last executing test programs: 9.313065541s ago: executing program 0 (id=2622): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x80ff, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) 9.295130564s ago: executing program 2 (id=2623): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x9, 0x81, &(0x7f0000000280)="1a0000000212a277", 0x8) r1 = syz_io_uring_setup(0x2a4, &(0x7f0000000040)={0x0, 0xbf59, 0x10000, 0x3, 0x2d0}, &(0x7f0000000440), &(0x7f00000003c0)) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1, 0xa, 0x8, 0x8, 0x40}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f00000004c0), 0xce, r2}, 0x38) syz_usb_connect(0x3, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x3a, 0xa4, 0x70, 0x20, 0xb57, 0xfcbb, 0x56b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x58, 0x0, [{{0x9, 0x4, 0x86, 0x0, 0x0, 0x3, 0x1, 0x2, 0x6}}]}}]}}, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r2, 0x0, &(0x7f0000000280)=""/201}, 0x20) io_uring_enter(r1, 0x7b20, 0xe93c, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='fdinfo/3\x00') read$FUSE(r3, &(0x7f0000000480)={0x2020}, 0x2020) syz_usb_connect(0x0, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100004366b408c70b0800c84f0102030109022d00010000000009040000032eb47d000905f9ffffff00000009050f47"], 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback, 0x20}], 0x1c) r4 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140), 0x38181, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) connect$can_j1939(r5, &(0x7f0000000140)={0x1d, r6, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18) r7 = fcntl$dupfd(r1, 0x0, r3) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000024c0)={0x1b, 0x0, 0x0, 0x2, 0x0, r4, 0xe4, '\x00', r6, r7, 0x1, 0x4, 0x5}, 0x50) sendto$inet6(r0, &(0x7f0000000080)="b1", 0x1, 0x4000050, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback, 0xfffffe01}, 0x1c) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000100), &(0x7f0000000200)=0x8) 8.554866534s ago: executing program 2 (id=2629): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x2, 0x96, 0xd1, 0xca, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0xd, 0x0, 0x6}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, &(0x7f0000000580)=ANY=[@ANYBLOB="0d1704000011580e5e715f9d16013e8987c10f05e8a866cbbfcd23c9c6c3b1930fdb69f28145664655d74b3223d6df12b1ff651f43cf067e1ad99f253f0eb6a8341e8295604766a6c4e1d21a418eb12a0945450ae6e65e0ee61931f0397f04e211414c64cf4e5c948d4609f9bed1846aa4e5a6e16132acc5c47356eda5a48790119ab63ae3a335ea303fa1e970f84e35671fbdb27c911c6104cd08f96e6bd2128037f5ea42cfcaf530ca8fe0f43b8324d3b3798e36d9f46d3cccf92ed36ff3732d68b926c0e2cdb3610ecd432c644080e35b7052f562e0bca7c10f1fa296815b8be06cec0a720e2e7da7faf27ee83636a7f5ad8dfada76198e91ee2e402f174242efaf03391a3a5ec8d8da7a83f5e5c32bc934ee9b6331e3ff871fc3030ff12c9971e13e061b2782abe821ca89a79b7c22200d82ed324922204f43482d40d7ca079a9d9ba779beb49eba347db948481f2dd7f61c2ba6b0fd48c4f5db94309ac204fa456642"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000500)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa802, 0x0) close(r2) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0xb, 0xd}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) recvmmsg(r5, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000002ac0)=""/227, 0xe3}, {&(0x7f0000000400)=""/92, 0x5c}, {&(0x7f0000002bc0)=""/4096, 0x1000}, {&(0x7f00000002c0)=""/192, 0xc0}, {&(0x7f0000003cc0)=""/204, 0xcc}], 0x5}, 0x9}], 0x1, 0x10022, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="200104"], 0x0, 0x0}) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r6) read$char_usb(r7, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000013c0)={0x44, &(0x7f00000011c0)={0x20, 0x14, 0x4, "0426fd98"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000fc0)={0x84, &(0x7f0000000c80)=ANY=[@ANYBLOB="0800000600000d000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001200)={0x84, &(0x7f0000000f00)={0x0, 0x14, 0x4, "42467af9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 8.331387571s ago: executing program 0 (id=2630): syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = socket(0x10, 0x803, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x44, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x24, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'syz_tun\x00'}]}]}]}], {0x14}}, 0x6c}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000140)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c6dd00", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x89, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x4100}}}}}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)=@newlink={0x38, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x40083}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @broadcast}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x4840) r4 = memfd_create(&(0x7f0000000400)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\xd1x4]PZ\x9e\xd5Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\x97\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev\x15h$\x01\xdd\xe5\xce\xf8*\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xa2\xab\xf6\x84\xe0\xcf1\x9a', 0x0) execveat(r4, 0x0, 0x0, 0x0, 0x1000) creat(&(0x7f0000000000)='./file0\x00', 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/custom1\x00', 0x402, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000100)) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x89}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1, 0x10ffff, 0xfffffffd, 0x1}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r7, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e22, 0x7a, @mcast2, 0x1}}, 0x0, 0x0, 0x222, 0x0, "bb353738cb473fc7c9f1cf53b6a7b4e23602a3c364ca41d6e5615445244740bd4c0b42a21d7214bf92594925208a0e2f34a6324d4993fcf19b2df3ee818a118a7c49462189316d556d2ccd00"}, 0xd8) inotify_add_watch(0xffffffffffffffff, 0x0, 0x2000434) r8 = syz_open_procfs(0x0, 0x0) getdents(r8, 0x0, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="64000000020605000a0000000000000000000000100003006269746d61703a706f72740005000400010000000900020073797a3000000000050005000000000005000100060000001c000780060004401c020000060005400003000008000640"], 0x64}}, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000600)={'pcl812\x00', [0x4f27, 0x2, 0x3, 0xc466, 0x4, 0xcc7, 0xc9, 0x5c952399, 0x5, 0xffc, 0x802, 0x1607, 0x1, 0x41, 0x9, 0xffffffff, 0x6dd5, 0x4, 0x0, 0x2, 0x8, 0xfffffffd, 0xfffffffd, 0xfffffff5, 0x475c, 0x1, 0x10002, 0x8, 0x0, 0x8000000, 0x6]}) 8.138424381s ago: executing program 0 (id=2631): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@alu={0x7, 0x0, 0x9, 0x0, 0x0, 0x1, 0xffffffffffffffff}]}, &(0x7f0000001a40)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400000}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) mount(0x0, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000500)='autofs\x00', 0x0, &(0x7f0000000280)='gid=0,no9\xe1\x12 \x91\xfdP\x83\x0e\xb9G!8\xb0\x89\x99\x81\x02\x85\x1cE\b\x9f\x0f8-\xf6\xa4 \x99\x8d\x1d\x8a\xc7\xc5\x96\xe8Ee\xd5\xac\x18(\x9d\tIr\xdd\\\x95\x9eu}\x06ib\x88\x8c\x9d\xde\xeaT0;\xb4\x1f\x8cm\x15y\xb4[Gc\xaf\xee#\xcf>Qk\xcf\xfc\x12bY\xfc&\x93\xe0\xcc#\x93w\x84@/VV\xbc\x0eL\xeb~1\x832\xa7\xf7l\x1b\xffh\x96O\x84h\x1b\'\x15\xae\xc8\xfbrK1\x1b\x82\\kU{!\x8fe\xbd\xfa\xf3\xac\xdc\x9a7\xbb\xdf\xdf\n\xc4U\xfa\x15\x03e\xe2[\xa6\xd3\xce%\b#s\x05\x00\x00\xc0\x03\x84\x0e\xc3\x0e\xce\x1e\xe4\xc8\xd4s\xd8\xe4W\x8a\x18j\xc4S\xbf\xc9\xcc1\x87\xa0\f\x91/\x8b\a\xdd\x1bj\xff\xae\xfcJM\x9b\xc3\xe6q\xc1T\x19\xa9,\xef\x8ax\xbb\x18\xe7\x99\xff\x10\x15S\x19\'?\xfbt/\x86\xc6\xd3\xb2c\xc4*\x06\x05NT\xaa_\x97\xda8\xc8\xd0\x8d\x87Yk\xa1\x83\x9f\x86.[\x83\xdf&\x13\xcc\xb9\x01`D7R\xb7o\xa1\x1e\xffD#\t\x18i\xed\xa4<\x9c\x02\x00\x82\xbd\x93\x9e+\x03\xc6w?\x83\x05\x0e\xf3TB]\xc0V\x1b\xf3\xfe\xe1s1r\xcb\xbc9\x19#3k\xd4#r\x9e=C\xd6k\xf89S\xb3\xf4\x84\xd8)\x17L\xeb\xf4\xf3iW\xe6\x9b\x8a\x13\x01\x0ej\x88N\xb5\xf7e;\xdd\xe1\xfc\x9c\x8a\xae>=n\xb3\x12\x7f\x94\x19~\x93\x92xK\x9b\x9e\xa6\x9e\x16v\"e\xe80\xa3%oS\xb4\xad\xb1\xb6\xe0\xef\x1fy\xf2\x1aN\xd7\xee\\*6\xa6\x8e\x84 \xc5\xc0\xd4/\x0eVg\xc1\xd9\xcb\xdc\xc7p)1\x00u\xa5\x8c\n\x91l\xef\x17\xfc\xc2\xef\xb9\x03\b*\x1c\xc6\xe8\x9a\xe0o\xba\x1d {%\x904\xa2\x8f\xed\xca%Z\x1a#\xddA7\x1b\xdf\xd5]\xc6\x0f\x9a\xf5)g\x8c\x98\x9e\xe6\x9b\xbd\x96\xc3\xb6}3\x98r\\.o\xe0\xee\x1d\x80\x0f\x8c\xa0%>]\x9a{=\xdd\x80\x13.\x96\xf9]u\x96P\xdb+A\xaa\xce\x9dP\xde\v\x16\x1d\x05\xbe\xd3\x8c\x99\xb2\x1b\xccX\xfdy\x05\xb0Q]bB') sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) getdents(0xffffffffffffffff, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x41, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) r5 = syz_open_dev$vcsa(&(0x7f00000004c0), 0x2, 0x108c0) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r5, 0x330f, 0x6) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000ac0)=@newqdisc={0x38, 0x24, 0xd0f, 0x70bd2c, 0x25dfdbfb, {0x60, 0x0, 0x0, r4, {0x0, 0xc}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0xbe5b}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0xc010) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x1}], 0x1}, 0x4000855) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$CEC_RECEIVE(0xffffffffffffffff, 0xc0386106, &(0x7f0000000180)={0x2, 0x1, 0x0, 0x6, 0x0, 0x0, "5debca561a5fbf61048955f6f876b2ff", 0x0, 0x0, 0x0, 0x0, 0x1}) r6 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000800)={r6, r6, r6}, 0x0, 0x0, &(0x7f0000000480)={&(0x7f00000000c0)={'sha384\x00'}}) 6.189857405s ago: executing program 0 (id=2638): syz_usb_connect(0x2, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x73, 0x86, 0x40, 0x20, 0xc72, 0x14, 0x39ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0xa, [{{0x9, 0x4, 0x1d, 0xf3, 0x0, 0x71, 0x6c, 0x75}}]}}]}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f815108f6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5", 0x144}], 0x1}, 0xff00) r0 = io_uring_setup(0x4117, &(0x7f0000000540)={0x0, 0xb152, 0x80, 0x3, 0x304}) io_uring_register$IORING_UNREGISTER_RING_FDS(r0, 0x25, &(0x7f00000032c0)=[{0x0, 0x1, 0x0, 0x0, 0x0}], 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) socket$can_raw(0x1d, 0x3, 0x1) sendmsg$NFC_CMD_DISABLE_SE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x14, 0x0, 0x1, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0x4000) 5.921332063s ago: executing program 4 (id=2641): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000180)={r0, &(0x7f0000000080)='-\x1b&-)#-{(\x00', 0x20380, &(0x7f00000000c0)={@align=0x2, {0xb97b, 0x8, 0x2, 0x1ff}}, 0x49e619c6, &(0x7f0000000100), &(0x7f0000000140)=0x10001}) readahead(r0, 0x81, 0xffff) syz_usb_connect(0x1, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x70, 0x61, 0xd1, 0x8, 0x830, 0x60, 0x2d89, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x2, 0x90, 0x4e, [{{0x9, 0x4, 0x35, 0x1, 0x0, 0xf3, 0x56, 0x8f, 0x9}}]}}]}}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) socket$nl_netfilter(0x10, 0x3, 0xc) (async) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000180)={r0, &(0x7f0000000080)='-\x1b&-)#-{(\x00', 0x20380, &(0x7f00000000c0)={@align=0x2, {0xb97b, 0x8, 0x2, 0x1ff}}, 0x49e619c6, &(0x7f0000000100), &(0x7f0000000140)=0x10001}) (async) readahead(r0, 0x81, 0xffff) (async) syz_usb_connect(0x1, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x70, 0x61, 0xd1, 0x8, 0x830, 0x60, 0x2d89, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x2, 0x90, 0x4e, [{{0x9, 0x4, 0x35, 0x1, 0x0, 0xf3, 0x56, 0x8f, 0x9}}]}}]}}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) (async) 4.772434231s ago: executing program 1 (id=2646): r0 = openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a73a5aba55a87d2a2525295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507acd92c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd100962db9a83ad63a4e7e1ca17c1b6aac63fefa9bebe429d00"}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x44004000) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000000)=ANY=[@ANYRES64=r0], 0x16c4}, 0x1, 0x0, 0x0, 0x4004850}, 0x24004840) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) mount$9p_virtio(0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0b000000080000000c0000000300000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000e00"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448de, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x3, r3}, 0x38) socket$vsock_stream(0x28, 0x1, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) r5 = socket(0x2, 0x2, 0x1) r6 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x1, 0x6) fchdir(r7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x60840, 0x8) io_setup(0x2e, &(0x7f0000000200)=0x0) io_submit(r9, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r8, 0x0, 0xf00f, 0x4000000, 0x0, 0x0, r8}]) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000140)="280320000a00140000007ef506be00000000000000000000000000143baa111f1f858ce632f47042195eb3cf545a41b6d78839980700e67bee78895e16f37fe8", 0x40, 0x400c010, &(0x7f00000000c0)={0x11, 0x3, r10, 0x1, 0xe5, 0x6, @multicast}, 0x14) 4.718944053s ago: executing program 3 (id=2647): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000025300)=""/102392, 0x18ff8) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x80, 0x0, &(0x7f0000001080)) ioctl$MEDIA_IOC_ENUM_LINKS(0xffffffffffffffff, 0xc0287c02, &(0x7f0000000180)={0x80000000, 0x0, 0x0}) add_key$user(&(0x7f00000003c0), 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$int_in(r1, 0x5452, &(0x7f0000000280)=0xffffffffffffffff) sendto$inet6(r1, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r1, 0x1) 4.34595534s ago: executing program 4 (id=2648): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000001340)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000f000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000001380)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b8000000000f23c00f21f835010003000f23f8ee6a6c2f800000c00f3266bac0000f3066b808008ed0660f38806f000701c8", 0x4c}], 0x1, 0x8, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000780)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x3, 0xc}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x10, 0x0, 0x0, 0x2}]}}, 0x0, 0x42}, 0x28) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x400000036, 0x40000000788, 0x80000000402, 0x183, 0x400000004, 0x0, 0xee, 0x0, 0x100000000, 0x100000001, 0x10000, 0x6, 0xf, 0xd99, 0x0, 0x10000ab], 0x8000000, 0x1d5250}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000180)=0x6f) read$dsp(0xffffffffffffffff, &(0x7f00000002c0)=""/4096, 0x1000) write$dsp(r1, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f0000001440)=ANY=[@ANYBLOB="9c000000", @ANYRES16=0x0, @ANYBLOB="000426bd7000fedbdf250e00000008000500040000ef420922830c7abbb40e9c000800060000000000080006000600000008000400f100000008000400d7a711320800040000000000500016801400010020010000000000000000000000000000080005007800000006000e004e20000006000e004e200a0006000b00020000000800040058300000080006000300000008000600050000000800040007000000"], 0x9c}, 0x1, 0x0, 0x0, 0x44000}, 0x4000040) syz_open_procfs(0x0, &(0x7f00000000c0)='net/anycast6\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000006, 0x8031, 0xffffffffffffffff, 0x808f0000) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x3}}]}, 0x34}}, 0x0) 3.818464845s ago: executing program 1 (id=2649): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1, 0x0, 0x0}) r3 = signalfd4(r0, &(0x7f0000000000)={[0xe]}, 0x8, 0x80000) r4 = socket$unix(0x1, 0x5, 0x0) bind$unix(r4, &(0x7f0000000140)=@abs={0x1}, 0x6e) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000002c0)={0xc, 0x0, 0x0}) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f00000016c0)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r0, 0x3ba0, &(0x7f00000001c0)={0x79, 0xa, r2, 0x0, r5}) 3.769864368s ago: executing program 3 (id=2650): ioctl$DRM_IOCTL_GET_CAP(0xffffffffffffffff, 0xc010640c, &(0x7f0000000040)={0x15}) 2.938229384s ago: executing program 1 (id=2651): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x30, 0x10, 0x401, 0x4, 0x0, {0x0, 0x0, 0x0, 0x0, 0x503}, [@IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0xb8}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000004) 2.661980791s ago: executing program 3 (id=2652): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffff1704b49e19de08004500005c0000005ae7c31678ac1e0001ac1414aa05009078e00000e0400c0000000000330000ac1414aa000000008303000723fc6401010164010100e0000001ac1e00017f000001ac1e0101ac1e0101ffffffff4404000300fd978f40a1bcafb63500"], 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000002100010000000000000000000a000000000000000000000008001b004e"], 0x24}}, 0x0) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x12, r1, 0x0) io_submit(0x0, 0x1, &(0x7f0000000140)=[&(0x7f0000000040)={0x1802, 0x0, 0x0, 0x5, 0x3, r1, 0x0, 0x0, 0x4, 0x0, 0x0, r1}]) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r4 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={r3}, 0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000000)={r3, 0x7f, 0x5, [0x0, 0x2, 0x47d, 0x8, 0x4]}, 0x12) 1.804882752s ago: executing program 0 (id=2653): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_emit_ethernet(0x66, &(0x7f0000003580)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x30, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x88, 0x0, 0x0, 0x5, '\x00', @dev={0xfe, 0x80, '\x00', 0x2a}, [{0x2, 0x3, "21c1e05659ae3f48e9296b2beda7add700385601f891"}]}}}}}}, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000080)={0xf0f041}) close_range(r0, 0xffffffffffffffff, 0x200000000000000) (async) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2}}) 1.702173567s ago: executing program 1 (id=2654): socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) chdir(&(0x7f0000000140)='./bus\x00') lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) (fail_nth: 5) 1.701783585s ago: executing program 3 (id=2655): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, &(0x7f0000000c80)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x1000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000bbdcd72daaa4d6ef01d80c609ac7e36453daf4e27f3a74eb61fdc7af6962e1c2e870633cd961b7349408f1727b07d7ee28a1222444e5ce8f3345419bd5bf4b61d6aebda10e7b97f46b8fbd85e9ba5c1bab19e575dca383b104d1893ab75076b542463c0e9b274cc56a", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="180000008001000000000000000007009500002000000000"], &(0x7f0000000180)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r2, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc2f2ddf33c9e9b986", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 1.700315616s ago: executing program 2 (id=2656): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000ac0)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0xa, 0x1, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0], 0x0, 0xd1, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xbc, 0x8, 0x8, &(0x7f0000000380)}}, 0x10) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000b40)=@ipv4_newroute={0x5cc, 0x18, 0x824, 0x70bd28, 0x25dfdbfb, {0x2, 0x0, 0x0, 0x7, 0xfe, 0x2, 0xfe, 0x5, 0x2400}, [@RTA_DPORT={0x6, 0x1d, 0x4e21}, @RTA_NH_ID={0x8, 0x1e, 0x3b99}, @RTA_DST={0x8, 0x1, @rand_addr=0x64010102}, @RTA_ENCAP={0x4d8, 0x16, 0x0, 0x1, @SEG6_IPTUNNEL_SRH={0x4d4, 0x1, {{0x2, {0x1d, 0x2, 0x4, 0x1, 0xb, 0x20, 0x2, [@local]}}, [@remote, @local, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @empty, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @dev={0xfe, 0x80, '\x00', 0x2d}, @remote, @remote, @remote, @ipv4={'\x00', '\xff\xff', @multicast1}, @remote, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, @private1, @loopback, @private1, @dev={0xfe, 0x80, '\x00', 0x3f}, @private2={0xfc, 0x2, '\x00', 0x1}, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @ipv4={'\x00', '\xff\xff', @private=0xa010102}, @loopback, @loopback, @local, @loopback, @loopback, @private1, @private2, @private1={0xfc, 0x1, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @ipv4={'\x00', '\xff\xff', @broadcast}, @local, @private1={0xfc, 0x1, '\x00', 0x1}, @empty, @empty, @remote, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, @private0={0xfc, 0x0, '\x00', 0x1}, @loopback, @private1, @private1={0xfc, 0x1, '\x00', 0x1}, @local, @private0, @mcast1, @loopback, @local, @private2, @local, @private1={0xfc, 0x1, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @remote, @private0, @mcast1, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2={0xfc, 0x2, '\x00', 0x1}, @loopback, @private1, @rand_addr=' \x01\x00', @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private0={0xfc, 0x0, '\x00', 0x1}]}}}, @RTA_IP_PROTO={0x5, 0x1b, 0x6}, @RTA_SPORT={0x6, 0x1c, 0x4e23}, @RTA_METRICS={0xa6, 0x8, 0x0, 0x1, "456105492f6e0712b7e15fd1ae44e9f0f9f6c46fd0f41933e92e7d9f18c84c9eeb220be2084a31280d5dd00c2fdbc598278d541bf626e1b6a54c09b5bc22f9d41a971f66252e366ef9aa7daee3bdf1a6c3c6f3654686974cad4db19826ba8b1147e4a2b0d3ab7abbc07b57210895d82e946cfc41b36108be59089583ae8de72dcc68e7c2e6ceab1ffaa8d72b829d08632cf29a00876231fbc548b3be36102df989aa"}, @RTA_OIF={0x8, 0x4, r2}]}, 0x5cc}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) io_uring_setup(0x3450, &(0x7f0000000280)={0x0, 0x3ff3, 0x803fc}) (async) io_uring_setup(0x3450, &(0x7f0000000280)={0x0, 0x3ff3, 0x803fc}) syz_open_dev$I2C(&(0x7f0000000080), 0x1, 0x420400) 1.586259906s ago: executing program 2 (id=2657): mkdir(&(0x7f0000001a80)='./file0\x00', 0xb33328a401cad7d9) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x8000, 0x0) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000300)={0x2, &(0x7f0000000280)=[{}, {}]}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x56ab, &(0x7f0000000040)={0x0, 0x5492, 0xc000, 0xc, 0x77}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0xfffffffffffffda2, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x24, &(0x7f0000000000)=0xa, 0x4) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1.313569147s ago: executing program 0 (id=2658): syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="21010000db168920402000d92ca9010203010902120001000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f0000000700)=[{0x1a00, 0xac39d643e9965aa2, 0x0, 0x0}, {0x8, 0xd001, 0x0, 0x0}], 0x2}) 1.308956624s ago: executing program 4 (id=2659): ioctl$VIDIOC_ENUM_FRAMEINTERVALS(0xffffffffffffffff, 0xc034564b, &(0x7f0000000100)={0x8000, 0x34524742, 0x280, 0x1e0, 0x2, @stepwise={{0x80000001, 0x9}, {0x97c1}, {0xffffffff, 0x36}}}) 968.060497ms ago: executing program 3 (id=2660): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x4) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x2000010, &(0x7f00000000c0)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000002140)={0x2020, 0x0, 0x0}, 0xffffff41) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x9, 0x1100, 0x40, 0x0, 0x6, 0x0, 0x0, 0x0, 0x40}}, 0x50) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_emit_ethernet(0x6a, &(0x7f0000000900)={@multicast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "c5819c", 0x34, 0x3a, 0x0, @dev, @mcast2, {[], @time_exceed={0x3, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, "5ad10a", 0x0, 0x2b, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @loopback, [], "aaa12ba2"}}}}}}}, 0x0) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r3, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r2, 0x0, 0x0, 0x0, 0x0, 0x1}]) openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x22801, 0x10) 909.680528ms ago: executing program 4 (id=2661): r0 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) syz_io_uring_setup(0xb5e, &(0x7f0000000640)={0x0, 0xbf8b, 0x0, 0x1, 0x292}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r0, 0x0, &(0x7f0000000080), 0x0, 0x4001}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) socket$can_j1939(0x1d, 0x2, 0x7) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00007c2000/0x4000)=nil, &(0x7f00009dc000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000726000/0x13000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r3 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002f9}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2b, &(0x7f0000000000)=0x2, 0x4) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) 909.399166ms ago: executing program 1 (id=2662): ioctl$DRM_IOCTL_GET_CAP(0xffffffffffffffff, 0xc010640c, &(0x7f0000000040)={0x15}) 908.991077ms ago: executing program 2 (id=2663): getsockopt(0xffffffffffffffff, 0x200000000114, 0x40002717, 0x0, &(0x7f0000000180)) 843.672012ms ago: executing program 4 (id=2664): r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$ndb(&(0x7f00000001c0), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DO_IT(r1, 0xab03) mkdir(&(0x7f0000000300)='./file0\x00', 0x21) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f0000002140)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r3, &(0x7f0000004180)="92756f43b31ffe542788ef586b7c5a344424e3acac2590be6bbe37adface4a8f2e534ffe76a83a93f0b3680a72fddfde83f96d01982384e8d689219cb9669b14dbaa1b799f82ea1fc926126a4163618e16d4f94143a4e0f27c44fcef3920a0b3805ed4e78098d8689cc7791bd86648070718d238664332948d87866c8d2590fc0f017f9853abd9ed60b99f1aa6ae2dbd24ab6dbcebdb055246815ace147cc50fa3b2861148fcda374d5b203e51d72c45e4dde3e9ee9a47ffe458baf7bb49035135a8194aa1f0a83fa2abed56398f90daff679634619453f533f22583a6e0a4dc09e9de46684d5e0136e229510f3702cf3a4cd0065d3e5d3c419e38a80b070ca55010e082a9c510fd18cc0b26bb5e8e459e747befbc5c6b60ace80bf41417b7b78cf57e5b3984f0cdddc615c5e0000454d3f4a196fb6d18aa629cf0b0245f95ba958d86dc175616f8cd3ac473057dc3a5ff7107973326350107f4468e7ecd48d689b82c12d22ae5f1858302a1b4cfde8fd347a99ddcde40d1c49d9b5099fbccf09e782212be4b2ce36a2bc3c9ee794abffe72a5501e6c4f3f7f68b74761ffd6620609224a3bf11f655dadb5c8a5813b02fb46830e9ac6825f5d0e89910352eb3a58c0dd82d094f94dd2c85666f684a8f437bbd0e66b9f4d366117b67a054d212c4fbc287848cb0578391335d5d616b14d99a2e3df8e8a152d5de99bcefcaab5bb5cc71f3ddd66b379c104648e190e0b28a180d3aecc5423575d4ba7dbf31215c717da7b87dd454b6efcd36c91aaa631127f5bd88723d221752f102bc0c7ac6c5c7a1ad6747af40d01b6d39eab7b0e1292b44683c586386ad00acf60fb8f9bac551a6eb5bab7317b5d89f64db10bd9018dfa6d65d93862e851afbc30fd70fe5f0de322462045177231852ca80e4e78da4fea0c79ba354333026c8bc77d308a8d256a19ec45d2088c196691d3f9aac28ded36004a65ee1ce49ba9599ceee84534bb61d02d04a6732f1e27d72962f74b59f3522bf844c5022986d55934e48b8681b7f5b7532391448caeef00315d28320a46d8bd7813544e1e4bf994e14a519c2654ff20b42bdb69c262897e28eca528f0999840b00ed8256597d27cfc20d71d5f40d0bbca759f7594c6034aa1e16a84ed152fad0fdc1c303a7f61225712714f823afc5ea241d482d3585759623af8c97ca6a84a2033b3d7314ea0ef7ba9b288b362a294c92c8b9736829c16f61c5a1ee04aca965d71162292274595ea62c9c2918e8279c99f5d2830c617c58211fd7452330184b9428d5ec1d5cd75ddcc6de3326fdc70e891104b3b013c30ffccfaf3308d9671b01f6b080a930dac2052c6f39817a662121d90d40d6a1facfb50bec7d408030b6d0ae3e744f3bcc327c35dc43cf86b743db78ff2e593b19923235ed6467f299b08718fe1840c16a748935dff941150fb08b30573b37bf9af5c86cc8d9e229a832e4ef25ec91f71120f2b3e9062485976c280a2d172386029e2f2a4801197fca0a13514edacf5ddbac5a62e8bb13dd1572657a821a8739297f72e29239d1cdddf3e30cbe9af3141f2275ee4ae85d86ec888fe9a6751f252057e95b8beb055e276439581afee93cd44f1e92f70e5f725451d3ab662918ffbb1269509fbd511e95a00ec717f9d60d643864abd6ad1cc4dd7f933379a6078a86c2158db8076e7b660366fca7b1c46d09d2c8e67a6494bfb4c2c6750e76593895b5e2b2bc78093840c3c4a807826bc2750a96b4e1dd5b82b492bb2215518c92064d1763c37132604e52e73fac3f4511f791753aeecfbb19816e0da7a1bfbea9eeaa0f256eaedcb119a61f7d0ea0f5cd4969d45cb014800f2c888d5c2217cf0f69a7507779883b57352bb8883cc584891950d6e792537074f4fc4337aa19b9bf60e18edd939d289fb4a6b7aa6c66da20774e249ca4f779d3c910b1a9a8e4c38af6adecc87d5481d181fd66023ffff246f4e2556b218fe8110acebe20b1675f1de6f265b6d1d8514a53522396bf0e2f2b153c498e48b36d16f8b9bd56f45d7f5b9397d7f1339117a176d0bad0b68e800682416d3e18fe2197c7f8dc20600feb95cc6ba86ad47f113e159bd4389e30eab2874bd27eebc56020c4dab9973b13f3e82aa62a7e0a151d73de48cb811e32be63ffd303f5a6ea6f097ed763fbf36c430821e451146de79922348354ce285af0997bf3c66e6ef02942e24b8f1ccdd542f09cfe65c0da0094c0b5fd26bbc061538b41e5ed2cbb390ee29b10a4b7a696009e1b5b86c44c0a561a257c15415feaeb1433ea275ed6e4b228503fe71ee5942665164faaed6697112206be0fe7863aebd4bbe951d5dea1da294dba0793196385f4d5141c9d6c4b0fa22b2e200cfb70b52aca31655e71e5a576ccb8ccb5b1364748aa981edbb81a813b1aebc67be1f7619e7e197622d981280429f6ca5145c5b3b05e6bace9191e5c58fbf140f71f594cbfd4db0e9f6923f1758ff9464a61a720a5d4f09c622c3ce3f5d0d3a1d191111168108f41f12b16e9eaf3617c353715cd35260560cbfd0555d51ce5c40bbdb7c95ceaeadadb8902974de50b0863348183864f5ea682e678286a06a6f396af29a7c7fb33a3579e25835963612f3c0d4cf369d85959a0adeda94d35824050e6fba7f83f90867583f713d7783323c7010e94c9be331f860db395dbde6face5bfdb616fcefa9c6b01f6963daa840a31ff554a458c0c50cb5e09f91f54f63234589decaf45bbfbaef0dcbff4ae6e65ca26a530261c491ef8eb9a855a1d7463391c9b66be96cf24c3c321ee5a5bdc857f60b582683c6ae1e3775b62a9f19ff8fa51380ca8a2a3c6de79012f5727ba12025e7e6723a23a81e067ca6e54c7b38ff64880d235d21e7ee5258953dcbf9e2a962f006ca4ffe870859242c850cbae4222b3b72c4f86934379ba2ead1dcde906241b994d95c88355af5a9a30ace9c933a6942f341ad221dd825846a8fd44c03e2eaa9311c26e15a1bd7cbba961a22ef23d7ebba0e34cec5ef09b1ce72814a97e33bd29f3d9ec80a4f45d1d29486accf15c11f1a800bd84918e7626f678275d7c7acb02cc0e6e34bb766ba6b75c3ad14fca9352e09c3b69390c045cfc842ff9ade8ca693c07fadc7047a946e6e570c3afc5b501c964103397f5ddadc2d59a048348dd42f07cfe31bc9b5ae453f5086bb41bba4c8a3e518e30b0855184b053f923025dd72ce1bcbf41231978b34a8547c71d7313992165078903c61d312b0d9469413c9fd97ccdf0ea270fb6c47ec8861a1c8d909eeace761b5a06ba46e25785ff87f867777abb237c6c980687991f1ed0157d58492260c712cec34c1fc0962103955db4d5090b6e8409cf3c3c79d0e691cf4fbc0b2251a016dcd456969cd32e5429533bf0d6f8bda84c05f0e2040de8b53bfb8676eec4b76c3df6f46b1e43732035dda577e75f640777f6ae90fd2f1af42ba462dac732019c599bfef01acd6a0d4d1796bcb8f58519d6f9ad9a3206704a94d472516b988141f44ecd2e6f28a49aa0c449db87972fc995a97379914546ea43143ea2cf779a9cbe81f111fe89129db3610492164ab2598eca7e60d9a6963d8ba03a86729db86e420fd96d61b8fb11edc2b339b57a740074ae5b775eaf60cd85dc934e604bf2b4bd58ee01205b4df57ac20ff8db45a05982b579643882407050c005102a2e71f1e56dc76dbf5331112e83e48bfb5cf2a78a893190d78426175c162ffaa7278a43b9932318fc17fb8cb0dfac610b1ad235b91f9cb7623b155117e07f7b876a3c37627aa31eafed141cc0c5491c4f621a66b6d837a144d78719c46511c04a093cf65fce9fabe5bd6d499eceb63538ece3cf19053550a239bf978c08c879f9954485a4e3e0d5bedb84b407ced85c4dfc4d75af116815992c29f0bc927c4a990c38ae4fcc9feb90fec1b1b555e04d010423010855394d5ccfc8ed21164190cd8f83be5debb70290c3547f07e4dc42814f1e001798e6ceee2558b0c6ff8c1759f90269ee226131116332b99ac8dd104c92088e1f91ace3198c0f59bfb75c4e4a697660eed43a29c831a552de37fce6dce96fa51b6e2111f3071a4e94422d15e102e5f67da7ca6cae6bed7743ebffacb8a811a143605791d17232181a517e872f71262c3c73668f0ef83aad498f67fa26bae698cf78f24c2dbecd399a190e6b8d0684e929f2e8083765eb2c67793a1adbb89d36b58bfb197cdc5f3c894ac9d886e8f3b0936fabd233c09de8fab8099f72a74d908ba5c5e4d39790b0bf9e45b710f5587b7c937c76690c5c5fce621a53a9fd03b0a4ee6d8d1abbe2ed561820a77f12a08cad0755540ab6dd1604b7c30a8652995ab80b85e919011de9438a4637eb0291124ed4b745e782cff98510cb03be79c2a81351abf276584d75cdd96b9c97e73eb71000b3ab7c3c19c2cab4497298fcb3052b5d4503d05e7f310318be6f848547b1a4f4db82caee190801478be28065036aa4d91f290c1f396343e73a5fe8bb5ccf0a317177ed1f77acda1a4a49dccfcab8d1b5d79f015f788b6d5e9f8228a8bcdc0696e6b19f5edffbcd7e9509c87fbe1f726b93bf8c6d8d37428763e142560c46c9e894f7317859000c25abc4f3691ebcd020171e0d4911b5d97a238109aedeb00b2eb475c1e7b45175f8aa85193b5c0f43b434c15de01610c4d022646cd6e3637f349a434a77f571ac1c5d698452d1b991e267f78dca5e592ecd31ccafcad84e4e98d134b4adc525b81bd6843428883023a6ea407201738c8bf16b541ff7280274a34d4cf14819f2dbae167ca0cae8471c495e006b45194ad91c4516f21cbb10e0d26fd5d734cd7725df5b3fbe92955f4a9bb3b9b813aeeff79d6ed5db92def19d060a208c3ec8c42c110786f1e1496c50a7249b03fc792764366894a35320b99d0bef9fd0b6a246c36a357c6b985dc83a37a8d9b8b9ad643dea94860cbe763bb73cc8422b69d4d12332242c8954075fb7117a6679638073617abcdb4619855b2036af160647f66b3531645a3bf047ae290d6ae2249f114e7a8464278bae1486022bcc7c37390c8d9a0efb0e1cfa0da8ef7a5e072f99a47ecc75e4e442880375193db49bb82ba34901286ca473ed5b63e4048db4dc455e74b3fdd2e7898ca3f4c3a02d435cde6141eea645055123a7dcf0d22057f8d425701afc55859f5147954e719d58c7486b1e02ac16cb799b77632c66bb78e6e52e11017c1736424fa4d433f1e19b4c881d23f0b2a12d5fae3ae24339088088d9b496ad97bd9f6e20a8597d1452a0c72dcf43dbbda8f18166585c06d21fbffe5fe7b55f71c9b9f1b34a02bd05ca63c7c1b1bebbb9dd24fb10291b04c665d45154dd28b85d821ce7e613119128996785e1006a8dabc4899b10d2671107d5a0658ed363b9d4b39d02f8cc5e350fbf0a31048adecd1f9e2ca749bd86f195eb48e9b4605f050de03d642940d79184618f7f88a9a0a4683ad84d6134e395305bc1d4d9d17cc334b97653529d6682a87a5fac80a6d46d6e72fc22e58be7b8f8617b3372ef2622110ab1ec448717118b257acffe55d18c7855e9e8710ad977a6792b2315a189eb4468c68641e9b60c0dab7016ac1ad63cd8004b6eca8fc88b1e4263acc00499255c16b11487a0af858075f9c892dc8044c4146e5a5677c4a2cb24bde5e078985020d4ab1e4c87492e76b7e6f4bbd71d84bab1885c9702849e70cf728776b1a94c2a8fb8c7ca01b6111ef6f2032a290949bfe473fe215273b8b5b3ad540f187490f63077dccbca6f62f0a7a66717c596cdef412f2560b10685ede967b3ee68b8c951959aeb1d7564c3b9d806b2ce858381393a79916b78f7e90beadae30ffc0b2b614380f1c2cc551a44565209db3516be379ef566ab00c673fd8aaeeecdcf1168c1960e9a477b9e13757498a44ff089351d1f27abf9fd76816f924504647d1247715ca861ebe624172c322146d66eb2b247f8ecb3e1b5ddca89b287c57510cec40fcf89d802cf4368a861af320e01e34f7a6177d4bc549181b5e87ecdfe02f78c9a59a3bf91ebb6364023ec06410e7b4476ec4e3685bfa3bfe9ef9ecc12dcd899abe0f3c7f16b4686801c0c0a949aa26bed57df56f2bc54ef19af7fcbc7b0d691075f42a4a67acf980b568acb2342f42249f7c1ee3527c13182b096064ecd250887a942d26f637e1c4041b139659d2462a68680bb04387a3b399e396b9fe74de10356125fa47d0a20827370cbf36a79b6fffade91c439dd6cfff4bbe0dd3efefb61c491ee32f935d62307cba369ac8c20f6fe3d4857ce6d240ece5e4d149f0587155a8350fcc18efae2ff11cdbe15218a82499a1996df8b5462ee170b284321e76bbe5c3f4158387644d95f087c598e3d46fbe27f63fa784bda239512113424045a2c5dbc6bc3662ca730a86d13cf8f6fe2743224ca7b535caf6b4701a7dae9cfad3d7290104bbba15b6a064ae6e909a099f75fbe47c9e654d8e3b8dc0f3dbffe829e6c56f7a241e565136812a857f59ab565a9991c6b1d8abcc94c6b33bba314f6e5060e657e4647f969a551dd6c51dfca0ff5d9e4f401fedbc2c927eb1ed95ef25f4e5accba4999322ba1539499310dd5875433a22835cfd42fd77fd4680b7fe767d7aa5c33acde04a65bd3a663fcde4c80e9f2af498f13bf9abbaa1c1265edc691e94abdcc92270c05811cd2a8104eb18efbfec9e4ba9ae5cde211b9b93082ce034b6cd5fbe9cfbac4f7e2404ef159766124f73017cc3600f3c81cd78db25fc3459629eaf20dfdb062c7e502aa69412381d847a9d254d5befc451cda3606f0bc8ae62e0aee928f9ed0b21d705a8d31b899e16445ee064563d32f7b6bb5ad197023cf528d9b329ec67815c6ddf27d2a6ffa7328bb993407cde3d166159fd49fe469254b84c2916daea8df9d69bef019f1351b9bce193e30278835b82ea5f60dc0bdd7f7452b7a820ae7cd6dc29d7ac6a6c1b6411711a96338b1e769146b2a385d282bfaae61b041166efafab2d89a4567b9460cc22d752f8e9aacaaa0db7c84879f5359662d55df6570d4214740851c74574ced733807cbb54571110410892394c3dea07bd4154d0e5689d57c3360207dac951f96a358e9c466a5c5113f3a632e184f57f075edef4dcc9721b963beb95df09dedf848260cbc1ebfdc7408218eaba6d2c51928cd37c4c0c9f321fbb0994a56947cfd9643056db5dbea60a241f8f004c932bc8e645b2ec2eb9bc4e9e2f4156293234d05e70cb26b8a370b0206c756bda6defc11c5eb386640f535a4ffb714168defc6d82f40d8f5ba8768537ead5773c53bd779ca899a2dd31c9138569ff5107c2fb12b804375c3b3dc9b828bfd550328adf358f71e86a0c49fb119f5ef9e06c13855cbfc7d1a62ca2ea655ed912a6dc7bb8b18656e8923fc7a1702ab36947d79384d681c31923e98cf40209f776bc2b219a7ccd139e756a905aa351e6eaae90770c8a193f96cd5c66e4d77a357985556e14333716d80204a5c390e0d76f4081afe917f99ad8a0976b3342f51854b374b4baa9a7f22124d2b82749446e30d9795acb9c3c3a305a6d273ac528e8e9c95c37a78e765fdda55982c2961fbc85a14fc095a78b4654ee6dfc3298749a639ab9c8e155af3a77f8a409ce174532a492ef550a140f774d77d732b3b4ca5bc41fa4488ce5957ce219b032ae1f585273748d81b19edcf3e6cb9a93ec24e41c6b3c472f9baf3ca46cb8b9a91df18acebe7d83bd4473750c4f26806da2f95b9ea48b342460af729ab15e9f033eda67feec645f985d4b9489cf6ceec1b100d007bf46c74be53c7ea17296f9c5b5cbae736491213c93b513009ebdecfcd60d46d7b86c6e3b5e288f2ba5867c07936e7bd1b00de52191eb8630ff82ccafb27a59295164751811bf74eff1e5e2abdf3c93bc5dc9814be83b2562477935e2fa30db7ebb6ec380170cf10c1f98f8c5eb71c730c2b31b55a1dd1c12a64802ab95b63c529e0a96cec8f38680221d6089926d8309796c79994d63b67bfb62f66b4a502f30ed12be41e896e88bc45a160a526fbd5f002e677322f116ec5740d7563cd23ee853c008b84998e38fdf158556e28a532573956e7c00f91f08ca245c295a3d5e003a99ea727f61d12893b435d4c8f2f5cce00c6a3091e2a47f290c07168975c53d7529b71d10faf42d2bac9db8d53669cf59c709c25e9e40b5feaed4c37dde8b84c4961c00712326fb6aaa06e80d766b40b72480f3971def61d1d129676df2478e778d899ed317426ec33e496d1fdd2ec27128f8faee92828e13da72d6aee8330a7988ea1cc8b64ec4d8b20990864c16c52c4be6d00b304b87d97bffdd9c66a740b517223089d9f3f414abedc53c768dab9220b980e6c18d5f20ba8994cc8886d7bdee213442f456d79fce1b1eb48fbf600a666c8ade24d118e6328251cf7b57a6285c650e019850f392b1c29aec5c8fc489a3819d60d5de377d4c11b8ee5625b7c02c5d50d2af3397006f2e2a41a06f039229eef5878ed91f9f6be7e988924dbaeb8455f616275e8698d93fb536e2c839b203aa69bceceddbf9c53f8addba53d50ca0f7a4729a42ac6eb757f1b408ad4a0147546173e62f7621eb18a9e1681510cceb48e0a30ab7a1bf71d56742d5f034f2d725e7ea68a011dbb100fa6eefe4ee093873de366d34f4240ca027a25c5b979c9ac47dd1dcb6ed82c4aee09dcc23cf329a8644f89b5cf00e5683934b1837574e9b39b31b1009f276e15aa040959fdf100838ca3f5ab17e45036668d06044e3a13f3a0a6f68579e50d5b0164f900d7bcfcde78396cf30f0b1dff76dc397ab1a5a44b207eb1eaaf73b945c575029ae2dce20724991e6550155ded6a42672609f2439c5aab4882b2ffaf7da787b71d05d15516bd68c6f1a9d79b675395845f24ee853f877e72c14b6c6702f7b8775ca1bfabbbcf4019f7bccf07f1c211531dfc66a7a1df79e92a20dd1cbe1b22e1209e7e3ecb9d3c2450fc22a57bfe09bd735f61c361cdac2488ae0adc7885edc0712655daaf535e1de96ccbe7869d531d8bf3db512fbd17c772332a3f8cf1e052ee0202eb99a36a0f8d7219888acbb57090cdaf3b28e1e62e8fc2ec237bdf18592a7afe4d8390dcb5e7fcc31bf4f797e6f5710070902265cc2e8c459b7da1451046abd6c8c5b02c0be2d2f505a65376266563ac7b59ef3b4e2570a6cb0bd94d46ad861317c743ce1de12bfa2295a98cdded4414d87a1580b1e4675bbdf73a22cac4a1d8d456d089e0b60cbfd16158f073bd1dac481db49fa5d8801d0fb0844b4afec1bab4e61fa0f381fa667880a1cd8163953be7b591cc9dfd7f91902370b783ae8a0f3c7cbefa7d229a37c00f523529e159b11d2e240629b64af2d11404773e991207a722c320221ce23baed7cbe40a440c5680814b122cfba9092fe03478f85adcbdeacb76d6cbf2491eafae98327b278e267821a0e1cd06ef90cb0328e246c19d8c63b9332291a89bc9f989effc675c79a870ac024756c6f5a7e32babd69625d61487ae7399490b70dd0fade7d70ad9b0757300a2dde77abaff4f63a0303853589d44efa968e10d36561f04408ad0cc227fc6b2f904cead189a0fcca9b2e6cbde5498652e0b3bc9d8b7921474403718feb5cc750dc70f5a9b1a0ae2c642015b6a1a8ab0572182b4e39e0c869cbdc60c9465f5d564d18ba2f5b3bc3e05a458744077430c5ea031ee02dd8f0a65d7dd8d90dd9b8717f77d202239a5778719423fb2aec7ca86eb07c39de65a34b988d65377a7473e9145f16d79593e96903330bbf3a8024fc15519d9baa0fae2018786f4b1846fca355ff0fccf65cccad1896309a5ccf2056dd542c929850cc91cd655962360fe316557ab3fb378328f77a07d9da24447d3fa2020b382ed2e808ec9529a01273434c64b0b7c35a06a019e4ab51cdc9c0f266ab25b6984338a0ba910d1060283b636c5d7e8a3f969c1ee1c99b54bba7ff3679fbeecbb70349f076480a867cc4ee4cacaea39c80f642533599486d2ffb77b8c9109a9d25fa0b06e58eca764f7d56469eb9547036bbea9d5c3d35b4c1fbc3d39a372c2b7ad184965cad3819c8928f1588d00949949c0c4c93d30ac7f6665247c0108bd89dff3aafe780ac66febfacc8c6a3cc387d09da6de700487a80e2c8d56df94d7ebd3e1d9e06411a6c5f7eb6da41c6f52997b5ad47ba985261103fdf12eb4a2828b248f652ef00b6abccab2eb161b878b9dbc0aa911405b6f67adda83c16187748d7b524ffe6381f489f432d592e6171bd9ccb2cd52f977143f57fbf2ab0b823d449ae55f02440972334344cda01837b93afa4f46a2fdefe27e92764cf9596780846de2e3b1ea83e62ee43b1c05aee675e25363504addfaa68e7c53ed685413f5ba951f120d0a646e474872c81e5a887464c19f8460ae814ffff24cb51dd2dca28d597ab2ea60949f8dbbe67f263e722fdb51bce4e328a19f5ff1218e1f63b8da6d40dbd5490964499b2522ea323310634893ead661407966207a66ab13adfcf1a725ed14339c46011c0e0401f2386b47cd9f902fdf84bc85e74d3ae7cc544e4d65670a554a537712c6ee9f75191631d2a4c4da06fc38423b1d5b828d7201235b2974164f52aa16bee70ee509250752f4fdd6b9f8d021943df8320682a6f80ff0d67ab7a4ceea807bd5b3b7b6380b0c7f0caa67b0208ba71317f0355a3b755af0e2c007186389438615df80b7b25104a733fc90625b62682198733c0f1625dfaa08cf81e3df043094b7b5a098b3b36f803b5b0f10a057bf814ae3579932c0a5f208985bab3d817f975283b8838ae5cb709be72b58df7425e059fdbf4e0ee51b3da01fe0b44963c1196baee5ec5909ad80d9d1660f3edd90374952a0bf8b3bece2c2f944593f4de7de5e05ded096b8f4f05d65dfc2e806f78220d84b3db564fb12f4e5e8f5eab316591f004e9374cce8e787263bc3827affe6793c130b8621d3bbb2a86fd87f070ea21718281ee7aec4bb3bb71af4bf5721cecd139c4be8c9df4ec8dfb09a5cf1d86a25d39faa9f064a997c214f334e4410917fc3b4d67ada8d87a38c0f86b02bf653dddaeb5b75b300f8bcfd792858bef8ab23e063421939c59212964c9ed5dd56e215db58cef53d31a966bb8ce4ed56287fecb3a85ba435e0b41b20ba1164b9c9f2c49fa0f7b17a89e0ec47eefe992d63ee29c8c0a1ece2664fee8edadd43636a54c48519b4fcf55b0d9103602b92441a5f85cf8c5e406d0f5815f8f37309934bd78fbc2acf0a03b051b4528db4f7c09de7d0aabafca3736b8259c818ca338ca6754e0747717c2794d664a1cacc1e9c52764a308e6df73d975638630b74cce6c49b1bac16454e96852c4f9d8ed118e86d2f1c8dc33bccd4a07be128db5e80f5684ddcc1158e744411acde590f902f0987cfb750bb5bfeed53bff076868986b566d7701f48ddfcacbd325c8d930bcef26713bf60585d5c991e2a6cc33ccbc27f7ddfba18f998497c2eb378cc8f2cc07a1b4f141c5e0fb6f52e18242e505bcf6dd20e33a469d056a0b4fd5e72d0da9d0bcce1e2f9e9dc7d1c7b6cb0f3604287eca", 0x2000, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0x6, {0x6, 0x2, 0xffffffffffffeffe, 0xffffffffffbffffd, 0x400000, 0x0, {0x40, 0x8, 0xb, 0xfffc, 0x3, 0x1, 0x0, 0xfffffffd, 0x120, 0x2000, 0x0, r5, r6, 0x501, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r3, &(0x7f0000000340)={0x50, 0x0, r4, {0x7, 0x29, 0x0, 0x30c6cee1, 0x40, 0x73, 0x0, 0x0, 0x0, 0x0, 0x80, 0x7fffffff}}, 0x50) openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x300000d, 0x1) ioctl$NBD_CLEAR_SOCK(r0, 0xab04) 792.923983ms ago: executing program 2 (id=2665): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="2000000001030101000000000a000000000000000c00020000000002"], 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4001}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000180)="1c0000005e007f62516a071c02f8abc36f1d73dbe1ce84ebc7c4c1c9", 0x1c}], 0x1}, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000100), 0x1, 0x800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000400)={&(0x7f0000000140), &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000340)=[0x0, 0x0], 0x0, 0x4, 0x1, 0x2}) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x1a, &(0x7f00000001c0)=[{&(0x7f0000000380)="5c00000012006bab9a3fe3d86e17aa0a076b876c1d0048007ea60864160af36504001a0038001d00e517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb000011d600a0680d4bbd6df1db6f1078bc", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40000d0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) 745.778321ms ago: executing program 1 (id=2666): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x2, 0x96, 0xd1, 0xca, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0xd, 0x0, 0x6}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, &(0x7f0000000580)=ANY=[@ANYBLOB="0d1704000011580e5e715f9d16013e8987c10f05e8a866cbbfcd23c9c6c3b1930fdb69f28145664655d74b3223d6df12b1ff651f43cf067e1ad99f253f0eb6a8341e8295604766a6c4e1d21a418eb12a0945450ae6e65e0ee61931f0397f04e211414c64cf4e5c948d4609f9bed1846aa4e5a6e16132acc5c47356eda5a48790119ab63ae3a335ea303fa1e970f84e35671fbdb27c911c6104cd08f96e6bd2128037f5ea42cfcaf530ca8fe0f43b8324d3b3798e36d9f46d3cccf92ed36ff3732d68b926c0e2cdb3610ecd432c644080e35b7052f562e0bca7c10f1fa296815b8be06cec0a720e2e7da7faf27ee83636a7f5ad8dfada76198e91ee2e402f174242efaf03391a3a5ec8d8da7a83f5e5c32bc934ee9b6331e3ff871fc3030ff12c9971e13e061b2782abe821ca89a79b7c22200d82ed324922204f43482d40d7ca079a9d9ba779beb49eba347db948481f2dd7f61c2ba6b0fd48c4f5db94309ac204fa456642"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000500)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa802, 0x0) close(r2) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0xb, 0xd}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) recvmmsg(r5, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000002ac0)=""/227, 0xe3}, {&(0x7f0000000400)=""/92, 0x5c}, {&(0x7f0000002bc0)=""/4096, 0x1000}, {&(0x7f00000002c0)=""/192, 0xc0}, {&(0x7f0000003cc0)=""/204, 0xcc}], 0x5}, 0x9}], 0x1, 0x10022, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="200104"], 0x0, 0x0}) syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r6) read$char_usb(r7, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000013c0)={0x44, &(0x7f00000011c0)={0x20, 0x14, 0x4, "0426fd98"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000fc0)={0x84, &(0x7f0000000c80)=ANY=[@ANYBLOB="0800000600000d000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001200)={0x84, &(0x7f0000000f00)={0x0, 0x14, 0x4, "42467af9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 384.655086ms ago: executing program 4 (id=2667): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2080c0, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(0xffffffffffffffff, 0x4188aec6, &(0x7f0000002cc0)={0x1, [{0x0, 0x70, 0x6, &(0x7f0000000080)="7a650e526bd0998268bb5847d9be"}, {0x0, 0x0, 0x7fffffff, 0x0}, {0x3, 0x0, 0x100d5ba, 0x0}, {0x2, 0x0, 0x4, 0x0}, {0x0, 0x0, 0x9, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x2, 0x0, 0xa2d, 0x0}, {0x1, 0x0, 0x1, 0x0}, {0x1, 0xfffffc4a, 0xf3f, 0x0}, {0x4, 0x0, 0x1000, 0x0}, {0x2, 0x0, 0x6, 0x0}, {0x3, 0x0, 0x1000, 0x0}, {0x2, 0x0, 0x9, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x2, 0x0, 0x7fff, 0x0}, {0xb8f133ac4ad20386, 0x0, 0x40007, 0x0}]}) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=[@out_dx={0x6a, 0x28, {0x6769, 0x4, 0x2}}], 0x28}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)=[@code={0x1, 0x87, {"0f22e5c744240060420000c744240233d8cecbc7442406000000000f011c24660f38816810c4027958b20000000064449966baf80cb83284af80ef66bafc0c66ed66baf80cb8cc07ff8aef66bafc0cb8d4000000ef48b8f8000000000000000f23c00f21f835030009000f23f8450f2244c4417c50cc"}}], 0x87}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0xb6ec0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0xaaa, &(0x7f0000000240), 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x3, 0xcf) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) setsockopt$ax25_int(r2, 0x101, 0x6, &(0x7f0000000000)=0x104, 0x4) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x9, 0x0, 0x2004cb, 0x0, 0xa1d, 0x68ff, 0x5, 0x0, 0x3, 0xa], 0x10000, 0x202}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket(0x40000000015, 0x5, 0x0) connect$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r4, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) epoll_create1(0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd, 0x400000, 0x0, 0xffffffffffffff1b, 0x7b}, 0x0, &(0x7f0000000280)={0x3fc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 0s ago: executing program 3 (id=2668): openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147c40, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000000a00)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000940)=""/3, 0x3, 0x3, 0x4, 0xfffffffe, 0x400, 0xc00}}, 0x120) readv(r0, &(0x7f00000007c0)=[{&(0x7f0000000080)=""/149, 0x95}, {&(0x7f0000000340)=""/134, 0x86}, {0x0}, {0x0}], 0x4) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000340)={0x7, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000580)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000000c0), r2, 0x0, 0x1, 0x4}}, 0x20) write$UHID_DESTROY(r0, &(0x7f0000000200), 0x4) kernel console output (not intermixed with test programs): -1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 755.590633][ T5867] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 755.610130][ T5867] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 755.649922][ T5867] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 755.659103][ T5867] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 755.674145][ T29] audit: type=1400 audit(2000000038.722:1259): avc: denied { getopt } for pid=14697 comm="syz.4.2317" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 755.694752][ T5867] usb 1-1: Manufacturer: syz [ 755.700397][T14698] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14698 comm=syz.4.2317 [ 755.701295][ T5867] usb 1-1: config 0 descriptor?? [ 755.881604][T14699] siw: device registration error -23 [ 755.890861][ T5813] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 755.992681][ T5867] rc_core: IR keymap rc-hauppauge not found [ 755.998644][ T5867] Registered IR keymap rc-empty [ 756.010825][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.041376][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.070435][ T5867] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 756.091953][ T5813] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 756.121393][ T5867] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input90 [ 756.140120][ T5813] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 756.154920][ T5813] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 756.170345][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.178016][ T5813] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 756.187564][ T5813] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 756.206860][ T5813] usb 2-1: config 0 descriptor?? [ 756.212059][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.231491][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.250803][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.277958][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.300830][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.303597][ T10] tipc: Node number set to 2865200874 [ 756.331539][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.350813][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.370778][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.390795][ T5867] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 756.415399][ T5867] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 756.426822][ T5867] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 756.458302][ T5860] usb 1-1: USB disconnect, device number 81 [ 756.530972][ T10] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 756.649749][ T5813] plantronics 0003:047F:FFFF.001C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 756.681605][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 756.693820][ T10] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 756.706219][ T10] usb 4-1: config 0 has no interface number 0 [ 756.713469][ T10] usb 4-1: config 0 interface 184 has no altsetting 0 [ 756.722004][ T10] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 756.731226][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.739187][ T10] usb 4-1: Product: syz [ 756.743703][ T10] usb 4-1: Manufacturer: syz [ 756.748280][ T10] usb 4-1: SerialNumber: syz [ 756.755758][ T10] usb 4-1: config 0 descriptor?? [ 756.810797][ T5860] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 756.911669][T14696] netlink: 140 bytes leftover after parsing attributes in process `syz.1.2316'. [ 756.923044][T14696] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 756.949654][T14696] CIFS mount error: No usable UNC path provided in device string! [ 756.949654][T14696] [ 756.959943][T14696] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 756.962374][ T5860] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 756.995895][ T5860] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 757.008897][ T5860] usb 5-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 757.018431][ T5860] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 757.028766][T14716] binder_alloc: binder_alloc_mmap_handler: 14715 200000ffe000-200001000000 already mapped failed -16 [ 757.029401][ T5860] usb 5-1: config 0 descriptor?? [ 757.106135][ T5874] usb 2-1: USB disconnect, device number 70 [ 757.107138][T14717] plantronics 0003:047F:FFFF.001C: usb_submit_urb(ctrl) failed: -19 [ 757.280540][T14724] syzkaller1: entered promiscuous mode [ 757.286529][T14724] syzkaller1: entered allmulticast mode [ 757.792173][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 757.993378][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 758.004623][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 758.014321][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 758.024887][ T10] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 758.035041][ T10] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 758.046595][ T10] usb 4-1: USB disconnect, device number 80 [ 758.187527][ T29] audit: type=1400 audit(2000000041.232:1260): avc: denied { name_connect } for pid=14730 comm="syz.0.2327" dest=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 758.210021][ T29] audit: type=1400 audit(2000000041.262:1261): avc: denied { listen } for pid=14730 comm="syz.0.2327" lport=33859 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 758.232563][ T29] audit: type=1400 audit(2000000041.262:1262): avc: denied { accept } for pid=14730 comm="syz.0.2327" lport=33859 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 758.940599][ T5921] usb 4-1: new low-speed USB device number 81 using dummy_hcd [ 759.721267][T14755] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2333'. [ 759.954588][ T5860] usbhid 5-1:0.0: can't add hid device: -71 [ 759.960625][ T5860] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 759.972119][ T5860] usb 5-1: USB disconnect, device number 80 [ 760.481611][T14759] macvlan1: entered promiscuous mode [ 760.537036][T14759] macvlan1: entered allmulticast mode [ 760.600921][T14759] veth1_vlan: entered allmulticast mode [ 760.699908][ T5921] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 760.711049][ T5921] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid maxpacket 16, setting to 8 [ 760.743612][ T5921] usb 4-1: config 0 interface 0 has no altsetting 0 [ 760.750236][ T5921] usb 4-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 760.809497][ T5921] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 760.929407][ T5921] usb 4-1: config 0 descriptor?? [ 760.934422][T14769] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2339'. [ 760.962753][T14769] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 761.045022][T14769] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 761.101950][T14741] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 761.915223][ T29] audit: type=1326 audit(2000000044.962:1263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14775 comm="syz.1.2340" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2b81b9c629 code=0x0 [ 761.940970][ T5921] petalynx 0003:18B1:0037.001D: unknown main item tag 0x2 [ 761.948187][ T5921] petalynx 0003:18B1:0037.001D: item fetching failed at offset 3/5 [ 761.971132][ T5921] petalynx 0003:18B1:0037.001D: parse failed [ 761.977180][ T5921] petalynx 0003:18B1:0037.001D: probe with driver petalynx failed with error -22 [ 762.009025][T14784] netlink: 'syz.0.2344': attribute type 21 has an invalid length. [ 762.018857][T14784] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2344'. [ 762.029355][T14784] netlink: 3 bytes leftover after parsing attributes in process `syz.0.2344'. [ 762.145884][ T5867] usb 4-1: USB disconnect, device number 81 [ 762.235421][ T29] audit: type=1400 audit(2000000045.282:1264): avc: denied { map } for pid=14790 comm="syz.4.2342" path="socket:[54320]" dev="sockfs" ino=54320 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 762.270417][ T29] audit: type=1400 audit(2000000045.282:1265): avc: denied { read accept } for pid=14790 comm="syz.4.2342" path="socket:[54320]" dev="sockfs" ino=54320 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 762.321651][ T29] audit: type=1400 audit(2000000045.372:1266): avc: denied { bind } for pid=14792 comm="syz.2.2347" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 762.346030][ T29] audit: type=1400 audit(2000000045.372:1267): avc: denied { append } for pid=14792 comm="syz.2.2347" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 762.362401][T14795] FAULT_INJECTION: forcing a failure. [ 762.362401][T14795] name failslab, interval 1, probability 0, space 0, times 0 [ 762.383097][T14795] CPU: 0 UID: 0 PID: 14795 Comm: syz.4.2348 Tainted: G L syzkaller #0 PREEMPT(full) [ 762.383123][T14795] Tainted: [L]=SOFTLOCKUP [ 762.383129][T14795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 762.383139][T14795] Call Trace: [ 762.383145][T14795] [ 762.383152][T14795] dump_stack_lvl+0x100/0x190 [ 762.383185][T14795] should_fail_ex.cold+0x5/0xa [ 762.383207][T14795] ? iter_file_splice_write+0x1d8/0x10a0 [ 762.383225][T14795] should_failslab+0xc2/0x120 [ 762.383252][T14795] __kmalloc_noprof+0xe0/0x850 [ 762.383279][T14795] iter_file_splice_write+0x1d8/0x10a0 [ 762.383297][T14795] ? lockdep_hardirqs_on+0x78/0x100 [ 762.383317][T14795] ? copy_splice_read+0x734/0xb90 [ 762.383331][T14795] ? kfree+0x1f6/0x6b0 [ 762.383356][T14795] ? __pfx_iter_file_splice_write+0x10/0x10 [ 762.383373][T14795] ? __lock_acquire+0x4a5/0x2630 [ 762.383403][T14795] ? __pfx_copy_splice_read+0x10/0x10 [ 762.383434][T14795] ? __pfx_iter_file_splice_write+0x10/0x10 [ 762.383454][T14795] direct_splice_actor+0x192/0x6c0 [ 762.383473][T14795] splice_direct_to_actor+0x345/0xa30 [ 762.383493][T14795] ? __pfx_direct_splice_actor+0x10/0x10 [ 762.383514][T14795] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 762.383537][T14795] do_splice_direct+0x174/0x240 [ 762.383556][T14795] ? __pfx_do_splice_direct+0x10/0x10 [ 762.383570][T14795] ? avc_policy_seqno+0x9/0x20 [ 762.383585][T14795] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 762.383608][T14795] ? rw_verify_area+0xce/0x6d0 [ 762.383624][T14795] do_sendfile+0xadc/0xe20 [ 762.383641][T14795] ? __pfx_do_sendfile+0x10/0x10 [ 762.383661][T14795] __x64_sys_sendfile64+0x154/0x220 [ 762.383673][T14795] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 762.383689][T14795] do_syscall_64+0x106/0xf80 [ 762.383699][T14795] ? clear_bhb_loop+0x40/0x90 [ 762.383713][T14795] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 762.383724][T14795] RIP: 0033:0x7f566859c629 [ 762.383734][T14795] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 762.383745][T14795] RSP: 002b:00007f5669498028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 762.383755][T14795] RAX: ffffffffffffffda RBX: 00007f5668815fa0 RCX: 00007f566859c629 [ 762.383762][T14795] RDX: 00002000000000c0 RSI: 0000000000000003 RDI: 0000000000000004 [ 762.383774][T14795] RBP: 00007f5669498090 R08: 0000000000000000 R09: 0000000000000000 [ 762.383780][T14795] R10: 0000000100000500 R11: 0000000000000246 R12: 0000000000000002 [ 762.383786][T14795] R13: 00007f5668816038 R14: 00007f5668815fa0 R15: 00007ffd918d3008 [ 762.383800][T14795] [ 762.440582][ T24] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 762.447977][T14797] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2347'. [ 762.512451][T14798] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=14798 comm=syz.2.2347 [ 762.892531][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 762.914741][ T24] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 762.941726][T14811] hpfs: hpfs_map_sector(): read error [ 762.947181][ T24] usb 1-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 762.980904][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 763.254980][ T24] usb 1-1: config 0 descriptor?? [ 763.505471][T14817] binder_alloc: binder_alloc_mmap_handler: 14816 200000ffe000-200001000000 already mapped failed -16 [ 763.591372][T14819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 763.624896][T14819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 763.969884][T14827] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 763.987630][T14827] bridge0: port 2(bridge_slave_1) entered disabled state [ 763.995335][T14827] bridge0: port 1() entered disabled state [ 764.100320][ T5867] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 764.261958][ T5867] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 764.270069][ T5867] usb 5-1: config 0 has no interface number 0 [ 764.276258][ T5867] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 764.287231][ T5867] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 764.297032][ T5867] usb 5-1: config 0 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 764.309898][ T5867] usb 5-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 764.318991][ T5867] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 764.327999][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.338034][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.338995][ T5867] usb 5-1: config 0 descriptor?? [ 764.360322][ T5921] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 764.511862][ T5921] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 764.522115][ T5921] usb 2-1: config 0 interface 0 has no altsetting 0 [ 764.531178][ T5921] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 764.540333][ T5921] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 764.548503][ T5921] usb 2-1: Product: syz [ 764.553522][ T5921] usb 2-1: Manufacturer: syz [ 764.558126][ T5921] usb 2-1: SerialNumber: syz [ 764.565731][ T5921] usb 2-1: config 0 descriptor?? [ 764.573360][T14825] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 764.576045][ T5921] usb 2-1: selecting invalid altsetting 0 [ 764.588871][T14825] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 764.797246][T14829] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2359'. [ 764.813002][ T5921] usb 2-1: USB disconnect, device number 71 [ 765.006881][ T5867] uclogic 0003:28BD:0042.001E: failed retrieving string descriptor #100: -71 [ 765.016876][ T5867] uclogic 0003:28BD:0042.001E: failed retrieving pen parameters: -71 [ 765.032339][ T5867] uclogic 0003:28BD:0042.001E: pen probing failed: -71 [ 765.046570][ T5867] uclogic 0003:28BD:0042.001E: failed probing parameters: -71 [ 765.054402][ T5867] uclogic 0003:28BD:0042.001E: probe with driver uclogic failed with error -71 [ 765.066998][ T5867] usb 5-1: USB disconnect, device number 81 [ 765.096712][T14836] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2361'. [ 765.141283][ T24] usbhid 1-1:0.0: can't add hid device: -71 [ 765.152548][ T24] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 765.164049][ T24] usb 1-1: USB disconnect, device number 82 [ 765.486923][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.500426][ T6009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.933307][T14852] binder_alloc: binder_alloc_mmap_handler: 14851 200000ffe000-200001000000 already mapped failed -16 [ 766.002904][ T5921] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 766.062569][T14860] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2367'. [ 766.523157][ T24] hid-generic 0003:0004:FFFFFFFE.001F: unknown main item tag 0x0 [ 766.534040][ T24] hid-generic 0003:0004:FFFFFFFE.001F: unknown main item tag 0x0 [ 766.542085][ T24] hid-generic 0003:0004:FFFFFFFE.001F: unknown main item tag 0x0 [ 766.557829][ T24] hid-generic 0003:0004:FFFFFFFE.001F: hidraw0: USB HID v4.00 Device [syz0] on syz1 [ 766.580078][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 766.649321][T14872] fido_id[14872]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 766.801959][ T6036] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 766.853984][T14883] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2370'. [ 766.971858][T14884] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 767.038601][T14884] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 767.210307][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.600886][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.627272][T14898] binder_alloc: binder_alloc_mmap_handler: 14897 200000ffe000-200001000000 already mapped failed -16 [ 767.736381][ T29] audit: type=1400 audit(2000000050.782:1268): avc: denied { setopt } for pid=14899 comm="syz.4.2378" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 768.080474][ T6036] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.901688][ T29] audit: type=1400 audit(2000000051.952:1269): avc: denied { bind } for pid=14915 comm="syz.4.2383" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 768.954889][ T29] audit: type=1400 audit(2000000051.972:1270): avc: denied { write } for pid=14915 comm="syz.4.2383" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 769.069144][T14918] netlink: 'syz.4.2384': attribute type 1 has an invalid length. [ 769.297588][T14923] binder: 14922:14923 ioctl c018620b 200000000440 returned -14 [ 769.311346][ T29] audit: type=1400 audit(2000000052.362:1271): avc: denied { create } for pid=14922 comm="syz.4.2386" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 769.386304][T14927] binder_alloc: binder_alloc_mmap_handler: 14926 200000ffe000-200001000000 already mapped failed -16 [ 769.476297][ T5818] Bluetooth: hci2: unexpected cc 0x2010 length: 69 > 1 [ 769.483911][ T5818] Bluetooth: hci2: unexpected event for opcode 0x2010 [ 769.683836][ T47] net_ratelimit: 3 callbacks suppressed [ 769.683848][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 769.796552][T14936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 769.809290][T14936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 769.890023][ T47] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 770.039968][ T47] usb 2-1: Using ep0 maxpacket: 16 [ 770.046372][ T47] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 770.056748][ T47] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 770.068554][ T47] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 770.078877][ T47] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 770.088800][ T47] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 770.102868][ T47] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 770.112189][ T47] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 770.120539][ T47] usb 2-1: Manufacturer: syz [ 770.126592][ T47] usb 2-1: config 0 descriptor?? [ 770.374737][T14940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 770.384818][T14940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 770.391048][ T47] rc_core: IR keymap rc-hauppauge not found [ 770.398577][ T47] Registered IR keymap rc-empty [ 770.399855][ T6036] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.403833][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.430021][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.450662][ T47] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 770.464395][ T47] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input91 [ 770.478136][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.500032][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.520109][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.540044][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.560291][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.580030][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.602254][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.630012][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.650662][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.680014][ T47] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 770.701526][ T47] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 770.710659][ T47] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 770.720107][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.794580][ T24] usb 2-1: USB disconnect, device number 72 [ 771.125698][ T5860] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 771.401399][ T5860] usb 5-1: config index 0 descriptor too short (expected 45, got 36) [ 771.409529][ T5860] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 771.430240][ T5860] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 771.450155][ T5860] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 771.489868][ T5860] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 771.510185][ T5860] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 771.510252][ T29] audit: type=1400 audit(2000000054.563:1272): avc: denied { read } for pid=14960 comm="syz.1.2400" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 771.519212][ T5860] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 771.541274][ T5860] usb 5-1: config 0 descriptor?? [ 771.581676][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.597203][T14944] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 771.605608][ T29] audit: type=1400 audit(2000000054.593:1273): avc: denied { append } for pid=14960 comm="syz.1.2400" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 771.632165][ T29] audit: type=1400 audit(2000000054.593:1274): avc: denied { map } for pid=14960 comm="syz.1.2400" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 771.715015][ T29] audit: type=1400 audit(2000000054.593:1275): avc: denied { execute } for pid=14960 comm="syz.1.2400" path="/dev/fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 771.764240][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.800100][ T29] audit: type=1400 audit(2000000054.623:1276): avc: denied { mount } for pid=14953 comm="syz.2.2397" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 771.829294][ T29] audit: type=1400 audit(2000000054.793:1277): avc: denied { watch watch_reads } for pid=14953 comm="syz.2.2397" path="/524" dev="tmpfs" ino=2783 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 772.065278][ T5860] plantronics 0003:047F:FFFF.0020: unknown main item tag 0x0 [ 772.072915][ T5860] plantronics 0003:047F:FFFF.0020: unknown main item tag 0x0 [ 772.143537][ T5921] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.169135][ T5860] plantronics 0003:047F:FFFF.0020: unknown main item tag 0x0 [ 772.183331][ T5860] plantronics 0003:047F:FFFF.0020: unknown main item tag 0x0 [ 772.215593][ T5860] plantronics 0003:047F:FFFF.0020: unknown main item tag 0x0 [ 772.240729][ T5860] plantronics 0003:047F:FFFF.0020: unknown main item tag 0x0 [ 772.270824][ T5860] plantronics 0003:047F:FFFF.0020: unknown main item tag 0x0 [ 772.298217][ T5860] plantronics 0003:047F:FFFF.0020: unknown main item tag 0x0 [ 772.324476][ T5860] plantronics 0003:047F:FFFF.0020: unknown main item tag 0x0 [ 772.348156][ T5860] plantronics 0003:047F:FFFF.0020: unknown main item tag 0x0 [ 772.399208][ T5860] plantronics 0003:047F:FFFF.0020: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 773.510056][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.580329][T14982] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 773.602278][ T5921] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.704012][ T47] usb 5-1: USB disconnect, device number 82 [ 773.745335][ T6036] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.959741][ T5921] usb 4-1: new low-speed USB device number 82 using dummy_hcd [ 774.448816][ T5921] usb 4-1: config 0 interface 0 altsetting 41 endpoint 0x81 has invalid maxpacket 32, setting to 8 [ 774.768610][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.779695][ T5921] usb 4-1: config 0 interface 0 altsetting 41 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 774.807333][ T5921] usb 4-1: config 0 interface 0 has no altsetting 0 [ 775.138185][ T29] audit: type=1400 audit(2000000000.610:1278): avc: denied { shutdown } for pid=14997 comm="syz.0.2413" lport=9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 775.158920][ T24] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 775.270067][ T6011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.413926][ T24] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 776.115607][ T5860] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.230878][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 776.406571][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.422570][ T24] usb 5-1: config 0 descriptor?? [ 776.439027][ T24] cp210x 5-1:0.0: cp210x converter detected [ 776.480964][T15006] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 776.517712][T15012] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2415'. [ 776.528301][T15012] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.2415'. [ 776.549761][ T29] audit: type=1400 audit(2000000002.020:1279): avc: denied { module_load } for pid=15010 comm="syz.2.2415" path="/sys/power/pm_wakeup_irq" dev="sysfs" ino=1415 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 776.583068][T15006] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 776.669862][ T6021] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.702617][ T5921] usb 4-1: New USB device found, idVendor=046d, idProduct=c088, bcdDevice= 0.00 [ 776.722144][ T5921] usb 4-1: New USB device strings: Mfr=247, Product=0, SerialNumber=0 [ 776.751210][ T5921] usb 4-1: config 0 descriptor?? [ 776.771636][ T5921] usb 4-1: can't set config #0, error -71 [ 776.775879][T15006] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 776.829188][ T5921] usb 4-1: USB disconnect, device number 82 [ 776.895902][T15006] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 776.913457][T15018] binder_alloc: binder_alloc_mmap_handler: 15017 200000ffe000-200001000000 already mapped failed -16 [ 777.511511][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 777.543928][ T29] audit: type=1400 audit(2000000003.020:1280): avc: denied { mount } for pid=15021 comm="syz.1.2417" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 777.566162][T15022] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2566 sclass=netlink_route_socket pid=15022 comm=syz.1.2417 [ 777.623271][T15022] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2563 sclass=netlink_route_socket pid=15022 comm=syz.1.2417 [ 777.687257][ T24] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -71 [ 777.705565][T15022] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2569 sclass=netlink_route_socket pid=15022 comm=syz.1.2417 [ 777.728545][ T24] cp210x 5-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 777.737061][ T24] cp210x 5-1:0.0: GPIO initialisation failed: -71 [ 777.748900][T15022] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2582 sclass=netlink_route_socket pid=15022 comm=syz.1.2417 [ 777.770370][ T24] usb 5-1: cp210x converter now attached to ttyUSB0 [ 777.787822][ T24] usb 5-1: USB disconnect, device number 83 [ 777.804543][ T24] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 777.828549][T15022] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2582 sclass=netlink_route_socket pid=15022 comm=syz.1.2417 [ 777.843600][ T24] cp210x 5-1:0.0: device disconnected [ 777.850535][ T35] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 777.852918][T15022] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2563 sclass=netlink_route_socket pid=15022 comm=syz.1.2417 [ 777.871439][T15022] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2580 sclass=netlink_route_socket pid=15022 comm=syz.1.2417 [ 777.939212][ T29] audit: type=1400 audit(2000000003.410:1281): avc: denied { create } for pid=15031 comm="syz.2.2420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 778.015970][T15037] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 778.026564][ T29] audit: type=1400 audit(2000000003.500:1282): avc: denied { getopt } for pid=15031 comm="syz.2.2420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 778.048312][ T29] audit: type=1400 audit(2000000003.520:1283): avc: denied { write } for pid=15031 comm="syz.2.2420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 778.569871][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 778.699700][ T5921] usb 5-1: new full-speed USB device number 84 using dummy_hcd [ 778.876014][ T5921] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 778.925712][ T5921] usb 5-1: config 0 has no interface number 0 [ 778.936362][ T5921] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 778.946172][ T5921] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 778.955959][ T5921] usb 5-1: Product: syz [ 778.960754][ T5921] usb 5-1: Manufacturer: syz [ 778.965547][ T5921] usb 5-1: SerialNumber: syz [ 778.973228][ T5921] usb 5-1: config 0 descriptor?? [ 779.036049][T15050] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2423'. [ 779.248535][ T5874] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.380554][ T35] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.519564][ T5867] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 779.620361][ T29] audit: type=1326 audit(2000000005.100:1284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15054 comm="syz.1.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b81b9c629 code=0x7ffc0000 [ 779.680564][T15057] loop5: detected capacity change from 0 to 7 [ 779.689728][ T29] audit: type=1326 audit(2000000005.130:1285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15054 comm="syz.1.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7f2b81b9c629 code=0x7ffc0000 [ 779.703686][ T5867] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 779.723257][T15057] Dev loop5: unable to read RDB block 7 [ 779.730818][ T5867] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 779.730942][T15057] loop5: unable to read partition table [ 779.750999][ T29] audit: type=1326 audit(2000000005.130:1286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15054 comm="syz.1.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2b81b9c629 code=0x7ffc0000 [ 779.775514][ T5867] usb 1-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 779.775629][ T29] audit: type=1326 audit(2000000005.130:1287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15054 comm="syz.1.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f2b81b9c629 code=0x7ffc0000 [ 779.784874][T15057] loop5: partition table beyond EOD, truncated [ 779.815374][ T5867] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 779.825193][ T5867] usb 1-1: config 0 descriptor?? [ 779.835222][T15057] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 780.176916][ T29] kauditd_printk_skb: 35 callbacks suppressed [ 780.176932][ T29] audit: type=1400 audit(2000000005.650:1323): avc: denied { call } for pid=15043 comm="syz.4.2422" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 780.217363][ T29] audit: type=1400 audit(2000000005.650:1324): avc: denied { transfer } for pid=15043 comm="syz.4.2422" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 780.467719][ T5921] asix 5-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 780.478181][ T5921] asix 5-1:0.251 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 780.498655][ T5921] asix 5-1:0.251: probe with driver asix failed with error -71 [ 780.527927][ T5921] usb 5-1: USB disconnect, device number 84 [ 780.559725][ T6009] net_ratelimit: 1 callbacks suppressed [ 780.559749][ T6009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.639739][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.678848][ T29] audit: type=1400 audit(2000000006.150:1325): avc: denied { name_bind } for pid=15060 comm="syz.1.2427" path="socket:[55318]" dev="sockfs" ino=55318 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 780.726358][T15064] binder_alloc: binder_alloc_mmap_handler: 15063 200000ffe000-200001000000 already mapped failed -16 [ 780.818177][T15066] hpfs: hpfs_map_sector(): read error [ 781.197086][ T29] audit: type=1400 audit(2000000006.670:1326): avc: denied { append } for pid=15074 comm="syz.4.2433" name="video6" dev="devtmpfs" ino=940 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 781.469561][ T5921] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 781.549356][ T24] usb 4-1: new full-speed USB device number 83 using dummy_hcd [ 781.619580][ T5921] usb 5-1: Using ep0 maxpacket: 16 [ 781.626470][ T5921] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 781.636855][ T5921] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 781.648039][ T5921] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 781.670778][ T5921] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 781.680820][ T5921] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 781.689512][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.694694][ T5921] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 781.718971][ T5921] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 781.727958][ T6009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.736262][ T5921] usb 5-1: Manufacturer: syz [ 781.740766][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 781.751959][ T24] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 781.753615][ T5921] usb 5-1: config 0 descriptor?? [ 781.769715][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 781.770771][T15084] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 781.781186][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 781.797424][ T29] audit: type=1400 audit(2000000007.270:1327): avc: denied { ioctl } for pid=15083 comm="syz.1.2437" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x3b80 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 781.797943][T15084] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 781.823112][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 781.837111][T15084] overlayfs: NFS export requires an index dir, falling back to nfs_export=off. [ 781.949907][ T5867] usbhid 1-1:0.0: can't add hid device: -71 [ 781.956711][ T5867] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 781.969350][ T24] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 781.978395][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 781.989179][ T5867] usb 1-1: USB disconnect, device number 83 [ 782.002169][ T24] usb 4-1: Product: syz [ 782.006395][ T24] usb 4-1: Manufacturer: syz [ 782.011033][ T24] usb 4-1: SerialNumber: syz [ 782.021988][ T24] usb 4-1: config 0 descriptor?? [ 782.570143][T15093] Invalid ELF header magic: != ELF [ 783.093362][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.101494][ T5860] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.102002][ T29] audit: type=1400 audit(2000000007.970:1328): avc: denied { module_load } for pid=15090 comm="syz.1.2440" path=2F6D656D66643A20C736BE918D183229219A25A2D238D606070EFCFE128F2613AE254054A3B03E5CECA9F951403641108C6E7C202864656C6574656429 dev="hugetlbfs" ino=55386 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=system permissive=1 [ 783.149276][ T24] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 783.158543][ T24] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -5 [ 783.202415][ T24] usb 4-1: USB disconnect, device number 83 [ 783.209868][ T5860] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.273261][ T5921] rc_core: IR keymap rc-hauppauge not found [ 783.283887][ T5921] Registered IR keymap rc-empty [ 783.288808][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 783.689445][ T5867] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 783.749570][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 783.821184][ T5921] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 783.855078][ T5921] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input92 [ 783.873601][ T5867] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 783.889035][ T5867] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 783.909811][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 783.919973][ T5867] usb 1-1: New USB device found, idVendor=04f2, idProduct=1421, bcdDevice= 0.00 [ 783.929947][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 783.939310][ T5867] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 783.963932][ T5867] usb 1-1: config 0 descriptor?? [ 783.969610][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 784.022159][ T6009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.030907][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 784.049541][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 784.069350][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 784.089653][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 784.170172][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 784.283674][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 784.339212][ T5921] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 784.466751][ T5921] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 784.550668][ T5921] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 784.664614][ T5813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.700158][ T5921] usb 5-1: USB disconnect, device number 85 [ 785.070991][T15120] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2448'. [ 785.445103][ T1131] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.526265][ T5867] usbhid 1-1:0.0: can't add hid device: -71 [ 785.538856][ T5867] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 785.566105][ T5867] usb 1-1: USB disconnect, device number 84 [ 785.580225][ T5860] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 785.587759][T15120] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2448'. [ 785.682469][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.738411][T15138] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 785.744920][T15138] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 785.759075][ T5860] usb 2-1: Using ep0 maxpacket: 16 [ 785.764410][T15138] vhci_hcd vhci_hcd.0: Device attached [ 785.765650][ T5860] usb 2-1: config 0 has an invalid descriptor of length 31, skipping remainder of the config [ 785.781115][ T5860] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 785.793494][T15140] vhci_hcd: connection closed [ 785.793697][ T1131] vhci_hcd vhci_hcd.3: stop threads [ 785.793811][ T5860] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 785.802572][ T1131] vhci_hcd vhci_hcd.3: release socket [ 785.804912][ T5860] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 785.820158][ T1131] vhci_hcd vhci_hcd.3: disconnect device [ 785.829641][ T5860] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 785.848439][ T5860] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 785.857931][ T5860] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 785.866543][ T5860] usb 2-1: Manufacturer: syz [ 785.873809][ T5860] usb 2-1: config 0 descriptor?? [ 785.977394][ T29] audit: type=1400 audit(2000000011.450:1329): avc: denied { read } for pid=15134 comm="syz.2.2451" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 786.006471][ T29] audit: type=1400 audit(2000000011.450:1330): avc: denied { open } for pid=15134 comm="syz.2.2451" path="/dev/loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 786.031889][ T29] audit: type=1400 audit(2000000011.480:1331): avc: denied { ioctl } for pid=15134 comm="syz.2.2451" path="/dev/loop-control" dev="devtmpfs" ino=646 ioctlcmd=0x4c82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 786.129333][ T5860] rc_core: IR keymap rc-hauppauge not found [ 786.135344][ T5860] Registered IR keymap rc-empty [ 786.141269][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.159590][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.166834][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 786.189864][ T5860] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 786.212053][ T5860] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input93 [ 786.216329][T15147] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 786.234182][T15147] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 786.244220][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.269192][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.285852][T15125] block nbd4: shutting down sockets [ 786.291257][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.318769][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.349433][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.369697][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.517903][T15156] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 786.524440][T15156] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 786.548825][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.555240][T15156] vhci_hcd vhci_hcd.0: Device attached [ 786.564885][T15161] macsec1: entered promiscuous mode [ 786.569109][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.573723][T15161] bridge0: entered promiscuous mode [ 786.585160][T15158] vhci_hcd: connection closed [ 786.587276][ T6009] vhci_hcd vhci_hcd.4: stop threads [ 786.597457][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.604746][ T6009] vhci_hcd vhci_hcd.4: release socket [ 786.610752][ T6009] vhci_hcd vhci_hcd.4: disconnect device [ 786.620107][ T5860] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 786.627404][ T35] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 786.641241][ T5860] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 786.650701][ T5860] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 786.663249][ T5860] usb 2-1: USB disconnect, device number 73 [ 786.711601][T15167] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 786.718121][T15167] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 786.726507][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 786.730100][T15167] vhci_hcd vhci_hcd.0: Device attached [ 786.745411][T15169] vhci_hcd: connection closed [ 786.745687][ T1131] vhci_hcd vhci_hcd.0: stop threads [ 786.755961][ T1131] vhci_hcd vhci_hcd.0: release socket [ 786.763647][ T1131] vhci_hcd vhci_hcd.0: disconnect device [ 786.984513][T15174] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2461'. [ 787.417500][T15182] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 787.424028][T15182] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 787.519115][T15182] vhci_hcd vhci_hcd.0: Device attached [ 787.550237][T15190] vhci_hcd: connection closed [ 787.550431][ T6005] vhci_hcd vhci_hcd.4: stop threads [ 787.560544][ T6005] vhci_hcd vhci_hcd.4: release socket [ 787.566983][ T6005] vhci_hcd vhci_hcd.4: disconnect device [ 787.877644][ T1131] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.995960][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 788.401168][ T29] audit: type=1400 audit(2000000013.880:1332): avc: denied { append } for pid=15205 comm="syz.4.2471" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 788.433129][T15210] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2472'. [ 788.651765][T15225] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 788.658289][T15225] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 788.666231][T15225] vhci_hcd vhci_hcd.0: Device attached [ 788.674702][T15227] vhci_hcd: connection closed [ 788.674863][ T6009] vhci_hcd vhci_hcd.4: stop threads [ 788.685341][ T6009] vhci_hcd vhci_hcd.4: release socket [ 788.690753][ T6009] vhci_hcd vhci_hcd.4: disconnect device [ 789.039879][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.131154][ T1131] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.221918][ T5860] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.463284][ T29] audit: type=1804 audit(2000000014.940:1333): pid=15241 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.1.2483" name="/newroot/468/file1" dev="tmpfs" ino=2494 res=1 errno=0 [ 789.792495][ T5921] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 790.630148][ T5818] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 790.642586][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.971211][ T5921] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 790.996119][ T5921] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 791.044777][ T5921] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 791.075578][T15263] netlink: 'syz.2.2490': attribute type 10 has an invalid length. [ 791.092114][ T5921] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 791.118886][ T5921] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 791.145687][ T5921] usb 5-1: Product: syz [ 791.150079][ T5921] usb 5-1: Manufacturer: syz [ 791.154673][ T5921] usb 5-1: SerialNumber: syz [ 791.190273][ T5921] usb 5-1: config 0 descriptor?? [ 791.196154][T15240] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 791.215424][T15240] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 791.236583][ T5921] usb 5-1: ucan: probing device on interface #0 [ 791.297838][ T10] usb 2-1: new full-speed USB device number 74 using dummy_hcd [ 791.448867][ T6011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 791.601196][ T10] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 791.601226][ T10] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 791.601264][ T10] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 791.601307][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 791.712456][ T29] audit: type=1400 audit(2000000017.180:1334): avc: denied { checkpoint_restore } for pid=15271 comm="syz.3.2493" capability=40 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 791.832972][ T5921] usb 5-1: ucan: device reported invalid device info [ 791.833027][ T5921] usb 5-1: ucan: probe failed; try to update the device firmware [ 791.886657][ T10] usb 2-1: usb_control_msg returned -32 [ 791.886856][ T10] usbtmc 2-1:16.0: can't read capabilities [ 792.025374][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.068611][ T29] audit: type=1400 audit(2000000017.540:1335): avc: denied { ioctl } for pid=15238 comm="syz.4.2484" path="socket:[55884]" dev="sockfs" ino=55884 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 792.074364][ T5813] usb 5-1: USB disconnect, device number 86 [ 792.237974][T15277] netlink: 'syz.1.2488': attribute type 4 has an invalid length. [ 792.237996][T15277] netlink: 17 bytes leftover after parsing attributes in process `syz.1.2488'. [ 792.250689][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.279731][T15279] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 792.279788][T15279] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 792.280036][T15279] vhci_hcd vhci_hcd.0: Device attached [ 792.281123][T15280] vhci_hcd: connection closed [ 792.281257][ T6011] vhci_hcd vhci_hcd.2: stop threads [ 792.281277][ T6011] vhci_hcd vhci_hcd.2: release socket [ 792.281291][ T6011] vhci_hcd vhci_hcd.2: disconnect device [ 792.389023][T15284] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.418815][T15284] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.427060][T15284] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.440586][T15285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.449442][T15285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.459725][T15285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.481401][T15285] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.908691][ T5813] usb 5-1: new full-speed USB device number 87 using dummy_hcd [ 793.064283][ T5813] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 793.074579][ T5813] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 793.148582][ T5813] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 793.160907][ T5813] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 793.173113][ T5813] usb 5-1: config 0 descriptor?? [ 793.184599][ T5813] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 793.191556][ T5813] dvb-usb: bulk message failed: -22 (3/0) [ 793.241860][ T5813] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 793.264998][ T5813] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 793.281125][ T5813] usb 5-1: media controller created [ 793.292050][ T5813] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 793.350137][ T5813] dvb-usb: bulk message failed: -22 (6/0) [ 793.362561][ T5813] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 793.372750][T15310] No source specified [ 793.382455][T15310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 793.401035][T15293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 793.428227][T15293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 793.440125][T15310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 793.446299][ T5813] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input94 [ 793.463719][T15293] dvb-usb: bulk message failed: -22 (2/0) [ 793.489647][ T5813] dvb-usb: schedule remote query interval to 150 msecs. [ 793.508492][ T5813] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 793.551379][ T5813] usb 5-1: USB disconnect, device number 87 [ 793.596200][ T5813] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 793.677608][T15318] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2509'. [ 794.107511][ T5921] usb 2-1: USB disconnect, device number 74 [ 794.207224][T15325] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 794.213755][T15325] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 794.266866][T15325] vhci_hcd vhci_hcd.0: Device attached [ 794.293634][T15326] vhci_hcd: connection closed [ 794.297942][ T6005] vhci_hcd vhci_hcd.4: stop threads [ 794.308014][ T6005] vhci_hcd vhci_hcd.4: release socket [ 794.315204][ T6005] vhci_hcd vhci_hcd.4: disconnect device [ 795.008647][ T24] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 795.062982][ T5921] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 795.256273][ T5921] usb 1-1: device descriptor read/64, error -71 [ 795.476811][ T5813] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 795.499754][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 795.510689][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 795.520445][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 795.520702][ T5921] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 795.533427][ T24] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 795.550916][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 795.560676][ T24] usb 4-1: config 0 descriptor?? [ 795.628521][ T5813] usb 5-1: Using ep0 maxpacket: 16 [ 795.635368][ T5813] usb 5-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 149, changing to 11 [ 795.646602][ T5813] usb 5-1: config 1 interface 0 altsetting 1 endpoint 0x2 has an invalid bInterval 64, changing to 10 [ 795.657686][ T5813] usb 5-1: config 1 interface 0 has no altsetting 0 [ 795.668090][ T5813] usb 5-1: New USB device found, idVendor=1b1c, idProduct=1d00, bcdDevice= 0.40 [ 795.677304][ T5813] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 795.678756][ T5921] usb 1-1: device descriptor read/64, error -71 [ 795.685390][ T5813] usb 5-1: Product: 릅㋮甀妎羴㶘ꃒ랽堩䇺樲밝₏갧욅孍㢳砢좘ㅿ혱첫鬪憘혊㧒镉礦∨坛椼ᛁ尨焙ড়牳ῂ辰ﺯ뵣樗⹵䎶׉㠆쀲頍婓쭣䵍垡鄋 [ 795.710895][ T5813] usb 5-1: SerialNumber: syz [ 795.798831][ T5921] usb usb1-port1: attempt power cycle [ 795.887584][T15358] FAULT_INJECTION: forcing a failure. [ 795.887584][T15358] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 795.901722][T15358] CPU: 1 UID: 0 PID: 15358 Comm: syz.2.2521 Tainted: G L syzkaller #0 PREEMPT(full) [ 795.901743][T15358] Tainted: [L]=SOFTLOCKUP [ 795.901747][T15358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 795.901753][T15358] Call Trace: [ 795.901758][T15358] [ 795.901762][T15358] dump_stack_lvl+0x100/0x190 [ 795.901784][T15358] should_fail_ex.cold+0x5/0xa [ 795.901798][T15358] _copy_from_user+0x2e/0xd0 [ 795.901814][T15358] kstrtouint_from_user+0xd6/0x1d0 [ 795.901825][T15358] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 795.901835][T15358] ? __lock_acquire+0x4a5/0x2630 [ 795.901859][T15358] proc_fail_nth_write+0x83/0x220 [ 795.901874][T15358] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 795.901893][T15358] vfs_write+0x2aa/0x1070 [ 795.901915][T15358] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 795.901930][T15358] ? __pfx_vfs_write+0x10/0x10 [ 795.901947][T15358] ? __fget_files+0x215/0x3d0 [ 795.901961][T15358] ? __fget_files+0x21f/0x3d0 [ 795.901975][T15358] ksys_write+0x12a/0x250 [ 795.901991][T15358] ? __pfx_ksys_write+0x10/0x10 [ 795.902010][T15358] do_syscall_64+0x106/0xf80 [ 795.902021][T15358] ? clear_bhb_loop+0x40/0x90 [ 795.902035][T15358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 795.902046][T15358] RIP: 0033:0x7f80ded5cece [ 795.902055][T15358] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 795.902067][T15358] RSP: 002b:00007f80dfc78fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 795.902078][T15358] RAX: ffffffffffffffda RBX: 00007f80dfc796c0 RCX: 00007f80ded5cece [ 795.902087][T15358] RDX: 0000000000000001 RSI: 00007f80dfc790a0 RDI: 0000000000000004 [ 795.902095][T15358] RBP: 00007f80dfc79090 R08: 0000000000000000 R09: 0000000000000000 [ 795.902104][T15358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 795.902112][T15358] R13: 00007f80df016038 R14: 00007f80df015fa0 R15: 00007ffe8c6f5718 [ 795.902126][T15358] [ 796.101722][ T24] plantronics 0003:047F:FFFF.0021: reserved main item tag 0xd [ 796.133892][ T24] plantronics 0003:047F:FFFF.0021: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 796.158841][ T5921] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 796.199537][ T5921] usb 1-1: device descriptor read/8, error -71 [ 796.205881][ T29] audit: type=1400 audit(2000000021.681:1336): avc: denied { ioctl } for pid=15362 comm="syz.2.2523" path="socket:[56876]" dev="sockfs" ino=56876 ioctlcmd=0x8915 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 796.370913][ T10] usb 4-1: USB disconnect, device number 84 [ 796.478851][ T5921] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 796.509105][ T5921] usb 1-1: device descriptor read/8, error -71 [ 796.567320][ T29] audit: type=1400 audit(2000000022.041:1337): avc: denied { nlmsg_read } for pid=15367 comm="syz.2.2525" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 796.567358][T15368] netlink: 84 bytes leftover after parsing attributes in process `syz.2.2525'. [ 796.618779][ T5921] usb usb1-port1: unable to enumerate USB device [ 796.925172][T15373] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2526'. [ 796.935675][T15373] netlink: 'syz.2.2526': attribute type 6 has an invalid length. [ 796.943697][T15373] netlink: 'syz.2.2526': attribute type 5 has an invalid length. [ 796.951476][T15373] netlink: 'syz.2.2526': attribute type 4 has an invalid length. [ 797.200784][T13917] net_ratelimit: 265 callbacks suppressed [ 797.200812][T13917] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 797.438983][ T1131] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 797.460211][T15375] FAULT_INJECTION: forcing a failure. [ 797.460211][T15375] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 797.558720][T15375] CPU: 0 UID: 0 PID: 15375 Comm: syz.3.2527 Tainted: G L syzkaller #0 PREEMPT(full) [ 797.558751][T15375] Tainted: [L]=SOFTLOCKUP [ 797.558757][T15375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 797.558768][T15375] Call Trace: [ 797.558775][T15375] [ 797.558782][T15375] dump_stack_lvl+0x100/0x190 [ 797.558816][T15375] should_fail_ex.cold+0x5/0xa [ 797.558839][T15375] _copy_to_user+0x32/0xd0 [ 797.558865][T15375] simple_read_from_buffer+0xcb/0x170 [ 797.558894][T15375] proc_fail_nth_read+0x1af/0x230 [ 797.558919][T15375] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 797.558944][T15375] ? rw_verify_area+0xce/0x6d0 [ 797.558966][T15375] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 797.558989][T15375] vfs_read+0x1e4/0xb30 [ 797.559017][T15375] ? __pfx_vfs_read+0x10/0x10 [ 797.559040][T15375] ? __fget_files+0x215/0x3d0 [ 797.559063][T15375] ? __fget_files+0x21f/0x3d0 [ 797.559087][T15375] ksys_read+0x12a/0x250 [ 797.559112][T15375] ? __pfx_ksys_read+0x10/0x10 [ 797.559144][T15375] do_syscall_64+0x106/0xf80 [ 797.559160][T15375] ? clear_bhb_loop+0x40/0x90 [ 797.559182][T15375] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 797.559200][T15375] RIP: 0033:0x7f9a0795cece [ 797.559228][T15375] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 797.559245][T15375] RSP: 002b:00007f9a088defe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 797.559266][T15375] RAX: ffffffffffffffda RBX: 00007f9a088df6c0 RCX: 00007f9a0795cece [ 797.559278][T15375] RDX: 000000000000000f RSI: 00007f9a088df0a0 RDI: 0000000000000004 [ 797.559288][T15375] RBP: 00007f9a088df090 R08: 0000000000000000 R09: 0000000000000000 [ 797.559297][T15375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 797.559307][T15375] R13: 00007f9a07c16038 R14: 00007f9a07c15fa0 R15: 00007ffc9c89f1c8 [ 797.559332][T15375] [ 797.812202][T15377] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 797.818737][T15377] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 797.826583][T15377] vhci_hcd vhci_hcd.0: Device attached [ 797.833658][T15378] vhci_hcd: connection closed [ 797.863911][ T6005] vhci_hcd vhci_hcd.0: stop threads [ 797.877193][ T6005] vhci_hcd vhci_hcd.0: release socket [ 797.883049][ T6005] vhci_hcd vhci_hcd.0: disconnect device [ 798.164181][ T5813] usbhid 5-1:1.0: can't add hid device: -71 [ 798.178444][ T5813] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 798.212222][ T5813] usb 5-1: USB disconnect, device number 88 [ 798.228150][T15387] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2532'. [ 798.239428][T13917] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 798.391123][T15387] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 798.560503][ T5921] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 798.964482][T15400] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 798.973132][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.137779][T15403] netlink: 204220 bytes leftover after parsing attributes in process `syz.1.2538'. [ 799.221480][T15410] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2539'. [ 799.338771][ T6011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.575883][T13917] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.863365][T15418] FAULT_INJECTION: forcing a failure. [ 799.863365][T15418] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 799.948053][T15418] CPU: 0 UID: 0 PID: 15418 Comm: syz.0.2542 Tainted: G L syzkaller #0 PREEMPT(full) [ 799.948082][T15418] Tainted: [L]=SOFTLOCKUP [ 799.948088][T15418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 799.948098][T15418] Call Trace: [ 799.948104][T15418] [ 799.948112][T15418] dump_stack_lvl+0x100/0x190 [ 799.948144][T15418] should_fail_ex.cold+0x5/0xa [ 799.948167][T15418] _copy_to_user+0x32/0xd0 [ 799.948199][T15418] simple_read_from_buffer+0xcb/0x170 [ 799.948229][T15418] proc_fail_nth_read+0x1af/0x230 [ 799.948252][T15418] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 799.948275][T15418] ? rw_verify_area+0xce/0x6d0 [ 799.948296][T15418] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 799.948317][T15418] vfs_read+0x1e4/0xb30 [ 799.948345][T15418] ? __pfx_vfs_read+0x10/0x10 [ 799.948368][T15418] ? __fget_files+0x215/0x3d0 [ 799.948390][T15418] ? __fget_files+0x21f/0x3d0 [ 799.948414][T15418] ksys_read+0x12a/0x250 [ 799.948438][T15418] ? __pfx_ksys_read+0x10/0x10 [ 799.948460][T15418] ? v4l2_ioctl+0x1c5/0x250 [ 799.948486][T15418] do_syscall_64+0x106/0xf80 [ 799.948504][T15418] ? clear_bhb_loop+0x40/0x90 [ 799.948525][T15418] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 799.948543][T15418] RIP: 0033:0x7f7a2fb5cece [ 799.948559][T15418] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 799.948576][T15418] RSP: 002b:00007f7a30aecfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 799.948594][T15418] RAX: ffffffffffffffda RBX: 00007f7a30aed6c0 RCX: 00007f7a2fb5cece [ 799.948605][T15418] RDX: 000000000000000f RSI: 00007f7a30aed0a0 RDI: 0000000000000004 [ 799.948615][T15418] RBP: 00007f7a30aed090 R08: 0000000000000000 R09: 0000000000000000 [ 799.948625][T15418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 799.948636][T15418] R13: 00007f7a2fe16038 R14: 00007f7a2fe15fa0 R15: 00007fff869701f8 [ 799.948660][T15418] [ 800.353761][T13917] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 800.530868][T15428] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2545'. [ 800.576973][T13917] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 800.587339][T13917] usb 2-1: config 1 has an invalid descriptor of length 48, skipping remainder of the config [ 800.619355][T13917] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 800.638063][T13917] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 48, changing to 9 [ 800.649527][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 800.670468][T13917] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8240, setting to 1024 [ 800.704185][T13917] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 800.747697][T13917] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 800.756346][T13917] usb 2-1: Product: syz [ 800.761432][T13917] usb 2-1: Manufacturer: syz [ 800.820530][T13917] cdc_wdm 2-1:1.0: skipping garbage [ 800.826083][T13917] cdc_wdm 2-1:1.0: skipping garbage [ 800.988768][ T6005] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 801.086799][T15443] FAULT_INJECTION: forcing a failure. [ 801.086799][T15443] name failslab, interval 1, probability 0, space 0, times 0 [ 801.099865][T15443] CPU: 1 UID: 0 PID: 15443 Comm: syz.3.2550 Tainted: G L syzkaller #0 PREEMPT(full) [ 801.099894][T15443] Tainted: [L]=SOFTLOCKUP [ 801.099901][T15443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 801.099911][T15443] Call Trace: [ 801.099919][T15443] [ 801.099926][T15443] dump_stack_lvl+0x100/0x190 [ 801.099959][T15443] should_fail_ex.cold+0x5/0xa [ 801.099979][T15443] ? __lock_acquire+0x4a5/0x2630 [ 801.100010][T15443] should_failslab+0xc2/0x120 [ 801.100038][T15443] __kmalloc_cache_noprof+0x7a/0x6f0 [ 801.100058][T15443] ? xfrm_policy_alloc+0x9f/0x420 [ 801.100084][T15443] xfrm_policy_alloc+0x9f/0x420 [ 801.100106][T15443] pfkey_compile_policy+0x26d/0xab0 [ 801.100139][T15443] xfrm_user_policy+0x363/0xb50 [ 801.100162][T15443] ? __pfx_xfrm_user_policy+0x10/0x10 [ 801.100181][T15443] ? cap_capable+0x107/0x460 [ 801.100210][T15443] ? bpf_lsm_capable+0x9/0x10 [ 801.100230][T15443] ? ns_capable+0xd2/0xf0 [ 801.100261][T15443] do_ip_setsockopt+0x1b64/0x3310 [ 801.100289][T15443] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 801.100312][T15443] ? __pfx_sock_has_perm+0x10/0x10 [ 801.100339][T15443] ? selinux_netlbl_socket_setsockopt+0x134/0x470 [ 801.100362][T15443] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 801.100392][T15443] ip_setsockopt+0x5a/0xf0 [ 801.100418][T15443] tcp_setsockopt+0xa7/0x100 [ 801.100443][T15443] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 801.100467][T15443] do_sock_setsockopt+0xf3/0x1d0 [ 801.100491][T15443] __sys_setsockopt+0x195/0x220 [ 801.100523][T15443] __x64_sys_setsockopt+0xbd/0x160 [ 801.100550][T15443] ? do_syscall_64+0x95/0xf80 [ 801.100568][T15443] ? lockdep_hardirqs_on+0x78/0x100 [ 801.100586][T15443] do_syscall_64+0x106/0xf80 [ 801.100602][T15443] ? clear_bhb_loop+0x40/0x90 [ 801.100625][T15443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 801.100643][T15443] RIP: 0033:0x7f9a0799c629 [ 801.100660][T15443] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 801.100678][T15443] RSP: 002b:00007f9a0889d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 801.100696][T15443] RAX: ffffffffffffffda RBX: 00007f9a07c16180 RCX: 00007f9a0799c629 [ 801.100708][T15443] RDX: 0008008000000010 RSI: 0000000000000000 RDI: 0000000000000005 [ 801.100719][T15443] RBP: 00007f9a0889d090 R08: 00000000000000b8 R09: 0000000000000000 [ 801.100729][T15443] R10: 00002000000004c0 R11: 0000000000000246 R12: 0000000000000001 [ 801.100740][T15443] R13: 00007f9a07c16218 R14: 00007f9a07c16180 R15: 00007ffc9c89f1c8 [ 801.100765][T15443] [ 801.566504][T13917] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 801.572496][T13917] cdc_wdm 2-1:1.0: Unknown control protocol [ 801.600533][T13917] usb 2-1: USB disconnect, device number 75 [ 801.623560][ T10] hid_parser_main: 5 callbacks suppressed [ 801.623578][ T10] hid-generic 0003:0004:FFFFFFFE.0022: unknown main item tag 0x0 [ 801.643742][ T10] hid-generic 0003:0004:FFFFFFFE.0022: unknown main item tag 0x0 [ 801.652148][ T5921] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 801.660968][ T10] hid-generic 0003:0004:FFFFFFFE.0022: unknown main item tag 0x0 [ 801.672800][ T10] hid-generic 0003:0004:FFFFFFFE.0022: hidraw0: USB HID v4.00 Device [syz0] on syz1 [ 801.719634][T15452] fido_id[15452]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 801.780480][T15457] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 801.789162][T15457] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 801.828283][ T5921] usb 5-1: Using ep0 maxpacket: 16 [ 801.841573][ T5921] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 801.852998][ T5921] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87 [ 801.864876][ T5921] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 152, changing to 11 [ 801.924889][ T5921] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x87 has invalid maxpacket 8285, setting to 1024 [ 801.936143][ T5921] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 801.951124][ T5921] usb 5-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 801.960812][ T5921] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 801.968880][ T5921] usb 5-1: Product: syz [ 801.973178][ T5921] usb 5-1: Manufacturer: syz [ 801.977800][ T5921] usb 5-1: SerialNumber: syz [ 801.993905][ T5921] usb 5-1: config 0 descriptor?? [ 802.302081][ T5921] appledisplay 5-1:0.0: Error while getting initial brightness: -71 [ 802.313397][ T5921] appledisplay 5-1:0.0: probe with driver appledisplay failed with error -71 [ 802.335683][ T5921] usb 5-1: USB disconnect, device number 89 [ 802.398535][ T5935] net_ratelimit: 2 callbacks suppressed [ 802.398547][ T5935] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.545706][T15463] FAULT_INJECTION: forcing a failure. [ 802.545706][T15463] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 802.559566][T15463] CPU: 0 UID: 0 PID: 15463 Comm: syz.3.2555 Tainted: G L syzkaller #0 PREEMPT(full) [ 802.559594][T15463] Tainted: [L]=SOFTLOCKUP [ 802.559601][T15463] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 802.559611][T15463] Call Trace: [ 802.559617][T15463] [ 802.559624][T15463] dump_stack_lvl+0x100/0x190 [ 802.559657][T15463] should_fail_ex.cold+0x5/0xa [ 802.559680][T15463] _copy_to_user+0x32/0xd0 [ 802.559705][T15463] simple_read_from_buffer+0xcb/0x170 [ 802.559733][T15463] proc_fail_nth_read+0x1af/0x230 [ 802.559758][T15463] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 802.559783][T15463] ? rw_verify_area+0xce/0x6d0 [ 802.559805][T15463] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 802.559828][T15463] vfs_read+0x1e4/0xb30 [ 802.559856][T15463] ? __pfx_vfs_read+0x10/0x10 [ 802.559880][T15463] ? __fget_files+0x215/0x3d0 [ 802.559903][T15463] ? __fget_files+0x21f/0x3d0 [ 802.559927][T15463] ksys_read+0x12a/0x250 [ 802.559951][T15463] ? __pfx_ksys_read+0x10/0x10 [ 802.559974][T15463] ? v4l2_ioctl+0x1c5/0x250 [ 802.560000][T15463] do_syscall_64+0x106/0xf80 [ 802.560018][T15463] ? clear_bhb_loop+0x40/0x90 [ 802.560039][T15463] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 802.560057][T15463] RIP: 0033:0x7f9a0795cece [ 802.560072][T15463] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 802.560089][T15463] RSP: 002b:00007f9a088defe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 802.560106][T15463] RAX: ffffffffffffffda RBX: 00007f9a088df6c0 RCX: 00007f9a0795cece [ 802.560117][T15463] RDX: 000000000000000f RSI: 00007f9a088df0a0 RDI: 0000000000000004 [ 802.560127][T15463] RBP: 00007f9a088df090 R08: 0000000000000000 R09: 0000000000000000 [ 802.560138][T15463] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 802.560149][T15463] R13: 00007f9a07c16038 R14: 00007f9a07c15fa0 R15: 00007ffc9c89f1c8 [ 802.560174][T15463] [ 802.820359][ T5813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.831488][T15465] FAULT_INJECTION: forcing a failure. [ 802.831488][T15465] name failslab, interval 1, probability 0, space 0, times 0 [ 802.844767][T15465] CPU: 1 UID: 0 PID: 15465 Comm: syz.3.2557 Tainted: G L syzkaller #0 PREEMPT(full) [ 802.844795][T15465] Tainted: [L]=SOFTLOCKUP [ 802.844801][T15465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 802.844812][T15465] Call Trace: [ 802.844818][T15465] [ 802.844825][T15465] dump_stack_lvl+0x100/0x190 [ 802.844858][T15465] should_fail_ex.cold+0x5/0xa [ 802.844882][T15465] should_failslab+0xc2/0x120 [ 802.844910][T15465] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 802.844933][T15465] ? skb_clone+0x190/0x400 [ 802.844956][T15465] skb_clone+0x190/0x400 [ 802.844974][T15465] nfnetlink_rcv_batch+0x1cc/0x2880 [ 802.845003][T15465] ? kmem_cache_free+0x124/0x6a0 [ 802.845027][T15465] ? __lock_acquire+0x4a5/0x2630 [ 802.845058][T15465] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 802.845083][T15465] ? find_held_lock+0x2b/0x80 [ 802.845119][T15465] ? avc_has_perm_noaudit+0x145/0x3b0 [ 802.845148][T15465] ? __asan_memset+0x23/0x50 [ 802.845168][T15465] ? __nla_validate_parse+0x1e7/0x28b0 [ 802.845192][T15465] ? __pfx___nla_validate_parse+0x10/0x10 [ 802.845211][T15465] ? rcu_is_watching+0x12/0xc0 [ 802.845232][T15465] ? cap_capable+0x107/0x460 [ 802.845262][T15465] ? __nla_parse+0x40/0x60 [ 802.845283][T15465] nfnetlink_rcv+0x3bd/0x440 [ 802.845308][T15465] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 802.845340][T15465] netlink_unicast+0x5aa/0x870 [ 802.845365][T15465] ? __pfx_netlink_unicast+0x10/0x10 [ 802.845394][T15465] netlink_sendmsg+0x8b0/0xda0 [ 802.845418][T15465] ? __pfx_netlink_sendmsg+0x10/0x10 [ 802.845436][T15465] ? __might_fault+0x20/0x140 [ 802.845466][T15465] ____sys_sendmsg+0xa54/0xc30 [ 802.845490][T15465] ? __pfx_____sys_sendmsg+0x10/0x10 [ 802.845527][T15465] ___sys_sendmsg+0x190/0x1e0 [ 802.845551][T15465] ? __pfx____sys_sendmsg+0x10/0x10 [ 802.845599][T15465] __sys_sendmsg+0x170/0x220 [ 802.845616][T15465] ? __pfx___sys_sendmsg+0x10/0x10 [ 802.845647][T15465] do_syscall_64+0x106/0xf80 [ 802.845663][T15465] ? clear_bhb_loop+0x40/0x90 [ 802.845684][T15465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 802.845700][T15465] RIP: 0033:0x7f9a0799c629 [ 802.845715][T15465] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 802.845732][T15465] RSP: 002b:00007f9a088df028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 802.845747][T15465] RAX: ffffffffffffffda RBX: 00007f9a07c15fa0 RCX: 00007f9a0799c629 [ 802.845758][T15465] RDX: 000000000004c080 RSI: 00002000000000c0 RDI: 0000000000000003 [ 802.845768][T15465] RBP: 00007f9a088df090 R08: 0000000000000000 R09: 0000000000000000 [ 802.845779][T15465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 802.845789][T15465] R13: 00007f9a07c16038 R14: 00007f9a07c15fa0 R15: 00007ffc9c89f1c8 [ 802.845812][T15465] [ 803.126163][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 803.152770][T15470] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 803.228450][ T6011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 803.961606][ T5813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.307908][T15495] FAULT_INJECTION: forcing a failure. [ 804.307908][T15495] name failslab, interval 1, probability 0, space 0, times 0 [ 804.321263][T15495] CPU: 0 UID: 0 PID: 15495 Comm: syz.1.2567 Tainted: G L syzkaller #0 PREEMPT(full) [ 804.321291][T15495] Tainted: [L]=SOFTLOCKUP [ 804.321297][T15495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 804.321308][T15495] Call Trace: [ 804.321314][T15495] [ 804.321321][T15495] dump_stack_lvl+0x100/0x190 [ 804.321355][T15495] should_fail_ex.cold+0x5/0xa [ 804.321378][T15495] should_failslab+0xc2/0x120 [ 804.321405][T15495] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 804.321434][T15495] ? can_rx_register+0x582/0x6f0 [ 804.321459][T15495] ? lockdep_hardirqs_on+0x78/0x100 [ 804.321483][T15495] can_rx_register+0x582/0x6f0 [ 804.321507][T15495] ? __pfx_bcm_rx_handler+0x10/0x10 [ 804.321531][T15495] ? __pfx_can_rx_register+0x10/0x10 [ 804.321560][T15495] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 804.321590][T15495] bcm_sendmsg+0xcd0/0x44e0 [ 804.321622][T15495] ? __pfx_bcm_sendmsg+0x10/0x10 [ 804.321640][T15495] ? iovec_from_user+0xda/0x140 [ 804.321680][T15495] ____sys_sendmsg+0xa54/0xc30 [ 804.321704][T15495] ? __pfx_____sys_sendmsg+0x10/0x10 [ 804.321730][T15495] ? __pfx__kstrtoull+0x10/0x10 [ 804.321753][T15495] ___sys_sendmsg+0x190/0x1e0 [ 804.321777][T15495] ? __pfx____sys_sendmsg+0x10/0x10 [ 804.321812][T15495] ? find_held_lock+0x2b/0x80 [ 804.321851][T15495] __sys_sendmmsg+0x205/0x430 [ 804.321873][T15495] ? __pfx___sys_sendmmsg+0x10/0x10 [ 804.321898][T15495] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 804.321928][T15495] ? fput+0x79/0x100 [ 804.321947][T15495] ? ksys_write+0x1ac/0x250 [ 804.321972][T15495] ? __pfx_ksys_write+0x10/0x10 [ 804.322001][T15495] __x64_sys_sendmmsg+0x9c/0x100 [ 804.322018][T15495] ? lockdep_hardirqs_on+0x78/0x100 [ 804.322035][T15495] do_syscall_64+0x106/0xf80 [ 804.322051][T15495] ? clear_bhb_loop+0x40/0x90 [ 804.322073][T15495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 804.322092][T15495] RIP: 0033:0x7f2b81b9c629 [ 804.322109][T15495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 804.322126][T15495] RSP: 002b:00007f2b829f1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 804.322144][T15495] RAX: ffffffffffffffda RBX: 00007f2b81e15fa0 RCX: 00007f2b81b9c629 [ 804.322162][T15495] RDX: 040000000000003a RSI: 0000200000001b00 RDI: 0000000000000007 [ 804.322173][T15495] RBP: 00007f2b829f1090 R08: 0000000000000000 R09: 0000000000000000 [ 804.322184][T15495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 804.322194][T15495] R13: 00007f2b81e16038 R14: 00007f2b81e15fa0 R15: 00007ffc55c95108 [ 804.322220][T15495] [ 804.638203][ T5935] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.708022][ T5921] usb 5-1: new full-speed USB device number 90 using dummy_hcd [ 804.724805][T15497] input: syz1 as /devices/virtual/input/input96 [ 804.870308][ T5921] usb 5-1: config 0 has an invalid interface number: 29 but max is 0 [ 804.870345][ T5921] usb 5-1: config 0 has no interface number 0 [ 804.870387][ T5921] usb 5-1: config 0 interface 29 has no altsetting 0 [ 804.873301][ T5921] usb 5-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 804.873334][ T5921] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 804.873361][ T5921] usb 5-1: Product: syz [ 804.873386][ T5921] usb 5-1: Manufacturer: syz [ 804.873410][ T5921] usb 5-1: SerialNumber: syz [ 804.877530][ T5921] usb 5-1: config 0 descriptor?? [ 804.918753][ T6005] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 805.038604][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 805.145875][ T5921] peak_usb 5-1:0.29 can0: unable to request usb[type=0 value=1] err=-32 [ 805.145907][ T5921] peak_usb 5-1:0.29: unable to read PCAN-USB X6 firmware info (err -32) [ 805.309084][ T5921] peak_usb 5-1:0.29: probe with driver peak_usb failed with error -32 [ 805.469944][ T5921] usb 5-1: USB disconnect, device number 90 [ 806.754446][ T5813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.834607][T15533] FAULT_INJECTION: forcing a failure. [ 806.834607][T15533] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 806.889887][T15533] CPU: 1 UID: 0 PID: 15533 Comm: syz.1.2576 Tainted: G L syzkaller #0 PREEMPT(full) [ 806.889917][T15533] Tainted: [L]=SOFTLOCKUP [ 806.889922][T15533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 806.889931][T15533] Call Trace: [ 806.889936][T15533] [ 806.889943][T15533] dump_stack_lvl+0x100/0x190 [ 806.889972][T15533] should_fail_ex.cold+0x5/0xa [ 806.889994][T15533] _copy_from_user+0x2e/0xd0 [ 806.890017][T15533] copy_msghdr_from_user+0x9f/0x4f0 [ 806.890039][T15533] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 806.890072][T15533] ___sys_sendmsg+0x106/0x1e0 [ 806.890095][T15533] ? __pfx____sys_sendmsg+0x10/0x10 [ 806.890145][T15533] __sys_sendmsg+0x170/0x220 [ 806.890163][T15533] ? __pfx___sys_sendmsg+0x10/0x10 [ 806.890193][T15533] do_syscall_64+0x106/0xf80 [ 806.890211][T15533] ? clear_bhb_loop+0x40/0x90 [ 806.890233][T15533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 806.890250][T15533] RIP: 0033:0x7f2b81b9c629 [ 806.890265][T15533] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 806.890281][T15533] RSP: 002b:00007f2b829af028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 806.890298][T15533] RAX: ffffffffffffffda RBX: 00007f2b81e16180 RCX: 00007f2b81b9c629 [ 806.890309][T15533] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000005 [ 806.890318][T15533] RBP: 00007f2b829af090 R08: 0000000000000000 R09: 0000000000000000 [ 806.890328][T15533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 806.890338][T15533] R13: 00007f2b81e16218 R14: 00007f2b81e16180 R15: 00007ffc55c95108 [ 806.890359][T15533] [ 807.357304][ T6009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 807.678340][ T5935] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.684172][ T5921] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 808.693505][T13917] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 808.757934][ T5813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.819888][T15565] FAULT_INJECTION: forcing a failure. [ 808.819888][T15565] name failslab, interval 1, probability 0, space 0, times 0 [ 808.847668][ T5921] usb 4-1: New USB device found, idVendor=0451, idProduct=3410, bcdDevice=ef.1e [ 808.868205][ T5921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 808.882071][ T5921] usb 4-1: Product: syz [ 808.886685][ T5921] usb 4-1: Manufacturer: syz [ 808.891490][ T5921] usb 4-1: SerialNumber: syz [ 808.897453][ T5921] usb 4-1: config 0 descriptor?? [ 808.909441][ T5921] ti_usb_3410_5052 4-1:0.0: required endpoints missing [ 808.921637][T13917] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 808.931255][T15565] CPU: 1 UID: 0 PID: 15565 Comm: syz.4.2577 Tainted: G L syzkaller #0 PREEMPT(full) [ 808.931282][T15565] Tainted: [L]=SOFTLOCKUP [ 808.931289][T15565] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 808.931299][T15565] Call Trace: [ 808.931305][T15565] [ 808.931312][T15565] dump_stack_lvl+0x100/0x190 [ 808.931344][T15565] should_fail_ex.cold+0x5/0xa [ 808.931366][T15565] ? blk_rq_map_user_iov+0x2a5/0x14c0 [ 808.931398][T15565] should_failslab+0xc2/0x120 [ 808.931427][T15565] __kmalloc_noprof+0xe0/0x850 [ 808.931455][T15565] blk_rq_map_user_iov+0x2a5/0x14c0 [ 808.931486][T15565] ? sbitmap_get+0x1d7/0x360 [ 808.931503][T15565] ? __pfx_blk_rq_map_user_iov+0x10/0x10 [ 808.931532][T15565] ? __import_iovec+0x1d2/0x640 [ 808.931555][T15565] ? lockdep_hardirqs_off+0xc0/0xe0 [ 808.931575][T15565] ? register_lock_class+0x40/0x560 [ 808.931596][T15565] ? import_iovec+0x101/0x130 [ 808.931623][T15565] blk_rq_map_user_io.part.0+0x280/0x2c0 [ 808.931653][T15565] ? __pfx_blk_rq_map_user_io.part.0+0x10/0x10 [ 808.931679][T15565] ? __lock_acquire+0x4a5/0x2630 [ 808.931722][T15565] ? rcu_is_watching+0x12/0xc0 [ 808.931742][T15565] ? find_held_lock+0x2b/0x80 [ 808.931763][T15565] ? sg_common_write.isra.0+0xe26/0x1b90 [ 808.931784][T15565] ? sg_common_write.isra.0+0xe26/0x1b90 [ 808.931808][T15565] blk_rq_map_user_io+0xe3/0x230 [ 808.931837][T15565] ? __pfx_blk_rq_map_user_io+0x10/0x10 [ 808.931863][T15565] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 808.931886][T15565] ? avc_has_perm_noaudit+0x145/0x3b0 [ 808.931915][T15565] sg_common_write.isra.0+0xf74/0x1b90 [ 808.931947][T15565] ? __pfx_sg_common_write.isra.0+0x10/0x10 [ 808.931969][T15565] ? bpf_lsm_capable+0x9/0x10 [ 808.931985][T15565] ? security_capable+0x80/0x260 [ 808.932013][T15565] ? capable+0xd3/0xf0 [ 808.932035][T15565] sg_new_write.isra.0+0x5b9/0xb10 [ 808.932058][T15565] ? __pfx_sg_new_write.isra.0+0x10/0x10 [ 808.932105][T15565] sg_ioctl+0x357/0x27a0 [ 808.932127][T15565] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 808.932152][T15565] ? __pfx_sg_ioctl+0x10/0x10 [ 808.932173][T15565] ? __fget_files+0x215/0x3d0 [ 808.932189][T15565] ? hook_file_ioctl_common+0x146/0x410 [ 808.932219][T15565] ? selinux_file_ioctl+0x139/0x290 [ 808.932237][T15565] ? selinux_file_ioctl+0xb4/0x290 [ 808.932257][T15565] ? __pfx_sg_ioctl+0x10/0x10 [ 808.932276][T15565] __x64_sys_ioctl+0x18e/0x210 [ 808.932303][T15565] do_syscall_64+0x106/0xf80 [ 808.932315][T15565] ? clear_bhb_loop+0x40/0x90 [ 808.932328][T15565] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.932339][T15565] RIP: 0033:0x7f566859c629 [ 808.932348][T15565] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 808.932358][T15565] RSP: 002b:00007f5669498028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 808.932369][T15565] RAX: ffffffffffffffda RBX: 00007f5668815fa0 RCX: 00007f566859c629 [ 808.932382][T15565] RDX: 00002000000004c0 RSI: 0000000000002285 RDI: 0000000000000003 [ 808.932389][T15565] RBP: 00007f5669498090 R08: 0000000000000000 R09: 0000000000000000 [ 808.932395][T15565] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 808.932401][T15565] R13: 00007f5668816038 R14: 00007f5668815fa0 R15: 00007ffd918d3008 [ 808.932415][T15565] [ 809.258628][T13917] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 809.269353][T13917] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 809.278330][T13917] usb 2-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 809.289793][T13917] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 809.300921][T13917] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 809.319347][T13917] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 809.328425][T13917] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 809.336394][T13917] usb 2-1: Product: syz [ 809.340586][T13917] usb 2-1: Manufacturer: syz [ 809.368137][T15556] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 809.469626][ T5921] usb 4-1: USB disconnect, device number 85 [ 809.470047][T13917] cdc_wdm 2-1:1.0: skipping garbage [ 809.481182][T13917] cdc_wdm 2-1:1.0: skipping garbage [ 809.490378][T13917] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 809.496291][T13917] cdc_wdm 2-1:1.0: Unknown control protocol [ 809.668876][ T6011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 809.684819][T15556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 809.703985][T15556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 809.722668][T15556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 809.741603][T15556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 809.763066][ C0] wdm_int_callback: 2 callbacks suppressed [ 809.763088][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 809.775461][ C0] wdm_int_callback: 2 callbacks suppressed [ 809.775474][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 809.788044][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 809.794615][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 809.800975][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 809.807551][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 809.813851][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 809.820427][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 809.827238][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 809.833827][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 809.840163][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 809.846749][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 809.853272][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 809.859855][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 809.866088][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 809.872681][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 809.879343][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 809.884761][T13917] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 809.885928][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 809.900531][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 809.907105][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 809.924631][ T5813] usb 2-1: USB disconnect, device number 76 [ 809.924650][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 810.257776][T13917] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 810.448245][T13917] usb 4-1: Using ep0 maxpacket: 32 [ 810.466601][T13917] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 810.487746][T13917] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 810.507903][T13917] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 810.516948][T13917] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 810.548382][T13917] usb 4-1: config 0 descriptor?? [ 810.717880][ T5921] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.817905][ T6005] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.881565][T15583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 810.890645][T15583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 810.924705][T15583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 810.949597][T15583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 810.958073][ T5813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.970593][ T5921] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 810.978659][ T5874] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 810.995696][T13917] ft260 0003:0403:6030.0023: unknown main item tag 0x0 [ 811.002859][T13917] ft260 0003:0403:6030.0023: unknown main item tag 0x0 [ 811.137683][ T5874] usb 5-1: Using ep0 maxpacket: 32 [ 811.143386][ T5921] usb 2-1: Using ep0 maxpacket: 16 [ 811.150847][ T5874] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 811.161934][ T5921] usb 2-1: config 0 has an invalid descriptor of length 40, skipping remainder of the config [ 811.172326][ T5874] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 811.182414][ T5921] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 811.193350][ T5874] usb 5-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 811.194128][T13917] ft260 0003:0403:6030.0023: chip code: 0000 0000 [ 811.202801][ T10] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 811.217451][ T5921] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 811.227188][ T5874] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 811.235337][ T5921] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 811.247716][ T5874] usb 5-1: config 0 descriptor?? [ 811.257746][ T5921] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 811.276202][ T5921] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 811.285445][ T5921] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 811.293489][ T5921] usb 2-1: Manufacturer: syz [ 811.300569][ T5921] usb 2-1: config 0 descriptor?? [ 811.387927][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 811.394676][ T10] usb 1-1: config 0 has an invalid interface number: 85 but max is 0 [ 811.394879][T13917] ft260 0003:0403:6030.0023: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.3-1/input0 [ 811.402981][ T10] usb 1-1: config 0 has no interface number 0 [ 811.419936][ T10] usb 1-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 811.431126][ T10] usb 1-1: config 0 interface 85 has no altsetting 0 [ 811.439887][ T10] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 811.449357][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.457386][ T10] usb 1-1: Product: syz [ 811.461836][ T10] usb 1-1: Manufacturer: syz [ 811.466486][ T10] usb 1-1: SerialNumber: syz [ 811.473387][ T10] usb 1-1: config 0 descriptor?? [ 811.619757][T13917] ft260 0003:0403:6030.0023: failed to retrieve status: -32, no wakeup [ 811.651177][T13917] ft260 0003:0403:6030.0023: failed to retrieve status: -5 [ 811.677905][ T5921] rc_core: IR keymap rc-hauppauge not found [ 811.685258][ T5921] Registered IR keymap rc-empty [ 811.771688][ T5874] ft260 0003:0403:6030.0024: unknown main item tag 0x0 [ 811.782060][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 811.792850][ T5874] ft260 0003:0403:6030.0024: unknown main item tag 0x0 [ 811.819158][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 811.892710][T13917] ft260 0003:0403:6030.0023: failed to reset I2C controller: -71 [ 811.892961][ T5921] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 811.937414][T13917] usb 4-1: USB disconnect, device number 86 [ 811.949209][ T6036] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.949638][ T5874] ft260 0003:0403:6030.0024: chip code: 0000 0000 [ 811.975112][ T5921] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input98 [ 811.999462][ T1205] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 812.007612][ T1205] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 812.040502][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 812.067811][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 812.087930][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 812.107765][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 812.127844][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 812.135406][ T10] appletouch 1-1:0.85: Geyser mode initialized. [ 812.143450][ T10] input: appletouch as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.85/input/input97 [ 812.153246][ T5874] ft260 0003:0403:6030.0024: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.4-1/input0 [ 812.169923][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 812.197669][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 812.219613][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 812.258633][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 812.296011][ T5921] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 812.329526][ T5921] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 812.339277][ T5921] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 812.353074][ T5921] usb 2-1: USB disconnect, device number 77 [ 812.359557][ T5874] ft260 0003:0403:6030.0024: failed to retrieve status: -32, no wakeup [ 812.376695][ T5874] ft260 0003:0403:6030.0024: failed to retrieve status: -5 [ 812.647020][T15599] FAULT_INJECTION: forcing a failure. [ 812.647020][T15599] name failslab, interval 1, probability 0, space 0, times 0 [ 812.661746][T15599] CPU: 1 UID: 0 PID: 15599 Comm: syz.3.2598 Tainted: G L syzkaller #0 PREEMPT(full) [ 812.661776][T15599] Tainted: [L]=SOFTLOCKUP [ 812.661782][T15599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 812.661793][T15599] Call Trace: [ 812.661799][T15599] [ 812.661806][T15599] dump_stack_lvl+0x100/0x190 [ 812.661840][T15599] should_fail_ex.cold+0x5/0xa [ 812.661864][T15599] ? tomoyo_encode2+0xfb/0x3c0 [ 812.661883][T15599] should_failslab+0xc2/0x120 [ 812.661910][T15599] __kmalloc_noprof+0xe0/0x850 [ 812.661932][T15599] ? d_absolute_path+0x136/0x1b0 [ 812.661961][T15599] tomoyo_encode2+0xfb/0x3c0 [ 812.661985][T15599] tomoyo_encode+0x29/0x50 [ 812.662004][T15599] tomoyo_realpath_from_path+0x18c/0x690 [ 812.662032][T15599] tomoyo_path_number_perm+0x23c/0x580 [ 812.662059][T15599] ? tomoyo_path_number_perm+0x22e/0x580 [ 812.662088][T15599] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 812.662121][T15599] ? rcu_read_unlock+0x17/0x60 [ 812.662162][T15599] ? current_check_access_path+0x281/0x460 [ 812.662190][T15599] ? __pfx_current_check_access_path+0x10/0x10 [ 812.662215][T15599] ? _raw_spin_unlock+0x28/0x50 [ 812.662244][T15599] ? lookup_one_qstr_excl+0xb3/0x250 [ 812.662270][T15599] tomoyo_path_mkdir+0x9b/0xe0 [ 812.662292][T15599] ? __pfx_tomoyo_path_mkdir+0x10/0x10 [ 812.662323][T15599] security_path_mkdir+0x154/0x2e0 [ 812.662348][T15599] filename_mkdirat+0x168/0x5e0 [ 812.662375][T15599] ? __pfx_filename_mkdirat+0x10/0x10 [ 812.662394][T15599] ? strncpy_from_user+0x19d/0x2d0 [ 812.662420][T15599] ? do_getname+0x191/0x390 [ 812.662443][T15599] __x64_sys_mkdirat+0x89/0xc0 [ 812.662463][T15599] do_syscall_64+0x106/0xf80 [ 812.662479][T15599] ? clear_bhb_loop+0x40/0x90 [ 812.662503][T15599] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 812.662521][T15599] RIP: 0033:0x7f9a0799c629 [ 812.662537][T15599] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 812.662554][T15599] RSP: 002b:00007f9a088df028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 812.662571][T15599] RAX: ffffffffffffffda RBX: 00007f9a07c15fa0 RCX: 00007f9a0799c629 [ 812.662583][T15599] RDX: 0000000000000002 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 812.662594][T15599] RBP: 00007f9a088df090 R08: 0000000000000000 R09: 0000000000000000 [ 812.662604][T15599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 812.662614][T15599] R13: 00007f9a07c16038 R14: 00007f9a07c15fa0 R15: 00007ffc9c89f1c8 [ 812.662640][T15599] [ 812.662784][T15599] ERROR: Out of memory at tomoyo_realpath_from_path. [ 812.750417][ T5874] ft260 0003:0403:6030.0024: failed to reset I2C controller: -71 [ 812.916358][ T29] audit: type=1400 audit(2000000038.392:1338): avc: denied { rename } for pid=15598 comm="syz.3.2598" name="file0" dev="tmpfs" ino=2751 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 812.957381][ T5874] usb 5-1: USB disconnect, device number 91 [ 813.038112][T13917] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 813.060743][T15603] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 813.067245][T15603] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 813.077847][T15603] vhci_hcd vhci_hcd.0: Device attached [ 813.087888][T15605] vhci_hcd: connection closed [ 813.088181][ T6005] vhci_hcd vhci_hcd.1: stop threads [ 813.098369][ T6005] vhci_hcd vhci_hcd.1: release socket [ 813.103794][ T6005] vhci_hcd vhci_hcd.1: disconnect device [ 813.128591][ T6009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 813.156474][T15608] autofs: Unknown parameter ']BLN:+E;' [ 813.286024][ T10] usb 4-1: new full-speed USB device number 87 using dummy_hcd [ 813.907874][ T5921] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 814.092066][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 814.147878][ T10] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 814.157689][ T5813] usb 1-1: USB disconnect, device number 89 [ 814.160003][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 814.191964][ T10] usb 4-1: Product: syz [ 814.196148][ T10] usb 4-1: Manufacturer: syz [ 814.207830][ T10] usb 4-1: SerialNumber: syz [ 814.257497][ T5813] appletouch 1-1:0.85: input: appletouch disconnected [ 814.258101][ T10] usb 4-1: config 0 descriptor?? [ 814.288401][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 814.894305][ T10] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 815.181918][ T5813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 815.809773][ T6036] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 816.001831][T15644] FAULT_INJECTION: forcing a failure. [ 816.001831][T15644] name failslab, interval 1, probability 0, space 0, times 0 [ 816.014686][T15644] CPU: 1 UID: 0 PID: 15644 Comm: syz.1.2610 Tainted: G L syzkaller #0 PREEMPT(full) [ 816.014714][T15644] Tainted: [L]=SOFTLOCKUP [ 816.014719][T15644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 816.014729][T15644] Call Trace: [ 816.014735][T15644] [ 816.014743][T15644] dump_stack_lvl+0x100/0x190 [ 816.014775][T15644] should_fail_ex.cold+0x5/0xa [ 816.014799][T15644] should_failslab+0xc2/0x120 [ 816.014826][T15644] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 816.014850][T15644] ? do_getname+0x35/0x390 [ 816.014874][T15644] do_getname+0x35/0x390 [ 816.014897][T15644] user_path_at+0x26/0x60 [ 816.014924][T15644] __x64_sys_mount+0x1fb/0x310 [ 816.014946][T15644] ? __pfx___x64_sys_mount+0x10/0x10 [ 816.014975][T15644] do_syscall_64+0x106/0xf80 [ 816.014992][T15644] ? clear_bhb_loop+0x40/0x90 [ 816.015014][T15644] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 816.015033][T15644] RIP: 0033:0x7f2b81b9c629 [ 816.015048][T15644] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 816.015072][T15644] RSP: 002b:00007f2b829f1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 816.015089][T15644] RAX: ffffffffffffffda RBX: 00007f2b81e15fa0 RCX: 00007f2b81b9c629 [ 816.015100][T15644] RDX: 0000200000000040 RSI: 0000200000000100 RDI: 0000000000000000 [ 816.015111][T15644] RBP: 00007f2b829f1090 R08: 0000200000000080 R09: 0000000000000000 [ 816.015122][T15644] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000001 [ 816.015132][T15644] R13: 00007f2b81e16038 R14: 00007f2b81e15fa0 R15: 00007ffc55c95108 [ 816.015155][T15644] [ 816.238842][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 816.924407][ T5813] hid-generic 0003:0004:FFFFFFFE.0025: unknown main item tag 0x0 [ 816.939230][ T5813] hid-generic 0003:0004:FFFFFFFE.0025: unknown main item tag 0x0 [ 816.967641][ T5874] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 817.125388][ T5813] hid-generic 0003:0004:FFFFFFFE.0025: unknown main item tag 0x0 [ 817.138430][ T6009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 817.148799][ T5813] hid-generic 0003:0004:FFFFFFFE.0025: hidraw0: USB HID v4.00 Device [syz0] on syz1 [ 817.169300][T15653] block nbd1: shutting down sockets [ 817.197076][T15664] fido_id[15664]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 817.384125][T15674] binder_alloc: 15673: binder_alloc_buf, no vma [ 817.993254][ T10] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 818.014073][ T10] usb 4-1: USB disconnect, device number 87 [ 818.225004][T15683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 818.245855][T15683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 818.269881][T15683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 818.287620][ T49] net_ratelimit: 1 callbacks suppressed [ 818.287635][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 818.297551][T15683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 818.319021][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 818.343676][ T29] audit: type=1400 audit(2000000043.822:1339): avc: denied { mount } for pid=15690 comm="syz.1.2626" name="/" dev="configfs" ino=1071 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 818.374552][ T29] audit: type=1400 audit(2000000043.822:1340): avc: denied { search } for pid=15690 comm="syz.1.2626" name="/" dev="configfs" ino=1071 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 818.400418][ T29] audit: type=1400 audit(2000000043.822:1341): avc: denied { setattr } for pid=15690 comm="syz.1.2626" name="/" dev="configfs" ino=1071 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 818.429089][T15696] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 818.437336][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 819.027277][ T5874] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 819.028379][T15702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 819.043736][T15702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 819.217220][ T5874] usb 2-1: Using ep0 maxpacket: 8 [ 819.218066][T15702] syzkaller0: entered promiscuous mode [ 819.232775][T15702] syzkaller0: entered allmulticast mode [ 819.233844][ T5874] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 819.284598][ T5874] usb 2-1: config 179 has no interface number 0 [ 819.286340][T15702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 819.291449][ T5874] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 819.332483][T15702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 819.347259][ T5874] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 819.349394][T15709] autofs: Unknown parameter 'no9 PG!8E8- ŖEeլ( Ir\u}ibT0;my[Gc#>QkbY&#w@/VVL~12lhOh'rK1\kU{!eܚ7 [ 819.349394][T15709] Ue[%#s' [ 819.382985][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 819.407872][ T5874] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 819.419987][T15702] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 819.429575][ T5874] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 819.442782][T15702] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 819.538203][ T6036] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 819.556946][ T5874] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 819.597665][ T5874] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 820.077897][ T5935] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 820.086153][ T5874] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 820.109522][T15700] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 820.404485][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 820.422829][T15726] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 820.429332][T15726] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 820.447027][ T5874] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input99 [ 820.507224][T15726] vhci_hcd vhci_hcd.0: Device attached [ 820.579552][T15700] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 820.588356][T15700] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 820.636615][T15727] netlink: 'syz.3.2637': attribute type 7 has an invalid length. [ 820.644437][T15727] netlink: 'syz.3.2637': attribute type 8 has an invalid length. [ 820.653604][T15727] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 820.661830][T15727] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 820.763871][T15729] vhci_hcd: connection closed [ 820.764647][ T6021] vhci_hcd vhci_hcd.4: stop threads [ 820.796665][ T6021] vhci_hcd vhci_hcd.4: release socket [ 820.820029][ T6021] vhci_hcd vhci_hcd.4: disconnect device [ 820.837179][ T5867] usb 42-1: enqueue for inactive port 0 [ 821.351731][ T29] audit: type=1400 audit(2000000046.832:1342): avc: denied { create } for pid=15739 comm="syz.3.2639" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 821.394315][ T29] audit: type=1400 audit(2000000046.862:1343): avc: denied { sys_admin } for pid=15739 comm="syz.3.2639" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 821.450879][ T5867] usb usb42-port1: attempt power cycle [ 821.507629][ T5874] usb 1-1: new full-speed USB device number 90 using dummy_hcd [ 821.691925][ T5874] usb 1-1: config 0 has an invalid interface number: 29 but max is 0 [ 821.700742][ T5874] usb 1-1: config 0 has no interface number 0 [ 821.780491][ T5874] usb 1-1: config 0 interface 29 has no altsetting 0 [ 821.810331][ T5874] usb 1-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 821.819718][ T5874] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 821.833008][ T5874] usb 1-1: Product: syz [ 821.837383][ T5874] usb 1-1: Manufacturer: syz [ 821.842097][ T5874] usb 1-1: SerialNumber: syz [ 821.847111][ T24] usb 5-1: new low-speed USB device number 92 using dummy_hcd [ 821.856738][ T5874] usb 1-1: config 0 descriptor?? [ 822.004052][ T24] usb 5-1: config 1 has an invalid interface number: 53 but max is 0 [ 822.012502][ T24] usb 5-1: config 1 has no interface number 0 [ 822.019728][ T5867] usb usb42-port1: unable to enumerate USB device [ 822.028196][ T24] usb 5-1: config 1 interface 53 has no altsetting 0 [ 822.037722][ T24] usb 5-1: string descriptor 0 read error: -22 [ 822.043974][ T24] usb 5-1: New USB device found, idVendor=0830, idProduct=0060, bcdDevice=2d.89 [ 822.054380][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 822.288442][T15755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 822.299942][T15755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 822.320944][ T24] usb 5-1: palm_os_4_probe - error -71 getting connection info [ 822.355747][ T24] visor 5-1:1.53: Handspring Visor / Palm OS converter detected [ 822.414820][ T5921] usb 2-1: USB disconnect, device number 78 [ 822.420793][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 822.420838][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 822.424622][ T24] usb 5-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 822.489220][ T24] usb 5-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 822.524537][ T24] usb 5-1: USB disconnect, device number 92 [ 822.539129][ T24] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 822.564274][ T24] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 822.578572][ T24] visor 5-1:1.53: device disconnected [ 823.425325][T15772] kvm: pic: level sensitive irq not supported [ 823.425628][T15772] kvm: pic: single mode not supported [ 823.432103][T15772] kvm: pic: level sensitive irq not supported [ 823.452544][T15772] kvm: pic: single mode not supported [ 823.458636][T15772] kvm: pic: level sensitive irq not supported [ 823.517612][ T24] net_ratelimit: 10 callbacks suppressed [ 823.517630][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 823.588284][ T6011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 823.900033][T15776] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 824.023913][T15776] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 824.602512][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 824.887498][ T35] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 825.626870][T15774] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2648'. [ 825.638387][ T5874] peak_usb 1-1:0.29 can0: unable to request usb[type=0 value=1] err=-71 [ 825.646731][ T5874] peak_usb 1-1:0.29: unable to read PCAN-USB X6 firmware info (err -71) [ 825.678634][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 825.731114][T15786] vivid-007: disconnect [ 825.757073][T15786] vivid-007: reconnect [ 825.789669][ T5874] peak_usb 1-1:0.29: probe with driver peak_usb failed with error -71 [ 826.046935][ T6009] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 826.137171][ T5874] usb 1-1: USB disconnect, device number 90 [ 826.147620][T15792] FAULT_INJECTION: forcing a failure. [ 826.147620][T15792] name failslab, interval 1, probability 0, space 0, times 0 [ 826.161394][ T5935] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 826.203601][T15792] CPU: 0 UID: 0 PID: 15792 Comm: syz.1.2654 Tainted: G L syzkaller #0 PREEMPT(full) [ 826.203627][T15792] Tainted: [L]=SOFTLOCKUP [ 826.203633][T15792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 826.203642][T15792] Call Trace: [ 826.203648][T15792] [ 826.203655][T15792] dump_stack_lvl+0x100/0x190 [ 826.203686][T15792] should_fail_ex.cold+0x5/0xa [ 826.203707][T15792] ? ovl_lookup_layers+0x13ff/0x2ac0 [ 826.203727][T15792] should_failslab+0xc2/0x120 [ 826.203754][T15792] __kmalloc_noprof+0xe0/0x850 [ 826.203777][T15792] ovl_lookup_layers+0x13ff/0x2ac0 [ 826.203798][T15792] ? find_held_lock+0x2b/0x80 [ 826.203820][T15792] ? rcu_read_unlock+0x17/0x60 [ 826.203842][T15792] ? __pfx_ovl_lookup_layers+0x10/0x10 [ 826.203872][T15792] ? find_held_lock+0x2b/0x80 [ 826.203892][T15792] ? d_alloc_parallel+0xb4e/0x14e0 [ 826.203917][T15792] ovl_lookup+0x4a8/0x6b0 [ 826.203936][T15792] ? d_alloc_parallel+0x864/0x14e0 [ 826.203959][T15792] ? __pfx_ovl_lookup+0x10/0x10 [ 826.203990][T15792] ? lockdep_init_map_type+0x5c/0x250 [ 826.204011][T15792] __lookup_slow+0x251/0x460 [ 826.204032][T15792] ? __pfx___lookup_slow+0x10/0x10 [ 826.204075][T15792] lookup_slow+0x50/0x70 [ 826.204095][T15792] path_lookupat+0x5e8/0xc40 [ 826.204123][T15792] filename_lookup+0x202/0x590 [ 826.204152][T15792] ? __pfx_filename_lookup+0x10/0x10 [ 826.204194][T15792] ? strncpy_from_user+0x19d/0x2d0 [ 826.204224][T15792] do_fchownat+0xe6/0x1f0 [ 826.204251][T15792] ? __pfx_do_fchownat+0x10/0x10 [ 826.204266][T15792] ? ksys_write+0x1ac/0x250 [ 826.204290][T15792] ? __pfx_ksys_write+0x10/0x10 [ 826.204320][T15792] __x64_sys_lchown+0x7e/0xc0 [ 826.204337][T15792] ? lockdep_hardirqs_on+0x78/0x100 [ 826.204356][T15792] do_syscall_64+0x106/0xf80 [ 826.204372][T15792] ? clear_bhb_loop+0x40/0x90 [ 826.204395][T15792] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 826.204413][T15792] RIP: 0033:0x7f2b81b9c629 [ 826.204429][T15792] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 826.204444][T15792] RSP: 002b:00007f2b829f1028 EFLAGS: 00000246 ORIG_RAX: 000000000000005e [ 826.204461][T15792] RAX: ffffffffffffffda RBX: 00007f2b81e15fa0 RCX: 00007f2b81b9c629 [ 826.204472][T15792] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 826.204482][T15792] RBP: 00007f2b829f1090 R08: 0000000000000000 R09: 0000000000000000 [ 826.204492][T15792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 826.204502][T15792] R13: 00007f2b81e16038 R14: 00007f2b81e15fa0 R15: 00007ffc55c95108 [ 826.204527][T15792] [ 826.720276][ T5867] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 826.767074][ T5874] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 826.771464][T15819] fuse: Unknown parameter 'grou00000000000000000000' [ 826.803287][T15819] block nbd4: shutting down sockets [ 826.929165][ T5874] usb 1-1: Using ep0 maxpacket: 32 [ 826.952142][ T5874] usb 1-1: New USB device found, idVendor=2040, idProduct=d900, bcdDevice=a9.2c [ 826.991379][ T5874] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 827.037000][ T5874] usb 1-1: Product: syz [ 827.063326][ T5874] usb 1-1: Manufacturer: syz [ 827.088309][ T5874] usb 1-1: SerialNumber: syz [ 827.181783][ T5874] usb 1-1: config 0 descriptor?? [ 827.230965][ T5874] dvb-usb: found a 'Hauppauge MAX S2 or WinTV NOVA HD USB2.0' in warm state. [ 827.245287][ T5874] dw2102: su3000_power_ctrl: 1, initialized 0 [ 827.251819][ T5874] dvb-usb: bulk message failed: -22 (2/0) [ 827.260298][ T5874] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 827.275212][ T5874] dvbdev: DVB: registering new adapter (Hauppauge MAX S2 or WinTV NOVA HD USB2.0) [ 827.284819][ T5874] usb 1-1: media controller created [ 827.286768][ T5867] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 827.290367][ T5874] dvb-usb: bulk message failed: -22 (6/0) [ 827.303919][ T5874] dw2102: i2c transfer failed. [ 827.304052][ T29] audit: type=1400 audit(2000000052.782:1344): avc: denied { setopt } for pid=15821 comm="syz.4.2667" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 827.308929][ T5874] dvb-usb: bulk message failed: -22 (6/0) [ 827.337218][ T5874] dw2102: i2c transfer failed. [ 827.342012][ T5874] dvb-usb: bulk message failed: -22 (6/0) [ 827.348392][ T5874] dw2102: i2c transfer failed. [ 827.353159][ T5874] dvb-usb: bulk message failed: -22 (6/0) [ 827.360956][ T5874] dw2102: i2c transfer failed. [ 827.365725][ T5874] dvb-usb: bulk message failed: -22 (6/0) [ 827.371794][ T5874] dw2102: i2c transfer failed. [ 827.376558][ T5874] dvb-usb: bulk message failed: -22 (6/0) [ 827.383234][ T6005] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 827.392082][ T5874] dw2102: i2c transfer failed. [ 827.397063][ T5874] dvb-usb: MAC address: 02:02:02:02:02:02 [ 827.411893][ T5874] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 827.412763][T15799] dvb-usb: bulk message failed: -22 (1/0) [ 827.445365][T15799] dw2102: i2c transfer failed. [ 827.451242][ T5867] usb 2-1: Using ep0 maxpacket: 32 [ 827.471390][T15799] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI [ 827.483468][T15799] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 827.491857][T15799] CPU: 1 UID: 0 PID: 15799 Comm: syz.0.2658 Tainted: G L syzkaller #0 PREEMPT(full) [ 827.502765][T15799] Tainted: [L]=SOFTLOCKUP [ 827.507058][T15799] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 827.517090][T15799] RIP: 0010:su3000_i2c_transfer+0x571/0xd90 [ 827.522970][T15799] Code: 6b 08 83 e2 07 0f b6 00 38 d0 7f 08 84 c0 0f 85 e9 06 00 00 48 8d 7d 01 45 0f b6 77 02 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 <42> 0f b6 04 20 38 d0 7f 08 84 c0 0f 85 b8 06 00 00 49 8d 7f 03 44 [ 827.542553][T15799] RSP: 0018:ffffc900050c7c10 EFLAGS: 00010202 [ 827.548595][T15799] RAX: 0000000000000002 RBX: ffff888057fd4480 RCX: ffffc90005869000 [ 827.556537][T15799] RDX: 0000000000000001 RSI: ffffffff88003f07 RDI: 0000000000000011 [ 827.564490][T15799] RBP: 0000000000000010 R08: 0000000000000005 R09: 0000000000000000 [ 827.572431][T15799] R10: 0000000080000000 R11: 000000000001af28 R12: dffffc0000000000 [ 827.580378][T15799] R13: ffff8880a036df02 R14: 0000000000000010 R15: ffff8880a036df00 [ 827.588327][T15799] FS: 00007f7a30aed6c0(0000) GS:ffff88812444a000(0000) knlGS:0000000000000000 [ 827.597229][T15799] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 827.603782][T15799] CR2: 0000000000000000 CR3: 000000002bb67000 CR4: 00000000003526f0 [ 827.611725][T15799] Call Trace: [ 827.614977][T15799] [ 827.617884][T15799] __i2c_transfer+0x5d9/0x17f0 [ 827.622623][T15799] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 827.628406][T15799] ? __pfx___i2c_transfer+0x10/0x10 [ 827.633577][T15799] ? rt_mutex_slowtrylock+0x93/0x100 [ 827.638844][T15799] i2c_transfer+0x15f/0x380 [ 827.643319][T15799] i2cdev_ioctl_rdwr+0x3ec/0x700 [ 827.648229][T15799] i2cdev_ioctl+0x19d/0x830 [ 827.652710][T15799] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 827.657708][T15799] ? selinux_file_ioctl+0x139/0x290 [ 827.662887][T15799] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 827.667890][T15799] __x64_sys_ioctl+0x18e/0x210 [ 827.672626][T15799] do_syscall_64+0x106/0xf80 [ 827.677191][T15799] ? clear_bhb_loop+0x40/0x90 [ 827.681858][T15799] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 827.687723][T15799] RIP: 0033:0x7f7a2fb9c629 [ 827.692107][T15799] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 827.711685][T15799] RSP: 002b:00007f7a30aed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 827.720068][T15799] RAX: ffffffffffffffda RBX: 00007f7a2fe15fa0 RCX: 00007f7a2fb9c629 [ 827.728012][T15799] RDX: 0000200000000a40 RSI: 0000000000000707 RDI: 0000000000000004 [ 827.735956][T15799] RBP: 00007f7a2fc32b39 R08: 0000000000000000 R09: 0000000000000000 [ 827.743898][T15799] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 827.751840][T15799] R13: 00007f7a2fe16038 R14: 00007f7a2fe15fa0 R15: 00007fff869701f8 [ 827.759784][T15799] [ 827.762780][T15799] Modules linked in: [ 827.767171][T15799] ---[ end trace 0000000000000000 ]--- [ 827.774134][ T29] audit: type=1400 audit(2000000053.252:1345): avc: denied { read } for pid=5158 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 827.806852][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 827.849390][T15799] RIP: 0010:su3000_i2c_transfer+0x571/0xd90 [ 827.858076][ T5867] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 827.859010][ T10] hid-generic 0003:0004:FFFFFFFE.0026: unknown main item tag 0x0 [ 827.866237][ T5867] usb 2-1: config 0 has no interface number 0 [ 827.866267][ T5867] usb 2-1: config 0 interface 184 has no altsetting 0 [ 827.876507][T15799] Code: 6b 08 83 e2 07 0f b6 00 38 d0 7f 08 84 c0 0f 85 e9 06 00 00 48 8d 7d 01 45 0f b6 77 02 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 <42> 0f b6 04 20 38 d0 7f 08 84 c0 0f 85 b8 06 00 00 49 8d 7f 03 44 [ 827.881711][ T5867] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 827.909374][T15799] RSP: 0018:ffffc900050c7c10 EFLAGS: 00010202 [ 827.915888][ T10] hid-generic 0003:0004:FFFFFFFE.0026: unknown main item tag 0x0 [ 827.917175][ T5867] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 827.922695][ T29] audit: type=1400 audit(2000000053.252:1346): avc: denied { search } for pid=5158 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 827.929679][ T5867] usb 2-1: Product: syz [ 827.929695][ T5867] usb 2-1: Manufacturer: syz [ 827.929708][ T5867] usb 2-1: SerialNumber: syz [ 827.946813][T15799] [ 827.960501][ T10] hid-generic 0003:0004:FFFFFFFE.0026: unknown main item tag 0x0 [ 827.972867][ T5867] usb 2-1: config 0 descriptor?? [ 827.983714][ T10] hid-generic 0003:0004:FFFFFFFE.0026: hidraw0: USB HID v4.00 Device [syz0] on syz1 [ 828.006073][ T29] audit: type=1400 audit(2000000053.252:1347): avc: denied { append } for pid=5158 comm="syslogd" name="messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 828.029523][ T29] audit: type=1400 audit(2000000053.252:1348): avc: denied { open } for pid=5158 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 828.029710][T15799] RAX: 0000000000000002 RBX: ffff888057fd4480 RCX: ffffc90005869000 [ 828.073736][ T29] audit: type=1400 audit(2000000053.252:1349): avc: denied { getattr } for pid=5158 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 828.087999][T15829] fido_id[15829]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 828.110084][T15799] RDX: 0000000000000001 RSI: ffffffff88003f07 RDI: 0000000000000011 [ 828.118532][T15799] RBP: 0000000000000010 R08: 0000000000000005 R09: 0000000000000000 [ 828.126516][T15799] R10: 0000000080000000 R11: 000000000001af28 R12: dffffc0000000000 [ 828.142250][T15799] R13: ffff8880a036df02 R14: 0000000000000010 R15: ffff8880a036df00 [ 828.150726][T15799] FS: 00007f7a30aed6c0(0000) GS:ffff88812444a000(0000) knlGS:0000000000000000 [ 828.160023][T15799] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 828.166618][T15799] CR2: 00007f7b534c5e9c CR3: 000000002bb67000 CR4: 00000000003526f0 [ 828.174753][T15799] Kernel panic - not syncing: Fatal exception [ 828.181061][T15799] Kernel Offset: disabled [ 828.185358][T15799] Rebooting in 86400 seconds..