [ 267.965507][ C1] vpanic+0x56c/0xa60 [ 267.969511][ C1] ? rcu_is_watching+0x15/0xb0 [ 267.974283][ C1] ? __pfx_vpanic+0x10/0x10 [ 267.978794][ C1] panic+0xc5/0xd0 [ 267.982523][ C1] ? __pfx_panic+0x10/0x10 [ 267.986947][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 267.992585][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 267.998252][ C1] check_panic_on_warn+0x89/0xb0 [ 268.003209][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 268.008850][ C1] end_report+0x73/0x170 [ 268.013105][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 268.018749][ C1] kasan_report+0x128/0x150 [ 268.023266][ C1] ? qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 268.028916][ C1] qdisc_pkt_len_segs_init+0x7f7/0xa30 [ 268.034400][ C1] __dev_queue_xmit+0x27f/0x3820 [ 268.039347][ C1] ? lock_acquire+0x106/0x350 [ 268.044034][ C1] ? __lock_acquire+0x683/0x2cf0 [ 268.048985][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 268.054455][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 268.059670][ C1] ? __pfx___dev_queue_xmit+0x10/0x10 [ 268.065061][ C1] ? __lock_acquire+0x683/0x2cf0 [ 268.070019][ C1] ? br_nf_post_routing+0xf0/0xee0 [ 268.075161][ C1] br_dev_queue_push_xmit+0x370/0x4b0 [ 268.080542][ C1] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 268.086529][ C1] NF_HOOK+0x360/0x3f0 [ 268.090618][ C1] ? net_generic+0x1e/0x240 [ 268.095147][ C1] ? NF_HOOK+0xa2/0x3f0 [ 268.099319][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 268.103924][ C1] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 268.109822][ C1] br_forward_finish+0xd3/0x130 [ 268.114695][ C1] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 268.120603][ C1] ? __pfx_br_forward_finish+0x10/0x10 [ 268.126081][ C1] NF_HOOK+0x360/0x3f0 [ 268.130167][ C1] ? NF_HOOK+0xa2/0x3f0 [ 268.134349][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 268.138958][ C1] ? __pfx_br_forward_finish+0x10/0x10 [ 268.144427][ C1] ? br_switchdev_frame_uses_tx_fwd_offload+0x14/0x70 [ 268.151227][ C1] ? br_handle_vlan+0x3dc/0x530 [ 268.156088][ C1] __br_forward+0x397/0x540 [ 268.160594][ C1] ? __pfx_br_forward_finish+0x10/0x10 [ 268.166070][ C1] br_flood+0x3e6/0x8d0 [ 268.170236][ C1] br_handle_frame_finish+0x1175/0x1990 [ 268.175792][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 268.181686][ C1] ? net_generic+0x1e/0x240 [ 268.186225][ C1] ? net_generic+0x1e/0x240 [ 268.190735][ C1] ? net_generic+0x1e/0x240 [ 268.195239][ C1] ? br_nf_pre_routing_finish_bridge+0x7d1/0xb60 [ 268.201573][ C1] ? br_nf_pre_routing+0xc41/0x14b0 [ 268.206777][ C1] br_handle_frame+0x81b/0x1510 [ 268.211639][ C1] ? __pfx_br_handle_frame+0x10/0x10 [ 268.216925][ C1] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 268.222822][ C1] ? __pfx_br_handle_frame+0x10/0x10 [ 268.228110][ C1] __netif_receive_skb_core+0x989/0x30b0 [ 268.233762][ C1] ? __kasan_check_byte+0x12/0x40 [ 268.238828][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 268.244040][ C1] ? rcu_is_watching+0x15/0xb0 [ 268.248908][ C1] ? __kasan_check_byte+0x12/0x40 [ 268.253956][ C1] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 268.260051][ C1] ? lock_release+0x4b/0x3c0 [ 268.264651][ C1] ? lock_release+0x4b/0x3c0 [ 268.269252][ C1] ? __lock_acquire+0x683/0x2cf0 [ 268.274316][ C1] ? __kernel_text_address+0xd/0x30 [ 268.279534][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 268.285698][ C1] __netif_receive_skb_list_core+0x24d/0x830 [ 268.291703][ C1] ? __pfx___netif_receive_skb_list_core+0x10/0x10 [ 268.298334][ C1] netif_receive_skb_list_internal+0x995/0xcf0 [ 268.304516][ C1] ? netif_receive_skb_list_internal+0x501/0xcf0 [ 268.310863][ C1] ? __pfx_netif_receive_skb_list_internal+0x10/0x10 [ 268.317544][ C1] ? dev_gro_receive+0x1097/0x2380 [ 268.322859][ C1] napi_complete_done+0x299/0x730 [ 268.327908][ C1] ? __pfx_napi_complete_done+0x10/0x10 [ 268.333487][ C1] ? gro_cell_poll+0x175/0x5d0 [ 268.338303][ C1] gro_cell_poll+0x5ab/0x5d0 [ 268.342908][ C1] ? gro_cell_poll+0x175/0x5d0 [ 268.347682][ C1] __napi_poll+0xaa/0x330 [ 268.353147][ C1] net_rx_action+0x61d/0xf50 [ 268.357763][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 268.362882][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 268.368087][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 268.373378][ C1] handle_softirqs+0x225/0x840 [ 268.378142][ C1] ? do_softirq+0x76/0xd0 [ 268.382658][ C1] ? tun_rx_batched+0x185/0x790 [ 268.387516][ C1] do_softirq+0x76/0xd0 [ 268.391672][ C1] [ 268.394629][ C1] [ 268.397559][ C1] __local_bh_enable_ip+0xf8/0x130 [ 268.402675][ C1] ? tun_rx_batched+0x185/0x790 [ 268.407529][ C1] tun_rx_batched+0x616/0x790 [ 268.412216][ C1] ? __pfx_tun_rx_batched+0x10/0x10 [ 268.417423][ C1] ? tun_get_user+0x2717/0x4370 [ 268.422274][ C1] ? tun_get_user+0x2717/0x4370 [ 268.427130][ C1] ? tun_get_user+0x23cb/0x4370 [ 268.431989][ C1] ? tun_get_user+0x23cb/0x4370 [ 268.436870][ C1] ? __local_bh_enable_ip+0xd0/0x130 [ 268.442179][ C1] ? tun_get_user+0x2717/0x4370 [ 268.447092][ C1] ? tun_get_user+0x2717/0x4370 [ 268.451972][ C1] tun_get_user+0x2b44/0x4370 [ 268.456662][ C1] ? aa_file_perm+0x18b/0x15f0 [ 268.461445][ C1] ? aa_file_perm+0x4ed/0x15f0 [ 268.466208][ C1] ? __pfx_tun_get_user+0x10/0x10 [ 268.471255][ C1] ? __lock_acquire+0x683/0x2cf0 [ 268.476282][ C1] ? __pfx___futex_wait+0x10/0x10 [ 268.481331][ C1] ? ref_tracker_alloc+0x341/0x4b0 [ 268.486461][ C1] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 268.491942][ C1] ? tun_get+0x1c/0x2f0 [ 268.496205][ C1] ? tun_get+0x1c/0x2f0 [ 268.500372][ C1] ? tun_get+0x1c/0x2f0 [ 268.504532][ C1] ? tun_get+0x1c/0x2f0 [ 268.508712][ C1] tun_chr_write_iter+0x113/0x200 [ 268.513753][ C1] vfs_write+0x612/0xba0 [ 268.518020][ C1] ? __pfx_vfs_write+0x10/0x10 [ 268.522810][ C1] ? __fget_files+0x2a/0x420 [ 268.527415][ C1] ksys_write+0x150/0x270 [ 268.531779][ C1] ? __pfx_ksys_write+0x10/0x10 [ 268.536668][ C1] __do_fast_syscall_32+0x23e/0x6f0 [ 268.541882][ C1] ? do_fast_syscall_32+0x33/0x70 [ 268.546915][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 268.552127][ C1] ? irqentry_exit+0x10f/0x8f0 [ 268.556899][ C1] ? trace_irq_disable+0x3b/0x140 [ 268.561927][ C1] do_fast_syscall_32+0x33/0x70 [ 268.566787][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 268.573119][ C1] RIP: 0023:0xf6fef0ec [ 268.577186][ C1] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 268.596798][ C1] RSP: 002b:00000000f53bc50c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 268.605218][ C1] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800004c0 [ 268.613189][ C1] RDX: 000000000000007a RSI: 0000000000000000 RDI: 0000000000000000 [ 268.621159][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 268.629126][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 268.637100][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 268.645083][ C1] [ 268.648705][ C1] Kernel Offset: disabled [ 268.653041][ C1] Rebooting in 86400 seconds..