last executing test programs: 8.032025245s ago: executing program 3 (id=2209): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$uac3(r1, 0x0, 0x0) close(0x3) 6.522548635s ago: executing program 1 (id=2214): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_disconnect(r0) r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) write(r1, &(0x7f0000000440), 0x0) 4.975228959s ago: executing program 3 (id=2218): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x24b, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x128, 0x0, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0x103, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x7, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x0, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x5a, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000100), 0xfffffffffffff001, 0xa000) ioctl$BLKTRACESTOP(r3, 0x1275, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="a4010000100001002dbd700000000000e0000001000000000000000000000000ff0100000000000000000000000000010000000000000000", @ANYBLOB="000000000000000000000000000000000000000032000000ff0100000000000000000000000000010000000000000000050000000000000000000000000000000000000000000000000000000000000004"], 0x1a4}}, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) add_key(&(0x7f0000000380)='pkcs7_test\x00', 0x0, &(0x7f0000000080)="305c061ce1821f7051667557c7d7982b8f57fb20a3adc9e3baa292ce8f0a861e64174d46de00a5a09fa80393d502b0cd490635d54cdf5bd046cc030000000000005e000000808ce41d86b9b949004fd8fe45b91e8fe7ec7c49750a1b0ade", 0x5e, 0xfffffffffffffffe) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 4.892950075s ago: executing program 1 (id=2219): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc4010203010902120001000000000904"], 0x0) keyctl$search(0xa, 0x0, 0x0, &(0x7f0000000180)={'syz', 0x0}, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0xc0245720, &(0x7f0000000180)) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x0, 0x80, 0x2, 0x27e}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)={0x5c, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="0f000000", @typed={0x3a, 0x1, 0x0, 0x0, @binary="00112233445566778899aabb86dd2c00001c00ff110001110000010101010253aa58fe6cbdf0357065ae44132403b1fd606412c3258e"}, @nested={0x4, 0x8002}, @nested={0x4, 0x8003}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4400c005}, 0x80) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r7, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x58, r9, 0x800, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0xb}}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xb}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x80}, 0x200100d4) syz_io_uring_submit(r4, r5, r6, &(0x7f00000005c0)=@IORING_OP_ACCEPT={0xd, 0x8, 0x3, r2, 0x0, 0x0, 0x0, 0x0, 0x1, {0x0, 0x0, 0xffffffff}}) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='config\x00', 0x0, 0x0) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r11, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r11, 0xc0502100, &(0x7f0000000200)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(r11, 0x40082102, &(0x7f0000000000)=r12) r13 = openat(r10, &(0x7f0000000180)='usb_gadget/g1\x00', 0x0, 0x0) openat(r13, &(0x7f0000000250)='bcdUSB\x00', 0x2, 0x0) sendto$inet(r13, &(0x7f0000000080)="97663f6402395727ccd1250bf8", 0xd, 0x80, &(0x7f00000000c0)={0x2, 0x4e22, @local}, 0x10) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000000)={0x20, 0x5, 0x1, 'O'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.655951548s ago: executing program 3 (id=2220): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x24b, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0x5a, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="a4010000100001002dbd700000000000e0000001000000000000000000000000ff0100000000000000000000000000010000000000000000", @ANYBLOB="000000000000000000000000000000000000000032000000ff0100000000000000000000000000010000000000000000050000000000000000000000000000000000000000000000000000000000000004"], 0x1a4}}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 4.018200995s ago: executing program 3 (id=2222): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000204355420000000000000109022400010000000b0900000000030000000921fd7f000122ea00090581031000000f00"], 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x1, 0xe) syz_usb_control_io$hid(r0, 0x0, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) setns(0xc9, 0x0) r1 = socket(0x8, 0x5, 0x5) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, 0x0) setresuid(0xee01, 0xee00, 0x0) chdir(&(0x7f0000000080)='./cgroup\x00') syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.538387044s ago: executing program 2 (id=2226): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$uac3(r1, 0x0, 0x0) close(0x3) 3.221050135s ago: executing program 0 (id=2228): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_disconnect(r0) r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) write(r1, &(0x7f0000000440), 0x0) 1.768233968s ago: executing program 0 (id=2229): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000200)='md0\n\x00', 0x4) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) pwrite64(r0, &(0x7f0000001000), 0x1000, 0x0) (fail_nth: 1) 1.674865151s ago: executing program 0 (id=2230): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x100000, 0x0) r2 = open(&(0x7f0000000180)='.\x00', 0x10000, 0x0) flock(r2, 0x1) flock(r1, 0x1) flock(r0, 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000dc0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x60b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0xb, 0x1, 'policy\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x20, 0x0, 0x0, {0x7}}}, 0x78}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r4, 0x810, 0x70bd25, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40) 1.658877687s ago: executing program 0 (id=2231): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffffff, &(0x7f00000000c0)='./dev\x00', 0x2fb) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000200)='md0\n\x00', 0x4) close(0xffffffffffffffff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000040)='./dev/md0\x00', &(0x7f0000000080), &(0x7f0000000340)={0x0, 0xfb, 0xca, 0x2, 0x3, "750feed074953e9dc84acc20fe85e6c5", "e81e5fd15c855c42e5a584595e6621f7f8de4cdda26651826f60b449df6c59de1d750686bfe6efcb8a273c2b319873d015c562936b24ec07198859c538025a8dbfd589960babbb7a294b7e8679ad905170fe580d7859287566fa0a90fb0b025358f0b85ece7711ac165b99a0d001c5fe6d152448c4568735c62d3dc8a00aae7a082e8e12a1fb55c7077e0e1c6de37cce905300b32ca8b25164dfcc1cd9ca831270de3ba569b94c49d3ead03d7a7afa85c1b0ba11fd"}, 0xca, 0x3) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) pwrite64(r0, &(0x7f0000001000), 0x1000, 0x0) 1.616390877s ago: executing program 1 (id=2232): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00005bd000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, &(0x7f00000000c0)="66b9a80900000f3266b9800000c00f326635008000000f300f30ba2100b80300ef66b8f19700000f23d80f21f86635400000100f23f80f2304b8c30a8ee8660f15290f0666b8004800000f23d00f21f86635300000060f23f8", 0x59}], 0x1, 0x18, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x2, 0xffffffffe8110f4c, 0xd, 0xfffd, 0xf, 0x401, 0x0, 0x0, 0x100, 0x1}}, 0x50) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) (fail_nth: 5) 1.546123325s ago: executing program 0 (id=2233): mkdir(&(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdir(0x0, 0x1ff) close(0xffffffffffffffff) symlink(&(0x7f0000000380)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x0) r0 = openat(0xffffffffffffffff, 0x0, 0x100, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffffff, 0x0, 0x1, 0x0) write(r1, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/os_desc/qw_sign\x00', 0x1, 0x0) symlink(&(0x7f0000000240)='./config\x00', 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') read$FUSE(r2, 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x20480, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r3, 0xc0045103, &(0x7f0000000040)) futex(&(0x7f0000001640), 0x8, 0x2, 0x0, 0x0, 0x1) socket$packet(0x11, 0x3, 0x300) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r4, &(0x7f0000000440)=ANY=[@ANYBLOB="70009300ffffffffffffaaaaaaaaaabb08005500000100004000022f9078ac1e0001e0000001000065580018907804000000000000006558000000000000"], 0x3e) r7 = syz_usb_connect(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120150026ae63240cd0c800086b201020301090224000202ecb08d0904"], &(0x7f0000001540)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r8 = syz_open_dev$video(&(0x7f0000000000), 0x8, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000005d80)={&(0x7f0000000100)=@proc={0x1d, 0x0, 0x25dfdbfc, 0x20000000}, 0xc, 0x0, 0x0, 0x0, 0x0, 0x4c0d1}, 0x40830) ioctl$VIDIOC_S_EXT_CTRLS(r8, 0xc0205648, &(0x7f00000000c0)={0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000200)={0x98f911, 0x1, '\x00', @value64=0xc13}}) syz_usb_control_io$uac1(r7, 0x0, &(0x7f0000000a00)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="201108000000eb2e874b9a05e65e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$vcsn(&(0x7f00000001c0), 0x100000000, 0x0) 1.185372092s ago: executing program 1 (id=2234): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00005bd000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, &(0x7f00000000c0)="66b9a80900000f3266b9800000c00f326635008000000f300f30ba2100b80300ef66b8f19700000f23d80f21f86635400000100f23f80f2304b8c30a8ee8660f15290f0666b8004800000f23d00f21f86635300000060f23f8", 0x59}], 0x1, 0x18, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x2, 0xffffffffe8110f4c, 0xd, 0xfffd, 0xf, 0x401, 0x0, 0x0, 0x100, 0x1}}, 0x50) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x30) 953.674724ms ago: executing program 3 (id=2235): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x8}, 0x9) write(r0, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000000500000000000000050009000d000000", 0x24) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00005bd000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, &(0x7f00000000c0)="66b9a80900000f3266b9800000c00f326635008000000f300f30ba2100b80300ef66b8f19700000f23d80f21f86635400000100f23f80f2304b8c30a8ee8660f15290f0666b8004800000f23d00f21f86635300000060f23f8", 0x59}], 0x1, 0x18, 0x0, 0x0) mknod(&(0x7f00000048c0)='./file0\x00', 0x0, 0xffffffff) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f000000a380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f00000006c0)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x0, 0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x80}}, 0x50) syz_fuse_handle_req(r1, &(0x7f0000008380)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008df76a250000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea21056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000131a5d9400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) syz_fuse_handle_req(r1, &(0x7f0000004900)="fac4e7c21565f79b73d8d7dcc36944c7d36505ed55b2c535ba5bc78cc94f55e518d13a9f4dd794ecf1b09fe12f2893933931db285710f8c78793ddf30ff7dd86203ab0177f8aa062d6fe9529d65fab047ca34c6840b505eee9082e8ccf311bfb84ee46c0d0dd466b0000000000000000fc309ddd9fcdd816ded9830e41f8cce8d3bc31a817f29e3ecdd0329aadc8b022c55c70eff8905b9bf223ea44cbb290ffe098bb78fcc9e39f16f4f0e8d60e440abc192d530e146bdb59e9e522668bebec672a965ee7bdb300ab4314235dc0e62e94e398742cfeee3b92ce29e1a62fd8375d95ef502ebc1f04959d83a15ee9496198f0b3440b80cb9950324c9d4dfa69381c5c0920e307ab1528efe02739c2a49fc4cf09ff76c165d5005234b8f9378c74040d212eed9e7485cdd758bf4d34c2cf52b278eb3114b13b43214814ba2e2a357c028c737892d0e8ab1f1d009a00ad0dcdb9ffd0f4fa0b03d3b006fd66e8faa4fd44b64dcb92cbb5e9da64165ef01602538708e5dad3c0986a2b03d4d4276c9268af76d300b01ceef84e2a501e2c3d04e31875d1e81270409516d4272d73e9899c5a939c03be73352b61cf32ea1f6cc2d31847703843cd2e54de294b1c957ae618dddd7fdb018908dd7be379fb3db575b0859d9f2a190d8f7abc8400bbcfc866c8f8454102a5b0c215f140cb17677556241e33443aacb35073752aa65f450b2d03750ebbc07ed809f97b5a55a4f11b920cc9bf0a1db7fce63718f85c3326120c8b774ec22ff9c1b7e9114c0b931b6805fa672b53a6a617881fd73dc1b79fbeade0120e08c7abbba9bed82e9700bbf779328ce0a73f7e60459ecfc3f0daf26da8d1b57c1536ec967fdcab8cca66aab0ce0a02320c0090c78511b1672d65b3d62ed38e2655bc6ebfb2480a0c33fc68bba5c444d8cde3f977a382d6413947fcb25e3e9330f45b8874463e2a3fab87d877652de9c2d35208ad5d3e59ee9e63061af0b119d8174e7eaf71551b1f3551d0247717b5bb7d4db41767e2608a2472c7258932e22eb591c957da5fad5732c86cf18ec338e83ed25e41a2e500360c7ea86755efe0962f0d1d4cc945645e01b5a34fc74630c91cd02c5932f2df9ec1e090dd83bda328a7c8d1b8a8294c3c551c1954a7f024eb7ac01e35538612f2f23a6c52c59beab75910c5abad25a3789baa0001569e93561a8992450bdb0a757b916af413d63badc4aeeb9489357ff7fdb27e913278dbb5f2d69bc196d110638601f31fb4db2b301faa7516955d6971b562288328e14c7957696eaa03d3911ec661279e37a850b7515fb4e122c39fd6dc3af40980173e6324ee678b47f74428a593827d75aae3368e661dbe9738a2704d8f7a086e77b9ffb3eb0e16199c58eff45dbe628d268e88bb2d69a310b60db0a850afcb08a2a7b316c70209ecf034d484a6b1f68de857d4ebfd45936c04b532202bea6b3a6d3751cf73db4ca0a76faf7a972f8a68a523b0a51d593436aed65999fe96058e085b4352c0d5603365ae4cf724e5801da03665ee2071e04b45c6de0a59afc376e3ce2ef206c3161f235049d7e0b504ccac4f1699629b3f8736601a6dadfd00dd9545cb7cabd1cba12ddb2a23c58b1da9c69ee4ec9853aaa81e1cf7a169f91a1c077fd6c5c2fd366c9a2a285420d5633bf0544003251768db01281f8259a0d0c489f7f7cfc0fa7ff2878fb0cea89ddb3593539a1184e667f3840e8e5043508777dcef371e2ea3cf489fcfd60066a8dcfc9d0fbc21aac05f24a88ceb5c186326d1fe5b6cb4a40d25e6f847f7a4030d0a9cd29b0f9e3b49471730df5c5d1e172376ab2a27f3aaa3d1c5f354952745db1c54464e9f4d224ca1bcc7a4004bbba7a21d60a1fd5a35c1179738fbcb61241f38703610d51b18afc0e0bce11564167344568875374c6114c64b7cd25cb3c005b2577afe3c0f528d5c838152fe7b307d743596c91f43f3958e1f25f741aa4b30baa4063d0d9c3453fa18de83f744786c7b4294415e0222ecd9ad9a115663f32e9505d3618f9c716f23d9e536d429557774f7910aded24931f373507dba89766d760b714da6e264492ffee985422e60da15b7ea862935d21bb878560b0f8270f82cb3a8fc99ac35c30038b95532fe848f8a2876f5782acbad93f1426fee13fa4f0b778950bb2096c7d1c5bdd481ecae83254800f78a762983418c3fd673deda93c206ad399144b141db743640e3102fb453d553f939ad643ce9faabbb01bfad49cd30a61cce67fd46782447e14c7b2d2dc1df244cd7d72404a0f5b54187c75aa45b9b2a73727de0ce187b7e9cfd471efb73e9a84971185cf335cb33fce92e06992398e53be779782a436579bef6d7b0d93915e758fde3fd67b9a964d5a8ddc5950cb2a78262d0e36d329f9ba56b06266a126334c56852b290937423bc178a575a442046a8a4406e88b829d36bea6786774b0c513dc951b330eb5dd914a907b97e83db55cf73c2897dc3d6944dac797b8b1434327fc15caa6b309b62e1aa52d4e8ca7a7db6f99e423489951961f147b3cb14956e801f7b1a15b959546ea229898ab9b99c9a080f5d9176c59ace26b72e620b9ff6e558bfe7808a7b430c414ab90cb0f1e4101be46dc360928797171922d41bcc8c12d17375222c706b3f864f8937ca947b33eb13216b1cd1d4119fa6de7e1a07c652671d20b1930ccf14c443223a4fb93848969465feaffc703347a5d5a9b68339e3951d3b8fc17c6045201af7e84a7026bc741592bd47768a793abe5009eb9427dfcfc4e4a9b9ae71f8582b0cd9c28c6270d5bbdf0f1415c722384808cc8fdaea65eb97d5fda8dd2014163598411c51495fd9fea5ae48c9e0d158217335c0181db4d196af623b5de7ebb1a0a71090e896c11b33cccd4515d1370b00ca48df5b855b8942cf35a8da12d4eb68b52ad786e2146383c54a13a3de979d03039e42a440c6d0db2a1509ccd1aa5097af5b15b49b90928d82e7b944d0750ac6d9433526e65d3ae79201b4a20175aa12692e4ba41c4733673a47e8ea44ed2b34d3ae80ca8b05aa159662f75ba748ef793aa184c8405796185ffb25ca4cb324f4f77610a3b372f5fad04ef85ab771f2f5efa3d95ca0074b9363b3b4095dacc04d48b9c86ebdfd94981a33b2fdb712409462aca416079a5daf92fd24374b6f3f76277fc36bd6d38832ae14db4711b0503fe12b647516d1df64c11962219c17ecc60fd25704a94742d6655e57ac9f89ae1db77fe8679b7f84b403e101d70352f1d80bba74c4aefe14cec35f4168d2e9c2625a0e692504299cf8ca875e7b45fd3c71df003628c3ac6616b3b1a8edb7879e5781877a9873b3885958edec9d1a7d24cc22c49047335dec3cf9b2821c267ac8dfaea3bdb3dde0fc7d1c1c96ce04f3bd5ddd7ec3ba253cc34e7df4a03d58e716b5bf8d680365931407a60c28922aceff1edb45417bae99167d99e97669d68efddd00a867f5b3ce5763be30e07ff2cf8b15c90a6f656f717bc1b590231f48e3fc4a85124d43a1a811b6043604870e56b81f127db36a686eb77d612609f44b0fb262b17739fbb36c67ed305e114b7b595626e897af9d59acee1af38295c366bc32e3af59427dc11d5cd594add4e226d947ff26a2140f476a43695ebc8f73cf5b7efeb2ce46d63484b9f3ded774088a0a31cb2eeae9538bf0c071f572657f905b33d4b3fb5280879cab0bc5fc7a89be10a9118c419f974c454a37bb934bd488cb1ecbdcb2ac26094f90b8093fc75454317b92278eff430f6622cbb2c4f6a8a2ef5c7388b504a6cf89bf889990977fd4f5ea1a530131a8e2356e3f1db0d9f93d7a65af79f1fadc0b40279965522d47dfe154d62036ce4e53eeb6e96473d3e2f59ce1f54414af8bada3d9b6089e7a670c7418d0f906ddd8494bbea718fb91acd0fdd0f2c19746f4c1ff87167987f056a86f03aad8c11aec6ea967383c29b9c8bc6d4f46c9c2f44fa5a43f52cda78cf36f270a7a9c77c7007a55b6770847aa8cf4676ea9abcbb91ca9a41ad56682f3dae20ed1a67d75391caabdb66808b91e86b9db4a13f7935fff256b54818a589402967c2242a70afffbc7ca73116a1ca81a126d2d609174a93b16d1fa4d18bd6a4e277aa42a8551765b241d1e54174ba7993d1694d5a191b3036cab5eed5311403ba6de613b73beddc753359f7339417e4f07724c6ba1ce99a55c6b8ec72c0a4df4776146877309382d3af87c204ce86f54c2a7c1027adee9ab2e4f6bd205fb41d7d6b2fabf7308ced5c870f156aaa9dbd24f232ad85d6123426c5e5264b4418ebc7acf1cac380212f48dd87c2000f0f0c7e4a54c04523fb7cebbc50c26691ca8ab9748831851392864c02166f5e2f0c7d5d76b71908de9ba69a88b0bbaad0dcfb9e3ad8680275e35218a60227bfb6f773fea9570831db671ec8912abe6c6190499e0100232aba631b9ab148547041f1bfabec860d19ce987c019249f07bf3effcff35a6c5402a584f0a55a3a580aa8303aa9a67856f8cc27abdfde11fd2b8c5432a46fe2c3c08ae53ff42d1c545fb890d097d9b31437c53f6563fe416570b4cb3d5fb084d9ad4165e6eaa6a24a5b77dfd6c0962d233a2030427dcab08660143dc3853d3ae8907a21f812501b1e96fca4e4c73226827477ae9e5e87f88be74228afc7393d7ed98f090577db9d70158e3acc36e07f959d32de1e34b471e2732e38d0a9397c6d3a218d0abd71af71993cff9e47793dc72d00c5d5079ad76e935c58d349f03c6a976abd04b4663324b63fba9fb7b4a048186d53f72012779b02ecc61faeed40494538a2df95f14be70f80e2c1072f56ccf59ff5d75dea6652ef90138b22c943fd4863e90216cf9ba84e69cbf43661031720bbc22e94bf2fa1dbfe8313487b4cf6cb31e9d26995471ab64a120e0eef82d95620890aaa48afa7acf4ba274dba1b5a1e37c1062fd70fab8218ceddaa8d10154e567c7cb8e5f4bb07c6c6065164c0b374b17c555f9c1ec8d108ae7ada1913db7a447e8ea3713d6e2fd6384ac3286d9941523e01d3fefb32cd65922f2113a5de4c7334657106a2c97a6282b22d7d67f39fd6601916b0d5bdcbe382fa786a3cf74b24cdbb5a2843b56ddb14d5514139b1cffcd68d45f9f082186e2ea8f774c899cbbaac2e6207cbe86645fb346fd360d94a2b61e0cf9d33778cf3b3aac5fbf29288fc065ea5a218b404b82c79098b48a8051d03b6f8c4df4843b665eaf6935ad0e703cd928d228a48b51d23afa1bde22b7655dd4d8fb73b2b10533d6da9b9fe6aac3d1e73e5157c0e33bae4f31f10212d7f87d9341e3090b3c7c8ef79efae8bb744a5f8db2bcedeceea81e8c23716e113bbd24722d6f33dfe6438006fadc9bab9809c5c5b3371994a55263a52e9bcdcd3665f8472bbc0c59d27c0a7d023763ca55f80b7a20014636be698a2f1e0a5ed5320b1591e0c1350fe41593942495ba1a214cf18dee3c73635d208a60737b253cc716d1cdf0c7546dab111bfdc0777c4ae297e9a35153e84d7c5411df5e134f2a128d5c0240aff77e076a1113214ee68fe0c294996944180a7a5c4c35ce341682cb31607c3cf5514b1f1035673f3475376a8cbf20b50cf3272a49c8aafda33fef13aa90781f9c14741886fbdda634205fa98c94dfe5f06533d17d772ec5be90243a24f1db46530fc8b8e167cec2276dc16cd755e371f85827f44da53114333abd41b2ea70faac6762d38b5751e243b2e01ce7d00dce1069419fde74c49ebfabf86eb696fc6f07a8b4f95683449416c9633f3ef6a2eba6a687291e2e7f48a3fd15bdd2187e7790fbfe684b5764d7ef0bb3ba99c2e120300cf58c408608ba6090e15539024787a0290083d808380214a8ecd11effcc05149e476b1ea5b82047411050068806e331171513c57713f0987133e155d3b312aadc9f243f8533fb07ce208d46c42604669ff4b8a28be3bc71f38b45081d262ec130a818d05d8a8b52cf923727f59380441524be1d3448223a2cccaabe7d86a88c4a9ad8683a42cadc41b4f26faa91d9c927edf30cb8137e74d7c8b40a9adc2567de40144ba8f86776a1ee234d02c56fbfecdc636aac44aa59d0392d8e8c13531350f2c4b5b6417db0667a557acca8f931d31a56c3b55f603e9646cc409dd54db6d89be0a7a5b5459639915bacc24885e4a1e2f3a805cd7a315f71601d5ad646003770df1be040641ff3391c4770e5461c38eb2b0eb58e9134de52e78d36c3dfd1ef42d9561b78116e70b3658ba7ff9411a7085b80a8082977d57e9df4851e5f7da33f06f7c47447bab0b4c7d3b9c9a511ff6d8ed4a26287d9ed154302ff6ed1aecaa226d60ded733eebc924ce2df1f7ada22a10db46e768918178cffc926b61544f59f6b0be26900a5204e97b6b91b16c227796f903e5e1d3924a4f3286579507a30a1486d7d186a2fd5059b2e83cecae0c7ae26dc7c262e717263c1599e7da38f3e3ce06abaf77876979c0835c859e101ff6fa4ab2a96e65a497cdf27b1df052d07bbe1bd4284d8f817d586667dca367a668a1904430ee1ca62098d919f0a4eea1244a8e4a7792c86165fdd8b9be99262d2f40ecda00a9a5afc1bde0e630814e8aef82176dcd37463e34e63c115d9d33012e497c41c22e98978ee1e4d44becb9df7920d9f8490427d020d602cc741a03284d01e81804714d46f13ac08e2a6a8677286fd66c528b985dc51030050417ce8fe991e2db228bca99fa6eecfe654307fda8a227ce880e7da556ffd3ed3adca545953da9c369033f2e819a1d66636fd1e9794bbd0d7a75e68c44c632eef85b205cab173aa5a9023ecbcdbdd43e4afc7ee5346075ee1bd79795245a8437d41496d3a25146b0900000000000035e28c753127fa19c147bc14c68b15fe170fff5b916eb069a414c069da3dd2640ddde8e819ae37b670ff42dca8010cced7373d0ee0c2fb05de16dc8959d172c4f467a25038b97fbf9e60bd3c40c73871d4114d6d81acb7d57552495c336e5da9b71b7872e9ebdf082023674118c3f94af6f05ab5e19ecd8ec055dd6eece56f850e902745173f758e2387c1464866348bbb5d436937192371564fd9769eb4542444ef4e60701594fbd6afc80fc7e0f7616ec8286fa1059395a2ff7ffd3fc434b84f23ca88fe44c8cf21e1b13b3f3f66543e71b855f3f785dfe1f954462fbcf57b591c0a725d27381251828d7fdf7e09bdbd625e89e98f61fb76d56ad69106510ecefa93853f0da630f7b4f324c17494d1fa51f94e9daa978b572065f6396a7f3d649060798b32b61ee7bc7ff03fdfd800e8dba8c9b0c8d51433972db34e0cc2666d54dacc4c1da366bfd58f5321f6daa88d4e49a450a75e2ae935471886bda66022b4167a743d8e7518fa2b427408f5c3278152f3d97404e34c2e0531a322518bea013e44c82546422e2e221c43634442eec3712c172f3b9a4e29c43d59ed1715391dc27f7254ac5918f9985288b5ff44a52c93c5663312331a3341fdff4d24607f91c4fc0cce634a4f69f686ab52ec6e36e41a1fc87af4eba40ab2da228194a6cc9b98f271f74666c47a3e371e866dd8a41293dd6474b2dde3f6bc452b010490e17cc4e7df92e7436788e7e60dda166a38314f18e631656862ff7ecdbb85cdad2dea4365443da5617877df6bad1abc1be597a2961df6cf34f5f110a60694b406e4ae9e48077132ed583f76b54f3c37108b19c47acc4bc02072a64a0da39bbbbd6f2110a8e925a63389d963057f466d02a10f6a6ba2112b74e28e0aae33b0f028c2270f1f07c42b25c812badc34f811b862c3485b4396cceca3ec6a62e47bd519533c30f3d9cf05b0ec9886f8abb796ce31b290ab6b515dcc7d7f3ab11582fff535ffe2746333c1d288f7a22ee36ed232f1a7d6dc3c825d86d211af3eecdfdea7cb7a4e5139ebec4a3b7e81518e76a6d8951bfb090705f21d158d89061815e7dba1cc8134e2f80955dc63f3fc0a5fb953b4ab05c22ca761092418c32725732e54dcf086430f6b114761b745ae8ab00127ca375ca08d7c4ff7e306f7bfeab6d87a7e43218c267ef145095fc7a1ad58a283007734de55aea229a24c63372ae40e32618468612464d61840d79d837722d8204ed09b9bda9f438df009c9a2e4584755dd4ad91a3378255e0b104258baf6175e7d9df45c3caa2aebfb5866e4d20fa09e06ab689903a1c1b622ea04f1208adbf7cd6ab7a53068441eab17dafb00a07bbd5083a6691f6f34a9fa82b1ded4660deaf67343ab9aaae5f70c0b5a287ba669f32a1431ede98ac58bb4f42ef2a23122cd6a3da7658174863a7400bbda3ea58ce0f5589a6d5eb45e0a17aedf12bb175a8d083492e768f52b23881e61f3492fc039e478a712918ff2b1721b9e6e7911e16539f6104fbd0457b5521391672f1e57cdc2632ace97d4e21372213d1546578f7c8c12218600d85bd53cc6a5f2a2b1e88400c55f13703df10ab28a327112404f4663b19c4e938acd3917bfa5580845d0060a9136dfd88000bc05d07476bda0742ced80e1f61103ac1a501cb648ec6ffcfb0c1ce6fcce6e97832a720eb621091f2bb8ca2535e4c4c2335d6cf8a88cdc484b19dd12a0cad69bcef70f1c5a416ea21ccdbaef497a4ae417370531e48fc48fd01106934b6fc6cfae0acfe78f208d5ecbb773707484b57768781f57126d774a75099b308035862572d3fbf86692d474bd92850405bfbb80dc8a525ff594bb0d908ceaa9f51b2ac7b41a2b4c45621b62b1e1ba55e394ee15c4c222598b4e58b8addf87474a3aa94e9233d36520ded5f6ede8be6c32d38af2f8a0fb27562b2e3330490d46047e0a2d383830c2b0525c049d3005888bbbd247162275b157e440942b37eaf4abb9a4d22ef15d6d3009096d9b3d6732c35c2878e4c2fc905f2d961bf3700f0c08740249b57a18be63a18ff2fd7340fa3baa719839cf8eaa389a2f3b81af202c4a9abbdd030bfaef70cb65fc961bb579ed400e648cd8c1b100b289c38067a6d422c1a0a9f027795eecdaa7230d6e0662d0f59ab1cb0671b3b99ec12b65771f0c7416456b99537d10779d496f17e0c04160e879a5d089adf6f8060d92c44039ef2475f4647b5f3b30335ba2a50403d09644a00122d3bf7553c8eccb0e8dc612a83e6e5a7acab9f014fbbc712623ea86edc9bec0e4c392efaea3c56bb5ec45832ccbe6329509a6800ee36e85bb3b65dcf5aff9aa2db6569a230cdf1296e815d717191bad83ba31c1e42b69c6a5cd214739b1af105a244283c59c4f60d730fe6835ca983f3bea050012d6b6bc13a70591950de0d0d8857c200b61158a13f2c2d2536a799b7b4ac302ffbc78e9769e324c6ebfd567f5f4c2b053f7b59b6b07285194526d40ca6a5c4c376fa127b6b100489ce5266ebafa0cdec24b5bd7a22f295402303f8d1ddc3d1427d4c3beece3309d55f138d878c8054b259c53e59489f5f3610b3784489cdfa6083867a92a5f7e30826a6f590b9c809020c0f8eb73b70a971c050a70af2ca3a70573554b97c60037872df3e5c3f2e91103827306e72fbf1b072250e432b7bf8a5540783a2848724989eb86670e1f5b0675a39f7b1548260fd211d9c05e48e1a3df852842c477a36bbbac07317246dc8b4c3383227485556992735bfea38ef7a8a3a372464dc0ee6b9a09548a37dce62d563d04eaec5cb54c9614170e0811b53fd05dbd192744f74b5e0e3cc1b29dc0755ae4fc0c14ae8927f72864a796e65130e05d012336a96e5b15f17ae6258c67ecab6505bc1a26c00d5010e86f243412ca4264da4ed41670238faca1d7c7ed6ae74cc104ff3f9c045ce7efad15db83c3f5bbf001507caf3e6ee0a11a9c10205d91a7bbc12b2a91065352440a18493315df7dfa671bf8e1bd6d67119fbc3bb69d5661a43481b00ee60dab9d725f7f166ff989a0cbe21ec7f0007bf09cf5b5bc65b5835c4d0bfe6981616dffe0eae36d5b8c39d14645801919bc537212fb941ebe346bcb5037cf8b894ca92a0682fb2b37f08609a4a9465f0c423250343fc2367da64b690e273293431a36813cea94de5cf411c5c3c026521aaafb8fbe45c55fabd94baf7053023d1b0f647abcc07be35fa5a0c3aba2da35f6c2d8a739beccd96916cd30bdd8533411a425ae30b5d02b8d79c3622118641fb8551a31e1c1f4a0551d2b57eeee4097e9c48e09481c228bef6aa3c4aa7b9e72e8731cbc57a20a9e3417ec718c6d57a401d3c04ee2e4066d6d950149e277dc2bdaa23879b2c5135611d82ad8d20a4b2235c09da69fbd9878cbc52b25622165e0ab3bffe476eb2884629596dc865f6b13ba510cb375e59195636deeeb06786a7c9904ccdc58eb8664fe7b4d32bcb9fc8ab135c25ee2c22837c6c3a8c116e8fdcfc310799d0fc974e43d3a73fa0f8bd9057a1465823567f681c1d2e6c4a33770a4dccd06bce94b0af0e4d198b040d8094d610bbbd4501d8da6028b5e73f135cba6a8d7bb6cab2f06576eacd823e520282f9f883634a6dd4cc4810cba3f760b9842a0acae7a396892b658e3b6c84d0e75196b4e6a3240e9d2aadf257ae970153238e347d3cbcbfabae300494ea0d1bf292799e09b8064ed885cce1574ee94c216c50017c43b3407716e5919fa0706ea739c382bb321e8d6fa2520543d0427a620bb45c56d3f7e66aa025f17863024a2bd693d932bacfa516fec791e86982d020faa819bf2264f8606ef260a29af16300971d0ec49d6f5a21f9c437b75b44eb59bbaf71947621a1e78c68e2767dd42c7f6e3dd6faeebfc8fdfe4dec6db3fdd2d53c906f6040278ea235b37442f34cfa1a1f1064acce6a7cdb9657c1ea2def6c1f2220ab57ececfe53b4bdb6e57afaac1c055f25202c1efa65b3e48f5b57dcd2b7f3572d1d96a736813ca6acc75c967a89edc5dd62eea64cd46eeab6aa879887360aec466dd287705497e832bd4eb3d73524e4847c18f8b46de1a88a00dfa43acf51fe97288d53e30c6f2739b4532c6e8f7286a25c5f5f10532fee71d7c1c1f6a1c56f2535d94e2dd774f424cab2bf3673e097fd3cfb55ba1f29a6d03dc31abc214a6dc5950824f05f0a3036690120684a7117d42e9d40b56f3738428540c27f25ce4130966fc9b08f831756d5448be9ad7d07b95bfe61fb396438bba4ccaffa7a8a21edc5324d72514427a75a3619e48400e1b13a97ae7097f87c9253035ac3a1e3bf6d22725d22e31b7e0c9515f98f34ba357cc136190f81c010f83306d97a89184656bef128a648b9878bbefc508a631f949d8540ed16aead49d51911901d74d7aa9649317356ebd2ac0441be95291c1c2ba803b2e4604ac4b09e29fc6200819fb2603b46dbe929e4cc661c4f31a6cdc94a81fa62eb28bf447fe2ddbbb3d5f2b97d4189ffe5d83bc8be19ee5c92b958488a55c859d7eb5885674bd351c4125a02151529e9ab01685f2e4bba3aef0d5e9ad8678dab470d761beb8785424d51c4aa728417d1edc7cc44d8c7f2f5a09c68f940fc72a4ed2952e1985b2727befdf551d95e8d43e4dcab6f65b12ea706cbc10e5354a894e7646118e6000", 0x2000, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x78, 0x0, 0x3, {0xc, 0x10, 0x0, {0x1, 0x6, 0x4030cf7d, 0x8000000000000001, 0x4100000000004, 0x200000004, 0x80000000, 0x9, 0xe29, 0x1000, 0x9, 0x0, 0x0, 0x2, 0x7}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lseek(r3, 0x0, 0x2) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x2, 0xffffffffe8110f4c, 0xd, 0xfffd, 0xf, 0x401, 0x0, 0x0, 0x100, 0x1}}, 0x50) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 847.993025ms ago: executing program 1 (id=2236): mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "d607f8f9951e76c13f64323723e7eecdf40c363423eb3d259266ec9c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468b257ff3e24852548deb01efd54f11ed2c41d078b9cf1fc8f725616b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2213f9d5c3b90400000000000000c279f03558083906666806001dcc3a633b72fad6265a293e3877adc1660edbc9a0307a25720a170e7f5670e419dc44febf7ddc73fd4a5a0b6c28665f7f46c7084e17c809268103a2584ab40a68e528329dffafc3612e325c1eb4a3ab2e156a974448000000000000000000000000000000000000000000000000008000", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90c495939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c87738d9679d3acc032a16fbefc64776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb24a9281192c7fe7499edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd20180000000000000db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c637f0000000000000058186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"}) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000240)=ANY=[@ANYBLOB="e0000001ac1414aa0000000003"], 0x1c) setsockopt$inet_mreqn(r0, 0x0, 0x25, &(0x7f0000000080)={@multicast1, @local}, 0xc) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x7, 0xca352c92cb699c71, 0xffffffffffffffff, 0xc0a55000) 797.369681ms ago: executing program 1 (id=2237): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_disconnect(r0) r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) write(r1, &(0x7f0000000440), 0x0) 661.773273ms ago: executing program 3 (id=2238): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_disconnect(r0) r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) write(r1, &(0x7f0000000440), 0x0) 430.412952ms ago: executing program 2 (id=2239): setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/net/bond0/bonding/mode\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='b', 0x1) 418.482396ms ago: executing program 2 (id=2240): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000022a00)={0x4000000, 0x0, 0x0, 0x2, 0x2}) 373.525631ms ago: executing program 2 (id=2241): ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0x642, 0x0, 0x0}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) munmap(&(0x7f0000000000/0x4000)=nil, 0x4000) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r1, 0x800452d3, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="2b1204"], 0x98) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$sndpcmc(&(0x7f0000004240), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS64(r3, 0xc0844123, &(0x7f00000001c0)) sendmsg$nl_generic(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000008ec0)={0x2c, 0x2d, 0x107, 0x0, 0x25dfdbff, {0x2, 0x7c}, [@nested={0x18, 0x1, 0x0, 0x1, [@typed={0x14, 0x6, 0x0, 0x0, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc000}, 0x2000c010) 202.346265ms ago: executing program 2 (id=2242): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000140)="f3a50f232b66baf80cb837b82786ef66bafc0cec0f001d86000000de8100000000b9800000c00f3235000800000f3066b8ca000f00d80fc75ea4f30f09b9800000c00f3235008000000f30", 0x4b}], 0x1, 0x3, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x500) 21.555026ms ago: executing program 0 (id=2243): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/md0\x00', 0x2, 0x0) ioctl(r0, 0x928, &(0x7f0000000400)) 0s ago: executing program 2 (id=2244): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)="f326", 0x2, 0xffffffffffffffff) (async) r0 = add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)="f326", 0x2, 0xffffffffffffffff) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) (async) syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) r1 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000004e40)={0xfb, 0x13, 0x0, 0x0, "4d512c91002a4950676142687108dcd3f82acf5a895bd90fca2bb40bb4fff29c"}) (async) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000004e40)={0xfb, 0x13, 0x0, 0x0, "4d512c91002a4950676142687108dcd3f82acf5a895bd90fca2bb40bb4fff29c"}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000140)=0x1, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000140)=0x1, 0x4) read(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(r2, 0x0, 0x0, 0x24004cd1) ioctl$KDGKBMETA(0xffffffffffffffff, 0x4b62, 0x0) r3 = add_key$user(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x1}, &(0x7f00000001c0)="c5c5d3012bfb2120d7aaaa47719a22739ad309c807640b273d07e73ff7e48948a322bcad1854bc817400599be4c6dc6c8bb344ddd7511e9a784789632ee425120bf85011182f721a04ab06cc1a4212d8aff4cd5d392957446eee3f985fc1c7b508a58592517693c7d51688ed6abe3eea272c2ecfb2fe584e26e2961f2cc6473ce391e5cc9b7a9a14710d2efbfc5b5dafa5b894dbf32fbbdb0454319a0e3b1629ead0af4e001ff316c317bc86b72912006481f1fbb4c7289c09fef9dbba950197", 0xc0, 0xfffffffffffffffb) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) write$vga_arbiter(r4, &(0x7f0000000080)=ANY=[@ANYBLOB='unlock i'], 0xa) add_key$user(&(0x7f00000000c0), &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000280)="8a", 0x1, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f00000002c0)={r0, r3, r0}, &(0x7f0000000300)=""/83, 0x53, &(0x7f0000000400)={&(0x7f0000000380)={'rmd256-generic\x00'}}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) syz_emit_vhci(&(0x7f0000000740)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x0, 0x0, 0x200d}}}, 0x7) pipe2$9p(&(0x7f00000001c0), 0x0) (async) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@version_9p2000}]}}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe4000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f00000000c0)="3b76210fb6150f209e440f20c0663503000000440f22c00fa2660fc7b2d42af30fa7d0440f20c066350d000000440f22c06767f2caab12bad004ec", 0x3b}], 0x1, 0xd, 0x0, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f0000000240)={[0x10583a, 0x5, 0xa, 0x4000000000, 0x6, 0x2, 0x1041, 0x4, 0x4, 0x32a, 0xfffffffffffffffb, 0xffffffff, 0xfffffffffffffffe, 0x9, 0x800005, 0x6a], 0x26000, 0x1000d6}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) (async) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) kernel console output (not intermixed with test programs): 460.440401][T12736] netlink_rcv_skb+0x226/0x4a0 [ 460.440486][T12736] ? __pfx_genl_rcv_msg+0x10/0x10 [ 460.440552][T12736] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 460.440683][T12736] ? down_read+0x2be/0x330 [ 460.440763][T12736] genl_rcv+0x28/0x40 [ 460.440818][T12736] netlink_unicast+0x7bd/0x940 [ 460.440925][T12736] netlink_sendmsg+0x813/0xb40 [ 460.441032][T12736] ? __pfx_netlink_sendmsg+0x10/0x10 [ 460.441145][T12736] ? apparmor_socket_sendmsg+0x98/0x360 [ 460.441230][T12736] ? __pfx_netlink_sendmsg+0x10/0x10 [ 460.441309][T12736] sock_sendmsg_nosec+0x13a/0x180 [ 460.441438][T12736] ____sys_sendmsg+0x54e/0x850 [ 460.441572][T12736] ? __pfx_____sys_sendmsg+0x10/0x10 [ 460.441688][T12736] ? import_iovec+0x73/0xa0 [ 460.441759][T12736] ___sys_sendmsg+0x2a5/0x360 [ 460.441833][T12736] ? __lock_acquire+0x6df/0x2e50 [ 460.441939][T12736] ? __pfx____sys_sendmsg+0x10/0x10 [ 460.442127][T12736] ? __fget_files+0x2a/0x420 [ 460.442192][T12736] ? __fget_files+0x3a2/0x420 [ 460.442288][T12736] __x64_sys_sendmsg+0x1b1/0x290 [ 460.442372][T12736] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 460.442510][T12736] do_syscall_64+0x166/0x520 [ 460.442558][T12736] ? trace_irq_disable+0x3b/0x140 [ 460.442644][T12736] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.442706][T12736] ? clear_bhb_loop+0x70/0xc0 [ 460.442788][T12736] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.442860][T12736] RIP: 0033:0x7f668d39e0d9 [ 460.442925][T12736] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 460.442979][T12736] RSP: 002b:00007f668e313028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 460.443068][T12736] RAX: ffffffffffffffda RBX: 00007f668d625fa0 RCX: 00007f668d39e0d9 [ 460.443111][T12736] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 460.443152][T12736] RBP: 00007f668e313090 R08: 0000000000000000 R09: 0000000000000000 [ 460.443192][T12736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 460.443226][T12736] R13: 00007f668d626038 R14: 00007f668d625fa0 R15: 00007fff766ecd18 [ 460.443314][T12736] [ 460.579027][ T1954] usb 3-1: Using ep0 maxpacket: 16 [ 460.584915][ T1954] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 460.611076][ T1954] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 460.680219][ T5746] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 460.705921][ T1954] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.705953][ T1954] usb 3-1: Product: syz [ 460.705969][ T1954] usb 3-1: Manufacturer: syz [ 460.705987][ T1954] usb 3-1: SerialNumber: syz [ 460.870208][ T1954] usb 3-1: config 0 descriptor?? [ 460.891155][ T5746] usb 1-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice= 1.00 [ 460.906550][ T5746] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.914758][ T5746] usb 1-1: Product: syz [ 460.914816][ T5746] usb 1-1: Manufacturer: syz [ 460.914839][ T5746] usb 1-1: SerialNumber: syz [ 460.943306][ T5746] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 460.951477][ T5746] gspca_m5602: Forcing a MT9M111 sensor [ 461.087821][ T5793] usb 3-1: USB disconnect, device number 56 [ 461.555527][ T5746] gspca_m5602: Could not initialize controls [ 461.564867][ T5746] ALi m5602 1-1:1.0: probe with driver ALi m5602 failed with error -34 [ 461.582856][ T5746] usb 1-1: USB disconnect, device number 95 [ 461.758793][ T10] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 461.909236][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 461.911402][ T10] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 461.923912][ T5725] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 461.930581][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.930674][ T10] usb 4-1: Product: syz [ 461.930721][ T10] usb 4-1: Manufacturer: syz [ 461.930789][ T10] usb 4-1: SerialNumber: syz [ 461.946182][ T10] usb 4-1: config 0 descriptor?? [ 462.090880][ T5725] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 462.101627][ T5725] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 462.101676][ T5725] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 462.101810][ T5725] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.124791][ T5725] usb 2-1: config 0 descriptor?? [ 462.172093][ T10] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: version d4.15 found at bus 004 address 093 [ 462.308764][ T5748] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 462.458926][ T1954] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 462.459817][ T5748] usb 3-1: Using ep0 maxpacket: 8 [ 462.466767][ T5748] usb 3-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 462.472297][ T5748] usb 3-1: config 0 has no interfaces? [ 462.485608][ T5748] usb 3-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 462.485694][ T5748] usb 3-1: Product: syz [ 462.485746][ T5748] usb 3-1: Manufacturer: syz [ 462.485810][ T5748] usb 3-1: SerialNumber: syz [ 462.501166][ T5748] usb 3-1: config 0 descriptor?? [ 462.658721][ T1954] usb 1-1: Using ep0 maxpacket: 8 [ 462.661220][ T1954] usb 1-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 462.663397][ T1954] usb 1-1: config 0 has no interfaces? [ 462.674145][ T1954] usb 1-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 462.674325][ T1954] usb 1-1: Product: syz [ 462.674377][ T1954] usb 1-1: Manufacturer: syz [ 462.674474][ T1954] usb 1-1: SerialNumber: syz [ 462.690863][ T1954] usb 1-1: config 0 descriptor?? [ 462.719364][ T5748] usb 3-1: USB disconnect, device number 57 [ 462.740173][T12800] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 462.753920][T12800] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 462.811634][ T5725] usbhid 2-1:0.0: can't add hid device: -71 [ 462.812714][ T5725] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 462.835570][ T5725] usb 2-1: USB disconnect, device number 88 [ 462.897610][ T10] usb 1-1: USB disconnect, device number 96 [ 463.446737][T12867] FAULT_INJECTION: forcing a failure. [ 463.446737][T12867] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 463.446803][T12867] CPU: 1 UID: 0 PID: 12867 Comm: syz.0.2070 Not tainted syzkaller #0 PREEMPT(full) [ 463.446828][T12867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 463.446867][T12867] Call Trace: [ 463.446908][T12867] [ 463.446939][T12867] dump_stack_lvl+0xe8/0x150 [ 463.447052][T12867] should_fail_ex+0x410/0x560 [ 463.447146][T12867] _copy_to_iter+0x59c/0x1810 [ 463.447285][T12867] ? __pfx__copy_to_iter+0x10/0x10 [ 463.447372][T12867] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 463.447461][T12867] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 463.447548][T12867] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 463.447646][T12867] __skb_datagram_iter+0xf8/0x980 [ 463.447717][T12867] ? __pfx_sk_busy_loop_end+0x10/0x10 [ 463.447769][T12867] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 463.447875][T12867] skb_copy_datagram_iter+0xb5/0x240 [ 463.447971][T12867] netlink_recvmsg+0x2b9/0xa50 [ 463.448080][T12867] ? __pfx_netlink_recvmsg+0x10/0x10 [ 463.448157][T12867] ? lock_acquire+0x115/0x350 [ 463.448261][T12867] ? aa_sock_msg_perm+0x144/0x210 [ 463.448397][T12867] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 463.448468][T12867] ? security_socket_recvmsg+0x7e/0x2c0 [ 463.448541][T12867] ? __pfx_netlink_recvmsg+0x10/0x10 [ 463.448629][T12867] sock_recvmsg+0x196/0x1e0 [ 463.448721][T12867] ____sys_recvmsg+0x1e6/0x4a0 [ 463.448826][T12867] ? __pfx_____sys_recvmsg+0x10/0x10 [ 463.448943][T12867] ? import_iovec+0x73/0xa0 [ 463.449008][T12867] ___sys_recvmsg+0x213/0x5a0 [ 463.449100][T12867] ? __pfx____sys_recvmsg+0x10/0x10 [ 463.449187][T12867] ? lock_acquire+0x115/0x350 [ 463.449322][T12867] ? __fget_files+0x3a2/0x420 [ 463.449398][T12867] do_recvmmsg+0x31a/0x7f0 [ 463.449490][T12867] ? __pfx_do_recvmmsg+0x10/0x10 [ 463.449603][T12867] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 463.449676][T12867] ? __fget_files+0x3a2/0x420 [ 463.449785][T12867] __x64_sys_recvmmsg+0x198/0x250 [ 463.449886][T12867] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 463.449990][T12867] do_syscall_64+0x166/0x520 [ 463.450045][T12867] ? trace_irq_disable+0x3b/0x140 [ 463.450113][T12867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 463.450177][T12867] ? clear_bhb_loop+0x70/0xc0 [ 463.450261][T12867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 463.450307][T12867] RIP: 0033:0x7f2d81f9e0d9 [ 463.450350][T12867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 463.450389][T12867] RSP: 002b:00007f2d82f00028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 463.450453][T12867] RAX: ffffffffffffffda RBX: 00007f2d82225fa0 RCX: 00007f2d81f9e0d9 [ 463.450491][T12867] RDX: 0000000000000003 RSI: 00002000000003c0 RDI: 0000000000000003 [ 463.450533][T12867] RBP: 00007f2d82f00090 R08: 0000000000000000 R09: 0000000000000000 [ 463.450575][T12867] R10: 0000000040000102 R11: 0000000000000246 R12: 0000000000000001 [ 463.450613][T12867] R13: 00007f2d82226038 R14: 00007f2d82225fa0 R15: 00007ffffd66b058 [ 463.450707][T12867] [ 463.528745][ T5725] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 463.631184][ T1954] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 463.706608][ T5725] usb 3-1: unable to get BOS descriptor or descriptor too short [ 463.706780][ T5725] usb 3-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 463.715374][ T5725] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 463.715459][ T5725] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 463.739490][ T5725] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.739574][ T5725] usb 3-1: Product: syz [ 463.739617][ T5725] usb 3-1: Manufacturer: syz [ 463.739660][ T5725] usb 3-1: SerialNumber: syz [ 463.811402][ T1954] usb 2-1: Using ep0 maxpacket: 8 [ 463.815564][ T1954] usb 2-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 463.822412][ T1954] usb 2-1: config 0 has no interfaces? [ 463.863971][ T1954] usb 2-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 463.864056][ T1954] usb 2-1: Product: syz [ 463.864099][ T1954] usb 2-1: Manufacturer: syz [ 463.864143][ T1954] usb 2-1: SerialNumber: syz [ 463.887953][ T5725] usb 3-1: selecting invalid altsetting 1 [ 463.896806][ T1954] usb 2-1: config 0 descriptor?? [ 463.913524][ T5725] usb 3-1: unit 6 not found! [ 464.016315][T12856] warning: `syz.2.2068' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 464.111780][ T1954] usb 2-1: USB disconnect, device number 89 [ 464.278749][ T10] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 464.428778][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 464.434789][ T10] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 464.440083][ T10] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 464.461070][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.461153][ T10] usb 1-1: Product: syz [ 464.461171][ T10] usb 1-1: Manufacturer: syz [ 464.461225][ T10] usb 1-1: SerialNumber: syz [ 464.474628][ T10] usb 1-1: config 0 descriptor?? [ 464.535979][ T10] usb 4-1: USB disconnect, device number 93 [ 464.625797][T12901] netlink: 'syz.3.2074': attribute type 11 has an invalid length. [ 464.659618][ T5725] usb 3-1: 2:0: broken mixer GET_CUR (0/123/1 => 0) [ 464.716133][ T1954] usb 1-1: USB disconnect, device number 97 [ 464.979068][ T5725] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 464.993757][ T5725] usb 3-1: USB disconnect, device number 58 [ 465.056419][ T5843] udevd[5843]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 465.085284][T12935] FAULT_INJECTION: forcing a failure. [ 465.085284][T12935] name failslab, interval 1, probability 0, space 0, times 0 [ 465.087668][T12935] CPU: 1 UID: 0 PID: 12935 Comm: syz.1.2076 Not tainted syzkaller #0 PREEMPT(full) [ 465.087699][T12935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 465.087718][T12935] Call Trace: [ 465.087729][T12935] [ 465.087739][T12935] dump_stack_lvl+0xe8/0x150 [ 465.087775][T12935] should_fail_ex+0x410/0x560 [ 465.087816][T12935] should_failslab+0xa8/0x100 [ 465.087845][T12935] __kmalloc_noprof+0xfe/0x720 [ 465.087878][T12935] ? do_insn_ioctl+0x100/0x5b0 [ 465.087901][T12935] ? do_insn_ioctl+0x100/0x5b0 [ 465.087930][T12935] do_insn_ioctl+0x100/0x5b0 [ 465.087961][T12935] comedi_unlocked_ioctl+0xe06/0x1af0 [ 465.088016][T12935] ? kasan_quarantine_put+0xbb/0x1f0 [ 465.088049][T12935] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 465.088091][T12935] ? tomoyo_path_number_perm+0x219/0x5f0 [ 465.088125][T12935] ? tomoyo_path_number_perm+0x219/0x5f0 [ 465.088160][T12935] ? do_vfs_ioctl+0x116f/0x1530 [ 465.088198][T12935] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 465.088244][T12935] ? hook_file_ioctl+0x1f2/0x600 [ 465.088298][T12935] ? __fget_files+0x2a/0x420 [ 465.088330][T12935] ? __fget_files+0x3a2/0x420 [ 465.088356][T12935] ? __fget_files+0x2a/0x420 [ 465.088386][T12935] ? bpf_lsm_file_ioctl+0x9/0x20 [ 465.088414][T12935] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 465.088449][T12935] __se_sys_ioctl+0xfc/0x170 [ 465.088485][T12935] do_syscall_64+0x166/0x520 [ 465.088509][T12935] ? trace_irq_disable+0x3b/0x140 [ 465.088541][T12935] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.088567][T12935] ? clear_bhb_loop+0x70/0xc0 [ 465.088605][T12935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.088627][T12935] RIP: 0033:0x7f4a3119e0d9 [ 465.088647][T12935] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 465.088668][T12935] RSP: 002b:00007f4a3212a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 465.088694][T12935] RAX: ffffffffffffffda RBX: 00007f4a31425fa0 RCX: 00007f4a3119e0d9 [ 465.088711][T12935] RDX: 0000200000022a00 RSI: 000000008028640c RDI: 0000000000000003 [ 465.088727][T12935] RBP: 00007f4a3212a090 R08: 0000000000000000 R09: 0000000000000000 [ 465.088742][T12935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 465.088756][T12935] R13: 00007f4a31426038 R14: 00007f4a31425fa0 R15: 00007fffab2fda88 [ 465.088792][T12935] [ 465.623611][T12947] FAULT_INJECTION: forcing a failure. [ 465.623611][T12947] name failslab, interval 1, probability 0, space 0, times 0 [ 465.623672][T12947] CPU: 0 UID: 0 PID: 12947 Comm: syz.0.2079 Not tainted syzkaller #0 PREEMPT(full) [ 465.623699][T12947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 465.623758][T12947] Call Trace: [ 465.623786][T12947] [ 465.623837][T12947] dump_stack_lvl+0xe8/0x150 [ 465.624007][T12947] should_fail_ex+0x410/0x560 [ 465.624109][T12947] ? dup_task_struct+0x52/0xa00 [ 465.624222][T12947] should_failslab+0xa8/0x100 [ 465.624294][T12947] ? dup_task_struct+0x52/0xa00 [ 465.624359][T12947] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 465.624454][T12947] ? dup_task_struct+0x52/0xa00 [ 465.624551][T12947] dup_task_struct+0x52/0xa00 [ 465.624617][T12947] ? _raw_spin_unlock_irq+0x23/0x50 [ 465.624720][T12947] copy_process+0x820/0x43e0 [ 465.624859][T12947] ? rcu_is_watching+0x16/0xb0 [ 465.624927][T12947] ? __pfx_copy_process+0x10/0x10 [ 465.625059][T12947] ? mutex_init_lockdep+0xdf/0x110 [ 465.625137][T12947] vhost_task_create+0x1f9/0x380 [ 465.625240][T12947] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 465.625321][T12947] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 465.625387][T12947] ? __pfx_vhost_task_create+0x10/0x10 [ 465.625466][T12947] ? register_lock_class+0x31/0x2e0 [ 465.625584][T12947] ? __pfx_vhost_task_fn+0x10/0x10 [ 465.625691][T12947] ? kasan_quarantine_put+0xbb/0x1f0 [ 465.625797][T12947] kvm_mmu_post_init_vm+0x147/0x2b0 [ 465.625874][T12947] kvm_arch_vcpu_ioctl_run+0x7c/0x19c0 [ 465.625983][T12947] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 465.626076][T12947] kvm_vcpu_ioctl+0xa61/0xfd0 [ 465.626182][T12947] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 465.626267][T12947] ? hook_file_ioctl+0x1f2/0x600 [ 465.626416][T12947] ? __fget_files+0x2a/0x420 [ 465.626514][T12947] ? __fget_files+0x2a/0x420 [ 465.626587][T12947] ? __fget_files+0x3a2/0x420 [ 465.626652][T12947] ? __fget_files+0x2a/0x420 [ 465.626746][T12947] ? bpf_lsm_file_ioctl+0x9/0x20 [ 465.626821][T12947] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 465.626914][T12947] __se_sys_ioctl+0xfc/0x170 [ 465.627014][T12947] do_syscall_64+0x166/0x520 [ 465.627070][T12947] ? trace_irq_disable+0x3b/0x140 [ 465.627154][T12947] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.627216][T12947] ? clear_bhb_loop+0x70/0xc0 [ 465.627292][T12947] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.627356][T12947] RIP: 0033:0x7f2d81f9e0d9 [ 465.627419][T12947] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 465.627472][T12947] RSP: 002b:00007f2d82edf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 465.627548][T12947] RAX: ffffffffffffffda RBX: 00007f2d82226090 RCX: 00007f2d81f9e0d9 [ 465.627599][T12947] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 465.627642][T12947] RBP: 00007f2d82edf090 R08: 0000000000000000 R09: 0000000000000000 [ 465.627677][T12947] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 465.627719][T12947] R13: 00007f2d82226128 R14: 00007f2d82226090 R15: 00007ffffd66b058 [ 465.627817][T12947] [ 466.079849][ T10] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 466.175532][T12974] 9p: Unknown Cache mode or invalid value fs [ 466.204344][T12974] nfs: Unknown parameter '&OJ+[mountport' [ 466.249337][ T10] usb 3-1: New USB device found, idVendor=056a, idProduct=0084, bcdDevice= 0.00 [ 466.249414][ T10] usb 3-1: too many configurations: 33, using maximum allowed: 8 [ 466.254255][ T10] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 466.254393][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 466.258590][ T10] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 466.259662][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 466.266441][ T10] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 466.266491][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 466.267867][ T10] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 466.267922][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 466.279439][ T10] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 466.279587][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 466.282424][ T10] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 466.282561][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 466.285682][ T10] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 466.290795][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 466.298458][ T10] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 466.303935][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 466.314287][ T10] usb 3-1: New USB device strings: Mfr=143, Product=226, SerialNumber=0 [ 466.314414][ T10] usb 3-1: Product: syz [ 466.314438][ T10] usb 3-1: Manufacturer: syz [ 466.380535][T12978] IPVS: set_ctl: invalid protocol: 59 127.0.0.1:5376 [ 466.390093][ T5725] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 466.464889][ T10] usbhid 3-1:1.0: couldn't find an input interrupt endpoint [ 466.543502][T12984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 466.546656][T12984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 466.578735][ T5725] usb 4-1: Using ep0 maxpacket: 32 [ 466.584688][ T5725] usb 4-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 466.598792][ T5725] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.607049][ T5725] usb 4-1: Product: syz [ 466.612280][ T5725] usb 4-1: Manufacturer: syz [ 466.616980][ T5725] usb 4-1: SerialNumber: syz [ 466.624998][ T5725] usb 4-1: config 0 descriptor?? [ 466.768802][ T1954] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 466.838419][ T5725] RobotFuzz Open Source InterFace, OSIF 4-1:0.0: version d4.15 found at bus 004 address 094 [ 466.908753][ T1954] usb 1-1: device descriptor read/64, error -71 [ 467.104573][T13001] bond0: option mode: unable to set because the bond device is up [ 467.104659][T13001] FAULT_INJECTION: forcing a failure. [ 467.104659][T13001] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 467.117454][T13001] CPU: 0 UID: 0 PID: 13001 Comm: syz.1.2086 Not tainted syzkaller #0 PREEMPT(full) [ 467.117540][T13001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 467.117582][T13001] Call Trace: [ 467.117612][T13001] [ 467.117637][T13001] dump_stack_lvl+0xe8/0x150 [ 467.117734][T13001] should_fail_ex+0x410/0x560 [ 467.117830][T13001] _copy_to_user+0x31/0xb0 [ 467.117903][T13001] simple_read_from_buffer+0xe1/0x170 [ 467.117989][T13001] proc_fail_nth_read+0x1bb/0x230 [ 467.118061][T13001] ? common_file_perm+0x20e/0x2b0 [ 467.118166][T13001] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 467.118277][T13001] ? rw_verify_area+0x24a/0x4c0 [ 467.118354][T13001] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 467.118436][T13001] vfs_read+0x213/0xa80 [ 467.118527][T13001] ? __pfx___mutex_lock+0x10/0x10 [ 467.118593][T13001] ? __pfx_vfs_read+0x10/0x10 [ 467.118689][T13001] ? __fget_files+0x2a/0x420 [ 467.118766][T13001] ? __fget_files+0x3a2/0x420 [ 467.118831][T13001] ? __fget_files+0x2a/0x420 [ 467.118925][T13001] ksys_read+0x150/0x270 [ 467.119003][T13001] ? __pfx_ksys_read+0x10/0x10 [ 467.119061][T13001] do_syscall_64+0x166/0x520 [ 467.119122][T13001] ? trace_irq_disable+0x3b/0x140 [ 467.119201][T13001] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.119265][T13001] ? clear_bhb_loop+0x70/0xc0 [ 467.119342][T13001] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.119399][T13001] RIP: 0033:0x7f4a3115e90e [ 467.119463][T13001] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 467.119541][T13001] RSP: 002b:00007f4a32129fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 467.119614][T13001] RAX: ffffffffffffffda RBX: 00007f4a3212a6c0 RCX: 00007f4a3115e90e [ 467.119664][T13001] RDX: 000000000000000f RSI: 00007f4a3212a0a0 RDI: 0000000000000004 [ 467.119707][T13001] RBP: 00007f4a3212a090 R08: 0000000000000000 R09: 0000000000000000 [ 467.119742][T13001] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 467.119782][T13001] R13: 00007f4a31426038 R14: 00007f4a31425fa0 R15: 00007fffab2fda88 [ 467.119879][T13001] [ 467.161758][ T1954] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 467.368713][ T1954] usb 1-1: device descriptor read/64, error -71 [ 467.403191][T13006] comedi comedi0: adq12b: I/O port conflict (0x300,16) [ 467.416586][T13006] bond0: option mode: unable to set because the bond device is up [ 467.490390][ T1954] usb usb1-port1: attempt power cycle [ 467.708733][ T5748] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 467.828726][ T1954] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 467.849434][ T1954] usb 1-1: device descriptor read/8, error -71 [ 467.858746][ T5748] usb 2-1: Using ep0 maxpacket: 16 [ 467.860521][ T5748] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 467.863884][ T5748] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 467.871769][ T5748] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.871846][ T5748] usb 2-1: Product: syz [ 467.871897][ T5748] usb 2-1: Manufacturer: syz [ 467.871940][ T5748] usb 2-1: SerialNumber: syz [ 467.884688][ T5748] usb 2-1: config 0 descriptor?? [ 468.088724][ T1954] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 468.111261][ T5748] usb 2-1: USB disconnect, device number 90 [ 468.120812][ T1954] usb 1-1: device descriptor read/8, error -71 [ 468.229181][ T1954] usb usb1-port1: unable to enumerate USB device [ 468.571445][ T25] usb 3-1: USB disconnect, device number 59 [ 469.011879][T13046] FAULT_INJECTION: forcing a failure. [ 469.011879][T13046] name failslab, interval 1, probability 0, space 0, times 0 [ 469.011940][T13046] CPU: 0 UID: 0 PID: 13046 Comm: syz.1.2094 Not tainted syzkaller #0 PREEMPT(full) [ 469.011966][T13046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 469.012015][T13046] Call Trace: [ 469.012052][T13046] [ 469.012093][T13046] dump_stack_lvl+0xe8/0x150 [ 469.012197][T13046] should_fail_ex+0x410/0x560 [ 469.012302][T13046] ? dup_task_struct+0x52/0xa00 [ 469.012368][T13046] should_failslab+0xa8/0x100 [ 469.012442][T13046] ? dup_task_struct+0x52/0xa00 [ 469.012500][T13046] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 469.012593][T13046] ? dup_task_struct+0x52/0xa00 [ 469.012660][T13046] dup_task_struct+0x52/0xa00 [ 469.012736][T13046] ? _raw_spin_unlock_irq+0x23/0x50 [ 469.012835][T13046] copy_process+0x820/0x43e0 [ 469.012969][T13046] ? rcu_is_watching+0x16/0xb0 [ 469.013044][T13046] ? __pfx_copy_process+0x10/0x10 [ 469.013129][T13046] ? mutex_init_lockdep+0xdf/0x110 [ 469.013206][T13046] vhost_task_create+0x1f9/0x380 [ 469.013300][T13046] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 469.013363][T13046] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 469.013427][T13046] ? __pfx_vhost_task_create+0x10/0x10 [ 469.013517][T13046] ? register_lock_class+0x31/0x2e0 [ 469.013638][T13046] ? __pfx_vhost_task_fn+0x10/0x10 [ 469.013750][T13046] ? kasan_quarantine_put+0xbb/0x1f0 [ 469.013857][T13046] kvm_mmu_post_init_vm+0x147/0x2b0 [ 469.013926][T13046] kvm_arch_vcpu_ioctl_run+0x7c/0x19c0 [ 469.014040][T13046] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 469.014140][T13046] kvm_vcpu_ioctl+0xa61/0xfd0 [ 469.014255][T13046] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 469.014340][T13046] ? hook_file_ioctl+0x1f2/0x600 [ 469.014477][T13046] ? __fget_files+0x2a/0x420 [ 469.014553][T13046] ? __fget_files+0x2a/0x420 [ 469.014646][T13046] ? __fget_files+0x3a2/0x420 [ 469.014724][T13046] ? __fget_files+0x2a/0x420 [ 469.014808][T13046] ? bpf_lsm_file_ioctl+0x9/0x20 [ 469.014892][T13046] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 469.015008][T13046] __se_sys_ioctl+0xfc/0x170 [ 469.015103][T13046] do_syscall_64+0x166/0x520 [ 469.015183][T13046] ? trace_irq_disable+0x3b/0x140 [ 469.015262][T13046] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.015363][T13046] ? clear_bhb_loop+0x70/0xc0 [ 469.015437][T13046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.015517][T13046] RIP: 0033:0x7f4a3119e0d9 [ 469.015580][T13046] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 469.015634][T13046] RSP: 002b:00007f4a3212a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 469.015706][T13046] RAX: ffffffffffffffda RBX: 00007f4a31425fa0 RCX: 00007f4a3119e0d9 [ 469.015758][T13046] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 469.015792][T13046] RBP: 00007f4a3212a090 R08: 0000000000000000 R09: 0000000000000000 [ 469.015839][T13046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 469.015879][T13046] R13: 00007f4a31426038 R14: 00007f4a31425fa0 R15: 00007fffab2fda88 [ 469.015971][T13046] [ 469.371695][ T10] usb 4-1: USB disconnect, device number 94 [ 469.409778][T13053] FAULT_INJECTION: forcing a failure. [ 469.409778][T13053] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 469.409844][T13053] CPU: 0 UID: 0 PID: 13053 Comm: syz.2.2095 Not tainted syzkaller #0 PREEMPT(full) [ 469.409870][T13053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 469.409917][T13053] Call Trace: [ 469.409949][T13053] [ 469.409984][T13053] dump_stack_lvl+0xe8/0x150 [ 469.410106][T13053] should_fail_ex+0x410/0x560 [ 469.410211][T13053] _copy_to_user+0x31/0xb0 [ 469.410270][T13053] simple_read_from_buffer+0xe1/0x170 [ 469.410364][T13053] proc_fail_nth_read+0x1bb/0x230 [ 469.410441][T13053] ? common_file_perm+0x20e/0x2b0 [ 469.410529][T13053] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 469.410618][T13053] ? rw_verify_area+0x24a/0x4c0 [ 469.410696][T13053] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 469.410773][T13053] vfs_read+0x213/0xa80 [ 469.410861][T13053] ? __pfx___mutex_lock+0x10/0x10 [ 469.410926][T13053] ? __pfx_vfs_read+0x10/0x10 [ 469.411011][T13053] ? __fget_files+0x2a/0x420 [ 469.411099][T13053] ? __fget_files+0x3a2/0x420 [ 469.411165][T13053] ? __fget_files+0x2a/0x420 [ 469.411253][T13053] ksys_read+0x150/0x270 [ 469.411337][T13053] ? __pfx_ksys_read+0x10/0x10 [ 469.411421][T13053] ? __pfx_blkdev_ioctl+0x10/0x10 [ 469.411555][T13053] do_syscall_64+0x166/0x520 [ 469.411617][T13053] ? trace_irq_disable+0x3b/0x140 [ 469.411702][T13053] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.411765][T13053] ? clear_bhb_loop+0x70/0xc0 [ 469.411842][T13053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.411905][T13053] RIP: 0033:0x7f66c975e90e [ 469.411960][T13053] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 469.412014][T13053] RSP: 002b:00007f66ca660fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 469.412088][T13053] RAX: ffffffffffffffda RBX: 00007f66ca6616c0 RCX: 00007f66c975e90e [ 469.412140][T13053] RDX: 000000000000000f RSI: 00007f66ca6610a0 RDI: 0000000000000004 [ 469.412176][T13053] RBP: 00007f66ca661090 R08: 0000000000000000 R09: 0000000000000000 [ 469.412217][T13053] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 469.412252][T13053] R13: 00007f66c9a26038 R14: 00007f66c9a25fa0 R15: 00007fffd8d01238 [ 469.412348][T13053] [ 469.849157][T13075] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2099'. [ 470.009312][T13091] FAULT_INJECTION: forcing a failure. [ 470.009312][T13091] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 470.009381][T13091] CPU: 0 UID: 0 PID: 13091 Comm: syz.1.2101 Not tainted syzkaller #0 PREEMPT(full) [ 470.009407][T13091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 470.009453][T13091] Call Trace: [ 470.009487][T13091] [ 470.009517][T13091] dump_stack_lvl+0xe8/0x150 [ 470.009647][T13091] should_fail_ex+0x410/0x560 [ 470.009748][T13091] _copy_from_user+0x2d/0xb0 [ 470.009814][T13091] memdup_user+0x5e/0xd0 [ 470.009905][T13091] kvm_arch_vm_ioctl+0x86b/0x1a10 [ 470.009981][T13091] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 470.010045][T13091] ? __lock_acquire+0x6df/0x2e50 [ 470.010164][T13091] ? __lock_acquire+0x6df/0x2e50 [ 470.010275][T13091] ? lock_acquire+0x115/0x350 [ 470.010382][T13091] ? lock_acquire+0x115/0x350 [ 470.010482][T13091] ? lock_acquire+0x115/0x350 [ 470.010591][T13091] ? is_bpf_text_address+0x26/0x2b0 [ 470.010668][T13091] ? is_bpf_text_address+0x292/0x2b0 [ 470.010725][T13091] ? is_bpf_text_address+0x26/0x2b0 [ 470.010792][T13091] ? kernel_text_address+0xa5/0xe0 [ 470.010857][T13091] ? __kernel_text_address+0xd/0x30 [ 470.010968][T13091] ? unwind_get_return_address+0x4d/0x90 [ 470.011039][T13091] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 470.011128][T13091] ? arch_stack_walk+0xfb/0x150 [ 470.011224][T13091] ? stack_trace_save+0xa9/0x100 [ 470.011302][T13091] ? __pfx_stack_trace_save+0x10/0x10 [ 470.011386][T13091] ? kasan_save_track+0x4f/0x80 [ 470.011481][T13091] ? stack_depot_save_flags+0x33/0x7f0 [ 470.011552][T13091] ? __lock_acquire+0x6df/0x2e50 [ 470.011640][T13091] ? kasan_save_track+0x4f/0x80 [ 470.011723][T13091] ? kasan_save_track+0x3e/0x80 [ 470.011799][T13091] ? kasan_save_free_info+0x40/0x50 [ 470.011865][T13091] ? __kasan_slab_free+0x5c/0x80 [ 470.011949][T13091] ? kfree+0x1c5/0x650 [ 470.012021][T13091] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 470.012107][T13091] ? security_file_ioctl+0xc3/0x2a0 [ 470.012183][T13091] ? __se_sys_ioctl+0x47/0x170 [ 470.012260][T13091] ? do_syscall_64+0x166/0x520 [ 470.012332][T13091] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.012454][T13091] kvm_vm_ioctl+0x8f7/0xd30 [ 470.012573][T13091] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 470.012693][T13091] ? kasan_quarantine_put+0xbb/0x1f0 [ 470.012801][T13091] ? tomoyo_path_number_perm+0x219/0x5f0 [ 470.012880][T13091] ? tomoyo_path_number_perm+0x219/0x5f0 [ 470.012994][T13091] ? do_vfs_ioctl+0x116f/0x1530 [ 470.013090][T13091] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 470.013201][T13091] ? hook_file_ioctl+0x1f2/0x600 [ 470.013339][T13091] ? __fget_files+0x2a/0x420 [ 470.013423][T13091] ? __fget_files+0x2a/0x420 [ 470.013510][T13091] ? __fget_files+0x3a2/0x420 [ 470.013587][T13091] ? __fget_files+0x2a/0x420 [ 470.013664][T13091] ? bpf_lsm_file_ioctl+0x9/0x20 [ 470.013754][T13091] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 470.013853][T13091] __se_sys_ioctl+0xfc/0x170 [ 470.013940][T13091] do_syscall_64+0x166/0x520 [ 470.013997][T13091] ? trace_irq_disable+0x3b/0x140 [ 470.014093][T13091] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.014157][T13091] ? clear_bhb_loop+0x70/0xc0 [ 470.014235][T13091] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.014300][T13091] RIP: 0033:0x7f4a3119e0d9 [ 470.014362][T13091] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 470.014415][T13091] RSP: 002b:00007f4a3212a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 470.014509][T13091] RAX: ffffffffffffffda RBX: 00007f4a31425fa0 RCX: 00007f4a3119e0d9 [ 470.014559][T13091] RDX: 0000200000000840 RSI: 000000008208ae63 RDI: 0000000000000004 [ 470.014601][T13091] RBP: 00007f4a3212a090 R08: 0000000000000000 R09: 0000000000000000 [ 470.014644][T13091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 470.014685][T13091] R13: 00007f4a31426038 R14: 00007f4a31425fa0 R15: 00007fffab2fda88 [ 470.014772][T13091] [ 470.060296][ T1954] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 470.261371][ T1954] usb 4-1: Using ep0 maxpacket: 16 [ 470.301627][ T1954] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 470.357892][ T1954] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 470.444984][ T1954] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.453149][ T1954] usb 4-1: Product: syz [ 470.457479][ T1954] usb 4-1: Manufacturer: syz [ 470.462212][ T1954] usb 4-1: SerialNumber: syz [ 470.470277][ T1954] usb 4-1: config 0 descriptor?? [ 470.647971][T13104] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2103'. [ 470.732357][ T10] usb 4-1: USB disconnect, device number 95 [ 470.990430][T13120] rnbd_client L203: map_device: Unknown parameter or missing value '%essname=s1' [ 471.318829][ T1954] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 471.479325][ T1954] usb 2-1: Using ep0 maxpacket: 16 [ 471.487359][ T1954] usb 2-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 471.499380][ T1954] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 471.499427][ T1954] usb 2-1: config 0 has no interface number 0 [ 471.519079][ T1954] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 471.519128][ T1954] usb 2-1: Product: syz [ 471.519164][ T1954] usb 2-1: Manufacturer: syz [ 471.519186][ T1954] usb 2-1: SerialNumber: syz [ 471.546177][ T1954] usb 2-1: config 0 descriptor?? [ 471.567384][ T1954] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 471.631288][T13133] FAULT_INJECTION: forcing a failure. [ 471.631288][T13133] name failslab, interval 1, probability 0, space 0, times 0 [ 471.631356][T13133] CPU: 0 UID: 0 PID: 13133 Comm: syz.0.2110 Not tainted syzkaller #0 PREEMPT(full) [ 471.631385][T13133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 471.631399][T13133] Call Trace: [ 471.631409][T13133] [ 471.631449][T13133] dump_stack_lvl+0xe8/0x150 [ 471.631574][T13133] should_fail_ex+0x410/0x560 [ 471.631721][T13133] should_failslab+0xa8/0x100 [ 471.631795][T13133] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 471.631883][T13133] ? __kasan_kmalloc+0x93/0xb0 [ 471.631976][T13133] ? rnbd_clt_map_device_store+0x2b4/0xd60 [ 471.632066][T13133] ? rnbd_clt_map_device_store+0x2b4/0xd60 [ 471.632174][T13133] ? __kmalloc_cache_noprof+0x14d/0x600 [ 471.632270][T13133] kstrdup+0x42/0x100 [ 471.632366][T13133] rnbd_clt_map_device_store+0x2b4/0xd60 [ 471.632453][T13133] ? __kernel_text_address+0xd/0x30 [ 471.632559][T13133] ? unwind_get_return_address+0x4d/0x90 [ 471.632634][T13133] ? __pfx_rnbd_clt_map_device_store+0x10/0x10 [ 471.632722][T13133] ? look_up_lock_class+0x57/0x110 [ 471.632795][T13133] ? register_lock_class+0x31/0x2e0 [ 471.632998][T13133] ? __lock_acquire+0x6df/0x2e50 [ 471.633152][T13133] ? lock_acquire+0x115/0x350 [ 471.633237][T13133] ? sysfs_file_kobj+0x1a/0x230 [ 471.633334][T13133] ? sysfs_file_kobj+0x1a/0x230 [ 471.633401][T13133] ? sysfs_file_kobj+0x1e4/0x230 [ 471.633472][T13133] ? sysfs_kf_write+0x166/0x260 [ 471.633558][T13133] ? __pfx_sysfs_kf_write+0x10/0x10 [ 471.633631][T13133] kernfs_fop_write_iter+0x3a4/0x540 [ 471.633706][T13133] vfs_write+0x612/0xba0 [ 471.633804][T13133] ? __pfx_vfs_write+0x10/0x10 [ 471.633910][T13133] ? __fget_files+0x2a/0x420 [ 471.634006][T13133] ksys_write+0x150/0x270 [ 471.634086][T13133] ? __pfx_ksys_write+0x10/0x10 [ 471.634193][T13133] do_syscall_64+0x166/0x520 [ 471.634257][T13133] ? trace_irq_disable+0x3b/0x140 [ 471.634365][T13133] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.634437][T13133] ? clear_bhb_loop+0x70/0xc0 [ 471.634518][T13133] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.634585][T13133] RIP: 0033:0x7f2d81f9e0d9 [ 471.634648][T13133] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 471.634701][T13133] RSP: 002b:00007f2d82f00028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 471.634767][T13133] RAX: ffffffffffffffda RBX: 00007f2d82225fa0 RCX: 00007f2d81f9e0d9 [ 471.634817][T13133] RDX: 0000000000000051 RSI: 00002000000000c0 RDI: 0000000000000003 [ 471.634852][T13133] RBP: 00007f2d82f00090 R08: 0000000000000000 R09: 0000000000000000 [ 471.634893][T13133] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 471.634933][T13133] R13: 00007f2d82226038 R14: 00007f2d82225fa0 R15: 00007ffffd66b058 [ 471.635029][T13133] [ 472.061674][T13145] binder: 13144:13145 ioctl c0306201 200000000280 returned -11 [ 472.071115][T13147] netlink: 'syz.0.2115': attribute type 11 has an invalid length. [ 472.190218][ T10] usb 4-1: new full-speed USB device number 96 using dummy_hcd [ 472.341322][ T10] usb 4-1: not running at top speed; connect to a high speed hub [ 472.341380][ T10] usb 4-1: New USB device found, idVendor=0582, idProduct=010f, bcdDevice= 0.40 [ 472.344376][ T10] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 128, changing to 4 [ 472.346408][ T10] usb 4-1: language id specifier not provided by device, defaulting to English [ 472.357616][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.357695][ T10] usb 4-1: Product: syz [ 472.357755][ T10] usb 4-1: Manufacturer: [ 472.357755][ T10] [ 472.357829][ T10] usb 4-1: SerialNumber: syz [ 472.608153][T13136] rnbd_client L127: Can't parse path ip:127.0.0.1\ߐ?:bEz[۵>,: -22 [ 472.650107][ T10] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 472.657455][ T10] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 472.729233][ T10] usb 4-1: USB disconnect, device number 96 [ 472.797529][ T5648] udevd[5648]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 473.319219][T13123] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2108'. [ 473.333241][ T1954] gspca_spca1528: reg_w err -71 [ 473.333590][ T1954] spca1528 2-1:0.1: probe with driver spca1528 failed with error -71 [ 473.365785][ T1954] usb 2-1: USB disconnect, device number 91 [ 473.479950][ T10] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 473.639506][ T10] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 473.642936][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 473.643089][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 473.656382][ T10] usb 1-1: config 0 descriptor?? [ 473.680899][ T10] pwc: Askey VC010 type 2 USB webcam detected. [ 473.890911][T13183] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.903261][T13183] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.912971][T13183] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.922771][T13183] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.086723][T13213] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2120'. [ 474.124360][T13213] sg_write: data in/out 408028/56 bytes for SCSI command 0x0-- guessing data in; [ 474.124360][T13213] program syz.2.2120 not setting count and/or reply_len properly [ 474.346776][T13226] FAULT_INJECTION: forcing a failure. [ 474.346776][T13226] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 474.363003][T13226] CPU: 1 UID: 0 PID: 13226 Comm: syz.2.2122 Not tainted syzkaller #0 PREEMPT(full) [ 474.363038][T13226] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 474.363053][T13226] Call Trace: [ 474.363063][T13226] [ 474.363075][T13226] dump_stack_lvl+0xe8/0x150 [ 474.363111][T13226] should_fail_ex+0x410/0x560 [ 474.363151][T13226] _copy_to_user+0x31/0xb0 [ 474.363176][T13226] simple_read_from_buffer+0xe1/0x170 [ 474.363223][T13226] proc_fail_nth_read+0x1bb/0x230 [ 474.363252][T13226] ? common_file_perm+0x20e/0x2b0 [ 474.363289][T13226] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 474.363324][T13226] ? rw_verify_area+0x24a/0x4c0 [ 474.363355][T13226] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 474.363392][T13226] vfs_read+0x213/0xa80 [ 474.363425][T13226] ? __pfx___mutex_lock+0x10/0x10 [ 474.363452][T13226] ? __pfx_vfs_read+0x10/0x10 [ 474.363492][T13226] ? __fget_files+0x2a/0x420 [ 474.363525][T13226] ? __fget_files+0x3a2/0x420 [ 474.363554][T13226] ? __fget_files+0x2a/0x420 [ 474.363599][T13226] ksys_read+0x150/0x270 [ 474.363632][T13226] ? __pfx_ksys_read+0x10/0x10 [ 474.363660][T13226] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 474.363705][T13226] do_syscall_64+0x166/0x520 [ 474.363728][T13226] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.363752][T13226] ? clear_bhb_loop+0x70/0xc0 [ 474.363780][T13226] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.363803][T13226] RIP: 0033:0x7f66c975e90e [ 474.363825][T13226] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 474.363845][T13226] RSP: 002b:00007f66ca660fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 474.363872][T13226] RAX: ffffffffffffffda RBX: 00007f66ca6616c0 RCX: 00007f66c975e90e [ 474.363889][T13226] RDX: 000000000000000f RSI: 00007f66ca6610a0 RDI: 0000000000000006 [ 474.363905][T13226] RBP: 00007f66ca661090 R08: 0000000000000000 R09: 0000000000000000 [ 474.363920][T13226] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 474.363935][T13226] R13: 00007f66c9a26038 R14: 00007f66c9a25fa0 R15: 00007fffd8d01238 [ 474.363971][T13226] [ 474.388217][ T10] pwc: recv_control_msg error -71 req 02 val 2b00 [ 474.482254][ T10] pwc: recv_control_msg error -71 req 02 val 2700 [ 474.482848][ T10] pwc: recv_control_msg error -71 req 02 val 2c00 [ 474.489308][ T5793] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 474.490459][ T10] pwc: recv_control_msg error -71 req 04 val 1000 [ 474.500248][ T10] pwc: recv_control_msg error -71 req 04 val 1300 [ 474.502182][ T10] pwc: recv_control_msg error -71 req 04 val 1400 [ 474.509308][ T10] pwc: recv_control_msg error -71 req 02 val 2000 [ 474.521346][ T10] pwc: recv_control_msg error -71 req 02 val 2100 [ 474.524977][ T10] pwc: recv_control_msg error -71 req 04 val 1500 [ 474.529519][ T10] pwc: recv_control_msg error -71 req 02 val 2500 [ 474.532355][ T10] pwc: recv_control_msg error -71 req 02 val 2400 [ 474.535955][ T10] pwc: recv_control_msg error -71 req 02 val 2600 [ 474.540565][ T10] pwc: recv_control_msg error -71 req 02 val 2900 [ 474.543654][ T10] pwc: recv_control_msg error -71 req 02 val 2800 [ 474.550822][ T10] pwc: recv_control_msg error -71 req 04 val 1100 [ 474.556058][ T10] pwc: recv_control_msg error -71 req 04 val 1200 [ 474.679660][ T5793] usb 4-1: Using ep0 maxpacket: 16 [ 474.682195][ T5793] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 474.714912][ T5793] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 474.742436][ T5793] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.742497][ T5793] usb 4-1: Product: syz [ 474.742532][ T5793] usb 4-1: Manufacturer: syz [ 474.742551][ T5793] usb 4-1: SerialNumber: syz [ 474.776536][ T5793] usb 4-1: config 0 descriptor?? [ 474.794780][ T5793] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 474.794840][ T5793] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 474.836030][ T10] pwc: Registered as video103. [ 474.852653][ T10] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input51 [ 474.899808][ T10] usb 1-1: USB disconnect, device number 102 [ 475.008719][ T25] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 475.082858][ T5793] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 475.139226][ T25] usb 2-1: device descriptor read/64, error -71 [ 475.154533][ T5793] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 475.154597][ T5793] em28xx 4-1:0.0: board has no eeprom [ 475.229273][ T5793] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 475.229336][ T5793] em28xx 4-1:0.0: dvb set to bulk mode. [ 475.248909][ T10] em28xx 4-1:0.0: Binding DVB extension [ 475.257709][ T5793] usb 4-1: USB disconnect, device number 97 [ 475.269152][ T5793] em28xx 4-1:0.0: Disconnecting em28xx [ 475.317456][ T10] em28xx 4-1:0.0: Registering input extension [ 475.322452][ T5793] em28xx 4-1:0.0: Closing input extension [ 475.347328][ T5793] em28xx: Freeing device [ 475.351970][ T1954] usb 3-1: new full-speed USB device number 60 using dummy_hcd [ 475.378722][ T25] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 475.508769][ T25] usb 2-1: device descriptor read/64, error -71 [ 475.522637][T13267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.532421][T13267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.545141][T13267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.555697][T13267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.569459][ T1954] usb 3-1: New USB device found, idVendor=5543, idProduct=004d, bcdDevice= 0.00 [ 475.574593][ T1954] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 475.574697][ T1954] usb 3-1: can't read configurations, error -71 [ 475.619537][ T25] usb usb2-port1: attempt power cycle [ 475.978782][ T25] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 475.999934][ T25] usb 2-1: device descriptor read/8, error -71 [ 476.144713][T13321] FAULT_INJECTION: forcing a failure. [ 476.144713][T13321] name failslab, interval 1, probability 0, space 0, times 0 [ 476.144784][T13321] CPU: 1 UID: 0 PID: 13321 Comm: syz.2.2133 Not tainted syzkaller #0 PREEMPT(full) [ 476.144810][T13321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 476.144854][T13321] Call Trace: [ 476.144905][T13321] [ 476.144937][T13321] dump_stack_lvl+0xe8/0x150 [ 476.145043][T13321] should_fail_ex+0x410/0x560 [ 476.145147][T13321] ? __alloc_skb+0x1db/0x7a0 [ 476.145213][T13321] should_failslab+0xa8/0x100 [ 476.145285][T13321] ? __alloc_skb+0x1db/0x7a0 [ 476.145349][T13321] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 476.145418][T13321] ? __alloc_skb+0x18d/0x7a0 [ 476.145481][T13321] ? __alloc_skb+0x1db/0x7a0 [ 476.145574][T13321] __alloc_skb+0x1db/0x7a0 [ 476.145654][T13321] rtmsg_ifinfo_build_skb+0x7f/0x260 [ 476.145853][T13321] rtnetlink_event+0x1b7/0x270 [ 476.146005][T13321] notifier_call_chain+0x1a5/0x3d0 [ 476.146036][T13321] netif_change_tx_queue_len+0x139/0x290 [ 476.146180][T13321] ? __pfx_netif_change_tx_queue_len+0x10/0x10 [ 476.146267][T13321] ? __dev_get_by_name+0xe5/0x130 [ 476.146420][T13321] dev_change_tx_queue_len+0x101/0x220 [ 476.146536][T13321] dev_ioctl+0x7b4/0x1150 [ 476.146666][T13321] sock_do_ioctl+0x23e/0x320 [ 476.146764][T13321] ? __pfx_sock_do_ioctl+0x10/0x10 [ 476.146844][T13321] ? hook_file_ioctl+0x1f2/0x600 [ 476.146974][T13321] sock_ioctl+0x57a/0x7e0 [ 476.147072][T13321] ? __pfx_sock_ioctl+0x10/0x10 [ 476.147188][T13321] ? __fget_files+0x2a/0x420 [ 476.147264][T13321] ? __fget_files+0x3a2/0x420 [ 476.147343][T13321] ? __fget_files+0x2a/0x420 [ 476.147446][T13321] ? bpf_lsm_file_ioctl+0x9/0x20 [ 476.147547][T13321] ? __pfx_sock_ioctl+0x10/0x10 [ 476.147628][T13321] __se_sys_ioctl+0xfc/0x170 [ 476.147738][T13321] do_syscall_64+0x166/0x520 [ 476.147820][T13321] ? trace_irq_disable+0x3b/0x140 [ 476.147914][T13321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.147979][T13321] ? clear_bhb_loop+0x70/0xc0 [ 476.148057][T13321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.148132][T13321] RIP: 0033:0x7f66c979e0d9 [ 476.148198][T13321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 476.148255][T13321] RSP: 002b:00007f66ca661028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 476.148323][T13321] RAX: ffffffffffffffda RBX: 00007f66c9a25fa0 RCX: 00007f66c979e0d9 [ 476.148368][T13321] RDX: 0000200000002280 RSI: 0000000000008943 RDI: 0000000000000008 [ 476.148410][T13321] RBP: 00007f66ca661090 R08: 0000000000000000 R09: 0000000000000000 [ 476.148452][T13321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 476.148487][T13321] R13: 00007f66c9a26038 R14: 00007f66c9a25fa0 R15: 00007fffd8d01238 [ 476.148574][T13321] [ 476.198910][ T5746] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 476.270678][ T25] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 476.307735][ T25] usb 2-1: device descriptor read/8, error -71 [ 476.371020][ T5746] usb 4-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 476.379637][ T5746] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.414337][ T5746] usb 4-1: config 0 descriptor?? [ 476.420538][ T25] usb usb2-port1: unable to enumerate USB device [ 476.762269][T13342] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2137'. [ 476.828854][ T1954] usb 1-1: new full-speed USB device number 103 using dummy_hcd [ 476.844989][ T5746] hackrf 4-1:0.0: Board ID: 00 [ 476.845050][ T5746] hackrf 4-1:0.0: Firmware version: [ 476.865440][ T5746] hackrf 4-1:0.0: Registered as swradio24 [ 476.865501][ T5746] videodev: could not get a free minor [ 476.865533][ T5746] hackrf 4-1:0.0: Failed to register as video device (-23) [ 476.893144][ T5746] hackrf 4-1:0.0: probe with driver hackrf failed with error -23 [ 477.002561][ T1954] usb 1-1: not running at top speed; connect to a high speed hub [ 477.002636][ T1954] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.40 [ 477.005900][ T1954] usb 1-1: config 1 interface 0 altsetting 11 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 477.006007][ T1954] usb 1-1: config 1 interface 0 altsetting 11 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 477.006129][ T1954] usb 1-1: config 1 interface 0 has no altsetting 0 [ 477.013498][ T1954] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.013583][ T1954] usb 1-1: Product: А [ 477.013626][ T1954] usb 1-1: Manufacturer: 䞓ᖂ㔩晆㰋 [ 477.013711][ T1954] usb 1-1: SerialNumber: Ь [ 477.030700][T13331] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 477.031005][T13331] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 477.072368][ T25] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 477.102321][ T5746] usb 4-1: USB disconnect, device number 98 [ 477.229664][ T25] usb 3-1: Using ep0 maxpacket: 16 [ 477.237197][ T25] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 477.246791][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 477.257610][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.257747][ T25] usb 3-1: Product: syz [ 477.257790][ T25] usb 3-1: Manufacturer: syz [ 477.257815][ T25] usb 3-1: SerialNumber: syz [ 477.281452][ T25] usb 3-1: config 0 descriptor?? [ 477.293460][ T25] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 477.293518][ T25] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 477.469178][ T1954] usbhid 1-1:1.0: can't add hid device: -71 [ 477.469595][ T1954] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 477.497250][ T1954] usb 1-1: USB disconnect, device number 103 [ 477.551397][ T25] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 477.617038][ T25] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 477.617096][ T25] em28xx 3-1:0.0: board has no eeprom [ 477.705784][ T25] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 477.705833][ T25] em28xx 3-1:0.0: dvb set to bulk mode. [ 477.722100][ T1954] em28xx 3-1:0.0: Binding DVB extension [ 477.754539][ T25] usb 3-1: USB disconnect, device number 62 [ 477.775132][ T25] em28xx 3-1:0.0: Disconnecting em28xx [ 477.837227][ T1954] em28xx 3-1:0.0: Registering input extension [ 477.838571][ T25] em28xx 3-1:0.0: Closing input extension [ 477.868147][ T25] em28xx: Freeing device [ 478.049030][ T5746] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 478.159998][ T31] usb 2-1: new full-speed USB device number 96 using dummy_hcd [ 478.190138][ T5746] usb 4-1: device descriptor read/64, error -71 [ 478.440630][ T5746] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 478.579925][ T5746] usb 4-1: device descriptor read/64, error -71 [ 478.691226][ T5746] usb usb4-port1: attempt power cycle [ 479.028742][ T5746] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 479.049517][ T5746] usb 4-1: device descriptor read/8, error -71 [ 479.288843][ T5746] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 479.319603][ T5746] usb 4-1: device descriptor read/8, error -71 [ 479.429438][ T5746] usb usb4-port1: unable to enumerate USB device [ 481.119315][ T32] audit: type=1400 audit(1787613354.777:162): apparmor="STATUS" info="failed to unpack profile capabilities" error=-71 profile="unconfined" name="//o" pid=13455 comm="syz.2.2148" name="//o" offset=71 [ 481.159084][ T5746] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 481.160515][ T1954] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 481.309159][ T1954] usb 1-1: device descriptor read/64, error -71 [ 481.330060][ T5746] usb 4-1: Using ep0 maxpacket: 16 [ 481.334049][ T5746] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 481.345068][ T5746] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 481.356485][ T5746] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.356547][ T5746] usb 4-1: Product: syz [ 481.358361][ T5746] usb 4-1: Manufacturer: syz [ 481.358415][ T5746] usb 4-1: SerialNumber: syz [ 481.382256][ T5746] usb 4-1: config 0 descriptor?? [ 481.392897][ T5746] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 481.392964][ T5746] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 481.568927][ T25] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 481.569671][ T1954] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 481.649755][ T5746] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 481.709652][ T1954] usb 1-1: device descriptor read/64, error -71 [ 481.718484][ T5746] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 481.718579][ T5746] em28xx 4-1:0.0: board has no eeprom [ 481.739058][ T25] usb 3-1: Using ep0 maxpacket: 16 [ 481.742413][ T25] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 481.746288][ T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 481.757864][ T25] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.757950][ T25] usb 3-1: Product: syz [ 481.757994][ T25] usb 3-1: Manufacturer: syz [ 481.758043][ T25] usb 3-1: SerialNumber: syz [ 481.775402][ T25] usb 3-1: config 0 descriptor?? [ 481.792256][ T5746] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 481.792406][ T5746] em28xx 4-1:0.0: dvb set to bulk mode. [ 481.816052][T13440] exFAT-fs (nbd3): unable to read boot sector [ 481.823122][T13440] exFAT-fs (nbd3): failed to read boot sector [ 481.829434][T13440] exFAT-fs (nbd3): failed to recognize exfat type [ 481.831300][ T1954] usb usb1-port1: attempt power cycle [ 481.842266][ T25] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 481.842301][ T25] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 481.871889][ T5746] usb 4-1: USB disconnect, device number 103 [ 481.878321][ T5746] em28xx 4-1:0.0: Disconnecting em28xx [ 481.884743][ T5725] em28xx 4-1:0.0: Binding DVB extension [ 481.932815][ T5725] em28xx 4-1:0.0: Registering input extension [ 481.936051][ T5746] em28xx 4-1:0.0: Closing input extension [ 482.004193][T13498] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 482.013128][ T31] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 482.050944][ T25] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 482.115458][ T25] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 482.115508][ T25] em28xx 3-1:0.0: board has no eeprom [ 482.168893][ T31] usb 2-1: Using ep0 maxpacket: 16 [ 482.174301][ T31] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 482.177695][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 482.188732][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.188819][ T31] usb 2-1: Product: syz [ 482.188862][ T31] usb 2-1: Manufacturer: syz [ 482.188899][ T31] usb 2-1: SerialNumber: syz [ 482.200034][ T25] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 482.200173][ T25] em28xx 3-1:0.0: dvb set to bulk mode. [ 482.219734][ T31] usb 2-1: config 0 descriptor?? [ 482.229795][ T1954] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 482.254174][ T1954] usb 1-1: device descriptor read/8, error -71 [ 482.263689][ T31] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 482.263729][ T31] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 482.270799][ T25] usb 3-1: USB disconnect, device number 63 [ 482.275860][ T5725] em28xx 3-1:0.0: Binding DVB extension [ 482.300738][ T25] em28xx 3-1:0.0: Disconnecting em28xx [ 482.342168][ T5725] em28xx 3-1:0.0: Registering input extension [ 482.346458][ T25] em28xx 3-1:0.0: Closing input extension [ 482.372421][ T25] em28xx: Freeing device [ 482.508762][ T1954] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 482.510649][ T31] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 482.530387][ T1954] usb 1-1: device descriptor read/8, error -71 [ 482.573306][ T31] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 482.573362][ T31] em28xx 2-1:0.0: board has no eeprom [ 482.639782][ T1954] usb usb1-port1: unable to enumerate USB device [ 482.658704][ T31] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 482.658749][ T31] em28xx 2-1:0.0: dvb set to bulk mode. [ 482.662785][ T1954] em28xx 2-1:0.0: Binding DVB extension [ 482.690770][ T31] usb 2-1: USB disconnect, device number 97 [ 482.698692][ T31] em28xx 2-1:0.0: Disconnecting em28xx [ 482.732284][ T1954] em28xx 2-1:0.0: Registering input extension [ 482.737025][ T31] em28xx 2-1:0.0: Closing input extension [ 482.765157][ T31] em28xx: Freeing device [ 483.198872][ T31] usb 3-1: new full-speed USB device number 64 using dummy_hcd [ 483.353916][ T31] usb 3-1: unable to get BOS descriptor or descriptor too short [ 483.355861][ T31] usb 3-1: not running at top speed; connect to a high speed hub [ 483.355967][ T31] usb 3-1: New USB device found, idVendor=0df6, idProduct=0072, bcdDevice=f8.4f [ 483.364100][ T31] usb 3-1: config 7 has an invalid interface number: 251 but max is 0 [ 483.364177][ T31] usb 3-1: config 7 has no interface number 0 [ 483.364287][ T31] usb 3-1: config 7 interface 251 has no altsetting 0 [ 483.374228][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 483.374515][ T31] usb 3-1: Product: syz [ 483.374570][ T31] usb 3-1: Manufacturer: syz [ 483.374615][ T31] usb 3-1: SerialNumber: syz [ 483.539322][T13573] 9p: Bad value for 'rfdno' [ 483.678166][T13555] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 483.687179][T13555] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 483.742900][ T31] ax88179_178a 3-1:7.251: probe with driver ax88179_178a failed with error -22 [ 483.755438][ T31] usb 3-1: USB disconnect, device number 64 [ 483.922377][ T5746] em28xx: Freeing device [ 483.947738][T13596] netlink: 'syz.0.2159': attribute type 4 has an invalid length. [ 483.961856][T13596] netlink: 'syz.0.2159': attribute type 4 has an invalid length. [ 484.037634][ T32] audit: type=1400 audit(1787613357.687:163): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" name="unknown" pid=13600 comm="syz.0.2160" name="unknown" offset=16 [ 484.354129][ T5748] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 484.511654][ T5748] usb 1-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 484.526748][ T5748] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 484.526817][ T5748] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 484.526860][ T5748] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 484.526891][ T5748] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 484.526940][ T5748] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.609494][ T31] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 484.758800][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 484.760819][ T31] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 484.770381][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 484.773973][ T10] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 484.790220][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.790317][ T31] usb 4-1: Product: syz [ 484.790361][ T31] usb 4-1: Manufacturer: syz [ 484.790410][ T31] usb 4-1: SerialNumber: syz [ 484.814808][ T31] usb 4-1: config 0 descriptor?? [ 484.828903][ T5746] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 484.838086][ T31] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 484.839407][ T31] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 484.949553][ T10] usb 3-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 484.959003][ T5746] usb 2-1: device descriptor read/64, error -71 [ 484.966817][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 484.976910][ T10] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 484.986922][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.004569][ T10] usb 3-1: probing VID:PID(0424:012C) [ 485.012380][T13603] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2161'. [ 485.022504][ T10] usb 3-1: vub300 testing BULK IN EndPoint(0) 81 [ 485.022561][ T10] usb 3-1: vub300 testing BULK OUT EndPoint(1) 02 [ 485.022584][ T10] usb 3-1: vub300 testing BULK IN EndPoint(2) 83 [ 485.022707][ T10] usb 3-1: vub300 testing BULK IN EndPoint(3) 85 [ 485.022770][ T10] usb 3-1: ignoring unexpected bulk_in endpoint [ 485.022880][ T10] usb 3-1: Could not find two sets of bulk-in/out endpoint pairs [ 485.056945][ T10] vub300 3-1:1.0: probe with driver vub300 failed with error -22 [ 485.061449][T13603] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2161'. [ 485.061475][T13603] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2161'. [ 485.124284][ T5748] gud 1-1:1.0: No supported pixel formats found [ 485.124350][ T5748] gud 1-1:1.0: probe with driver gud failed with error -22 [ 485.149387][ T31] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 485.202854][ T1954] usb 3-1: USB disconnect, device number 65 [ 485.219704][ T5746] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 485.238391][ T31] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 485.238452][ T31] em28xx 4-1:0.0: board has no eeprom [ 485.298021][T13617] em28xx 4-1:0.0: reading from i2c device at 0x0 failed (error=-5) [ 485.318756][ T31] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 485.318804][ T31] em28xx 4-1:0.0: dvb set to bulk mode. [ 485.336158][T13514] em28xx 4-1:0.0: Binding DVB extension [ 485.348939][ T5746] usb 2-1: device descriptor read/64, error -71 [ 485.374406][ T10] usb 1-1: USB disconnect, device number 108 [ 485.391797][ T31] usb 4-1: USB disconnect, device number 104 [ 485.413042][ T31] em28xx 4-1:0.0: Disconnecting em28xx [ 485.457523][T13514] em28xx 4-1:0.0: Registering input extension [ 485.465951][ T5746] usb usb2-port1: attempt power cycle [ 485.468579][ T31] em28xx 4-1:0.0: Closing input extension [ 485.489344][ T31] em28xx: Freeing device [ 485.819904][ T5746] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 485.841592][ T5746] usb 2-1: device descriptor read/8, error -71 [ 485.987584][T13698] FAULT_INJECTION: forcing a failure. [ 485.987584][T13698] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 485.987655][T13698] CPU: 1 UID: 0 PID: 13698 Comm: syz.0.2170 Not tainted syzkaller #0 PREEMPT(full) [ 485.987681][T13698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 485.987718][T13698] Call Trace: [ 485.987751][T13698] [ 485.987794][T13698] dump_stack_lvl+0xe8/0x150 [ 485.987907][T13698] should_fail_ex+0x410/0x560 [ 485.988024][T13698] _copy_to_user+0x31/0xb0 [ 485.988100][T13698] vmx_get_nested_state+0xa49/0x1010 [ 485.988209][T13698] ? __pfx_vmx_get_nested_state+0x10/0x10 [ 485.988293][T13698] ? lock_acquire+0x115/0x350 [ 485.988415][T13698] ? __might_fault+0xaf/0x130 [ 485.988506][T13698] kvm_arch_vcpu_ioctl+0x1883/0x23a0 [ 485.988581][T13698] ? lock_acquire+0x115/0x350 [ 485.988653][T13698] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 485.988735][T13698] ? lock_acquire+0x115/0x350 [ 485.988841][T13698] ? is_bpf_text_address+0x26/0x2b0 [ 485.988916][T13698] ? is_bpf_text_address+0x292/0x2b0 [ 485.988979][T13698] ? is_bpf_text_address+0x26/0x2b0 [ 485.989053][T13698] ? kernel_text_address+0xa5/0xe0 [ 485.989118][T13698] ? __kernel_text_address+0xd/0x30 [ 485.989227][T13698] ? unwind_get_return_address+0x4d/0x90 [ 485.989298][T13698] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 485.989385][T13698] ? arch_stack_walk+0xfb/0x150 [ 485.989474][T13698] ? stack_trace_save+0xa9/0x100 [ 485.989559][T13698] ? __pfx_stack_trace_save+0x10/0x10 [ 485.989626][T13698] ? kasan_save_track+0x4f/0x80 [ 485.989701][T13698] ? stack_depot_save_flags+0x33/0x7f0 [ 485.989791][T13698] ? __lock_acquire+0x6df/0x2e50 [ 485.989873][T13698] ? kasan_save_free_info+0x40/0x50 [ 485.989947][T13698] ? kfree+0x1c5/0x650 [ 485.990011][T13698] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 485.990091][T13698] ? security_file_ioctl+0xc3/0x2a0 [ 485.990184][T13698] ? __se_sys_ioctl+0x47/0x170 [ 485.990261][T13698] ? do_syscall_64+0x166/0x520 [ 485.990320][T13698] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.990422][T13698] ? __mutex_trylock_common+0x15f/0x270 [ 485.990497][T13698] ? __pfx___mutex_trylock_common+0x10/0x10 [ 485.990579][T13698] ? rcu_is_watching+0x16/0xb0 [ 485.990659][T13698] ? trace_contention_end+0x3d/0x140 [ 485.990738][T13698] ? __mutex_lock+0x30b/0x1550 [ 485.990806][T13698] ? kasan_quarantine_put+0xbb/0x1f0 [ 485.990908][T13698] ? kvm_vcpu_ioctl+0x27f/0xfd0 [ 485.991004][T13698] ? __pfx___mutex_lock+0x10/0x10 [ 485.991061][T13698] ? tomoyo_path_number_perm+0x219/0x5f0 [ 485.991153][T13698] ? do_vfs_ioctl+0x116f/0x1530 [ 485.991249][T13698] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 485.991347][T13698] kvm_vcpu_ioctl+0x7e3/0xfd0 [ 485.991447][T13698] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 485.991529][T13698] ? hook_file_ioctl+0x1f2/0x600 [ 485.991657][T13698] ? __fget_files+0x2a/0x420 [ 485.991725][T13698] ? __fget_files+0x2a/0x420 [ 485.991790][T13698] ? __fget_files+0x3a2/0x420 [ 485.991862][T13698] ? __fget_files+0x2a/0x420 [ 485.991938][T13698] ? bpf_lsm_file_ioctl+0x9/0x20 [ 485.992026][T13698] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 485.992154][T13698] __se_sys_ioctl+0xfc/0x170 [ 485.992250][T13698] do_syscall_64+0x166/0x520 [ 485.992307][T13698] ? trace_irq_disable+0x3b/0x140 [ 485.992391][T13698] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.992453][T13698] ? clear_bhb_loop+0x70/0xc0 [ 485.992528][T13698] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.992589][T13698] RIP: 0033:0x7f2d81f9e0d9 [ 485.992645][T13698] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 485.992698][T13698] RSP: 002b:00007f2d82f00028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 485.992763][T13698] RAX: ffffffffffffffda RBX: 00007f2d82225fa0 RCX: 00007f2d81f9e0d9 [ 485.992807][T13698] RDX: 0000200000000380 RSI: 00000000c080aebe RDI: 0000000000000005 [ 485.992849][T13698] RBP: 00007f2d82f00090 R08: 0000000000000000 R09: 0000000000000000 [ 485.992904][T13698] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 485.992944][T13698] R13: 00007f2d82226038 R14: 00007f2d82225fa0 R15: 00007ffffd66b058 [ 485.993036][T13698] [ 486.100681][ T5746] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 486.138420][ T5746] usb 2-1: device descriptor read/8, error -71 [ 486.278841][ T5746] usb usb2-port1: unable to enumerate USB device [ 486.363689][ T10] usb 3-1: new full-speed USB device number 66 using dummy_hcd [ 486.561088][ T10] usb 3-1: unable to get BOS descriptor or descriptor too short [ 486.571370][ T10] usb 3-1: not running at top speed; connect to a high speed hub [ 486.571404][ T10] usb 3-1: New USB device found, idVendor=17cc, idProduct=1011, bcdDevice= 0.40 [ 486.590211][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 486.603145][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 486.616680][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.616720][ T10] usb 3-1: Product: syz [ 486.618435][ T10] usb 3-1: Manufacturer: syz [ 486.618461][ T10] usb 3-1: SerialNumber: syz [ 486.855844][ T10] usb 3-1: unit 14 not found! [ 486.888724][ T31] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 486.957323][ T10] usb 3-1: USB disconnect, device number 66 [ 487.009210][ T5843] udevd[5843]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 487.049259][ T31] usb 1-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice= 1.00 [ 487.063878][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.072279][ T31] usb 1-1: Product: syz [ 487.072297][ T31] usb 1-1: Manufacturer: syz [ 487.072310][ T31] usb 1-1: SerialNumber: syz [ 487.279790][ T5793] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 487.294930][ T31] kalmia 1-1:1.0 (unnamed net_device) (uninitialized): Did not send all of init packet. Bytes sent: 0 [ 487.297578][ T31] kalmia 1-1:1.0 (unnamed net_device) (uninitialized): Error receiving init result. Status -71 [ 487.298508][ T31] kalmia 1-1:1.0: probe with driver kalmia failed with error -71 [ 487.346975][ T31] usb 1-1: USB disconnect, device number 109 [ 487.428765][ T5793] usb 4-1: Using ep0 maxpacket: 8 [ 487.436002][ T5793] usb 4-1: New USB device found, idVendor=054c, idProduct=042f, bcdDevice= 0.00 [ 487.446657][ T5793] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 487.457735][ T5793] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 487.457770][ T5793] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 487.457906][ T5793] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.469535][ T5793] usb 4-1: config 0 descriptor?? [ 487.662696][ T10] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 487.818950][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 487.823130][ T10] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 487.834865][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 487.850771][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.850849][ T10] usb 3-1: Product: syz [ 487.850867][ T10] usb 3-1: Manufacturer: syz [ 487.850932][ T10] usb 3-1: SerialNumber: syz [ 487.876149][ T10] usb 3-1: config 0 descriptor?? [ 487.888578][ T10] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 487.889506][ T10] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 488.149772][ T10] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 488.158911][ T5748] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 488.213762][ T10] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 488.213823][ T10] em28xx 3-1:0.0: board has no eeprom [ 488.288914][ T10] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 488.289635][ T10] em28xx 3-1:0.0: dvb set to bulk mode. [ 488.293815][ T190] em28xx 3-1:0.0: Binding DVB extension [ 488.317467][ T5748] usb 2-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 488.326911][ T5793] sony 0003:054C:042F.0005: can't set operational mode: step 1 [ 488.326992][ T5793] sony 0003:054C:042F.0005: Failed to set controller into operational mode [ 488.342400][ T5748] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 488.342502][ T5748] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 488.342658][ T5748] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.374480][T13514] usb 1-1: new full-speed USB device number 110 using dummy_hcd [ 488.383573][T13760] em28xx 3-1:0.0: reading from i2c device at 0x0 failed (error=-5) [ 488.396190][ T5748] usb 2-1: config 0 descriptor?? [ 488.443396][ T10] usb 3-1: USB disconnect, device number 67 [ 488.451114][ T190] em28xx 3-1:0.0: Registering input extension [ 488.477326][ T10] em28xx 3-1:0.0: Disconnecting em28xx [ 488.477406][ T10] em28xx 3-1:0.0: Closing input extension [ 488.485580][ T5793] sony 0003:054C:042F.0005: hidraw0: USB HID v0.00 Joystick [HID 054c:042f] on usb-dummy_hcd.3-1/input0 [ 488.494044][ T5793] sony 0003:054C:042F.0005: failed to claim input [ 488.520200][T13514] usb 1-1: device descriptor read/64, error -71 [ 488.595751][ T10] em28xx: Freeing device [ 488.601406][ T5793] usb 4-1: USB disconnect, device number 105 [ 488.768812][T13514] usb 1-1: new full-speed USB device number 111 using dummy_hcd [ 488.901055][T13514] usb 1-1: device descriptor read/64, error -71 [ 488.991559][T13840] FAULT_INJECTION: forcing a failure. [ 488.991559][T13840] name failslab, interval 1, probability 0, space 0, times 0 [ 489.005966][T13840] CPU: 1 UID: 0 PID: 13840 Comm: syz.2.2184 Not tainted syzkaller #0 PREEMPT(full) [ 489.005999][T13840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 489.006022][T13840] Call Trace: [ 489.006032][T13840] [ 489.006041][T13840] dump_stack_lvl+0xe8/0x150 [ 489.006070][T13840] should_fail_ex+0x410/0x560 [ 489.006101][T13840] should_failslab+0xa8/0x100 [ 489.006122][T13840] kmem_cache_alloc_lru_noprof+0xa7/0x5f0 [ 489.006151][T13840] ? __d_lookup+0x66/0x790 [ 489.006178][T13840] ? __d_alloc+0x37/0x6f0 [ 489.006199][T13840] ? __d_alloc+0x37/0x6f0 [ 489.006234][T13840] __d_alloc+0x37/0x6f0 [ 489.006261][T13840] d_alloc+0x4b/0x190 [ 489.006282][T13840] ? lookup_one_qstr_excl+0xc4/0x360 [ 489.006313][T13840] lookup_one_qstr_excl+0xd8/0x360 [ 489.006342][T13840] filename_create+0x20e/0x370 [ 489.006372][T13840] ? __pfx_filename_create+0x10/0x10 [ 489.006406][T13840] filename_symlinkat+0xf7/0x410 [ 489.006430][T13840] ? __pfx_filename_symlinkat+0x10/0x10 [ 489.006455][T13840] ? do_getname+0x151/0x250 [ 489.006476][T13840] __se_sys_symlinkat+0x4e/0x2b0 [ 489.006496][T13840] do_syscall_64+0x166/0x520 [ 489.006516][T13840] ? trace_irq_disable+0x3b/0x140 [ 489.006541][T13840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.006560][T13840] ? clear_bhb_loop+0x70/0xc0 [ 489.006589][T13840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.006607][T13840] RIP: 0033:0x7f66c979e0d9 [ 489.006625][T13840] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 489.006643][T13840] RSP: 002b:00007f66ca661028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 489.006663][T13840] RAX: ffffffffffffffda RBX: 00007f66c9a25fa0 RCX: 00007f66c979e0d9 [ 489.006677][T13840] RDX: 0000200000001400 RSI: ffffffffffffff9c RDI: 0000200000001300 [ 489.006691][T13840] RBP: 00007f66ca661090 R08: 0000000000000000 R09: 0000000000000000 [ 489.006703][T13840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 489.006718][T13840] R13: 00007f66c9a26038 R14: 00007f66c9a25fa0 R15: 00007fffd8d01238 [ 489.006750][T13840] [ 489.017938][T13514] usb usb1-port1: attempt power cycle [ 489.044884][ T5748] Bluetooth: Can't get version to change to load ram patch err [ 489.044954][ T5748] Bluetooth: Loading sysconfig file failed [ 489.045054][ T5748] ath3k 2-1:0.0: probe with driver ath3k failed with error -71 [ 489.085835][ T5748] usb 2-1: USB disconnect, device number 102 [ 489.175968][T13836] FAULT_INJECTION: forcing a failure. [ 489.175968][T13836] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 489.176006][T13836] CPU: 0 UID: 0 PID: 13836 Comm: syz.3.2183 Not tainted syzkaller #0 PREEMPT(full) [ 489.176031][T13836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 489.176045][T13836] Call Trace: [ 489.176054][T13836] [ 489.176065][T13836] dump_stack_lvl+0xe8/0x150 [ 489.176101][T13836] should_fail_ex+0x410/0x560 [ 489.176149][T13836] _copy_to_user+0x31/0xb0 [ 489.176175][T13836] vmx_get_nested_state+0xa49/0x1010 [ 489.176216][T13836] ? __pfx_vmx_get_nested_state+0x10/0x10 [ 489.176247][T13836] ? lock_acquire+0x115/0x350 [ 489.176300][T13836] ? __might_fault+0xaf/0x130 [ 489.176331][T13836] kvm_arch_vcpu_ioctl+0x1883/0x23a0 [ 489.176360][T13836] ? lock_acquire+0x115/0x350 [ 489.176391][T13836] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 489.176420][T13836] ? lock_acquire+0x115/0x350 [ 489.176462][T13836] ? is_bpf_text_address+0x26/0x2b0 [ 489.176490][T13836] ? is_bpf_text_address+0x292/0x2b0 [ 489.176512][T13836] ? is_bpf_text_address+0x26/0x2b0 [ 489.176539][T13836] ? kernel_text_address+0xa5/0xe0 [ 489.176563][T13836] ? __kernel_text_address+0xd/0x30 [ 489.176598][T13836] ? unwind_get_return_address+0x4d/0x90 [ 489.176621][T13836] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 489.176659][T13836] ? arch_stack_walk+0xfb/0x150 [ 489.176693][T13836] ? stack_trace_save+0xa9/0x100 [ 489.176723][T13836] ? __pfx_stack_trace_save+0x10/0x10 [ 489.176752][T13836] ? kasan_save_track+0x4f/0x80 [ 489.176788][T13836] ? stack_depot_save_flags+0x33/0x7f0 [ 489.176826][T13836] ? __lock_acquire+0x6df/0x2e50 [ 489.176859][T13836] ? kasan_save_free_info+0x40/0x50 [ 489.176885][T13836] ? kfree+0x1c5/0x650 [ 489.176982][T13836] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 489.177074][T13836] ? security_file_ioctl+0xc3/0x2a0 [ 489.177150][T13836] ? __se_sys_ioctl+0x47/0x170 [ 489.177227][T13836] ? do_syscall_64+0x166/0x520 [ 489.177289][T13836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.177398][T13836] ? __mutex_trylock_common+0x15f/0x270 [ 489.177472][T13836] ? __pfx___mutex_trylock_common+0x10/0x10 [ 489.177547][T13836] ? rcu_is_watching+0x16/0xb0 [ 489.177609][T13836] ? trace_contention_end+0x3d/0x140 [ 489.177670][T13836] ? __mutex_lock+0x30b/0x1550 [ 489.177744][T13836] ? kasan_quarantine_put+0xbb/0x1f0 [ 489.177840][T13836] ? kvm_vcpu_ioctl+0x27f/0xfd0 [ 489.177929][T13836] ? __pfx___mutex_lock+0x10/0x10 [ 489.177993][T13836] ? tomoyo_path_number_perm+0x219/0x5f0 [ 489.178088][T13836] ? do_vfs_ioctl+0x116f/0x1530 [ 489.178186][T13836] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 489.178280][T13836] kvm_vcpu_ioctl+0x7e3/0xfd0 [ 489.178396][T13836] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 489.178504][T13836] ? hook_file_ioctl+0x1f2/0x600 [ 489.178641][T13836] ? __fget_files+0x2a/0x420 [ 489.178716][T13836] ? __fget_files+0x2a/0x420 [ 489.178780][T13836] ? __fget_files+0x3a2/0x420 [ 489.178844][T13836] ? __fget_files+0x2a/0x420 [ 489.178921][T13836] ? bpf_lsm_file_ioctl+0x9/0x20 [ 489.178993][T13836] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 489.179082][T13836] __se_sys_ioctl+0xfc/0x170 [ 489.179187][T13836] do_syscall_64+0x166/0x520 [ 489.179250][T13836] ? trace_irq_disable+0x3b/0x140 [ 489.179336][T13836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.179401][T13836] ? clear_bhb_loop+0x70/0xc0 [ 489.179469][T13836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.179532][T13836] RIP: 0033:0x7f668d39e0d9 [ 489.179587][T13836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 489.179636][T13836] RSP: 002b:00007f668e313028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 489.179701][T13836] RAX: ffffffffffffffda RBX: 00007f668d625fa0 RCX: 00007f668d39e0d9 [ 489.179751][T13836] RDX: 0000200000000380 RSI: 00000000c080aebe RDI: 0000000000000005 [ 489.179793][T13836] RBP: 00007f668e313090 R08: 0000000000000000 R09: 0000000000000000 [ 489.179836][T13836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 489.179884][T13836] R13: 00007f668d626038 R14: 00007f668d625fa0 R15: 00007fff766ecd18 [ 489.179985][T13836] [ 489.463046][T13514] usb 1-1: new full-speed USB device number 112 using dummy_hcd [ 489.529028][T13514] usb 1-1: device descriptor read/8, error -71 [ 489.799338][T13514] usb 1-1: new full-speed USB device number 113 using dummy_hcd [ 489.819746][T13514] usb 1-1: device descriptor read/8, error -71 [ 489.856163][T13861] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2187'. [ 489.929024][T13514] usb usb1-port1: unable to enumerate USB device [ 489.958788][ T31] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 490.048788][ T10] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 490.088776][ T31] usb 3-1: device descriptor read/64, error -71 [ 490.108778][ T5793] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 490.200641][ T10] usb 4-1: New USB device found, idVendor=0af0, idProduct=6711, bcdDevice= 0.00 [ 490.203536][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 490.203640][ T10] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 490.208276][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 490.208351][ T10] usb 4-1: Product: syz [ 490.208395][ T10] usb 4-1: Manufacturer: syz [ 490.269585][ T5793] usb 2-1: Using ep0 maxpacket: 32 [ 490.276100][ T5793] usb 2-1: New USB device found, idVendor=1e14, idProduct=99a3, bcdDevice=e6.2b [ 490.288059][ T5793] usb 2-1: config 91 has an invalid interface number: 231 but max is 0 [ 490.288123][ T5793] usb 2-1: config 91 has no interface number 0 [ 490.288179][ T5793] usb 2-1: too many endpoints for config 91 interface 231 altsetting 53: 121, using maximum allowed: 30 [ 490.288318][ T5793] usb 2-1: config 91 interface 231 altsetting 53 has 0 endpoint descriptors, different from the interface descriptor's value: 121 [ 490.288416][ T5793] usb 2-1: config 91 interface 231 has no altsetting 0 [ 490.322503][ T5793] usb 2-1: New USB device strings: Mfr=226, Product=244, SerialNumber=3 [ 490.322582][ T5793] usb 2-1: Product: syz [ 490.322626][ T5793] usb 2-1: Manufacturer: syz [ 490.322668][ T5793] usb 2-1: SerialNumber: syz [ 490.348276][ T31] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 490.470297][ T10] usb 4-1: USB disconnect, device number 106 [ 490.489312][ T31] usb 3-1: device descriptor read/64, error -71 [ 490.599083][ T31] usb usb3-port1: attempt power cycle [ 490.668830][ T5793] usb 2-1: USB disconnect, device number 103 [ 490.968819][ T31] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 491.001096][ T31] usb 3-1: device descriptor read/8, error -71 [ 491.105905][T13922] WARNING! power/level is deprecated; use power/control instead [ 491.238826][ T31] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 491.267447][ T31] usb 3-1: device descriptor read/8, error -71 [ 491.287952][T13932] nvmet_rdma: address family 255 not supported [ 491.335682][T13938] FAULT_INJECTION: forcing a failure. [ 491.335682][T13938] name failslab, interval 1, probability 0, space 0, times 0 [ 491.350187][T13938] CPU: 1 UID: 0 PID: 13938 Comm: syz.1.2191 Not tainted syzkaller #0 PREEMPT(full) [ 491.350218][T13938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 491.350232][T13938] Call Trace: [ 491.350242][T13938] [ 491.350252][T13938] dump_stack_lvl+0xe8/0x150 [ 491.350297][T13938] should_fail_ex+0x410/0x560 [ 491.350335][T13938] should_failslab+0xa8/0x100 [ 491.350361][T13938] kmem_cache_alloc_lru_noprof+0xa7/0x5f0 [ 491.350403][T13938] ? __d_alloc+0x37/0x6f0 [ 491.350431][T13938] ? __d_alloc+0x37/0x6f0 [ 491.350459][T13938] ? security_file_alloc+0x34/0x310 [ 491.350490][T13938] __d_alloc+0x37/0x6f0 [ 491.350524][T13938] d_alloc_parallel+0xde/0x16b0 [ 491.350558][T13938] ? do_raw_spin_lock+0x12b/0x2f0 [ 491.350606][T13938] ? __pfx_d_alloc_parallel+0x10/0x10 [ 491.350635][T13938] ? lock_acquire+0x115/0x350 [ 491.350684][T13938] __lookup_slow+0x82/0x2f0 [ 491.350716][T13938] lookup_slow+0x53/0x70 [ 491.350745][T13938] link_path_walk+0xd2a/0x1910 [ 491.350793][T13938] path_openat+0x1c9/0x1d60 [ 491.350846][T13938] do_file_open+0x23e/0x4a0 [ 491.350883][T13938] ? __pfx_do_file_open+0x10/0x10 [ 491.350939][T13938] ? _raw_spin_unlock+0x28/0x50 [ 491.350972][T13938] ? alloc_fd+0x651/0x6c0 [ 491.351006][T13938] do_sys_openat2+0x115/0x200 [ 491.351034][T13938] ? __pfx_do_sys_openat2+0x10/0x10 [ 491.351059][T13938] ? ksys_write+0x242/0x270 [ 491.351091][T13938] ? __pfx_ksys_write+0x10/0x10 [ 491.351124][T13938] __x64_sys_openat+0x138/0x170 [ 491.351154][T13938] do_syscall_64+0x166/0x520 [ 491.351177][T13938] ? trace_irq_disable+0x3b/0x140 [ 491.351209][T13938] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.351233][T13938] ? clear_bhb_loop+0x70/0xc0 [ 491.351262][T13938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.351285][T13938] RIP: 0033:0x7f4a3119e0d9 [ 491.351307][T13938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 491.351328][T13938] RSP: 002b:00007f4a3212a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 491.351354][T13938] RAX: ffffffffffffffda RBX: 00007f4a31425fa0 RCX: 00007f4a3119e0d9 [ 491.351372][T13938] RDX: 0000000000000001 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 491.351396][T13938] RBP: 00007f4a3212a090 R08: 0000000000000000 R09: 0000000000000000 [ 491.351412][T13938] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000001 [ 491.351427][T13938] R13: 00007f4a31426038 R14: 00007f4a31425fa0 R15: 00007fffab2fda88 [ 491.351463][T13938] [ 491.371466][ T31] usb usb3-port1: unable to enumerate USB device [ 491.934959][T13967] program syz.1.2196 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 491.958947][T13514] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 492.093268][ T1954] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 492.108538][T13976] FAULT_INJECTION: forcing a failure. [ 492.108538][T13976] name failslab, interval 1, probability 0, space 0, times 0 [ 492.108602][T13976] CPU: 0 UID: 0 PID: 13976 Comm: syz.1.2198 Not tainted syzkaller #0 PREEMPT(full) [ 492.108632][T13976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 492.108647][T13976] Call Trace: [ 492.108656][T13976] [ 492.108666][T13976] dump_stack_lvl+0xe8/0x150 [ 492.108702][T13976] should_fail_ex+0x410/0x560 [ 492.108740][T13976] should_failslab+0xa8/0x100 [ 492.108765][T13976] __kmalloc_noprof+0xfe/0x720 [ 492.108796][T13976] ? is_bpf_text_address+0x26/0x2b0 [ 492.108818][T13976] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 492.108845][T13976] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 492.108880][T13976] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 492.108916][T13976] genl_family_rcv_msg_doit+0xda/0x340 [ 492.108949][T13976] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 492.108982][T13976] ? apparmor_capable+0x126/0x170 [ 492.109010][T13976] ? bpf_lsm_capable+0x9/0x20 [ 492.109039][T13976] ? security_capable+0x7e/0x2c0 [ 492.109077][T13976] genl_rcv_msg+0x614/0x7a0 [ 492.109109][T13976] ? __pfx_genl_rcv_msg+0x10/0x10 [ 492.109132][T13976] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 492.109160][T13976] ? __pfx_nl80211_connect+0x10/0x10 [ 492.109181][T13976] ? __pfx_nl80211_post_doit+0x10/0x10 [ 492.109224][T13976] netlink_rcv_skb+0x226/0x4a0 [ 492.109258][T13976] ? __pfx_genl_rcv_msg+0x10/0x10 [ 492.109284][T13976] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 492.109342][T13976] ? down_read+0x2be/0x330 [ 492.109373][T13976] genl_rcv+0x28/0x40 [ 492.109395][T13976] netlink_unicast+0x7bd/0x940 [ 492.109435][T13976] netlink_sendmsg+0x813/0xb40 [ 492.109477][T13976] ? __pfx_netlink_sendmsg+0x10/0x10 [ 492.109519][T13976] ? apparmor_socket_sendmsg+0x98/0x360 [ 492.109551][T13976] ? __pfx_netlink_sendmsg+0x10/0x10 [ 492.109582][T13976] sock_sendmsg_nosec+0x13a/0x180 [ 492.109622][T13976] ____sys_sendmsg+0x54e/0x850 [ 492.109662][T13976] ? __pfx_____sys_sendmsg+0x10/0x10 [ 492.109700][T13976] ? import_iovec+0x73/0xa0 [ 492.109727][T13976] ___sys_sendmsg+0x2a5/0x360 [ 492.109755][T13976] ? __lock_acquire+0x6df/0x2e50 [ 492.109793][T13976] ? __pfx____sys_sendmsg+0x10/0x10 [ 492.109859][T13976] ? __fget_files+0x2a/0x420 [ 492.109885][T13976] ? __fget_files+0x3a2/0x420 [ 492.109923][T13976] __x64_sys_sendmsg+0x1b1/0x290 [ 492.109955][T13976] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 492.110006][T13976] do_syscall_64+0x166/0x520 [ 492.110029][T13976] ? trace_irq_disable+0x3b/0x140 [ 492.110066][T13976] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.110089][T13976] ? clear_bhb_loop+0x70/0xc0 [ 492.110118][T13976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.110141][T13976] RIP: 0033:0x7f4a3119e0d9 [ 492.110163][T13976] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.110183][T13976] RSP: 002b:00007f4a3212a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 492.110209][T13976] RAX: ffffffffffffffda RBX: 00007f4a31425fa0 RCX: 00007f4a3119e0d9 [ 492.110227][T13976] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 492.110242][T13976] RBP: 00007f4a3212a090 R08: 0000000000000000 R09: 0000000000000000 [ 492.110257][T13976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 492.110271][T13976] R13: 00007f4a31426038 R14: 00007f4a31425fa0 R15: 00007fffab2fda88 [ 492.110314][T13976] [ 492.159442][T13514] usb 1-1: Using ep0 maxpacket: 16 [ 492.174584][T13514] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 492.218488][T13514] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 492.271450][T13514] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.271482][T13514] usb 1-1: Product: syz [ 492.271499][T13514] usb 1-1: Manufacturer: syz [ 492.271516][T13514] usb 1-1: SerialNumber: syz [ 492.392842][ T1954] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 492.487377][ T1954] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 101, changing to 10 [ 492.487429][ T1954] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 32 [ 492.487464][ T1954] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 1032, setting to 1024 [ 492.487494][ T1954] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 492.530015][T13514] usb 1-1: config 0 descriptor?? [ 492.578381][ T1954] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.578410][ T1954] usb 4-1: Product: syz [ 492.578426][ T1954] usb 4-1: Manufacturer: ࠖ [ 492.578442][ T1954] usb 4-1: SerialNumber: syz [ 492.618445][T13514] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 492.618514][T13514] em28xx 1-1:0.0: DVB interface 0 found: bulk [ 492.623727][T13979] workqueue: Failed to create a rescuer kthread for wq "xfs-reclaim/nullb0": -EINTR [ 492.830808][T13514] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 492.849084][T13956] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 492.859031][T13956] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 492.880810][ T1954] cdc_ncm 4-1:1.0: bind() failure [ 492.902074][ T1954] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 492.902154][ T1954] cdc_ncm 4-1:1.1: bind() failure [ 492.921047][T13514] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 492.921108][T13514] em28xx 1-1:0.0: board has no eeprom [ 492.947128][ T1954] usb 4-1: USB disconnect, device number 107 [ 492.984628][T13945] em28xx 1-1:0.0: reading from i2c device at 0x0 failed (error=-5) [ 493.010663][T13514] em28xx 1-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 493.012844][T13514] em28xx 1-1:0.0: dvb set to bulk mode. [ 493.015629][ T31] em28xx 1-1:0.0: Binding DVB extension [ 493.045572][T13514] usb 1-1: USB disconnect, device number 114 [ 493.053088][T13514] em28xx 1-1:0.0: Disconnecting em28xx [ 493.099237][ T5746] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 493.124109][ T31] em28xx 1-1:0.0: Registering input extension [ 493.127073][T13514] em28xx 1-1:0.0: Closing input extension [ 493.162837][T13514] em28xx: Freeing device [ 493.260165][ T5746] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 493.265555][ T5746] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 493.265692][ T5746] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.295652][ T5746] usb 2-1: config 0 descriptor?? [ 493.365966][T14041] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2202'. [ 493.507788][T14002] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2200'. [ 493.602984][T14057] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2200'. [ 494.379075][ T5746] ath6kl: Failed to submit usb control message: -110 [ 494.379188][ T5746] ath6kl: unable to send the bmi data to the device: -110 [ 494.379207][ T5746] ath6kl: Unable to send get target info: -110 [ 494.412216][ T5746] ath6kl: Failed to init ath6kl core: -110 [ 494.415964][ T5746] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 494.778851][ T5746] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 494.908775][ T190] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 494.908798][ T5746] usb 4-1: device descriptor read/64, error -71 [ 495.068797][ T190] usb 1-1: Using ep0 maxpacket: 8 [ 495.075216][ T190] usb 1-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 495.079163][ T190] usb 1-1: config 0 has no interfaces? [ 495.086546][ T190] usb 1-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 495.086654][ T190] usb 1-1: Product: syz [ 495.086707][ T190] usb 1-1: Manufacturer: syz [ 495.086752][ T190] usb 1-1: SerialNumber: syz [ 495.111525][ T190] usb 1-1: config 0 descriptor?? [ 495.168862][ T5746] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 495.308740][ T5746] usb 4-1: device descriptor read/64, error -71 [ 495.319573][ T31] usb 1-1: USB disconnect, device number 115 [ 495.419138][ T5746] usb usb4-port1: attempt power cycle [ 495.758753][ T5746] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 495.789584][ T5746] usb 4-1: device descriptor read/8, error -71 [ 495.832924][ T31] usb 2-1: USB disconnect, device number 104 [ 495.933734][T14112] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2212'. [ 496.028772][ T5746] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 496.059663][ T5746] usb 4-1: device descriptor read/8, error -71 [ 496.148793][ T190] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 496.169030][ T5746] usb usb4-port1: unable to enumerate USB device [ 496.299086][ T190] usb 1-1: Using ep0 maxpacket: 8 [ 496.301469][ T190] usb 1-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 496.304227][ T190] usb 1-1: config 0 has no interfaces? [ 496.319240][ T31] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 496.330893][ T190] usb 1-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 496.330962][ T190] usb 1-1: Product: syz [ 496.331615][ T190] usb 1-1: Manufacturer: syz [ 496.331669][ T190] usb 1-1: SerialNumber: syz [ 496.347366][ T190] usb 1-1: config 0 descriptor?? [ 496.468802][ T31] usb 2-1: Using ep0 maxpacket: 16 [ 496.475290][ T31] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 496.480656][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 496.486935][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.487020][ T31] usb 2-1: Product: syz [ 496.487063][ T31] usb 2-1: Manufacturer: syz [ 496.487121][ T31] usb 2-1: SerialNumber: syz [ 496.498537][ T31] usb 2-1: config 0 descriptor?? [ 496.526613][ T31] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 496.526680][ T31] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 496.554022][T14106] FAULT_INJECTION: forcing a failure. [ 496.554022][T14106] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 496.554083][T14106] CPU: 0 UID: 0 PID: 14106 Comm: syz.0.2213 Not tainted syzkaller #0 PREEMPT(full) [ 496.554110][T14106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 496.554125][T14106] Call Trace: [ 496.554134][T14106] [ 496.554199][T14106] dump_stack_lvl+0xe8/0x150 [ 496.554311][T14106] should_fail_ex+0x410/0x560 [ 496.554425][T14106] _copy_from_user+0x2d/0xb0 [ 496.554497][T14106] kstrtouint_from_user+0xd6/0x180 [ 496.554584][T14106] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 496.554692][T14106] ? lock_acquire+0x115/0x350 [ 496.554791][T14106] proc_fail_nth_write+0x8e/0x210 [ 496.554881][T14106] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 496.554987][T14106] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 496.555071][T14106] vfs_write+0x296/0xba0 [ 496.555168][T14106] ? __pfx_vfs_write+0x10/0x10 [ 496.555251][T14106] ? __fget_files+0x2a/0x420 [ 496.555346][T14106] ? __fget_files+0x3a2/0x420 [ 496.555410][T14106] ? __fget_files+0x2a/0x420 [ 496.555505][T14106] ksys_write+0x150/0x270 [ 496.555585][T14106] ? __pfx_ksys_write+0x10/0x10 [ 496.555715][T14106] do_syscall_64+0x166/0x520 [ 496.555793][T14106] ? trace_irq_disable+0x3b/0x140 [ 496.555859][T14106] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.555917][T14106] ? clear_bhb_loop+0x70/0xc0 [ 496.555992][T14106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.556050][T14106] RIP: 0033:0x7f2d81f5e90e [ 496.556112][T14106] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 496.556167][T14106] RSP: 002b:00007f2d82efffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 496.556232][T14106] RAX: ffffffffffffffda RBX: 00007f2d82f006c0 RCX: 00007f2d81f5e90e [ 496.556276][T14106] RDX: 0000000000000001 RSI: 00007f2d82f000a0 RDI: 0000000000000005 [ 496.556327][T14106] RBP: 00007f2d82f00090 R08: 0000000000000000 R09: 0000000000000000 [ 496.556362][T14106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 496.556401][T14106] R13: 00007f2d82226038 R14: 00007f2d82225fa0 R15: 00007ffffd66b058 [ 496.556495][T14106] [ 496.657994][ T190] usb 1-1: USB disconnect, device number 116 [ 496.827591][T14132] FAULT_INJECTION: forcing a failure. [ 496.827591][T14132] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 496.827661][T14132] CPU: 1 UID: 0 PID: 14132 Comm: syz.0.2215 Not tainted syzkaller #0 PREEMPT(full) [ 496.827688][T14132] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 496.827730][T14132] Call Trace: [ 496.827762][T14132] [ 496.827806][T14132] dump_stack_lvl+0xe8/0x150 [ 496.827919][T14132] should_fail_ex+0x410/0x560 [ 496.828019][T14132] prepare_alloc_pages+0x223/0x600 [ 496.828122][T14132] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 496.828233][T14132] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 496.828319][T14132] ? __pfx_policy_nodemask+0x10/0x10 [ 496.828374][T14132] ? __dev_queue_xmit+0x29b/0x3820 [ 496.828451][T14132] ? __local_bh_enable_ip+0xd6/0x140 [ 496.828529][T14132] ? __lock_acquire+0x6df/0x2e50 [ 496.828621][T14132] alloc_pages_mpol+0x21e/0x390 [ 496.828705][T14132] folio_alloc_mpol_noprof+0x39/0x160 [ 496.828771][T14132] vma_alloc_folio_noprof+0xe1/0x1e0 [ 496.828858][T14132] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 496.828925][T14132] ? lock_acquire+0x115/0x350 [ 496.829023][T14132] do_pte_missing+0x173a/0x34b0 [ 496.829153][T14132] handle_mm_fault+0x1a53/0x3750 [ 496.829265][T14132] ? handle_mm_fault+0xf1/0x3750 [ 496.829370][T14132] ? __pfx_handle_mm_fault+0x10/0x10 [ 496.829468][T14132] ? __lock_acquire+0x6df/0x2e50 [ 496.829564][T14132] ? lock_mm_and_find_vma+0xa7/0x340 [ 496.829652][T14132] do_user_addr_fault+0x746/0x1340 [ 496.829775][T14132] exc_page_fault+0x6a/0xc0 [ 496.829852][T14132] asm_exc_page_fault+0x26/0x30 [ 496.829916][T14132] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 496.829992][T14132] Code: 6a 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 496.830046][T14132] RSP: 0018:ffffc90005b8f4f8 EFLAGS: 00050206 [ 496.830101][T14132] RAX: ffff8880327ee001 RBX: ffff8880327ee09d RCX: 0000000000000ddf [ 496.830152][T14132] RDX: 0000000000000000 RSI: ffff8880327ee09d RDI: 00002000000027c0 [ 496.830195][T14132] RBP: ffffc90005b8f670 R08: ffff8880327eee7b R09: 1ffff110064fddcf [ 496.830238][T14132] R10: dffffc0000000000 R11: ffffed10064fddd0 R12: dffffc0000000000 [ 496.830282][T14132] R13: 0000000000000ddf R14: 000020000000359f R15: 00007ffffffff000 [ 496.830374][T14132] _copy_to_iter+0x619/0x1810 [ 496.830495][T14132] ? __pfx__copy_to_iter+0x10/0x10 [ 496.830589][T14132] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 496.830700][T14132] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 496.830800][T14132] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 496.830890][T14132] __skb_datagram_iter+0xf8/0x980 [ 496.830975][T14132] ? __pfx_sk_busy_loop_end+0x10/0x10 [ 496.831032][T14132] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 496.831139][T14132] skb_copy_datagram_iter+0xb5/0x240 [ 496.831228][T14132] netlink_recvmsg+0x2b9/0xa50 [ 496.831337][T14132] ? __pfx_netlink_recvmsg+0x10/0x10 [ 496.831422][T14132] ? lock_acquire+0x115/0x350 [ 496.831518][T14132] ? aa_sock_msg_perm+0x144/0x210 [ 496.831615][T14132] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 496.831672][T14132] ? security_socket_recvmsg+0x7e/0x2c0 [ 496.831737][T14132] ? __pfx_netlink_recvmsg+0x10/0x10 [ 496.831858][T14132] sock_recvmsg+0x196/0x1e0 [ 496.831957][T14132] ____sys_recvmsg+0x1e6/0x4a0 [ 496.832076][T14132] ? __pfx_____sys_recvmsg+0x10/0x10 [ 496.832206][T14132] ? import_iovec+0x73/0xa0 [ 496.832270][T14132] ___sys_recvmsg+0x213/0x5a0 [ 496.832352][T14132] ? __pfx____sys_recvmsg+0x10/0x10 [ 496.832441][T14132] ? lock_acquire+0x115/0x350 [ 496.832572][T14132] ? __fget_files+0x3a2/0x420 [ 496.832662][T14132] do_recvmmsg+0x31a/0x7f0 [ 496.832767][T14132] ? __pfx_do_recvmmsg+0x10/0x10 [ 496.832877][T14132] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 496.832951][T14132] ? __fget_files+0x3a2/0x420 [ 496.833047][T14132] __x64_sys_recvmmsg+0x198/0x250 [ 496.833133][T14132] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 496.833242][T14132] do_syscall_64+0x166/0x520 [ 496.833298][T14132] ? trace_irq_disable+0x3b/0x140 [ 496.833385][T14132] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.833462][T14132] ? clear_bhb_loop+0x70/0xc0 [ 496.833545][T14132] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.833602][T14132] RIP: 0033:0x7f2d81f9e0d9 [ 496.833656][T14132] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 496.833703][T14132] RSP: 002b:00007f2d82f00028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 496.833768][T14132] RAX: ffffffffffffffda RBX: 00007f2d82225fa0 RCX: 00007f2d81f9e0d9 [ 496.833824][T14132] RDX: 0000000000000003 RSI: 00002000000003c0 RDI: 0000000000000003 [ 496.833860][T14132] RBP: 00007f2d82f00090 R08: 0000000000000000 R09: 0000000000000000 [ 496.833902][T14132] R10: 0000000040000102 R11: 0000000000000246 R12: 0000000000000001 [ 496.833946][T14132] R13: 00007f2d82226038 R14: 00007f2d82225fa0 R15: 00007ffffd66b058 [ 496.834028][T14132] [ 496.864080][ T31] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 496.982902][ T31] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 496.983004][ T31] em28xx 2-1:0.0: board has no eeprom [ 497.075789][T14115] em28xx 2-1:0.0: reading from i2c device at 0x0 failed (error=-5) [ 497.113305][ T31] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 497.113394][ T31] em28xx 2-1:0.0: dvb set to bulk mode. [ 497.131039][ T5746] em28xx 2-1:0.0: Binding DVB extension [ 497.253173][ T31] usb 2-1: USB disconnect, device number 105 [ 497.287068][ T31] em28xx 2-1:0.0: Disconnecting em28xx [ 497.432528][ T5746] em28xx 2-1:0.0: Registering input extension [ 497.436714][ T31] em28xx 2-1:0.0: Closing input extension [ 497.463734][ T31] em28xx: Freeing device [ 497.597203][T14165] PKCS7: Unknown OID: [4] 5.25.287.112.81.102.117.87.150326315.2007.15776.1 [ 497.597247][T14165] PKCS7: Only support pkcs7_signedData type [ 497.709418][ T5793] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 497.858756][ T5793] usb 3-1: Using ep0 maxpacket: 8 [ 497.864746][ T5793] usb 3-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 497.880227][ T5793] usb 3-1: config 0 has no interfaces? [ 497.888095][ T5793] usb 3-1: New USB device strings: Mfr=17, Product=2, SerialNumber=3 [ 497.896823][ T5793] usb 3-1: Product: syz [ 497.901655][ T5793] usb 3-1: Manufacturer: syz [ 497.901677][ T5793] usb 3-1: SerialNumber: syz [ 497.916785][ T5793] usb 3-1: config 0 descriptor?? [ 497.929502][ T5746] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 498.076966][T14189] FAULT_INJECTION: forcing a failure. [ 498.076966][T14189] name failslab, interval 1, probability 0, space 0, times 0 [ 498.077032][T14189] CPU: 0 UID: 0 PID: 14189 Comm: syz.0.2221 Not tainted syzkaller #0 PREEMPT(full) [ 498.077058][T14189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 498.077102][T14189] Call Trace: [ 498.077134][T14189] [ 498.077168][T14189] dump_stack_lvl+0xe8/0x150 [ 498.077277][T14189] should_fail_ex+0x410/0x560 [ 498.077384][T14189] should_failslab+0xa8/0x100 [ 498.077460][T14189] __kmalloc_noprof+0xfe/0x720 [ 498.077531][T14189] ? rcu_is_watching+0x16/0xb0 [ 498.077595][T14189] ? tomoyo_realpath_from_path+0xef/0x640 [ 498.077685][T14189] ? tomoyo_realpath_from_path+0xef/0x640 [ 498.077781][T14189] tomoyo_realpath_from_path+0xef/0x640 [ 498.077894][T14189] ? tomoyo_path_number_perm+0x219/0x5f0 [ 498.077978][T14189] tomoyo_path_number_perm+0x246/0x5f0 [ 498.078067][T14189] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 498.078144][T14189] ? __lock_acquire+0x6df/0x2e50 [ 498.078277][T14189] ? hook_file_ioctl+0x1f2/0x600 [ 498.078411][T14189] ? __fget_files+0x2a/0x420 [ 498.078488][T14189] ? __fget_files+0x2a/0x420 [ 498.078562][T14189] ? __fget_files+0x3a2/0x420 [ 498.078640][T14189] ? __fget_files+0x2a/0x420 [ 498.078735][T14189] security_file_ioctl+0xc3/0x2a0 [ 498.078822][T14189] __se_sys_ioctl+0x47/0x170 [ 498.078910][T14189] do_syscall_64+0x166/0x520 [ 498.078970][T14189] ? trace_irq_disable+0x3b/0x140 [ 498.079058][T14189] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.079123][T14189] ? clear_bhb_loop+0x70/0xc0 [ 498.079200][T14189] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.079259][T14189] RIP: 0033:0x7f2d81f9e0d9 [ 498.079315][T14189] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.079369][T14189] RSP: 002b:00007f2d82f00028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 498.079433][T14189] RAX: ffffffffffffffda RBX: 00007f2d82225fa0 RCX: 00007f2d81f9e0d9 [ 498.079483][T14189] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000a [ 498.079518][T14189] RBP: 00007f2d82f00090 R08: 0000000000000000 R09: 0000000000000000 [ 498.079562][T14189] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.079597][T14189] R13: 00007f2d82226038 R14: 00007f2d82225fa0 R15: 00007ffffd66b058 [ 498.079693][T14189] [ 498.080332][T14189] ERROR: Out of memory at tomoyo_realpath_from_path. [ 498.101055][ T5746] usb 2-1: Using ep0 maxpacket: 8 [ 498.112134][ T5746] usb 2-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 498.159132][ T5793] usb 3-1: USB disconnect, device number 72 [ 498.271967][ T5746] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.271998][ T5746] usb 2-1: Product: syz [ 498.272015][ T5746] usb 2-1: Manufacturer: syz [ 498.272032][ T5746] usb 2-1: SerialNumber: syz [ 498.381670][ T5746] usb 2-1: config 0 descriptor?? [ 498.391884][ T5746] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 498.553199][T14207] FAULT_INJECTION: forcing a failure. [ 498.553199][T14207] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 498.566743][T14207] CPU: 1 UID: 0 PID: 14207 Comm: syz.0.2223 Not tainted syzkaller #0 PREEMPT(full) [ 498.566778][T14207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 498.566793][T14207] Call Trace: [ 498.566802][T14207] [ 498.566812][T14207] dump_stack_lvl+0xe8/0x150 [ 498.566845][T14207] should_fail_ex+0x410/0x560 [ 498.566882][T14207] _copy_to_user+0x31/0xb0 [ 498.566908][T14207] do_insn_ioctl+0x2e3/0x5b0 [ 498.566938][T14207] comedi_unlocked_ioctl+0xe06/0x1af0 [ 498.566988][T14207] ? kasan_quarantine_put+0xbb/0x1f0 [ 498.567021][T14207] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 498.567076][T14207] ? tomoyo_path_number_perm+0x219/0x5f0 [ 498.567109][T14207] ? tomoyo_path_number_perm+0x219/0x5f0 [ 498.567143][T14207] ? do_vfs_ioctl+0x116f/0x1530 [ 498.567179][T14207] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 498.567226][T14207] ? hook_file_ioctl+0x1f2/0x600 [ 498.567277][T14207] ? __fget_files+0x2a/0x420 [ 498.567308][T14207] ? __fget_files+0x3a2/0x420 [ 498.567333][T14207] ? __fget_files+0x2a/0x420 [ 498.567361][T14207] ? bpf_lsm_file_ioctl+0x9/0x20 [ 498.567388][T14207] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 498.567422][T14207] __se_sys_ioctl+0xfc/0x170 [ 498.567456][T14207] do_syscall_64+0x166/0x520 [ 498.567479][T14207] ? trace_irq_disable+0x3b/0x140 [ 498.567509][T14207] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.567531][T14207] ? clear_bhb_loop+0x70/0xc0 [ 498.567558][T14207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.567579][T14207] RIP: 0033:0x7f2d81f9e0d9 [ 498.567600][T14207] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.567618][T14207] RSP: 002b:00007f2d82f00028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 498.567641][T14207] RAX: ffffffffffffffda RBX: 00007f2d82225fa0 RCX: 00007f2d81f9e0d9 [ 498.567657][T14207] RDX: 0000200000022a00 RSI: 000000008028640c RDI: 0000000000000003 [ 498.567671][T14207] RBP: 00007f2d82f00090 R08: 0000000000000000 R09: 0000000000000000 [ 498.567687][T14207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.567700][T14207] R13: 00007f2d82226038 R14: 00007f2d82225fa0 R15: 00007ffffd66b058 [ 498.567734][T14207] [ 498.798835][ T5793] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 498.860588][T14215] jffs2: notice: (14215) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 498.883475][T14215] Invalid argument reading file caps for ./file0 [ 498.902688][T14218] jffs2: notice: (14218) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 498.920713][T14218] jffs2: fork failed for JFFS2 garbage collect thread: -EINTR [ 498.948860][ T5793] usb 4-1: Using ep0 maxpacket: 32 [ 498.950774][ T5793] usb 4-1: New USB device found, idVendor=5543, idProduct=0042, bcdDevice= 0.00 [ 498.964003][ T5793] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 498.964051][ T5793] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.981695][ T5793] usb 4-1: config 0 descriptor?? [ 499.278745][ T10] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 499.408821][ T10] usb 3-1: device descriptor read/64, error -71 [ 499.568729][ T5793] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 499.648724][ T10] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 499.718784][ T5793] usb 1-1: Using ep0 maxpacket: 16 [ 499.720939][ T5793] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 499.730685][ T5793] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 499.736590][ T5793] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.736666][ T5793] usb 1-1: Product: syz [ 499.736709][ T5793] usb 1-1: Manufacturer: syz [ 499.736746][ T5793] usb 1-1: SerialNumber: syz [ 499.765148][ T5793] usb 1-1: config 0 descriptor?? [ 499.780562][ T5793] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 499.780627][ T5793] em28xx 1-1:0.0: DVB interface 0 found: bulk [ 499.789964][ T10] usb 3-1: device descriptor read/64, error -71 [ 499.900584][ T10] usb usb3-port1: attempt power cycle [ 500.039670][ T5793] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 500.104978][ T5793] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 500.105043][ T5793] em28xx 1-1:0.0: board has no eeprom [ 500.149763][ T5746] gspca_sonixj: reg_w1 err -110 [ 500.178835][ T5793] em28xx 1-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 500.178897][ T5793] em28xx 1-1:0.0: dvb set to bulk mode. [ 500.179228][ T190] em28xx 1-1:0.0: Binding DVB extension [ 500.209421][ T5793] usb 1-1: USB disconnect, device number 117 [ 500.228803][ T5793] em28xx 1-1:0.0: Disconnecting em28xx [ 500.230145][T14234] em28xx 1-1:0.0: reading from i2c device at 0x0 failed (error=-19) [ 500.242886][ T5746] sonixj 2-1:0.0: probe with driver sonixj failed with error -110 [ 500.249555][ T10] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 500.274099][ T10] usb 3-1: device descriptor read/8, error -71 [ 500.317521][ T190] em28xx 1-1:0.0: Registering input extension [ 500.320267][ T5793] em28xx 1-1:0.0: Closing input extension [ 500.349047][ T5793] em28xx: Freeing device [ 500.508773][ T10] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 500.529371][ T10] usb 3-1: device descriptor read/8, error -71 [ 500.639518][ T10] usb usb3-port1: unable to enumerate USB device [ 500.789004][T14266] forcing mempool usage for raid10_make_request+0x3d4/0x25a0 [ 500.892208][ T5793] usb 2-1: USB disconnect, device number 106 [ 501.036598][T14286] FAULT_INJECTION: forcing a failure. [ 501.036598][T14286] name failslab, interval 1, probability 0, space 0, times 0 [ 501.036662][T14286] CPU: 1 UID: 0 PID: 14286 Comm: syz.1.2232 Not tainted syzkaller #0 PREEMPT(full) [ 501.036688][T14286] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 501.036732][T14286] Call Trace: [ 501.036765][T14286] [ 501.036800][T14286] dump_stack_lvl+0xe8/0x150 [ 501.036940][T14286] should_fail_ex+0x410/0x560 [ 501.037041][T14286] should_failslab+0xa8/0x100 [ 501.037117][T14286] __kmalloc_noprof+0xfe/0x720 [ 501.037195][T14286] ? mutex_init_lockdep+0xdf/0x110 [ 501.037255][T14286] ? security_task_alloc+0x4d/0x330 [ 501.037332][T14286] ? security_task_alloc+0x4d/0x330 [ 501.037420][T14286] ? copy_process+0xd3c/0x43e0 [ 501.037497][T14286] security_task_alloc+0x4d/0x330 [ 501.037582][T14286] ? copy_process+0xd3c/0x43e0 [ 501.037647][T14286] copy_process+0x1c45/0x43e0 [ 501.037743][T14286] ? copy_process+0xd3c/0x43e0 [ 501.037861][T14286] ? __pfx_copy_process+0x10/0x10 [ 501.037942][T14286] ? mutex_init_lockdep+0xdf/0x110 [ 501.038015][T14286] vhost_task_create+0x1f9/0x380 [ 501.038103][T14286] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 501.038169][T14286] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 501.038239][T14286] ? __pfx_vhost_task_create+0x10/0x10 [ 501.038336][T14286] ? register_lock_class+0x31/0x2e0 [ 501.038453][T14286] ? __pfx_vhost_task_fn+0x10/0x10 [ 501.038561][T14286] ? kasan_quarantine_put+0xbb/0x1f0 [ 501.038672][T14286] kvm_mmu_post_init_vm+0x147/0x2b0 [ 501.038750][T14286] kvm_arch_vcpu_ioctl_run+0x7c/0x19c0 [ 501.038868][T14286] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 501.038981][T14286] kvm_vcpu_ioctl+0xa61/0xfd0 [ 501.039088][T14286] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 501.039166][T14286] ? hook_file_ioctl+0x1f2/0x600 [ 501.039305][T14286] ? __fget_files+0x2a/0x420 [ 501.039389][T14286] ? __fget_files+0x2a/0x420 [ 501.039455][T14286] ? __fget_files+0x3a2/0x420 [ 501.039520][T14286] ? __fget_files+0x2a/0x420 [ 501.039603][T14286] ? bpf_lsm_file_ioctl+0x9/0x20 [ 501.039684][T14286] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 501.039785][T14286] __se_sys_ioctl+0xfc/0x170 [ 501.039867][T14286] do_syscall_64+0x166/0x520 [ 501.039934][T14286] ? trace_irq_disable+0x3b/0x140 [ 501.040014][T14286] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.040078][T14286] ? clear_bhb_loop+0x70/0xc0 [ 501.040153][T14286] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.040219][T14286] RIP: 0033:0x7f4a3119e0d9 [ 501.040267][T14286] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 501.040322][T14286] RSP: 002b:00007f4a3212a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 501.040399][T14286] RAX: ffffffffffffffda RBX: 00007f4a31425fa0 RCX: 00007f4a3119e0d9 [ 501.040452][T14286] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 501.040486][T14286] RBP: 00007f4a3212a090 R08: 0000000000000000 R09: 0000000000000000 [ 501.040526][T14286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 501.040561][T14286] R13: 00007f4a31426038 R14: 00007f4a31425fa0 R15: 00007fffab2fda88 [ 501.040648][T14286] [ 501.230276][ T31] usb 1-1: new full-speed USB device number 118 using dummy_hcd [ 501.391903][ T31] usb 1-1: unable to get BOS descriptor or descriptor too short [ 501.394872][ T31] usb 1-1: not running at top speed; connect to a high speed hub [ 501.394956][ T31] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=b2.86 [ 501.407558][ T31] usb 1-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 501.407643][ T31] usb 1-1: config 2 has 1 interface, different from the descriptor's value: 2 [ 501.443717][ T31] usb 1-1: string descriptor 0 read error: -22 [ 501.444065][ T31] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.556021][ T5793] usb 4-1: USB disconnect, device number 112 [ 501.672915][ T31] snd-usb-6fire 1-1:2.0: unknown device firmware state received from device: [ 501.672956][ T31] eb 2e 87 4b 9a 05 e6 5e [ 501.673200][ T31] snd-usb-6fire 1-1:2.0: probe with driver snd-usb-6fire failed with error -5 [ 501.740229][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.740323][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.883744][ T5746] usb 1-1: USB disconnect, device number 118 [ 502.018816][T13514] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 502.082493][T14340] bond0: option mode: unable to set because the bond device is up [ 502.170183][ T5793] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 502.179505][T13514] usb 2-1: Using ep0 maxpacket: 16 [ 502.186981][T13514] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 502.193838][T13514] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 502.203596][T13514] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.203681][T13514] usb 2-1: Product: syz [ 502.203732][T13514] usb 2-1: Manufacturer: syz [ 502.203775][T13514] usb 2-1: SerialNumber: syz [ 502.224267][T13514] usb 2-1: config 0 descriptor?? [ 502.242191][T13514] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 502.242258][T13514] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 502.321390][ T5793] usb 4-1: Using ep0 maxpacket: 16 [ 502.327227][ T5793] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 502.345711][ T5793] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 502.355899][ T5793] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.355931][ T5793] usb 4-1: Product: syz [ 502.355950][ T5793] usb 4-1: Manufacturer: syz [ 502.355968][ T5793] usb 4-1: SerialNumber: syz [ 502.384639][ T5793] usb 4-1: config 0 descriptor?? [ 502.397708][ T5793] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 502.397766][ T5793] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 502.489412][T13514] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 502.555549][T13514] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 502.555602][T13514] em28xx 2-1:0.0: board has no eeprom [ 502.589626][T14358] [ 502.592023][T14358] ====================================================== [ 502.598001][T14365] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 502.600668][T14365] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 502.615244][T14358] WARNING: possible circular locking dependency detected [ 502.622383][T14358] syzkaller #0 Not tainted [ 502.626836][T14358] ------------------------------------------------------ [ 502.634048][T14358] syz.0.2243/14358 is trying to acquire lock: [ 502.640118][T13514] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 502.640175][T13514] em28xx 2-1:0.0: dvb set to bulk mode. [ 502.640149][T14358] ffffffff8f750cc0 [ 502.644047][ T1954] em28xx 2-1:0.0: Binding DVB extension [ 502.649502][T14314] em28xx 2-1:0.0: reading from i2c device at 0x0 failed (error=-5) [ 502.667912][T14365] could not allocate digest TFM handle rmd256-generic [ 502.677568][T14358] (major_names_lock){+.+.}-{4:4}, at: blk_request_module+0x35/0x2a0 [ 502.685802][T14358] [ 502.685802][T14358] but task is already holding lock: [ 502.693199][T14358] ffff888076254358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 502.703589][T14358] [ 502.703589][T14358] which lock already depends on the new lock. [ 502.703589][T14358] [ 502.714024][T14358] [ 502.714024][T14358] the existing dependency chain (in reverse order) is: [ 502.723071][T14358] [ 502.723071][T14358] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 502.731481][T14358] __mutex_lock+0x19d/0x1550 [ 502.736626][T14358] md_start_sync+0x179/0x1010 [ 502.741909][T14358] process_scheduled_works+0xc3d/0x1630 [ 502.748004][T14358] worker_thread+0xa47/0xfb0 [ 502.753162][T14358] kthread+0x38b/0x480 [ 502.757789][T14358] ret_from_fork+0x514/0xb70 [ 502.762928][T14358] ret_from_fork_asm+0x1a/0x30 [ 502.768260][T14358] [ 502.768260][T14358] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 502.777762][T14358] process_scheduled_works+0xc03/0x1630 [ 502.784126][T14358] worker_thread+0xa47/0xfb0 [ 502.789270][T14358] kthread+0x38b/0x480 [ 502.793911][T14358] ret_from_fork+0x514/0xb70 [ 502.799054][T14358] ret_from_fork_asm+0x1a/0x30 [ 502.804365][T14358] [ 502.804365][T14358] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 502.812646][T14358] touch_wq_lockdep_map+0xcb/0x180 [ 502.818320][T14358] __flush_workqueue+0x148/0x1470 [ 502.823894][T14358] md_alloc+0x32/0xf20 [ 502.828508][T14358] md_alloc_and_put+0x1a/0x1f0 [ 502.833842][T14358] blk_request_module+0x27d/0x2a0 [ 502.839418][T14358] blkdev_get_no_open+0x3f/0xe0 [ 502.844913][T14358] blkdev_open+0x1d7/0x600 [ 502.849889][T14358] do_dentry_open+0x816/0x1380 [ 502.855201][T14358] vfs_open+0x3b/0x340 [ 502.859807][T14358] path_openat+0x1443/0x1d60 [ 502.864948][T14358] do_file_open+0x23e/0x4a0 [ 502.869997][T14358] do_sys_openat2+0x115/0x200 [ 502.875310][T14358] __x64_sys_openat+0x138/0x170 [ 502.880720][T14358] do_syscall_64+0x166/0x520 [ 502.885873][T14358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.892328][T14358] [ 502.892328][T14358] -> #0 (major_names_lock){+.+.}-{4:4}: [ 502.900104][T14358] __lock_acquire+0x15ff/0x2e50 [ 502.905535][T14358] lock_acquire+0x115/0x350 [ 502.911388][T14358] __mutex_lock+0x19d/0x1550 [ 502.916535][T14358] blk_request_module+0x35/0x2a0 [ 502.922120][T14358] blkdev_get_no_open+0x3f/0xe0 [ 502.927528][T14358] bdev_file_open_by_dev+0xa0/0x240 [ 502.933277][T14358] md_import_device+0x2e9/0x650 [ 502.938679][T14358] hot_add_disk+0xa7/0x4b0 [ 502.943757][T14358] md_ioctl+0x1e5e/0x2610 [ 502.948679][T14358] blkdev_ioctl+0x5e3/0x740 [ 502.953762][T14358] __se_sys_ioctl+0xfc/0x170 [ 502.958912][T14358] do_syscall_64+0x166/0x520 [ 502.964050][T14358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.970484][T14358] [ 502.970484][T14358] other info that might help us debug this: [ 502.970484][T14358] [ 502.980756][T14358] Chain exists of: [ 502.980756][T14358] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 502.980756][T14358] [ 502.996372][T14358] Possible unsafe locking scenario: [ 502.996372][T14358] [ 503.003935][T14358] CPU0 CPU1 [ 503.009467][T14358] ---- ---- [ 503.014878][T14358] lock(&mddev->reconfig_mutex); [ 503.019928][T14358] lock((work_completion)(&mddev->sync_work)); [ 503.028731][T14358] lock(&mddev->reconfig_mutex); [ 503.036303][T14358] lock(major_names_lock); [ 503.040831][T14358] [ 503.040831][T14358] *** DEADLOCK *** [ 503.040831][T14358] [ 503.048995][T14358] locks held by syz.0.2243/14358: 1, last CPU#0: [ 503.055435][T14358] #0: ffff888076254358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: mddev_suspend_and_lock+0x48/0xf0 [ 503.066229][T14358] [ 503.066229][T14358] stack backtrace: [ 503.072145][T14358] CPU: 0 UID: 0 PID: 14358 Comm: syz.0.2243 Not tainted syzkaller #0 PREEMPT(full) [ 503.081537][T14358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 503.091614][T14358] Call Trace: [ 503.094930][T14358] [ 503.097888][T14358] dump_stack_lvl+0xe8/0x150 [ 503.102508][T14358] print_circular_bug+0x2e2/0x300 [ 503.107562][T14358] check_noncircular+0x12f/0x150 [ 503.112531][T14358] __lock_acquire+0x15ff/0x2e50 [ 503.117412][T14358] ? __page_table_check_zero+0x6c/0x430 [ 503.122992][T14358] ? post_alloc_hook+0x208/0x250 [ 503.127976][T14358] ? get_page_from_freelist+0x2209/0x2280 [ 503.133733][T14358] lock_acquire+0x115/0x350 [ 503.138268][T14358] ? blk_request_module+0x35/0x2a0 [ 503.143419][T14358] __mutex_lock+0x19d/0x1550 [ 503.148133][T14358] ? blk_request_module+0x35/0x2a0 [ 503.153297][T14358] ? lock_acquire+0x115/0x350 [ 503.158023][T14358] ? blk_request_module+0x35/0x2a0 [ 503.163167][T14358] ? __pfx___mutex_lock+0x10/0x10 [ 503.168224][T14358] ? find_inode_fast+0xd2/0x740 [ 503.173107][T14358] ? find_inode_fast+0x5dc/0x740 [ 503.178078][T14358] ? find_inode_fast+0xd2/0x740 [ 503.182977][T14358] blk_request_module+0x35/0x2a0 [ 503.187989][T14358] blkdev_get_no_open+0x3f/0xe0 [ 503.192893][T14358] bdev_file_open_by_dev+0xa0/0x240 [ 503.198143][T14358] md_import_device+0x2e9/0x650 [ 503.203053][T14358] hot_add_disk+0xa7/0x4b0 [ 503.207504][T14358] md_ioctl+0x1e5e/0x2610 [ 503.211860][T14358] ? tomoyo_path_number_perm+0x219/0x5f0 [ 503.217620][T14358] ? __pfx_md_ioctl+0x10/0x10 [ 503.222341][T14358] ? do_vfs_ioctl+0x116f/0x1530 [ 503.227237][T14358] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 503.232383][T14358] ? hook_file_ioctl+0x1f2/0x600 [ 503.237362][T14358] ? __pfx_md_ioctl+0x10/0x10 [ 503.242078][T14358] blkdev_ioctl+0x5e3/0x740 [ 503.246882][T14358] ? __pfx_blkdev_ioctl+0x10/0x10 [ 503.251936][T14358] ? __fget_files+0x2a/0x420 [ 503.256563][T14358] ? bpf_lsm_file_ioctl+0x9/0x20 [ 503.261539][T14358] ? __pfx_blkdev_ioctl+0x10/0x10 [ 503.266622][T14358] __se_sys_ioctl+0xfc/0x170 [ 503.271360][T14358] do_syscall_64+0x166/0x520 [ 503.275974][T14358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.282064][T14358] ? clear_bhb_loop+0x70/0xc0 [ 503.286878][T14358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.292794][T14358] RIP: 0033:0x7f2d81f9e0d9 [ 503.297234][T14358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 503.316971][T14358] RSP: 002b:00007f2d82f00028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 503.325412][T14358] RAX: ffffffffffffffda RBX: 00007f2d82225fa0 RCX: 00007f2d81f9e0d9 [ 503.333404][T14358] RDX: 0000200000000400 RSI: 0000000000000928 RDI: 0000000000000003 [ 503.341420][T14358] RBP: 00007f2d82035024 R08: 0000000000000000 R09: 0000000000000000 [ 503.349436][T14358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 503.357439][T14358] R13: 00007f2d82226038 R14: 00007f2d82225fa0 R15: 00007ffffd66b058 [ 503.365462][T14358] [ 503.388675][T13514] usb 2-1: USB disconnect, device number 107 [ 503.389251][T13514] em28xx 2-1:0.0: Disconnecting em28xx [ 503.439460][ T5793] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 503.449735][ T31] usb 3-1: new full-speed USB device number 77 using dummy_hcd [ 503.498163][T14358] md: could not open device unknown-block(4,0). [ 503.498244][T14358] md: error, md_import_device() returned -6 [ 503.513198][ T5793] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 503.513266][ T5793] em28xx 4-1:0.0: board has no eeprom [ 503.540781][ T1954] em28xx 2-1:0.0: Registering input extension [ 503.547737][T13514] em28xx 2-1:0.0: Closing input extension [ 503.551749][T13514] em28xx: Freeing device [ 503.590080][ T5793] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 503.590152][ T5793] em28xx 4-1:0.0: dvb set to bulk mode. [ 503.591955][ T5748] em28xx 4-1:0.0: Binding DVB extension [ 503.617173][ T5793] usb 4-1: USB disconnect, device number 113 [ 503.617978][ T5793] em28xx 4-1:0.0: Disconnecting em28xx [ 503.651314][ T5748] em28xx 4-1:0.0: Registering input extension [ 503.652927][ T5793] em28xx 4-1:0.0: Closing input extension [ 503.669065][ T5793] em28xx: Freeing device