last executing test programs: 7.265198177s ago: executing program 2 (id=1626): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x181041, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x10a000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), r0) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r1, 0x1, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x810) 7.008162364s ago: executing program 2 (id=1631): r0 = socket$inet6(0xa, 0x1, 0x100) listen(r0, 0x0) syz_io_uring_setup(0x118d7, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000000)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f00000031c0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000004c0)=""/164, 0xa4}, {0x0}], 0x2, &(0x7f0000000a00)=""/152, 0x98}, 0x5}, {{&(0x7f0000000ac0)=@ieee802154, 0x80, &(0x7f0000002d00)=[{&(0x7f0000000d00)=""/4096, 0x1000}, {&(0x7f0000001d00)=""/4096, 0x1000}], 0x2, &(0x7f0000002d40)=""/44, 0x2c}, 0x2}, {{&(0x7f0000002d80)=@caif=@dgm, 0x80, &(0x7f0000003140)=[{&(0x7f0000002e00)=""/220, 0xdc}, {&(0x7f0000002f00)=""/69, 0x45}, {&(0x7f0000002f80)=""/172, 0xac}], 0x3, &(0x7f0000003180)=""/5, 0x5}, 0x7f}], 0x3, 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x20009, 0x6, 0x2, 0x3}, 0x0) r2 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000700)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) lseek(r2, 0xa45a, 0x3) 6.844977635s ago: executing program 3 (id=1635): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x2) 5.531951948s ago: executing program 1 (id=1647): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x181041, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd/3\x00') r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000440), r0) sendmsg$NLBL_MGMT_C_REMOVEDEF(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r1, 0x1, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x810) 5.355006379s ago: executing program 1 (id=1648): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="fc000000", @ANYRES16=r5, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r6, @ANYBLOB="e0005a80dc0000801400030020380000080003000600000003000800040002004a0002"], 0xfc}, 0x1, 0x0, 0x0, 0x4008821}, 0x8840) sched_setaffinity(r1, 0x8, &(0x7f0000000140)=0x2) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, 0x0, 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r7, 0xc0105512, &(0x7f00000000c0)=@usbdevfs_connect) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_LINKS(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x24, r8, 0x401, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x20004044}, 0x4800) 5.284751615s ago: executing program 0 (id=1650): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a70000000000", @ANYRES32], 0x0) r1 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000000200)='asymmetric\x00', &(0x7f00000003c0)) keyctl$get_persistent(0x16, 0x0, r1) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000280)=ANY=[@ANYBLOB="0005010000004f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.02138395s ago: executing program 4 (id=1652): r0 = socket$packet(0x11, 0x2, 0x300) sendmmsg$sock(r0, &(0x7f0000003680)=[{{&(0x7f0000000500)=@ieee802154={0x24, @short={0x2, 0x2, 0xffff}}, 0x80, 0x0}}], 0x1, 0x20008850) 4.93480425s ago: executing program 4 (id=1653): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) 4.867768628s ago: executing program 4 (id=1654): sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f0000000640)={{0x0, 0x2, 0xf, 0x8000000000000000, 0x1, 0x401, 0x1, 0x9, 0x5, 0x7ff, 0x9, 0x8, 0x6, 0x3, 0x8}, 0x8, [0x0]}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}}, 0x24}}, 0x4c840) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000002000000a00300000500000000000000", @ANYRES32, @ANYBLOB="0000000000000000405d86327c0001"], 0x48) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x62, 0x40800) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 4.653355169s ago: executing program 4 (id=1655): sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000040)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x20040844}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x40, 0x10, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0xc6da5938055fa6fd, 0x21}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0x1}, @IFLA_GTP_FD0={0x8, 0x1, @udp6=r1}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x44}, 0x2000c000) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x140, 0x10, 0x1, 0xbffffffe, 0x100, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x394, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@private=0xa010101, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0x6, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @XFRMA_IF_ID={0x8, 0x1f, 0x4}]}, 0x140}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$can_j1939(0x1d, 0x2, 0x7) socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r4, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000400)={r4, &(0x7f0000000380), &(0x7f0000000500)=""/166}, 0x20) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@newsa={0x134, 0x18, 0x1, 0x70bd27, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x60, 0x73}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@private0, {0x0, 0x4, 0x6, 0x800000ffff, 0x8251c, 0x2, 0x9}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0x3dca}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x134}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000020000082505a3a440000102030109023b000101000000090400"], 0x0) 4.541545727s ago: executing program 4 (id=1656): socket$packet(0x11, 0x2, 0x300) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) accept4(r0, 0x0, 0x0, 0x800) socket$nl_route(0x10, 0x3, 0x0) pselect6(0x40, &(0x7f0000000100), &(0x7f0000000000)={0x1f}, 0x0, 0x0, 0x0) 4.412019748s ago: executing program 3 (id=1657): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x6, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x29, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071101800000000001d400500000000004704000001ed00000f030000000000001d44000000000000620a00fe000000007203000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r5, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xffffffffffffff69}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xf}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x40) bind$bt_hci(r3, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000040)="09000000010000", 0x7) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r0, r6, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x8000000001000001, 0x0, 0x1}}, 0x40) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x80802, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000040)) ioctl$PPPIOCSACTIVE(r7, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) read(r7, 0x0, 0x0) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000300000000"], 0x0}, 0x94) r9 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'syz_tun\x00', 0x0}) r12 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r12, &(0x7f0000005400)=[{{&(0x7f0000001200)={0xa, 0x4e21, 0x7, @local, 0x1}, 0x1c, 0x0, 0x0, &(0x7f00000012c0)=[@rthdr_2292={{0x18, 0x29, 0x39, {0x135, 0x0, 0x2, 0x4}}}], 0x18}}], 0x1, 0x40810) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xb, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020752f00000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000f8ffffff850000000600000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r13, r11, 0x25, 0x0, @val=@netkit={@void, @value=r13}}, 0x1c) syz_emit_ethernet(0xf87, &(0x7f0000000000)=ANY=[], 0x0) syz_emit_ethernet(0x20e, &(0x7f0000000540)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000210", 0x1d8, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "8bb91d", 0x0, 0x11, 0x0, @loopback, @empty, [@fragment={0x87, 0x0, 0x5, 0x1, 0x0, 0x3, 0x68}, @hopopts={0x0, 0x32, '\x00', [@ra, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @generic={0x0, 0x9d, "a17e9ab13f6e142b20582c8d220c698a74dbf13dfc0ad1f526dfc43313759300929090dd4792ce67ea9f8769d3246f94412c56e0247939ed4b318e4b6066b72d91d9aff97fcf30977dfd4028dea535a8e9d1682c4794d255d62089716f2f97577f9bef264da3cfd3e5511fb253122f61808a73cc2e760f93ceb68a0db2613cf0956b23235f057c2f980a19266a6bb4a33a17f550a571c5b4211c6fa371"}, @ra, @generic={0x0, 0x8c, "65fd1a52737fa1ec91495f4d25a766a5dd36bcffb376f4b35d4a5bc51b0f8fb9a273282a9c8ef192a4de26c8732765dbeb6ce083e81cebf0612d1cc7956b78fb34ce0e4a867c8b4094bab04b23680ba97ad5c624055e8504a7a121cf38a402a7aa80e05dbe56fecab8b014420231c0e997cbfda9bdc7f29e3a8b13dcfc396cf6ff1fcd8a7f43a107871fdd7e"}, @padn={0x1, 0x2, [0x0, 0x0]}, @pad1, @generic={0x1, 0x52, "08f1390b0c74cba47ed1dbe3290dbd16fe15f3802c8f12d8687cb72f6783172e63fafc0bc19fc7ea5e20fe65290cc5531784929dd4b5c8ff0df008542d00f6159b80595da8d72872864da820552af488c1ce"}]}]}}}}}}}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r10}, &(0x7f0000000100), &(0x7f0000000200)=r8}, 0x20) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r9, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) socket$kcm(0x10, 0x2, 0x0) 4.357601052s ago: executing program 4 (id=1658): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @loopback, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) recvfrom(r0, &(0x7f0000001380)=""/179, 0xb3, 0x1, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, 0x0, 0x0) recvfrom(r0, 0x0, 0x0, 0x12, 0x0, 0x0) writev(r0, &(0x7f0000001540)=[{&(0x7f0000000140)='X', 0x1}], 0x1) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 3.765504345s ago: executing program 2 (id=1660): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000600)='mtd0\x00', &(0x7f0000000640)={0x200200, 0x101, 0x14}, 0x18) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000006c0), 0x80000, 0x0) mount_setattr(r0, &(0x7f0000000680)='./file1\x00', 0x800, &(0x7f0000000700)={0x77, 0x7e, 0x1c0000, {r1}}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x100) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000780), 0x80000, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0x18, &(0x7f0000000000)=0xa, 0x4) sendmsg(r2, &(0x7f0000000040)={&(0x7f0000000180)=@phonet={0x23, 0x2, 0xfc, 0x1}, 0x80, &(0x7f0000000280)=[{&(0x7f00000002c0)="01f80281000600a30000", 0xa}, {0x0}], 0x2}, 0x4000000) renameat2(0xffffffffffffff9c, &(0x7f00000007c0)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000000800)='mtd0/file0\x00', 0x8) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000540), 0x40400) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bond_slave_0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c0000001000010025bd7000fddbdf2500000000", @ANYRES32=r5, @ANYBLOB="10080400895504002c001280110001006272696467655f736c61766500000000140005"], 0x4c}, 0x1, 0x0, 0x0, 0x200404c1}, 0x4040010) connect$unix(r3, &(0x7f0000000580)=@abs={0x0, 0x0, 0x4e23}, 0x6e) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000000c0), 0x20a080, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(0xffffffffffffffff, 0xc0186445, &(0x7f0000000340)={0x5, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000380)={0x0}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000600fc000000080011000700000008000e00800000000800", @ANYRES64], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x80) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x7, &(0x7f0000000740)=[{0xc, 0x4, 0x3, 0x8}, {0x5, 0xf4, 0x5d, 0x785}, {0x0, 0x8, 0x5, 0x8}, {0x720, 0xae, 0x2, 0x2}, {0x0, 0x4, 0x1, 0xe}, {0x8, 0x9, 0x6, 0x81}, {0x5, 0x7, 0x0, 0x10001}]}) listns(&(0x7f0000000500)={0x20, 0x0, 0x9, 0x8000000, 0x0, 0x3}, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f00000003c0)={0x0, 0x0, 0x3, 0x0, 0x2, [0x0, 0x0, 0x0], [0x101, 0x9, 0x1, 0x100], [0x5, 0x582d, 0x80000000, 0x4], [0x8, 0xffffffff, 0x326, 0x2]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r7, 0xc06864b8, &(0x7f0000000440)={r8, 0x8, 0xf, 0xa, 0x1, [r9, r10, 0x0, r12], [0x4, 0x9, 0x8, 0x4], [0x3, 0xa00000, 0x6cb, 0x7], [0x2daf, 0x1, 0xf290, 0x1]}) 3.711338943s ago: executing program 3 (id=1661): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000220000000400000002"], 0x48) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010001d0025bd7000fadbdf2500000000", @ANYRES32=r3, @ANYBLOB="138000002b9201002400128009000100626f6e6400000000140002800800", @ANYRES16=r1], 0x44}, 0x1, 0x0, 0x0, 0x40448e0}, 0x0) write(r0, 0x0, 0x0) 3.306785602s ago: executing program 3 (id=1662): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="340000f401090102000000000000000808000640000000010900010094797a300000000008000340800000010400020000000000"], 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x20008051) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'ipvlan1\x00'}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000002c0), 0x20000, 0x0) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(0xffffffffffffffff, 0xc0106441, &(0x7f0000000300)={0x0, 0x0}) ioctl$DRM_IOCTL_PANTHOR_TILER_HEAP_CREATE(r2, 0xc028644b, &(0x7f0000000340)={r3, 0x74, 0x5c0000, 0x3, 0x4, 0x0, 0x6, 0x5}) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x2, &(0x7f0000000080)=[{0x48, 0x0, 0x7, 0x6}, {0x6, 0xfd, 0xee, 0x16}]}) ioctl$PPPIOCSDEBUG(r0, 0x40047440, &(0x7f0000000540)=0xfff) write$ppp(r0, &(0x7f00000001c0)="43f1", 0x2) sendmsg$inet(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000001c0)="1fd93fd76d4934184bbec63c656291062a3d29cd3034d4ceaba77debecd9573575cd14ce0838f22abc3c4abd5ed67a90ed87b702e18760b6d86669edc113fc3d0fb30d76c29ca5d1ca9327b1b13f5c020d14d28ff3452cec6811f625cbbd4a55a1418c1fe5cbbd20b990c63ba007e69518e03b5ce67f73", 0x77}, {&(0x7f00000002c0)="3c205b072336bce6ff13a65e159454de32ebdcbc4731acffd34e211c584048de1c7bcbe3d078fc02a51e5db635eec4e205f69b90cace8bb4d2da8a78b8d943e7217619c89d28fca63b956fd6e231e732d6", 0x51}], 0x2}, 0x8841) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 2.735259732s ago: executing program 3 (id=1663): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x2) ioctl$DRM_IOCTL_PANTHOR_TILER_HEAP_CREATE(0xffffffffffffffff, 0xc028644b, &(0x7f0000000340)={0x0, 0x74, 0x5c0000, 0x3, 0x4, 0x0, 0x6, 0x5}) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x2, &(0x7f0000000080)=[{0x48, 0x0, 0x7, 0x6}, {0x6, 0xfd, 0xee, 0x16}]}) ioctl$PPPIOCSDEBUG(r0, 0x40047440, &(0x7f0000000540)=0xfff) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000001c0)="1fd93fd76d4934184bbec63c656291062a3d29cd3034d4ceaba77debecd9573575cd14ce0838f22abc3c4abd5ed67a90ed87b702e18760b6d86669edc113fc3d0fb30d76c29ca5d1ca9327b1b13f5c020d14d28ff3452cec6811f625cbbd4a55a1418c1fe5cbbd20b990c63ba007e69518e03b5ce67f73", 0x77}, {&(0x7f00000002c0)="3c205b072336bce6ff13a65e159454de32ebdcbc4731acffd34e211c584048de1c7bcbe3d078fc02a51e5db635eec4e205f69b90cace8bb4d2da8a78b8d943e7217619c89d28fca63b956fd6e231e732d6", 0x51}], 0x2}, 0x8841) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x2000000000000000, 0x0, 0x4004840}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) 2.578675793s ago: executing program 1 (id=1664): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) 2.399058513s ago: executing program 1 (id=1665): sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f0000000640)={{0x0, 0x2, 0xf, 0x8000000000000000, 0x1, 0x401, 0x1, 0x9, 0x5, 0x7ff, 0x9, 0x8, 0x6, 0x3, 0x8}, 0x8, [0x0]}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}}, 0x24}}, 0x4c840) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000002000000a00300000500000000000000", @ANYRES32, @ANYBLOB="0000000000000000405d86327c0001"], 0x48) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x62, 0x40800) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 2.224309067s ago: executing program 1 (id=1666): r0 = syz_open_dev$dri(0x0, 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000380)={0xff, 0x3, 0xd83f}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000002c0)={0x8, 0xd7, 0x8, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x96e, 0xb, 0x400}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000280)={r1}) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write(r3, &(0x7f0000000180)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=nqn.201', 0x37) ioctl$TIOCCBRK(r2, 0x5428) 2.166431153s ago: executing program 2 (id=1667): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r1, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000640)="97452a307eb495fe223600"/28, 0x1c}], 0x16, &(0x7f0000000600)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x16}, @private=0xa010101}}}], 0x20}, 0x400c804) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x2) 2.093448238s ago: executing program 0 (id=1668): socket$packet(0x11, 0x2, 0x300) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) accept4(r0, 0x0, 0x0, 0x800) socket$nl_route(0x10, 0x3, 0x0) pselect6(0x40, &(0x7f0000000100), &(0x7f0000000000)={0x1f}, 0x0, 0x0, 0x0) 2.034511457s ago: executing program 3 (id=1669): r0 = socket$inet6(0xa, 0x1, 0x100) listen(r0, 0x0) syz_io_uring_setup(0x118d7, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000000)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f00000031c0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000004c0)=""/164, 0xa4}, {0x0}], 0x2, &(0x7f0000000a00)=""/152, 0x98}, 0x5}, {{&(0x7f0000000ac0)=@ieee802154, 0x80, &(0x7f0000002d00)=[{&(0x7f0000000d00)=""/4096, 0x1000}, {&(0x7f0000001d00)=""/4096, 0x1000}], 0x2, &(0x7f0000002d40)=""/44, 0x2c}, 0x2}, {{&(0x7f0000002d80)=@caif=@dgm, 0x80, &(0x7f0000003140)=[{&(0x7f0000002e00)=""/220, 0xdc}, {&(0x7f0000002f00)=""/69, 0x45}, {&(0x7f0000002f80)=""/172, 0xac}], 0x3, &(0x7f0000003180)=""/5, 0x5}, 0x7f}], 0x3, 0x2, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x20009, 0x6, 0x2, 0x3}, 0x0) r2 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000700)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) lseek(r2, 0xa45a, 0x3) 1.654682033s ago: executing program 0 (id=1670): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x10, &(0x7f0000000200)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000009500000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r2, 0xfffff000, 0xe, 0x0, &(0x7f0000001700)="61df7100c80400d5721ff59fe864", 0x0, 0x85, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) sendmsg$nl_generic(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000001c0)={0x14, 0x23, 0x9, 0x70bd25, 0x25dfd3ff, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x24040811}, 0x8410) 698.508623ms ago: executing program 2 (id=1671): sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r1, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x62, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 392.243353ms ago: executing program 0 (id=1672): bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0b00000005000000010000007f00000001000000", @ANYRES32=0x1, @ANYBLOB="08000f00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) socket$inet_smc(0x2b, 0x1, 0x0) r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000100)={0x2, 'bridge_slave_1\x00', 0x2}, 0x18) 258.91596ms ago: executing program 2 (id=1673): socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="fc000000", @ANYRES16, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32, @ANYBLOB="e0005a80dc0000801400030020380000080003000600000003000800040002004a0002"], 0xfc}, 0x1, 0x0, 0x0, 0x4008821}, 0x8840) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f00000000c0)=@usbdevfs_connect) 125.422637ms ago: executing program 0 (id=1674): mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) 55.530826ms ago: executing program 1 (id=1675): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0xa, [@struct={0x8, 0x0, 0x0, 0xf, 0x0, 0x10005}]}, {0x0, [0x5f, 0x0, 0x0, 0xcf, 0x0, 0x0, 0x0, 0x2e]}}, &(0x7f00000001c0)=""/257, 0x2e, 0x101, 0x6}, 0x28) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000008c0)=ANY=[@ANYBLOB="200000000a0a0108000000f0ff0000000a00000000f85403d4d86341571a978a714d71e4f8f222d6a1e91dd6ecf3a806cf1f4c3bf86de2ca4127c095899fd8d84e3b5060"], 0x20}, 0x1, 0x0, 0x0, 0x20000084}, 0x44) syz_usb_connect(0x2, 0x2b7, &(0x7f0000000240)={{0x12, 0x1, 0x310, 0xbd, 0x5e, 0x47, 0x8, 0x12d1, 0x4b3b, 0xe7d6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2a5, 0x1, 0x6, 0x2, 0x0, 0x9, "", [{{0x9, 0x4, 0xb, 0x8, 0x5, 0xff, 0x1, 0x1, 0x3c, [@uac_control={{0xa, 0x24, 0x1, 0x7ff, 0x16}, [@input_terminal={0xc, 0x24, 0x2, 0x4, 0x402, 0x5, 0x67, 0x1, 0x7f, 0x6}]}, @cdc_ncm={{0x9, 0x24, 0x6, 0x0, 0x1, "8f934d54"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x80000000, 0x9, 0x7f, 0x3}, {0x6, 0x24, 0x1a, 0x3}, [@mdlm_detail={0x13, 0x24, 0x13, 0xe4, "7337243c5e6e59948b40dafa49366c"}, @country_functional={0x8, 0x24, 0x7, 0x81, 0x90a, [0x7]}, @dmm={0x7, 0x24, 0x14, 0x1, 0xb}]}], [{{0x9, 0x5, 0xa, 0x4, 0x40, 0x7f, 0x0, 0x7}}, {{0x9, 0x5, 0xe, 0xc, 0x8, 0x2, 0x6, 0x8, [@generic={0xd2, 0xd, "b1cbf112685dde9bfe3e8d142a1595dd7875c4d112f2d4403a7ed2dc5866cba6bba0bb252ddae9a68a657ec9fc1c81f3236e5d602b5f288025a4e558f4809b0f1bbaed7ce1fc2f9af4a0fcb6234da648ae56aa8dda4895c383544d01468db11871387fd63c2a4a6f1c90a722ad6af948056a232b4c269672405e71a3c0d06fe87aa0065980d7d7b6d359a4bfc45acd461e232494475321038a8446c99be412fdf8a20685a41b5384c34edf46a32798717b3c69793c011de7e3dc5f9d93e1d2c8c13feb32e02789322961a41239f2dfee"}]}}, {{0x9, 0x5, 0x4, 0x0, 0x3ff, 0x5, 0x6, 0x9, [@generic={0x44, 0x5, "76ca79e8127bb4260e7a91f6669190218f31d201586ac300a91059a3c335c1c0a68ec733f15b5f46175dac434d974d952729a042e570b8173613b57d7810ca2d612f"}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0x2, 0x9}]}}, {{0x9, 0x5, 0x1, 0x2, 0x200, 0xf7, 0x2, 0x8, [@generic={0x81, 0x4, "cd2e71fa83e0752f7ec7e963ef71649f5145ececa91d147ddb8ef522936bc16ca06f1f159fc8f19c6312cbbf9b9b9829b4f444ef93d3c8a6cbfbb427992fff2b80f0cec14554319d56f8552cc2a19046f76c9f096945b6b224353a0fc93657d1cdbe0f50fdf44bd6a36dea35a46f7c1ae92d606636470c2e9afd803e0dfc2c"}, @generic={0x6f, 0x23, "3cc532503d726e0f99c4e14ff0adcd2e70e87c0b8e36081cf4014347cbc9b014474efa39aa2df19c63e71ce55d3a9a5e74e262d7486dd0b1292d67d8679d4b9279fbcbb519c91ae18679830852a2fedb9697812ea386fda303b68208f2bcf27a056cb54d532fd3d9468e2e8e18"}]}}, {{0x9, 0x5, 0xb, 0x10, 0x400, 0x9, 0x8, 0xc0}}]}}]}}]}}, &(0x7f0000000840)={0xa, &(0x7f0000000500)={0xa, 0x6, 0x300, 0xc0, 0x4, 0x39, 0x20, 0xcf}, 0xfb, &(0x7f0000000540)={0x5, 0xf, 0xfb, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x6, 0x6, 0x6, 0xff}, @generic={0xef, 0x10, 0xb, "ea7885d55ed4d2a03357cfa17bfd19e4a6c33d52bd7a633e591e1f1083736904381c09a0b1ee5f584d842c20509b27f0a64b8bb3a94c38bd4ec22af344f8132bed49a49dd0f470560859f747f7af451d11e826242b6743f61916bb79965fd1c3ec1a4546014cd45054d1cf44aecdda55e83656eaffff177b94ccd0ce256e7d88372356b49e5c6075c94f06a46effe6b57f6ba8166d4de9e096fcd6dd8501d531b0522f3829d26b91fcf1661d0cf06485f74b85ee7768150d13a12dd98d47cac590fe52f471fd894f3d80370b412419f0cecc3e057505b0277feb93241c641ece8a7c6a97c0e01f0f571906d6"}]}, 0x4, [{0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x861}}, {0x4, &(0x7f0000000680)=@lang_id={0x4, 0x3, 0x2009}}, {0xfb, &(0x7f00000006c0)=@string={0xfb, 0x3, "44faf8274688017578a9d22b54092041088d03b1eccaf5339f183b41ea1c2f846eb4d9b6cf4523daf5b748c578b759980ce4b06caca286f27d8357a1406ae936fa7d2909a1a2647ff05371ebb1981c94330057c2062e7f203fb1c915b5bf961a0534fcc79852799a8993d562c4c037f9332774e1ffcc125e51fdd6244b5222561798da88d73bdcade50a433d3508426986130482cccd48f2d5de3cad8af4e7f8c73672c7819437dad0a703cf2164bd4e95af69d387474df3d439d4edbe1a92ecd0b3223a09e210d9c8bbf7f46ecd43489950f5f24c9420d06b23bd09e427d073d7befbf8ef0b1cdccd3fc3f7f6aaadfc1994e45f8da74eb6cd"}}, {0x65, &(0x7f00000007c0)=@string={0x65, 0x3, "a177a26a7516cba7704334acf98634f7709079a34204fe733d0b2089ca97aa74dfb3758b1f4a8997410beb7937070dba64c649db8acf0e61adf2914b3dee5b692be32080a90d5bf5fdf63b032d10fb78ce6dfea3fcc7a628a9a9b2ca638e1f48829519"}}]}) syz_open_dev$I2C(&(0x7f0000000200), 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_CMAP(r2, 0x4b71, 0x0) 0s ago: executing program 0 (id=1676): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="340000f401090102000000000000000808000640000000010900010094797a300000000008000340800000010400020000000000"], 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x20008051) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'ipvlan1\x00'}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000002c0), 0x20000, 0x0) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(0xffffffffffffffff, 0xc0106441, &(0x7f0000000300)={0x0, 0x0}) ioctl$DRM_IOCTL_PANTHOR_TILER_HEAP_CREATE(r2, 0xc028644b, &(0x7f0000000340)={r3, 0x74, 0x5c0000, 0x3, 0x4, 0x0, 0x6, 0x5}) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x2, &(0x7f0000000080)=[{0x48, 0x0, 0x7, 0x6}, {0x6, 0xfd, 0xee, 0x16}]}) sendmsg$inet(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000001c0)="1fd93fd76d4934184bbec63c656291062a3d29cd3034d4ceaba77debecd9573575cd14ce0838f22abc3c4abd5ed67a90ed87b702e18760b6d86669edc113fc3d0fb30d76c29ca5d1ca9327b1b13f5c020d14d28ff3452cec6811f625cbbd4a55a1418c1fe5cbbd20b990c63ba007e69518e03b5ce67f73", 0x77}, {&(0x7f00000002c0)="3c205b072336bce6ff13a65e159454de32ebdcbc4731acffd34e211c584048de1c7bcbe3d078fc02a51e5db635eec4e205f69b90cace8bb4d2da8a78b8d943e7217619c89d28fca63b956fd6e231e732d6", 0x51}], 0x2}, 0x8841) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x2000000000000000, 0x0, 0x4004840}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f00000000c0)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0x29}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bind$alg(r4, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r5 = accept4(r4, 0x0, 0x0, 0x800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) kernel console output (not intermixed with test programs): ce 0, class 0) [ 245.937692][ T5853] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 246.214258][ T7498] tmpfs: Unknown parameter 'grpquota_block_hardli`it' [ 246.540375][ T5853] em28xx 4-1:0.0: unknown em28xx chip ID (240) [ 246.853682][ T5853] em28xx 4-1:0.0: Config register raw data: 0xaf [ 246.853709][ T5853] em28xx 4-1:0.0: I2S Audio (3 sample rate(s)) [ 246.853726][ T5853] em28xx 4-1:0.0: No AC97 audio processor [ 248.619007][ T7507] netlink: 16 bytes leftover after parsing attributes in process `syz.2.588'. [ 248.627702][ T7510] hub 8-0:1.0: USB hub found [ 248.629653][ T7510] hub 8-0:1.0: 1 port detected [ 248.870234][ T5706] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 248.989214][ T1692] usb 4-1: USB disconnect, device number 12 [ 249.050996][ T5706] usb 5-1: Using ep0 maxpacket: 32 [ 249.051951][ T5706] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 249.053632][ T5706] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 249.089632][ T5706] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 249.089661][ T5706] usb 5-1: Product: syz [ 249.089677][ T5706] usb 5-1: Manufacturer: syz [ 249.089693][ T5706] usb 5-1: SerialNumber: syz [ 249.129684][ T5706] usb 5-1: config 0 descriptor?? [ 249.154422][ T5706] gs_usb 5-1:0.0: Required endpoints not found [ 249.218534][ T7519] netlink: 8 bytes leftover after parsing attributes in process `syz.1.590'. [ 249.375782][ T1692] usb 5-1: USB disconnect, device number 9 [ 249.442829][ T7518] netlink: ct family unspecified [ 249.442880][ T7518] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 249.913823][ T7535] netlink: 116 bytes leftover after parsing attributes in process `syz.1.595'. [ 249.968482][ T7535] hub 8-0:1.0: USB hub found [ 249.971462][ T7535] hub 8-0:1.0: 1 port detected [ 251.003776][ T7537] netlink: 52 bytes leftover after parsing attributes in process `syz.1.598'. [ 251.012559][ T7539] tmpfs: Unknown parameter 'grpquota_block_hardli`it' [ 253.773782][ T7553] netlink: 16 bytes leftover after parsing attributes in process `syz.0.603'. [ 254.314702][ T7564] hub 8-0:1.0: USB hub found [ 254.317196][ T7564] hub 8-0:1.0: 1 port detected [ 255.632351][ T7573] netlink: 116 bytes leftover after parsing attributes in process `syz.3.608'. [ 255.682417][ T7573] hub 8-0:1.0: USB hub found [ 255.684972][ T7573] hub 8-0:1.0: 1 port detected [ 256.731086][ T1328] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.731164][ T1328] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.741470][ T5717] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 256.910935][ T5717] usb 2-1: Using ep0 maxpacket: 16 [ 256.912263][ T5717] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 256.913538][ T5717] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 256.913571][ T5717] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 256.916675][ T5717] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.916701][ T5717] usb 2-1: Product: syz [ 256.916717][ T5717] usb 2-1: Manufacturer: syz [ 256.916732][ T5717] usb 2-1: SerialNumber: syz [ 256.986596][ T5717] usb 2-1: config 0 descriptor?? [ 257.004021][ T5717] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 257.004058][ T5717] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 257.379024][ T7586] netlink: 16054 bytes leftover after parsing attributes in process `syz.2.611'. [ 257.608764][ T5717] em28xx 2-1:0.0: unknown em28xx chip ID (240) [ 257.721743][ T7591] tmpfs: Unknown parameter 'grpquota_block_hardli`it' [ 257.810458][ T5717] em28xx 2-1:0.0: Config register raw data: 0xaf [ 257.810482][ T5717] em28xx 2-1:0.0: I2S Audio (3 sample rate(s)) [ 257.810499][ T5717] em28xx 2-1:0.0: No AC97 audio processor [ 259.177497][ T7594] netlink: 16 bytes leftover after parsing attributes in process `syz.2.614'. [ 259.410380][ T5717] usb 2-1: USB disconnect, device number 10 [ 259.796119][ T7603] netlink: 52 bytes leftover after parsing attributes in process `syz.0.604'. [ 260.083446][ T7610] hub 8-0:1.0: USB hub found [ 260.085687][ T7610] hub 8-0:1.0: 1 port detected [ 261.325668][ T7614] netlink: 16054 bytes leftover after parsing attributes in process `syz.1.619'. [ 261.832540][ T7632] netlink: 8 bytes leftover after parsing attributes in process `syz.4.624'. [ 261.975379][ T7635] tmpfs: Unknown parameter 'grpquota_block_hardli`it' [ 262.149358][ T7637] FAULT_INJECTION: forcing a failure. [ 262.149358][ T7637] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.149405][ T7637] CPU: 0 UID: 0 PID: 7637 Comm: syz.3.628 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 262.149446][ T7637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 262.149461][ T7637] Call Trace: [ 262.149469][ T7637] [ 262.149478][ T7637] dump_stack_lvl+0xe8/0x150 [ 262.149518][ T7637] should_fail_ex+0x467/0x600 [ 262.149557][ T7637] _copy_from_user+0x2d/0xb0 [ 262.149583][ T7637] ___sys_sendmsg+0x1c6/0x360 [ 262.149611][ T7637] ? __lock_acquire+0x683/0x2ce0 [ 262.149638][ T7637] ? __pfx____sys_sendmsg+0x10/0x10 [ 262.149709][ T7637] ? __fget_files+0x2a/0x420 [ 262.149731][ T7637] ? __fget_files+0x3a8/0x420 [ 262.149764][ T7637] __x64_sys_sendmsg+0x1b7/0x290 [ 262.149795][ T7637] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 262.149843][ T7637] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.149868][ T7637] do_syscall_64+0x174/0x580 [ 262.149900][ T7637] ? trace_irq_disable+0x3b/0x140 [ 262.149935][ T7637] ? clear_bhb_loop+0x70/0xc0 [ 262.149971][ T7637] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.149993][ T7637] RIP: 0033:0x7f51c3d9e0d9 [ 262.150014][ T7637] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 262.150038][ T7637] RSP: 002b:00007f51c1ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 262.150061][ T7637] RAX: ffffffffffffffda RBX: 00007f51c4025fa0 RCX: 00007f51c3d9e0d9 [ 262.150077][ T7637] RDX: 0000000000000802 RSI: 00002000000003c0 RDI: 0000000000000003 [ 262.150090][ T7637] RBP: 00007f51c1ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 262.150103][ T7637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 262.150115][ T7637] R13: 00007f51c4026038 R14: 00007f51c4025fa0 R15: 00007ffd95a08888 [ 262.150149][ T7637] [ 262.594313][ T7643] hub 8-0:1.0: USB hub found [ 262.598042][ T7643] hub 8-0:1.0: 1 port detected [ 263.883993][ T7653] hub 8-0:1.0: USB hub found [ 263.886834][ T7653] hub 8-0:1.0: 1 port detected [ 264.922117][ T5717] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 265.080901][ T5717] usb 3-1: Using ep0 maxpacket: 16 [ 265.081856][ T5717] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 265.083389][ T5717] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 265.083421][ T5717] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 265.086535][ T5717] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 265.086563][ T5717] usb 3-1: Product: syz [ 265.086579][ T5717] usb 3-1: Manufacturer: syz [ 265.086595][ T5717] usb 3-1: SerialNumber: syz [ 265.194668][ T7659] netlink: 116 bytes leftover after parsing attributes in process `syz.0.633'. [ 265.397832][ T7660] hub 8-0:1.0: USB hub found [ 265.400614][ T7660] hub 8-0:1.0: 1 port detected [ 265.987059][ T5717] usb 3-1: config 0 descriptor?? [ 266.134024][ T5717] usb 3-1: can't set config #0, error -71 [ 266.273628][ T5717] usb 3-1: USB disconnect, device number 16 [ 266.401279][ T7667] netlink: 8 bytes leftover after parsing attributes in process `syz.3.636'. [ 266.573790][ T7663] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.635'. [ 266.780098][ T7681] netlink: 16054 bytes leftover after parsing attributes in process `syz.3.639'. [ 266.833208][ T5853] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 266.988913][ T5853] usb 2-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 267.001974][ T5853] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 267.002004][ T5853] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 267.002058][ T5853] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 267.005748][ T5853] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 267.005776][ T5853] usb 2-1: Product: syz [ 267.005793][ T5853] usb 2-1: Manufacturer: syz [ 267.005809][ T5853] usb 2-1: SerialNumber: syz [ 267.060941][ T5313] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 267.231322][ T7674] netlink: 116 bytes leftover after parsing attributes in process `syz.0.637'. [ 267.978782][ T5853] uvcvideo 2-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 267.978818][ T5853] uvcvideo 2-1:1.0: No valid video chain found. [ 268.006988][ T5313] usb 4-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 268.008719][ T5313] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 268.008745][ T5313] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 268.008795][ T5313] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 268.077951][ T5313] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 268.077981][ T5313] usb 4-1: Product: syz [ 268.077997][ T5313] usb 4-1: Manufacturer: syz [ 268.078012][ T5313] usb 4-1: SerialNumber: syz [ 268.179366][ T5313] uvcvideo 4-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 268.179403][ T5313] uvcvideo 4-1:1.0: No valid video chain found. [ 268.233850][ T5853] usb 2-1: USB disconnect, device number 11 [ 268.617138][ T7690] hub 8-0:1.0: USB hub found [ 268.619856][ T7690] hub 8-0:1.0: 1 port detected [ 269.214562][ T5598] usb 4-1: USB disconnect, device number 13 [ 269.595097][ T7700] netlink: ct family unspecified [ 269.595130][ T7700] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 269.618349][ T7702] netlink: 12 bytes leftover after parsing attributes in process `syz.0.646'. [ 269.835574][ T7707] netlink: 8 bytes leftover after parsing attributes in process `syz.4.649'. [ 270.092962][ T7713] hub 8-0:1.0: USB hub found [ 270.095359][ T7713] hub 8-0:1.0: 1 port detected [ 271.214062][ T7730] hub 8-0:1.0: USB hub found [ 271.233657][ T7730] hub 8-0:1.0: 1 port detected [ 272.247242][ T7736] tmpfs: Unknown parameter 'grpquota_block_hardli`it' [ 272.353465][ T7738] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.657'. [ 272.423322][ T7740] netlink: ct family unspecified [ 272.423355][ T7740] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 272.450956][ T5706] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 272.611702][ T5706] usb 5-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 272.619020][ T5706] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.619057][ T5706] usb 5-1: Product: syz [ 272.619073][ T5706] usb 5-1: Manufacturer: syz [ 272.619088][ T5706] usb 5-1: SerialNumber: syz [ 272.660969][ T5853] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 272.812895][ T5853] usb 2-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 272.814475][ T5853] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 272.814509][ T5853] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 272.814560][ T5853] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 272.862468][ T5853] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.862507][ T5853] usb 2-1: Product: syz [ 272.862524][ T5853] usb 2-1: Manufacturer: syz [ 272.862540][ T5853] usb 2-1: SerialNumber: syz [ 272.956128][ T5706] usb 5-1: selecting invalid altsetting 1 [ 272.956154][ T5706] speedtch 5-1:1.0: speedtch_bind: setting interface to 1 failed (-22)! [ 272.956226][ T5706] speedtch 5-1:1.0: usbatm_usb_probe: bind failed: -22! [ 272.956274][ T5706] speedtch 5-1:1.0: probe with driver speedtch failed with error -22 [ 272.994255][ T5853] uvcvideo 2-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 272.994288][ T5853] uvcvideo 2-1:1.0: No valid video chain found. [ 273.044239][ T5706] usb 5-1: selecting invalid altsetting 1 [ 273.044264][ T5706] speedtch 5-1:1.1: speedtch_bind: setting interface to 1 failed (-22)! [ 273.046893][ T5706] speedtch 5-1:1.1: usbatm_usb_probe: bind failed: -22! [ 273.046963][ T5706] speedtch 5-1:1.1: probe with driver speedtch failed with error -22 [ 273.085493][ T5706] usb 5-1: USB disconnect, device number 10 [ 273.313486][ T7756] hub 8-0:1.0: USB hub found [ 273.315772][ T7756] hub 8-0:1.0: 1 port detected [ 274.134224][ T5853] usb 2-1: USB disconnect, device number 12 [ 274.871081][ T5853] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 274.934567][ T7773] FAULT_INJECTION: forcing a failure. [ 274.934567][ T7773] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 274.934604][ T7773] CPU: 1 UID: 0 PID: 7773 Comm: syz.3.669 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 274.934629][ T7773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 274.934642][ T7773] Call Trace: [ 274.934650][ T7773] [ 274.934660][ T7773] dump_stack_lvl+0xe8/0x150 [ 274.934699][ T7773] should_fail_ex+0x467/0x600 [ 274.934736][ T7773] _copy_from_user+0x2d/0xb0 [ 274.934762][ T7773] ___sys_sendmsg+0x1c6/0x360 [ 274.934789][ T7773] ? __lock_acquire+0x683/0x2ce0 [ 274.934816][ T7773] ? __pfx____sys_sendmsg+0x10/0x10 [ 274.934881][ T7773] ? __fget_files+0x2a/0x420 [ 274.934902][ T7773] ? __fget_files+0x3a8/0x420 [ 274.934935][ T7773] __x64_sys_sendmsg+0x1b7/0x290 [ 274.934968][ T7773] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 274.935015][ T7773] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.935041][ T7773] do_syscall_64+0x174/0x580 [ 274.935072][ T7773] ? trace_irq_disable+0x3b/0x140 [ 274.935107][ T7773] ? clear_bhb_loop+0x70/0xc0 [ 274.935135][ T7773] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.935158][ T7773] RIP: 0033:0x7f51c3d9e0d9 [ 274.935179][ T7773] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 274.935198][ T7773] RSP: 002b:00007f51c1ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 274.935221][ T7773] RAX: ffffffffffffffda RBX: 00007f51c4025fa0 RCX: 00007f51c3d9e0d9 [ 274.935238][ T7773] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000004 [ 274.935252][ T7773] RBP: 00007f51c1ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 274.935265][ T7773] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 274.935290][ T7773] R13: 00007f51c4026038 R14: 00007f51c4025fa0 R15: 00007ffd95a08888 [ 274.935325][ T7773] [ 275.032168][ T5853] usb 5-1: Using ep0 maxpacket: 16 [ 275.038537][ T5853] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 275.042959][ T7774] tipc: Failed to obtain node identity [ 275.043085][ T7774] tipc: Enabling of bearer rejected, failed to enable media [ 275.053659][ T5853] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 275.053697][ T5853] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 275.207481][ T5853] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.207510][ T5853] usb 5-1: Product: syz [ 275.207526][ T5853] usb 5-1: Manufacturer: syz [ 275.207542][ T5853] usb 5-1: SerialNumber: syz [ 275.325067][ T5853] usb 5-1: config 0 descriptor?? [ 275.356650][ T5853] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 275.356690][ T5853] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 275.466230][ T7780] macvlan0: entered allmulticast mode [ 275.466258][ T7780] veth1_vlan: entered allmulticast mode [ 275.692419][ T7787] tipc: Failed to obtain node identity [ 275.692452][ T7787] tipc: Enabling of bearer rejected, failed to enable media [ 276.097367][ T7792] netlink: 116 bytes leftover after parsing attributes in process `syz.1.674'. [ 276.263017][ T7791] hub 8-0:1.0: USB hub found [ 276.269986][ T7791] hub 8-0:1.0: 1 port detected [ 276.859707][ T7797] hub 8-0:1.0: USB hub found [ 276.860103][ T7797] hub 8-0:1.0: 1 port detected [ 276.900390][ T7798] hub 8-0:1.0: USB hub found [ 276.901076][ T7798] hub 8-0:1.0: 1 port detected [ 277.151308][ T5853] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 277.151884][ T5853] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 277.152302][ T5853] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 277.152320][ T5853] em28xx 5-1:0.0: No AC97 audio processor [ 277.563071][ T37] audit: type=1326 audit(1786377366.738:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7800 comm="syz.0.678" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f299219e0d9 code=0x0 [ 277.871096][ T7810] tmpfs: Unknown parameter 'grpquota_block_hardli`it' [ 278.052360][ T7814] netlink: 116 bytes leftover after parsing attributes in process `syz.3.679'. [ 279.003781][ T5853] usb 5-1: USB disconnect, device number 11 [ 279.014829][ T5853] em28xx 5-1:0.0: Disconnecting em28xx [ 279.248017][ T5853] em28xx 5-1:0.0: Freeing device [ 279.446222][ T7829] trusted_key: encrypted_key: master key parameter '%bojBG%{w"' is invalid [ 279.665681][ T7833] netlink: 116 bytes leftover after parsing attributes in process `syz.1.685'. [ 281.307762][ T7846] hub 8-0:1.0: USB hub found [ 281.313748][ T7846] hub 8-0:1.0: 1 port detected [ 283.243916][ T7848] hub 8-0:1.0: USB hub found [ 283.350891][ T7848] hub 8-0:1.0: 1 port detected [ 285.352087][ T5853] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 285.480961][ T5853] usb 2-1: device descriptor read/64, error -71 [ 285.486999][ T37] audit: type=1326 audit(1786377374.738:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7869 comm="syz.4.696" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7faf94d3e0d9 code=0x0 [ 285.724620][ T5853] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 285.856258][ T5853] usb 2-1: device descriptor read/64, error -71 [ 285.897138][ T7881] input: syz1 as /devices/virtual/input/input15 [ 285.962241][ T5853] usb usb2-port1: attempt power cycle [ 286.183281][ T7885] hub 8-0:1.0: USB hub found [ 286.185967][ T7885] hub 8-0:1.0: 1 port detected [ 287.171674][ T5853] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 287.199184][ T5853] usb 2-1: device descriptor read/8, error -71 [ 287.445947][ T7895] netlink: 116 bytes leftover after parsing attributes in process `syz.0.703'. [ 287.527227][ T7895] hub 8-0:1.0: USB hub found [ 287.645852][ T7895] hub 8-0:1.0: 1 port detected [ 288.310927][ T5853] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 288.445807][ T5853] usb 2-1: device descriptor read/8, error -71 [ 288.562378][ T5853] usb usb2-port1: unable to enumerate USB device [ 288.910957][ T31] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 289.083855][ T31] usb 4-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 289.087513][ T31] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 289.087572][ T31] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x12, changing to 0x2 [ 289.087591][ T31] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 289.087608][ T31] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 289.087638][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 289.100999][ T5853] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 289.149104][ T31] usb 4-1: config 0 descriptor?? [ 289.262037][ T5853] usb 5-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 289.266289][ T5853] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.266321][ T5853] usb 5-1: Product: syz [ 289.266337][ T5853] usb 5-1: Manufacturer: syz [ 289.266360][ T5853] usb 5-1: SerialNumber: syz [ 289.388864][ T5706] usb 4-1: USB disconnect, device number 14 [ 289.559027][ T5853] usb 5-1: selecting invalid altsetting 1 [ 289.559054][ T5853] speedtch 5-1:1.0: speedtch_bind: setting interface to 1 failed (-22)! [ 289.559129][ T5853] speedtch 5-1:1.0: usbatm_usb_probe: bind failed: -22! [ 289.559193][ T5853] speedtch 5-1:1.0: probe with driver speedtch failed with error -22 [ 289.601238][ T5853] usb 5-1: selecting invalid altsetting 1 [ 289.601264][ T5853] speedtch 5-1:1.1: speedtch_bind: setting interface to 1 failed (-22)! [ 289.601931][ T5853] speedtch 5-1:1.1: usbatm_usb_probe: bind failed: -22! [ 289.601995][ T5853] speedtch 5-1:1.1: probe with driver speedtch failed with error -22 [ 289.606908][ T5853] usb 5-1: USB disconnect, device number 12 [ 290.071014][ T5768] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 290.221099][ T5768] usb 3-1: Using ep0 maxpacket: 32 [ 290.222107][ T5768] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 290.224285][ T5768] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 290.224319][ T5768] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 290.224348][ T5768] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 290.224373][ T5768] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 290.224402][ T5768] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 290.302295][ T5768] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 290.302325][ T5768] usb 3-1: Product: syz [ 290.302341][ T5768] usb 3-1: Manufacturer: syz [ 290.302357][ T5768] usb 3-1: SerialNumber: syz [ 290.347888][ T5768] usb 3-1: config 0 descriptor?? [ 290.790901][ T5768] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 290.790980][ T5768] input input16: Device does not respond to id packet M [ 290.791532][ T5768] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 290.791580][ T5768] input input16: Device does not respond to id packet P [ 290.793409][ T5768] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 290.793572][ T5768] input input16: Device does not respond to id packet B [ 290.815282][ T5768] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 290.815342][ T5768] input input16: Device does not respond to id packet N [ 290.831191][ T5768] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 290.852718][ T5768] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 290.867938][ T5768] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 290.876279][ T5768] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 290.927642][ T5768] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input16 [ 290.968268][ T7943] netlink: 116 bytes leftover after parsing attributes in process `syz.1.718'. [ 291.058286][ T5768] usb 3-1: USB disconnect, device number 17 [ 291.307504][ T7954] hub 8-0:1.0: USB hub found [ 291.307861][ T7954] hub 8-0:1.0: 1 port detected [ 291.902267][ T5768] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 291.979680][ T5768] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 292.013742][ T7967] netlink: 52 bytes leftover after parsing attributes in process `syz.0.726'. [ 292.137209][ T7955] ceph: No mds server is up or the cluster is laggy [ 292.242844][ T5768] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 292.390668][ T7974] hub 8-0:1.0: USB hub found [ 292.393394][ T7974] hub 8-0:1.0: 1 port detected [ 293.265915][ T9] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 293.495731][ T7979] input: syz1 as /devices/virtual/input/input17 [ 293.633240][ T7984] netlink: 16054 bytes leftover after parsing attributes in process `syz.3.732'. [ 293.710961][ T9] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 293.859224][ T7986] netlink: 44 bytes leftover after parsing attributes in process `syz.0.734'. [ 293.862607][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 293.880905][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 293.880965][ T9] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 293.880988][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 293.881033][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 293.929964][ T9] usb 3-1: config 0 descriptor?? [ 293.936074][ T5768] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 294.083549][ T5768] usb 4-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 294.088781][ T5768] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 294.088811][ T5768] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 294.088864][ T5768] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 294.143640][ T5768] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.143680][ T5768] usb 4-1: Product: syz [ 294.143697][ T5768] usb 4-1: Manufacturer: syz [ 294.143712][ T5768] usb 4-1: SerialNumber: syz [ 294.186141][ T5768] uvcvideo 4-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 294.186175][ T5768] uvcvideo 4-1:1.0: No valid video chain found. [ 294.234148][ T5717] usb 3-1: USB disconnect, device number 18 [ 294.370996][ T5706] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 294.392333][ T9] usb 4-1: USB disconnect, device number 15 [ 294.554051][ T5706] usb 2-1: Using ep0 maxpacket: 32 [ 294.555113][ T5706] usb 2-1: New USB device found, idVendor=06a3, idProduct=0cfa, bcdDevice= 0.00 [ 294.556923][ T5706] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 294.556970][ T5706] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 294.556999][ T5706] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 294.557045][ T5706] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 294.579627][ T5706] usb 2-1: config 0 descriptor?? [ 294.831944][ T7989] sg_write: data in/out 540636/136 bytes for SCSI command 0x9-- guessing data in; [ 294.831944][ T7989] program syz.1.733 not setting count and/or reply_len properly [ 294.888485][ T8006] hub 8-0:1.0: USB hub found [ 294.888821][ T8006] hub 8-0:1.0: 1 port detected [ 295.216503][ T8010] netlink: 52 bytes leftover after parsing attributes in process `syz.3.741'. [ 295.331697][ T5706] saitek 0003:06A3:0CFA.0001: item fetching failed at offset 3/6 [ 295.332744][ T5706] saitek 0003:06A3:0CFA.0001: parse failed [ 295.363146][ T5706] saitek 0003:06A3:0CFA.0001: probe with driver saitek failed with error -22 [ 295.490948][ T9] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 295.512671][ T5706] usb 2-1: USB disconnect, device number 17 [ 295.643336][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 295.646038][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 295.688144][ T9] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 295.688182][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 295.732480][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 295.732512][ T9] usb 3-1: Product: syz [ 295.732528][ T9] usb 3-1: Manufacturer: syz [ 295.732545][ T9] usb 3-1: SerialNumber: syz [ 295.769395][ T9] usb 3-1: config 0 descriptor?? [ 295.782322][ T9] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 295.782359][ T9] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 296.445140][ T9] em28xx 3-1:0.0: unknown em28xx chip ID (240) [ 296.646823][ T9] em28xx 3-1:0.0: Config register raw data: 0xaf [ 296.646849][ T9] em28xx 3-1:0.0: I2S Audio (3 sample rate(s)) [ 296.646866][ T9] em28xx 3-1:0.0: No AC97 audio processor [ 296.917575][ T9] usb 3-1: USB disconnect, device number 19 [ 297.526701][ T8042] netlink: 16054 bytes leftover after parsing attributes in process `syz.4.751'. [ 297.851921][ T5313] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 298.005245][ T5313] usb 5-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 298.009534][ T5313] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 298.009582][ T5313] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 298.009628][ T5313] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 298.013498][ T5717] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 298.039225][ T5313] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.039312][ T5313] usb 5-1: Product: syz [ 298.039348][ T5313] usb 5-1: Manufacturer: syz [ 298.039380][ T5313] usb 5-1: SerialNumber: syz [ 298.169493][ T5313] uvcvideo 5-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 298.169520][ T5313] uvcvideo 5-1:1.0: No valid video chain found. [ 298.211570][ T5717] usb 2-1: Using ep0 maxpacket: 32 [ 298.215490][ T5717] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 298.265572][ T5717] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 298.265610][ T5717] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 298.265638][ T5717] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 298.265662][ T5717] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 298.265691][ T5717] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 298.296820][ T5717] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.296850][ T5717] usb 2-1: Product: syz [ 298.296867][ T5717] usb 2-1: Manufacturer: syz [ 298.296882][ T5717] usb 2-1: SerialNumber: syz [ 298.353845][ T5717] usb 2-1: config 0 descriptor?? [ 298.391127][ T5313] usb 5-1: USB disconnect, device number 13 [ 298.499720][ T8056] FAULT_INJECTION: forcing a failure. [ 298.499720][ T8056] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 298.499757][ T8056] CPU: 0 UID: 0 PID: 8056 Comm: syz.0.757 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 298.499792][ T8056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 298.499806][ T8056] Call Trace: [ 298.499815][ T8056] [ 298.499825][ T8056] dump_stack_lvl+0xe8/0x150 [ 298.499863][ T8056] should_fail_ex+0x467/0x600 [ 298.499901][ T8056] _copy_to_user+0x31/0xb0 [ 298.499928][ T8056] simple_read_from_buffer+0xe1/0x170 [ 298.499959][ T8056] proc_fail_nth_read+0x1be/0x230 [ 298.499986][ T8056] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 298.500019][ T8056] ? rw_verify_area+0x250/0x4d0 [ 298.500052][ T8056] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 298.500075][ T8056] vfs_read+0x219/0xa90 [ 298.500110][ T8056] ? __pfx_vfs_read+0x10/0x10 [ 298.500140][ T8056] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 298.500173][ T8056] ? lockdep_hardirqs_on+0x7a/0x110 [ 298.500203][ T8056] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 298.500236][ T8056] ? mutex_lock_nested+0x152/0x1d0 [ 298.500258][ T8056] ? fdget_pos+0x252/0x320 [ 298.500290][ T8056] ksys_read+0x156/0x270 [ 298.500320][ T8056] ? __pfx_ksys_read+0x10/0x10 [ 298.500355][ T8056] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.500381][ T8056] do_syscall_64+0x174/0x580 [ 298.500411][ T8056] ? trace_irq_disable+0x3b/0x140 [ 298.500446][ T8056] ? clear_bhb_loop+0x70/0xc0 [ 298.500477][ T8056] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 298.500499][ T8056] RIP: 0033:0x7f299215e90e [ 298.500520][ T8056] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 298.500540][ T8056] RSP: 002b:00007f29903f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 298.500564][ T8056] RAX: ffffffffffffffda RBX: 00007f29903f66c0 RCX: 00007f299215e90e [ 298.500581][ T8056] RDX: 000000000000000f RSI: 00007f29903f60a0 RDI: 0000000000000003 [ 298.500595][ T8056] RBP: 00007f29903f6090 R08: 0000000000000000 R09: 0000000000000000 [ 298.500608][ T8056] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 298.500621][ T8056] R13: 00007f2992426038 R14: 00007f2992425fa0 R15: 00007fff71078408 [ 298.500657][ T8056] [ 298.845794][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.849369][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.864615][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.866558][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.868544][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.869008][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.869464][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.869911][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.870372][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.917235][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.917747][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.918197][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.918638][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.919113][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.952868][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.954434][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.954916][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.955367][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.958513][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.959262][ T5717] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 298.959298][ T5717] input input18: Timeout waiting for response from device. [ 299.081784][ T5717] usb 2-1: USB disconnect, device number 18 [ 299.461018][ T5706] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 299.610913][ T5706] usb 5-1: Using ep0 maxpacket: 16 [ 299.611830][ T5706] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 299.617498][ T5706] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 299.617534][ T5706] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 299.666661][ T5706] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 299.666692][ T5706] usb 5-1: Product: syz [ 299.666707][ T5706] usb 5-1: Manufacturer: syz [ 299.666724][ T5706] usb 5-1: SerialNumber: syz [ 299.697520][ T5706] usb 5-1: config 0 descriptor?? [ 299.708557][ T5706] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 299.708595][ T5706] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 300.255703][ T37] audit: type=1326 audit(1786377389.498:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8077 comm="syz.2.766" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6d54cde0d9 code=0x0 [ 300.426451][ T8084] hub 8-0:1.0: USB hub found [ 300.428398][ T8084] hub 8-0:1.0: 1 port detected [ 301.313336][ T5706] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 301.313821][ T5706] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 301.314267][ T5706] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 301.314286][ T5706] em28xx 5-1:0.0: No AC97 audio processor [ 302.316954][ T8101] tmpfs: Unknown parameter 'grpquota_block_hardli`it' [ 302.371105][ T1692] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 302.446808][ T5706] usb 5-1: USB disconnect, device number 14 [ 302.454843][ T5706] em28xx 5-1:0.0: Disconnecting em28xx [ 302.530892][ T1692] usb 2-1: Using ep0 maxpacket: 32 [ 302.531865][ T1692] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 302.540287][ T1692] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 302.540324][ T1692] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 302.540353][ T1692] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 302.540378][ T1692] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 302.540406][ T1692] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 302.611981][ T1692] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 302.612037][ T1692] usb 2-1: Product: syz [ 302.612053][ T1692] usb 2-1: Manufacturer: syz [ 302.612068][ T1692] usb 2-1: SerialNumber: syz [ 302.714618][ T5706] em28xx 5-1:0.0: Freeing device [ 302.785480][ T1692] usb 2-1: config 0 descriptor?? [ 303.012568][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.013085][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.013559][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.014579][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.016268][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.019922][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.060454][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.067111][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.067802][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.072508][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.091051][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.092921][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.093403][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.093873][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.094334][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.099762][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.102442][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.103838][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.104973][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.108872][ T1692] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 303.108985][ T1692] input input19: Timeout waiting for response from device. [ 303.190542][ T8111] hub 8-0:1.0: USB hub found [ 303.191091][ T8111] hub 8-0:1.0: 1 port detected [ 303.252602][ T1692] usb 2-1: USB disconnect, device number 19 [ 303.400173][ T8114] netlink: 52 bytes leftover after parsing attributes in process `syz.3.779'. [ 303.480900][ T5768] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 303.504476][ T8116] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 303.663222][ T5768] usb 5-1: Using ep0 maxpacket: 16 [ 303.666330][ T5768] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 303.668918][ T5768] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 303.668953][ T5768] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 303.711013][ T5768] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 303.711042][ T5768] usb 5-1: Product: syz [ 303.711058][ T5768] usb 5-1: Manufacturer: syz [ 303.711074][ T5768] usb 5-1: SerialNumber: syz [ 303.766323][ T5768] usb 5-1: config 0 descriptor?? [ 303.784294][ T5768] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 303.784331][ T5768] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 304.428899][ T5768] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 304.430328][ T5768] em28xx 5-1:0.0: Config register raw data: 0xaf [ 304.430353][ T5768] em28xx 5-1:0.0: I2S Audio (1 sample rate(s)) [ 304.430369][ T5768] em28xx 5-1:0.0: No AC97 audio processor [ 304.644582][ T8130] FAULT_INJECTION: forcing a failure. [ 304.644582][ T8130] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 304.644613][ T8130] CPU: 1 UID: 0 PID: 8130 Comm: syz.0.785 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 304.644634][ T8130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 304.644660][ T8130] Call Trace: [ 304.644667][ T8130] [ 304.644675][ T8130] dump_stack_lvl+0xe8/0x150 [ 304.644707][ T8130] should_fail_ex+0x467/0x600 [ 304.644738][ T8130] _copy_from_iter+0x1d3/0x1660 [ 304.644780][ T8130] ? txopt_get+0x79/0x3f0 [ 304.644806][ T8130] ? txopt_get+0x79/0x3f0 [ 304.644830][ T8130] ? txopt_get+0x79/0x3f0 [ 304.644857][ T8130] ? __pfx__copy_from_iter+0x10/0x10 [ 304.644882][ T8130] ? txopt_get+0x343/0x3f0 [ 304.644909][ T8130] ? __pfx_txopt_get+0x10/0x10 [ 304.644932][ T8130] ? is_bpf_text_address+0x26/0x2b0 [ 304.644960][ T8130] rawv6_sendmsg+0xb88/0x18c0 [ 304.645000][ T8130] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 304.645030][ T8130] ? smack_socket_sendmsg+0x1a9/0x590 [ 304.645053][ T8130] ? __pfx_smack_socket_sendmsg+0x10/0x10 [ 304.645086][ T8130] ? sock_rps_record_flow+0x19/0x350 [ 304.645108][ T8130] ? inet_sendmsg+0x298/0x320 [ 304.645125][ T8130] ? get_pid_task+0x20/0x1f0 [ 304.645153][ T8130] ? __pfx_inet_sendmsg+0x10/0x10 [ 304.645171][ T8130] sock_sendmsg_nosec+0x10e/0x180 [ 304.645204][ T8130] sock_write_iter+0x2e4/0x3f0 [ 304.645230][ T8130] ? __pfx_sock_write_iter+0x10/0x10 [ 304.645263][ T8130] ? bpf_lsm_file_permission+0x9/0x20 [ 304.645290][ T8130] ? security_file_permission+0x75/0x260 [ 304.645314][ T8130] vfs_write+0x61e/0xbb0 [ 304.645343][ T8130] ? __pfx_vfs_write+0x10/0x10 [ 304.645376][ T8130] ? __fget_files+0x2a/0x420 [ 304.645402][ T8130] ksys_write+0x156/0x270 [ 304.645425][ T8130] ? __pfx_ksys_write+0x10/0x10 [ 304.645452][ T8130] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 304.645472][ T8130] do_syscall_64+0x174/0x580 [ 304.645500][ T8130] ? trace_irq_disable+0x3b/0x140 [ 304.645529][ T8130] ? clear_bhb_loop+0x70/0xc0 [ 304.645551][ T8130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 304.645569][ T8130] RIP: 0033:0x7f299219e0d9 [ 304.645587][ T8130] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 304.645602][ T8130] RSP: 002b:00007f29903f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 304.645625][ T8130] RAX: ffffffffffffffda RBX: 00007f2992425fa0 RCX: 00007f299219e0d9 [ 304.645638][ T8130] RDX: 00000000000005ac RSI: 00002000000000c0 RDI: 0000000000000003 [ 304.645649][ T8130] RBP: 00007f29903f6090 R08: 0000000000000000 R09: 0000000000000000 [ 304.645659][ T8130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 304.645669][ T8130] R13: 00007f2992426038 R14: 00007f2992425fa0 R15: 00007fff71078408 [ 304.645695][ T8130] [ 304.829606][ T5768] usb 5-1: USB disconnect, device number 15 [ 305.299109][ T8139] netlink: 4 bytes leftover after parsing attributes in process `syz.0.789'. [ 305.702443][ T5768] usb 2-1: new full-speed USB device number 20 using dummy_hcd [ 305.857985][ T5768] usb 2-1: not running at top speed; connect to a high speed hub [ 305.858032][ T5768] usb 2-1: New USB device found, idVendor=12d1, idProduct=4b3b, bcdDevice=e7.d6 [ 305.878278][ T5768] usb 2-1: config 6 has an invalid interface number: 11 but max is 0 [ 305.878308][ T5768] usb 2-1: config 6 has an invalid interface number: 205 but max is 0 [ 305.878331][ T5768] usb 2-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 305.878354][ T5768] usb 2-1: config 6 has no interface number 0 [ 305.878371][ T5768] usb 2-1: config 6 has no interface number 1 [ 305.878457][ T5768] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 305.878487][ T5768] usb 2-1: config 6 interface 11 altsetting 8 has an endpoint descriptor with address 0x76, changing to 0x6 [ 305.878515][ T5768] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x6 has invalid maxpacket 59513, setting to 64 [ 305.878544][ T5768] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 305.878573][ T5768] usb 2-1: too many endpoints for config 6 interface 205 altsetting 46: 113, using maximum allowed: 30 [ 305.878626][ T5768] usb 2-1: config 6 interface 205 altsetting 46 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 305.878655][ T5768] usb 2-1: config 6 interface 205 altsetting 46 has 1 endpoint descriptor, different from the interface descriptor's value: 113 [ 305.878685][ T5768] usb 2-1: config 6 interface 11 has no altsetting 0 [ 305.878704][ T5768] usb 2-1: config 6 interface 205 has no altsetting 0 [ 306.082879][ T5768] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.082913][ T5768] usb 2-1: Product: 梅⟸衆甁ꥸ⯒॔䄠贈넃쫬㏵ᢟ䄻ᳪ萯둮뛙䗏럵안띸顙沰ꊬ荽ꅗ橀㛩緺ऩꊡ罤台颱鐜3쉗⸆ⁿ넿ᗉ뾵᪖㐅쟼劘驹鎉拕샄路✳쳿帒ﵑⓖ剋嘢頗裚㯗규૥㵃࠵楂ᎆ舄췌괼㛇읲钁Ꟑ켃搡亽꾕퍩䞇㧔᪾돐㨢믈쵮䡃備鑌퀠⍫ঽ⟤珐뻗௯㿍꫶ﲭ鐙忤Ɥ뙎 [ 306.082951][ T5768] usb 2-1: Manufacturer:   [ 306.082967][ T5768] usb 2-1: SerialNumber: 瞡檢ᙵꟋ䍰갴蛹遰ꍹт現ଽ褠韊璪돟譵䨟鞉ୁ秫ܷ먍왤쾊愎䮑楛耠ඩ̻ိ磻淎ꏾ쟼⢦ꦩ쪲蹣䠟閂 [ 306.178088][ T8142] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 306.178373][ T8142] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 306.439028][ T5768] option 2-1:6.11: GSM modem (1-port) converter detected [ 306.496715][ T8156] netlink: 116 bytes leftover after parsing attributes in process `syz.2.794'. [ 306.513723][ T5768] usb 2-1: USB disconnect, device number 20 [ 306.729868][ T5768] option 2-1:6.11: device disconnected [ 306.770927][ T5717] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 306.938346][ T5717] usb 4-1: not running at top speed; connect to a high speed hub [ 306.938392][ T5717] usb 4-1: New USB device found, idVendor=12d1, idProduct=4b3b, bcdDevice=e7.d6 [ 306.968808][ T5717] usb 4-1: config 6 has an invalid interface number: 11 but max is 0 [ 306.968845][ T5717] usb 4-1: config 6 has an invalid interface number: 205 but max is 0 [ 306.968868][ T5717] usb 4-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 306.968891][ T5717] usb 4-1: config 6 has no interface number 0 [ 306.968908][ T5717] usb 4-1: config 6 has no interface number 1 [ 306.968973][ T5717] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 306.969021][ T5717] usb 4-1: config 6 interface 11 altsetting 8 has an endpoint descriptor with address 0x76, changing to 0x6 [ 306.969049][ T5717] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x6 has invalid maxpacket 59513, setting to 64 [ 306.969078][ T5717] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 306.969107][ T5717] usb 4-1: too many endpoints for config 6 interface 205 altsetting 46: 113, using maximum allowed: 30 [ 306.969249][ T5717] usb 4-1: config 6 interface 205 altsetting 46 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 306.969278][ T5717] usb 4-1: config 6 interface 205 altsetting 46 has 1 endpoint descriptor, different from the interface descriptor's value: 113 [ 306.969308][ T5717] usb 4-1: config 6 interface 11 has no altsetting 0 [ 306.969327][ T5717] usb 4-1: config 6 interface 205 has no altsetting 0 [ 307.127942][ T5717] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.127972][ T5717] usb 4-1: Product: 梅⟸衆甁ꥸ⯒॔䄠贈넃쫬㏵ᢟ䄻ᳪ萯둮뛙䗏럵안띸顙沰ꊬ荽ꅗ橀㛩緺ऩꊡ罤台颱鐜3쉗⸆ⁿ넿ᗉ뾵᪖㐅쟼劘驹鎉拕샄路✳쳿帒ﵑⓖ剋嘢頗裚㯗규૥㵃࠵楂ᎆ舄췌괼㛇읲钁Ꟑ켃搡亽꾕퍩䞇㧔᪾돐㨢믈쵮䡃備鑌퀠⍫ঽ⟤珐뻗௯㿍꫶ﲭ鐙忤Ɥ뙎 [ 307.128010][ T5717] usb 4-1: Manufacturer:   [ 307.128026][ T5717] usb 4-1: SerialNumber: 瞡檢ᙵꟋ䍰갴蛹遰ꍹт現ଽ褠韊璪돟譵䨟鞉ୁ秫ܷ먍왤쾊愎䮑楛耠ඩ̻ိ磻淎ꏾ쟼⢦ꦩ쪲蹣䠟閂 [ 307.211164][ T8154] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 307.211368][ T8154] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 307.559245][ T5717] option 4-1:6.11: GSM modem (1-port) converter detected [ 307.587321][ T8167] FAULT_INJECTION: forcing a failure. [ 307.587321][ T8167] name failslab, interval 1, probability 0, space 0, times 0 [ 307.587359][ T8167] CPU: 0 UID: 0 PID: 8167 Comm: syz.2.798 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 307.587385][ T8167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 307.587399][ T8167] Call Trace: [ 307.587408][ T8167] [ 307.587417][ T8167] dump_stack_lvl+0xe8/0x150 [ 307.587456][ T8167] should_fail_ex+0x467/0x600 [ 307.587494][ T8167] should_failslab+0xa8/0x100 [ 307.587522][ T8167] __kmalloc_noprof+0xfe/0x780 [ 307.587543][ T8167] ? rcu_is_watching+0x15/0xb0 [ 307.587569][ T8167] ? tomoyo_realpath_from_path+0xef/0x640 [ 307.587597][ T8167] ? tomoyo_realpath_from_path+0xef/0x640 [ 307.587633][ T8167] tomoyo_realpath_from_path+0xef/0x640 [ 307.587674][ T8167] ? tomoyo_path_number_perm+0x219/0x5f0 [ 307.587712][ T8167] tomoyo_path_number_perm+0x246/0x5f0 [ 307.587754][ T8167] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 307.587790][ T8167] ? __lock_acquire+0x683/0x2ce0 [ 307.587828][ T8167] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 307.587860][ T8167] ? hook_file_ioctl+0x1f3/0x600 [ 307.587891][ T8167] ? lockdep_hardirqs_on+0x7a/0x110 [ 307.587942][ T8167] ? __fget_files+0x2a/0x420 [ 307.587966][ T8167] ? __fget_files+0x2a/0x420 [ 307.587986][ T8167] ? __fget_files+0x3a8/0x420 [ 307.588006][ T8167] ? __fget_files+0x2a/0x420 [ 307.588032][ T8167] security_file_ioctl+0xc3/0x2a0 [ 307.588058][ T8167] __se_sys_ioctl+0x47/0x170 [ 307.588097][ T8167] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.588123][ T8167] do_syscall_64+0x174/0x580 [ 307.588155][ T8167] ? trace_irq_disable+0x3b/0x140 [ 307.588191][ T8167] ? clear_bhb_loop+0x70/0xc0 [ 307.588220][ T8167] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.588242][ T8167] RIP: 0033:0x7f6d54cde0d9 [ 307.588263][ T8167] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 307.588283][ T8167] RSP: 002b:00007f6d52f15028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 307.588307][ T8167] RAX: ffffffffffffffda RBX: 00007f6d54f66090 RCX: 00007f6d54cde0d9 [ 307.588324][ T8167] RDX: 0000000000000000 RSI: 0000000000001276 RDI: 0000000000000003 [ 307.588337][ T8167] RBP: 00007f6d52f15090 R08: 0000000000000000 R09: 0000000000000000 [ 307.588350][ T8167] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 307.588363][ T8167] R13: 00007f6d54f66128 R14: 00007f6d54f66090 R15: 00007ffd12254f78 [ 307.588396][ T8167] [ 307.588405][ T8167] ERROR: Out of memory at tomoyo_realpath_from_path. [ 308.059560][ T5717] usb 4-1: USB disconnect, device number 16 [ 308.215100][ T5717] option 4-1:6.11: device disconnected [ 308.838937][ T8188] hub 8-0:1.0: USB hub found [ 308.842367][ T8188] hub 8-0:1.0: 1 port detected [ 309.966191][ T8195] netlink: 116 bytes leftover after parsing attributes in process `syz.0.808'. [ 310.715520][ T8216] input: syz1 as /devices/virtual/input/input21 [ 314.003263][ T8296] device-mapper: ioctl: Invalid new mapped device name or uuid string supplied. [ 314.279934][ T8301] netlink: 32 bytes leftover after parsing attributes in process `syz.1.853'. [ 316.719299][ T8341] tipc: Failed to obtain node identity [ 316.719331][ T8341] tipc: Enabling of bearer rejected, failed to enable media [ 317.700313][ T1328] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.700386][ T1328] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.729293][ T8356] netlink: 116 bytes leftover after parsing attributes in process `syz.3.871'. [ 318.016096][ T8362] FAULT_INJECTION: forcing a failure. [ 318.016096][ T8362] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 318.016134][ T8362] CPU: 0 UID: 0 PID: 8362 Comm: syz.4.875 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 318.016160][ T8362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 318.016174][ T8362] Call Trace: [ 318.016183][ T8362] [ 318.016193][ T8362] dump_stack_lvl+0xe8/0x150 [ 318.016236][ T8362] should_fail_ex+0x467/0x600 [ 318.016275][ T8362] _copy_to_user+0x31/0xb0 [ 318.016303][ T8362] simple_read_from_buffer+0xe1/0x170 [ 318.016332][ T8362] proc_fail_nth_read+0x1be/0x230 [ 318.016361][ T8362] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 318.016390][ T8362] ? rw_verify_area+0x250/0x4d0 [ 318.016419][ T8362] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 318.016443][ T8362] vfs_read+0x219/0xa90 [ 318.016477][ T8362] ? __pfx_vfs_read+0x10/0x10 [ 318.016504][ T8362] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 318.016546][ T8362] ? lockdep_hardirqs_on+0x7a/0x110 [ 318.016579][ T8362] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 318.016613][ T8362] ? mutex_lock_nested+0x152/0x1d0 [ 318.016636][ T8362] ? fdget_pos+0x252/0x320 [ 318.016668][ T8362] ksys_read+0x156/0x270 [ 318.016697][ T8362] ? __pfx_ksys_read+0x10/0x10 [ 318.016732][ T8362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.016758][ T8362] do_syscall_64+0x174/0x580 [ 318.016789][ T8362] ? trace_irq_disable+0x3b/0x140 [ 318.016826][ T8362] ? clear_bhb_loop+0x70/0xc0 [ 318.016854][ T8362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.016878][ T8362] RIP: 0033:0x7faf94cfe90e [ 318.016899][ T8362] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 318.016918][ T8362] RSP: 002b:00007faf92f53fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 318.016942][ T8362] RAX: ffffffffffffffda RBX: 00007faf92f546c0 RCX: 00007faf94cfe90e [ 318.016958][ T8362] RDX: 000000000000000f RSI: 00007faf92f540a0 RDI: 0000000000000006 [ 318.016972][ T8362] RBP: 00007faf92f54090 R08: 0000000000000000 R09: 0000000000000000 [ 318.016986][ T8362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 318.016999][ T8362] R13: 00007faf94fc6218 R14: 00007faf94fc6180 R15: 00007ffc88876dc8 [ 318.017034][ T8362] [ 318.760588][ T8377] FAULT_INJECTION: forcing a failure. [ 318.760588][ T8377] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 318.760627][ T8377] CPU: 0 UID: 0 PID: 8377 Comm: syz.1.881 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 318.760652][ T8377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 318.760665][ T8377] Call Trace: [ 318.760674][ T8377] [ 318.760683][ T8377] dump_stack_lvl+0xe8/0x150 [ 318.760722][ T8377] should_fail_ex+0x467/0x600 [ 318.760763][ T8377] _copy_from_user+0x2d/0xb0 [ 318.760790][ T8377] ___sys_sendmsg+0x1c6/0x360 [ 318.760817][ T8377] ? __lock_acquire+0x683/0x2ce0 [ 318.760844][ T8377] ? __pfx____sys_sendmsg+0x10/0x10 [ 318.760910][ T8377] ? __fget_files+0x2a/0x420 [ 318.760931][ T8377] ? __fget_files+0x3a8/0x420 [ 318.760964][ T8377] __x64_sys_sendmsg+0x1b7/0x290 [ 318.760996][ T8377] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 318.761043][ T8377] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.761068][ T8377] do_syscall_64+0x174/0x580 [ 318.761101][ T8377] ? trace_irq_disable+0x3b/0x140 [ 318.761135][ T8377] ? clear_bhb_loop+0x70/0xc0 [ 318.761163][ T8377] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.761186][ T8377] RIP: 0033:0x7fe643ebe0d9 [ 318.761206][ T8377] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 318.761226][ T8377] RSP: 002b:00007fe642116028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 318.761250][ T8377] RAX: ffffffffffffffda RBX: 00007fe644145fa0 RCX: 00007fe643ebe0d9 [ 318.761267][ T8377] RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000000000000004 [ 318.761281][ T8377] RBP: 00007fe642116090 R08: 0000000000000000 R09: 0000000000000000 [ 318.761294][ T8377] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 318.761306][ T8377] R13: 00007fe644146038 R14: 00007fe644145fa0 R15: 00007ffdc3059d98 [ 318.761341][ T8377] [ 318.791219][ T5313] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 318.980956][ T5313] usb 4-1: Using ep0 maxpacket: 16 [ 319.023151][ T5313] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 319.029409][ T5313] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 319.029455][ T5313] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 319.086085][ T5313] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 319.086121][ T5313] usb 4-1: Product: syz [ 319.086139][ T5313] usb 4-1: Manufacturer: syz [ 319.086156][ T5313] usb 4-1: SerialNumber: syz [ 319.119116][ T5313] usb 4-1: config 0 descriptor?? [ 319.148348][ T5313] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 319.148386][ T5313] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 319.827725][ T5313] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 319.830989][ T5313] em28xx 4-1:0.0: Config register raw data: 0xaf [ 319.831015][ T5313] em28xx 4-1:0.0: I2S Audio (1 sample rate(s)) [ 319.831033][ T5313] em28xx 4-1:0.0: No AC97 audio processor [ 320.039209][ T5313] usb 4-1: USB disconnect, device number 17 [ 321.384941][ T8425] netlink: 116 bytes leftover after parsing attributes in process `syz.3.902'. [ 321.392342][ T8425] hub 8-0:1.0: USB hub found [ 321.392773][ T8425] hub 8-0:1.0: 1 port detected [ 321.465117][ T8427] tipc: Failed to obtain node identity [ 321.465166][ T8427] tipc: Enabling of bearer rejected, failed to enable media [ 321.980984][ T5313] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 322.181921][ T5313] usb 5-1: device descriptor read/64, error -71 [ 322.264213][ T8443] IPVS: sync thread started: state = BACKUP, mcast_ifn = vxcan1, syncid = 0, id = 0 [ 322.421069][ T5313] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 322.562355][ T5313] usb 5-1: device descriptor read/64, error -71 [ 322.600924][ T1692] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 322.672632][ T5313] usb usb5-port1: attempt power cycle [ 322.778466][ T1692] usb 2-1: Using ep0 maxpacket: 16 [ 322.793425][ T1692] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 322.842187][ T1692] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 322.842226][ T1692] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 322.949358][ T1692] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.949389][ T1692] usb 2-1: Product: syz [ 322.949404][ T1692] usb 2-1: Manufacturer: syz [ 322.949421][ T1692] usb 2-1: SerialNumber: syz [ 323.009707][ T1692] usb 2-1: config 0 descriptor?? [ 323.040909][ T5313] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 323.061690][ T5313] usb 5-1: device descriptor read/8, error -71 [ 323.196308][ T1692] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 323.196348][ T1692] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 323.371220][ T5313] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 323.431743][ T5313] usb 5-1: device descriptor read/8, error -71 [ 323.544223][ T5313] usb usb5-port1: unable to enumerate USB device [ 323.669541][ T1692] em28xx 2-1:0.0: unknown em28xx chip ID (240) [ 323.877862][ T1692] em28xx 2-1:0.0: Config register raw data: 0xaf [ 323.877886][ T1692] em28xx 2-1:0.0: I2S Audio (3 sample rate(s)) [ 323.877900][ T1692] em28xx 2-1:0.0: No AC97 audio processor [ 324.100942][ T5853] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 324.131938][ T1692] usb 2-1: USB disconnect, device number 21 [ 324.280948][ T5853] usb 3-1: Using ep0 maxpacket: 16 [ 324.304179][ T5853] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 324.335325][ T5853] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 324.335363][ T5853] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 324.377221][ T5853] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.377251][ T5853] usb 3-1: Product: syz [ 324.377267][ T5853] usb 3-1: Manufacturer: syz [ 324.377282][ T5853] usb 3-1: SerialNumber: syz [ 324.413300][ T5853] usb 3-1: config 0 descriptor?? [ 324.445305][ T5853] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 324.445340][ T5853] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 325.070857][ T5853] em28xx 3-1:0.0: unknown em28xx chip ID (240) [ 325.279136][ T5853] em28xx 3-1:0.0: Config register raw data: 0xaf [ 325.279165][ T5853] em28xx 3-1:0.0: I2S Audio (3 sample rate(s)) [ 325.279182][ T5853] em28xx 3-1:0.0: No AC97 audio processor [ 325.571179][ T5853] usb 3-1: USB disconnect, device number 20 [ 325.939321][ T37] audit: type=1326 audit(1786377415.188:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8480 comm="syz.0.922" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f299219e0d9 code=0x0 [ 326.667893][ T8503] netlink: 116 bytes leftover after parsing attributes in process `syz.1.929'. [ 327.250932][ T5853] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 327.402289][ T5853] usb 4-1: Using ep0 maxpacket: 32 [ 327.404649][ T5853] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 327.432823][ T5853] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 327.439563][ T5853] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.439592][ T5853] usb 4-1: Product: syz [ 327.439608][ T5853] usb 4-1: Manufacturer: syz [ 327.439624][ T5853] usb 4-1: SerialNumber: syz [ 327.536540][ T5853] usb 4-1: config 0 descriptor?? [ 327.564730][ T5853] gs_usb 4-1:0.0: Required endpoints not found [ 327.902084][ T9] usb 4-1: USB disconnect, device number 18 [ 328.242501][ T8535] netlink: 116 bytes leftover after parsing attributes in process `syz.0.941'. [ 328.345550][ T8536] FAULT_INJECTION: forcing a failure. [ 328.345550][ T8536] name failslab, interval 1, probability 0, space 0, times 0 [ 328.345588][ T8536] CPU: 1 UID: 0 PID: 8536 Comm: syz.2.943 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 328.345627][ T8536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 328.345641][ T8536] Call Trace: [ 328.345649][ T8536] [ 328.345659][ T8536] dump_stack_lvl+0xe8/0x150 [ 328.345698][ T8536] should_fail_ex+0x467/0x600 [ 328.345738][ T8536] should_failslab+0xa8/0x100 [ 328.345765][ T8536] kmem_cache_alloc_noprof+0xa4/0x650 [ 328.345803][ T8536] ? vm_area_dup+0x28/0x670 [ 328.345827][ T8536] ? vm_area_dup+0x28/0x670 [ 328.345859][ T8536] vm_area_dup+0x28/0x670 [ 328.345881][ T8536] ? __split_vma+0x1ce/0xa40 [ 328.345914][ T8536] __split_vma+0x1e4/0xa40 [ 328.345949][ T8536] ? unwind_get_return_address+0x4d/0x90 [ 328.345976][ T8536] ? __pfx___split_vma+0x10/0x10 [ 328.346002][ T8536] ? __lock_acquire+0x683/0x2ce0 [ 328.346034][ T8536] ? __lock_acquire+0x683/0x2ce0 [ 328.346062][ T8536] vms_gather_munmap_vmas+0x322/0x1370 [ 328.346099][ T8536] ? mtree_range_walk+0x70a/0x8c0 [ 328.346126][ T8536] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 328.346164][ T8536] ? mas_find+0xa23/0xcf0 [ 328.346203][ T8536] mmap_region+0x914/0x2310 [ 328.346239][ T8536] ? is_bpf_text_address+0x292/0x2b0 [ 328.346268][ T8536] ? kernel_text_address+0xa5/0xe0 [ 328.346308][ T8536] ? __pfx_mmap_region+0x10/0x10 [ 328.346336][ T8536] ? arch_stack_walk+0xfb/0x150 [ 328.346370][ T8536] ? stack_trace_save+0xa9/0x100 [ 328.346404][ T8536] ? __pfx_stack_trace_save+0x10/0x10 [ 328.346448][ T8536] ? add_lock_to_list+0xc7/0x100 [ 328.346549][ T8536] ? drm_gem_object_lookup_at_offset+0x356/0x4c0 [ 328.346583][ T8536] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 328.346644][ T8536] ? cap_mmap_addr+0xaf/0x100 [ 328.346668][ T8536] ? bpf_lsm_mmap_addr+0x9/0x50 [ 328.346701][ T8536] ? security_mmap_addr+0x71/0x240 [ 328.346726][ T8536] ? shmem_mapping+0xd/0x50 [ 328.346756][ T8536] ? memfd_check_seals_mmap+0xcb/0x210 [ 328.346783][ T8536] do_mmap+0xc1e/0x10b0 [ 328.346827][ T8536] ? __pfx_do_mmap+0x10/0x10 [ 328.346860][ T8536] ? rwbase_write_lock+0x550/0x720 [ 328.346909][ T8536] vm_mmap_pgoff+0x275/0x4e0 [ 328.346950][ T8536] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 328.346991][ T8536] ? __fget_files+0x2a/0x420 [ 328.347011][ T8536] ? __fget_files+0x3a8/0x420 [ 328.347032][ T8536] ? __fget_files+0x2a/0x420 [ 328.347059][ T8536] ksys_mmap_pgoff+0x4a6/0x720 [ 328.347095][ T8536] ? __x64_sys_mmap+0x7f/0x140 [ 328.347129][ T8536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.347154][ T8536] do_syscall_64+0x174/0x580 [ 328.347187][ T8536] ? trace_irq_disable+0x3b/0x140 [ 328.347222][ T8536] ? clear_bhb_loop+0x70/0xc0 [ 328.347251][ T8536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.347274][ T8536] RIP: 0033:0x7f6d54cde0d9 [ 328.347296][ T8536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 328.347316][ T8536] RSP: 002b:00007f6d52f36028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 328.347340][ T8536] RAX: ffffffffffffffda RBX: 00007f6d54f65fa0 RCX: 00007f6d54cde0d9 [ 328.347358][ T8536] RDX: 0000000000000004 RSI: 0000000000004000 RDI: 00002000003e9000 [ 328.347372][ T8536] RBP: 00007f6d52f36090 R08: 0000000000000003 R09: 0000000100000000 [ 328.347388][ T8536] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000001 [ 328.347402][ T8536] R13: 00007f6d54f66038 R14: 00007f6d54f65fa0 R15: 00007ffd12254f78 [ 328.347440][ T8536] [ 329.130062][ T8545] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 329.194107][ T8545] CIFS: Attempting to mount //127.0.0.1/test [ 330.395561][ T8545] CIFS: VFS: Error connecting to socket. Aborting operation. [ 330.395825][ T8545] CIFS: VFS: cifs_mount failed w/return code = -4 [ 330.856360][ T8566] hub 8-0:1.0: USB hub found [ 330.859261][ T8566] hub 8-0:1.0: 1 port detected [ 332.420933][ T5313] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 332.574901][ T5313] usb 3-1: Using ep0 maxpacket: 32 [ 332.580526][ T5313] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 332.602058][ T5313] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 332.602095][ T5313] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 332.602124][ T5313] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 332.602148][ T5313] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 332.602176][ T5313] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 332.713103][ T5313] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.713133][ T5313] usb 3-1: Product: syz [ 332.713150][ T5313] usb 3-1: Manufacturer: syz [ 332.713166][ T5313] usb 3-1: SerialNumber: syz [ 332.720355][ T5313] usb 3-1: config 0 descriptor?? [ 333.047734][ T8591] hub 8-0:1.0: USB hub found [ 333.084020][ T8591] hub 8-0:1.0: 1 port detected [ 333.217939][ T5313] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 333.217992][ T5313] input input22: Device does not respond to id packet M [ 333.218442][ T5313] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 333.218486][ T5313] input input22: Device does not respond to id packet P [ 333.218966][ T5313] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 333.219081][ T5313] input input22: Device does not respond to id packet B [ 333.219544][ T5313] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 333.219588][ T5313] input input22: Device does not respond to id packet N [ 333.220017][ T5313] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 333.220516][ T5313] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 333.252598][ T5313] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 333.260984][ T5313] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 333.312601][ T5313] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input22 [ 333.361529][ T5313] usb 3-1: USB disconnect, device number 21 [ 334.680889][ T1692] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 335.740954][ T1692] usb 3-1: Using ep0 maxpacket: 8 [ 335.747935][ T1692] usb 3-1: unable to get BOS descriptor or descriptor too short [ 335.747996][ T1692] usb 3-1: New USB device found, idVendor=0c2e, idProduct=0700, bcdDevice=d4.f4 [ 335.753023][ T1692] usb 3-1: config 100 has an invalid interface number: 173 but max is 0 [ 335.753053][ T1692] usb 3-1: config 100 has no interface number 0 [ 335.753102][ T1692] usb 3-1: config 100 interface 173 altsetting 142 bulk endpoint 0xE has invalid maxpacket 64 [ 335.753132][ T1692] usb 3-1: config 100 interface 173 altsetting 142 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 335.753163][ T1692] usb 3-1: config 100 interface 173 has no altsetting 0 [ 335.867627][ T1692] usb 3-1: string descriptor 0 read error: -22 [ 335.867778][ T1692] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.914149][ T8614] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 335.918718][ T1692] metro_usb 3-1:100.173: required endpoints missing [ 336.135086][ T1692] usb 3-1: USB disconnect, device number 22 [ 338.741546][ T8656] netlink: 16 bytes leftover after parsing attributes in process `syz.3.996'. [ 339.164375][ T8664] netlink: 116 bytes leftover after parsing attributes in process `syz.2.998'. [ 339.788879][ T8675] 9p: Bad value for 'smackfstransmute' [ 340.631116][ T8688] kvm: kvm [8687]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x8019b [ 340.759662][ T8694] netlink: ct family unspecified [ 340.759696][ T8694] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 344.117519][ T8748] netlink: 'syz.2.1033': attribute type 3 has an invalid length. [ 344.270956][ T37] audit: type=1326 audit(1786377433.518:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8749 comm="syz.3.1035" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f51c3d9e0d9 code=0x0 [ 345.295582][ T8777] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1044'. [ 345.313671][ T8776] hub 8-0:1.0: USB hub found [ 345.314988][ T8776] hub 8-0:1.0: 1 port detected [ 346.820399][ T8800] netlink: 'syz.2.1056': attribute type 12 has an invalid length. [ 347.849903][ T8820] input: syz1 as /devices/virtual/input/input23 [ 348.115345][ T37] audit: type=1326 audit(1786377437.368:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8823 comm="syz.0.1069" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f299219e0d9 code=0x0 [ 348.267327][ T8834] faux_driver vgem: [drm] Unknown color mode 265; guessing buffer size. [ 348.304082][ T8834] FAULT_INJECTION: forcing a failure. [ 348.304082][ T8834] name failslab, interval 1, probability 0, space 0, times 0 [ 348.304123][ T8834] CPU: 1 UID: 0 PID: 8834 Comm: syz.4.1073 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 348.304167][ T8834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 348.304182][ T8834] Call Trace: [ 348.304284][ T8834] [ 348.304358][ T8834] dump_stack_lvl+0xe8/0x150 [ 348.304528][ T8834] should_fail_ex+0x467/0x600 [ 348.304646][ T8834] should_failslab+0xa8/0x100 [ 348.304724][ T8834] kmem_cache_alloc_noprof+0xa4/0x650 [ 348.304788][ T8834] ? vm_area_dup+0x28/0x670 [ 348.304890][ T8834] ? vm_area_dup+0x28/0x670 [ 348.304928][ T8834] vm_area_dup+0x28/0x670 [ 348.304951][ T8834] ? __split_vma+0x1ce/0xa40 [ 348.305010][ T8834] __split_vma+0x1e4/0xa40 [ 348.305047][ T8834] ? unwind_get_return_address+0x4d/0x90 [ 348.305127][ T8834] ? __pfx___split_vma+0x10/0x10 [ 348.305155][ T8834] ? __lock_acquire+0x683/0x2ce0 [ 348.305224][ T8834] ? __lock_acquire+0x683/0x2ce0 [ 348.305251][ T8834] vms_gather_munmap_vmas+0x322/0x1370 [ 348.305290][ T8834] ? mtree_range_walk+0x70a/0x8c0 [ 348.305418][ T8834] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 348.305457][ T8834] ? mas_find+0xa23/0xcf0 [ 348.305526][ T8834] mmap_region+0x914/0x2310 [ 348.305555][ T8834] ? is_bpf_text_address+0x292/0x2b0 [ 348.305630][ T8834] ? __kernel_text_address+0xd/0x30 [ 348.305714][ T8834] ? unwind_get_return_address+0x4d/0x90 [ 348.305737][ T8834] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 348.305823][ T8834] ? arch_stack_walk+0xfb/0x150 [ 348.305898][ T8834] ? __pfx_mmap_region+0x10/0x10 [ 348.305944][ T8834] ? stack_trace_save+0xa9/0x100 [ 348.305976][ T8834] ? __pfx_stack_trace_save+0x10/0x10 [ 348.306012][ T8834] ? check_path+0x21/0x40 [ 348.306063][ T8834] ? check_noncircular+0xda/0x150 [ 348.306173][ T8834] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 348.306314][ T8834] ? drm_gem_object_lookup_at_offset+0x314/0x4c0 [ 348.306448][ T8834] ? mm_get_unmapped_area+0xd3/0x100 [ 348.306512][ T8834] ? cap_mmap_addr+0xaf/0x100 [ 348.306583][ T8834] ? bpf_lsm_mmap_addr+0x9/0x50 [ 348.306676][ T8834] ? security_mmap_addr+0x71/0x240 [ 348.306726][ T8834] ? shmem_mapping+0xd/0x50 [ 348.306780][ T8834] ? memfd_check_seals_mmap+0xcb/0x210 [ 348.306854][ T8834] do_mmap+0xc1e/0x10b0 [ 348.306895][ T8834] ? __pfx_do_mmap+0x10/0x10 [ 348.306936][ T8834] ? rwbase_write_lock+0x550/0x720 [ 348.307015][ T8834] vm_mmap_pgoff+0x275/0x4e0 [ 348.307081][ T8834] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 348.307122][ T8834] ? __fget_files+0x2a/0x420 [ 348.307170][ T8834] ? __fget_files+0x3a8/0x420 [ 348.307192][ T8834] ? __fget_files+0x2a/0x420 [ 348.307218][ T8834] ksys_mmap_pgoff+0x4a6/0x720 [ 348.307256][ T8834] ? __x64_sys_mmap+0x7f/0x140 [ 348.307292][ T8834] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.307338][ T8834] do_syscall_64+0x174/0x580 [ 348.307417][ T8834] ? trace_irq_disable+0x3b/0x140 [ 348.307508][ T8834] ? clear_bhb_loop+0x70/0xc0 [ 348.307535][ T8834] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.307557][ T8834] RIP: 0033:0x7faf94d3e0d9 [ 348.307611][ T8834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 348.307631][ T8834] RSP: 002b:00007faf92f96028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 348.307686][ T8834] RAX: ffffffffffffffda RBX: 00007faf94fc5fa0 RCX: 00007faf94d3e0d9 [ 348.307702][ T8834] RDX: 0000000000000004 RSI: 0000000000004000 RDI: 00002000003e9000 [ 348.307716][ T8834] RBP: 00007faf92f96090 R08: 0000000000000003 R09: 0000000100000000 [ 348.307730][ T8834] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000000001 [ 348.307744][ T8834] R13: 00007faf94fc6038 R14: 00007faf94fc5fa0 R15: 00007ffc88876dc8 [ 348.307790][ T8834] [ 348.872366][ T8844] hub 8-0:1.0: USB hub found [ 348.872870][ T8844] hub 8-0:1.0: 1 port detected [ 349.035818][ T8848] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1077'. [ 350.355268][ T8860] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1082'. [ 350.406820][ T8859] kvm: kvm [8856]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x8019b [ 351.090990][ T9] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 351.240966][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 351.241785][ T9] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 351.244168][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 351.248761][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 351.248791][ T9] usb 4-1: Product: syz [ 351.248807][ T9] usb 4-1: Manufacturer: syz [ 351.248823][ T9] usb 4-1: SerialNumber: syz [ 351.319184][ T9] usb 4-1: config 0 descriptor?? [ 351.333328][ T9] gs_usb 4-1:0.0: Required endpoints not found [ 351.543289][ T36] usb 4-1: USB disconnect, device number 19 [ 352.172394][ T8906] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1103'. [ 353.105411][ T37] audit: type=1326 audit(1786377442.348:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8909 comm="syz.0.1105" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f299219e0d9 code=0x0 [ 353.647467][ T8930] FAULT_INJECTION: forcing a failure. [ 353.647467][ T8930] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 353.647506][ T8930] CPU: 1 UID: 0 PID: 8930 Comm: syz.4.1113 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 353.647531][ T8930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 353.647545][ T8930] Call Trace: [ 353.647553][ T8930] [ 353.647563][ T8930] dump_stack_lvl+0xe8/0x150 [ 353.647602][ T8930] should_fail_ex+0x467/0x600 [ 353.647645][ T8930] _copy_from_user+0x2d/0xb0 [ 353.647755][ T8930] __sys_sendto+0x2b5/0x5d0 [ 353.647861][ T8930] ? __pfx___sys_sendto+0x10/0x10 [ 353.647915][ T8930] ? __pfx_ksys_write+0x10/0x10 [ 353.647992][ T8930] __x64_sys_sendto+0xde/0x100 [ 353.648018][ T8930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.648043][ T8930] do_syscall_64+0x174/0x580 [ 353.648075][ T8930] ? trace_irq_disable+0x3b/0x140 [ 353.648111][ T8930] ? clear_bhb_loop+0x70/0xc0 [ 353.648139][ T8930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.648163][ T8930] RIP: 0033:0x7faf94d3e0d9 [ 353.648184][ T8930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.648203][ T8930] RSP: 002b:00007faf92f96028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 353.648228][ T8930] RAX: ffffffffffffffda RBX: 00007faf94fc5fa0 RCX: 00007faf94d3e0d9 [ 353.648244][ T8930] RDX: 000000000000fce0 RSI: 00002000000002c0 RDI: 0000000000000003 [ 353.648259][ T8930] RBP: 00007faf92f96090 R08: 0000200000000140 R09: 0000000000000014 [ 353.648272][ T8930] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 353.648286][ T8930] R13: 00007faf94fc6038 R14: 00007faf94fc5fa0 R15: 00007ffc88876dc8 [ 353.648319][ T8930] [ 354.769332][ T8953] hub 8-0:1.0: USB hub found [ 354.791346][ T8953] hub 8-0:1.0: 1 port detected [ 355.281736][ T8947] nvme nvme0: failed to connect socket: -512 [ 355.898113][ T8970] FAULT_INJECTION: forcing a failure. [ 355.898113][ T8970] name failslab, interval 1, probability 0, space 0, times 0 [ 355.898154][ T8970] CPU: 0 UID: 0 PID: 8970 Comm: syz.4.1129 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 355.898180][ T8970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 355.898193][ T8970] Call Trace: [ 355.898201][ T8970] [ 355.898212][ T8970] dump_stack_lvl+0xe8/0x150 [ 355.898260][ T8970] should_fail_ex+0x467/0x600 [ 355.898298][ T8970] should_failslab+0xa8/0x100 [ 355.898325][ T8970] __kmalloc_noprof+0xfe/0x780 [ 355.898428][ T8970] ? vmci_handle_arr_create+0x71/0x140 [ 355.898538][ T8970] ? vmci_handle_arr_create+0x71/0x140 [ 355.898571][ T8970] vmci_handle_arr_create+0x71/0x140 [ 355.898601][ T8970] vmci_ctx_put+0x11f/0xc00 [ 355.898624][ T8970] ? rt_spin_lock+0x1e0/0x400 [ 355.898683][ T8970] ? __pfx_vmci_ctx_put+0x10/0x10 [ 355.898720][ T8970] vmci_host_close+0x91/0x140 [ 355.898740][ T8970] ? __pfx_vmci_host_close+0x10/0x10 [ 355.898759][ T8970] __fput+0x42a/0xa80 [ 355.898783][ T8970] fput_close_sync+0x11f/0x240 [ 355.898801][ T8970] ? __pfx_fput_close_sync+0x10/0x10 [ 355.898823][ T8970] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.898845][ T8970] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.898863][ T8970] __x64_sys_close+0x7e/0x110 [ 355.898883][ T8970] do_syscall_64+0x174/0x580 [ 355.898912][ T8970] ? trace_irq_disable+0x3b/0x140 [ 355.898942][ T8970] ? clear_bhb_loop+0x70/0xc0 [ 355.898965][ T8970] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 355.898982][ T8970] RIP: 0033:0x7faf94d3e0d9 [ 355.899001][ T8970] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 355.899016][ T8970] RSP: 002b:00007faf92f96028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 355.899045][ T8970] RAX: ffffffffffffffda RBX: 00007faf94fc5fa0 RCX: 00007faf94d3e0d9 [ 355.899058][ T8970] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 355.899068][ T8970] RBP: 00007faf92f96090 R08: 0000000000000000 R09: 0000000000000000 [ 355.899078][ T8970] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 355.899089][ T8970] R13: 00007faf94fc6038 R14: 00007faf94fc5fa0 R15: 00007ffc88876dc8 [ 355.899122][ T8970] [ 356.966152][ T9003] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1144'. [ 357.121026][ T5313] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 357.272471][ T5313] usb 4-1: Using ep0 maxpacket: 16 [ 357.273330][ T5313] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 357.274857][ T5313] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 357.274891][ T5313] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 357.323413][ T5313] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.323442][ T5313] usb 4-1: Product: syz [ 357.323455][ T5313] usb 4-1: Manufacturer: syz [ 357.323467][ T5313] usb 4-1: SerialNumber: syz [ 357.360957][ T5313] usb 4-1: config 0 descriptor?? [ 357.392841][ T5313] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 357.393083][ T5313] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 357.655943][ T9018] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1148'. [ 357.766070][ T9018] netlink: 'syz.1.1148': attribute type 1 has an invalid length. [ 357.766176][ T9018] netlink: 'syz.1.1148': attribute type 2 has an invalid length. [ 358.041967][ T5313] em28xx 4-1:0.0: unknown em28xx chip ID (240) [ 358.258322][ T5313] em28xx 4-1:0.0: Config register raw data: 0xaf [ 358.258451][ T5313] em28xx 4-1:0.0: I2S Audio (3 sample rate(s)) [ 358.258470][ T5313] em28xx 4-1:0.0: No AC97 audio processor [ 358.475520][ T5313] usb 4-1: USB disconnect, device number 20 [ 359.734970][ T9050] hub 8-0:1.0: USB hub found [ 360.133356][ T9050] hub 8-0:1.0: 1 port detected [ 361.262973][ T9089] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1176'. [ 362.017715][ T9108] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1182'. [ 364.011503][ T5717] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 364.090268][ T9118] jffs2: notice: (9118) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 364.164396][ T5717] usb 4-1: Using ep0 maxpacket: 16 [ 364.165208][ T5717] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 364.167353][ T5717] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 364.167388][ T5717] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 364.210904][ T5717] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.210934][ T5717] usb 4-1: Product: syz [ 364.210950][ T5717] usb 4-1: Manufacturer: syz [ 364.210964][ T5717] usb 4-1: SerialNumber: syz [ 364.243268][ T5717] usb 4-1: config 0 descriptor?? [ 364.270452][ T9134] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1191'. [ 364.288258][ T5717] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 364.288295][ T5717] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 364.343460][ T9128] netlink: 'syz.0.1187': attribute type 11 has an invalid length. [ 364.409568][ T9122] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1187'. [ 364.549144][ T9139] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1195'. [ 364.918253][ T5717] em28xx 4-1:0.0: unknown em28xx chip ID (240) [ 365.037549][ T9150] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1199'. [ 365.972665][ T5717] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 365.974106][ T5717] em28xx 4-1:0.0: AC97 chip type couldn't be determined [ 365.974127][ T5717] em28xx 4-1:0.0: No AC97 audio processor [ 366.041038][ T9118] jffs2: fork failed for JFFS2 garbage collect thread: -EINTR [ 366.211671][ T5313] usb 4-1: USB disconnect, device number 21 [ 366.235586][ T5313] em28xx 4-1:0.0: Disconnecting em28xx [ 366.283809][ T5313] em28xx 4-1:0.0: Freeing device [ 366.666575][ T9158] netlink: 16054 bytes leftover after parsing attributes in process `syz.1.1200'. [ 366.859465][ T9167] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 366.859511][ T9167] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 367.004785][ T9171] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1207'. [ 367.240874][ T5853] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 367.394104][ T5853] usb 2-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 367.395752][ T5853] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 367.395780][ T5853] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 367.395831][ T5853] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 367.452080][ T5853] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.452110][ T5853] usb 2-1: Product: syz [ 367.452126][ T5853] usb 2-1: Manufacturer: syz [ 367.452142][ T5853] usb 2-1: SerialNumber: syz [ 367.619461][ T5853] uvcvideo 2-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 367.619545][ T5853] uvcvideo 2-1:1.0: No valid video chain found. [ 367.859235][ T5717] usb 2-1: USB disconnect, device number 22 [ 368.143039][ T9199] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1218'. [ 368.299567][ T9202] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 368.299612][ T9202] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 369.144574][ T9218] hub 8-0:1.0: USB hub found [ 369.187295][ T9218] hub 8-0:1.0: 1 port detected [ 379.947447][ T9241] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1229'. [ 380.009817][ T9242] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1230'. [ 380.256347][ T9243] hub 8-0:1.0: USB hub found [ 380.265767][ T1328] ieee802154 phy0 wpan0: encryption failed: -22 [ 380.265839][ T1328] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.274058][ T9243] hub 8-0:1.0: 1 port detected [ 380.739326][ T9249] input: syz1 as /devices/virtual/input/input24 [ 380.772322][ T9254] input: syz1 as /devices/virtual/input/input25 [ 381.107603][ T9258] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1239'. [ 381.154392][ T9258] hub 8-0:1.0: USB hub found [ 381.156681][ T9258] hub 8-0:1.0: 1 port detected [ 381.946434][ T9260] sch_tbf: peakrate 7 is lower than or equals to rate 7 ! [ 382.631827][ T9281] input: syz1 as /devices/virtual/input/input26 [ 383.341904][ T9297] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1253'. [ 383.660925][ T6106] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 383.824207][ T6106] usb 3-1: device descriptor read/64, error -71 [ 384.174384][ T6106] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 384.301076][ T6106] usb 3-1: device descriptor read/64, error -71 [ 384.411407][ T6106] usb usb3-port1: attempt power cycle [ 384.760890][ T6106] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 384.772908][ T6106] usb 3-1: device descriptor read/8, error -71 [ 385.020991][ T6106] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 385.042609][ T6106] usb 3-1: device descriptor read/8, error -71 [ 385.152278][ T6106] usb usb3-port1: unable to enumerate USB device [ 386.009756][ T9349] input: syz1 as /devices/virtual/input/input27 [ 386.885456][ T9381] hub 8-0:1.0: USB hub found [ 386.885842][ T9381] hub 8-0:1.0: 1 port detected [ 387.168226][ T9379] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1286'. [ 387.428647][ T9354] nvme nvme0: failed to connect socket: -512 [ 387.464997][ T9380] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1285'. [ 387.525165][ T9390] FAULT_INJECTION: forcing a failure. [ 387.525165][ T9390] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 387.529909][ T9390] CPU: 1 UID: 0 PID: 9390 Comm: syz.4.1290 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 387.529937][ T9390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 387.529949][ T9390] Call Trace: [ 387.529968][ T9390] [ 387.529977][ T9390] dump_stack_lvl+0xe8/0x150 [ 387.530011][ T9390] should_fail_ex+0x467/0x600 [ 387.530042][ T9390] prepare_alloc_pages+0x223/0x690 [ 387.530151][ T9390] __alloc_frozen_pages_noprof+0x12f/0x380 [ 387.530176][ T9390] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 387.530201][ T9390] ? __pfx_policy_nodemask+0x10/0x10 [ 387.530260][ T9390] ? __lock_acquire+0x683/0x2ce0 [ 387.530281][ T9390] alloc_pages_mpol+0xce/0x280 [ 387.530308][ T9390] alloc_pages_noprof+0xd2/0x2f0 [ 387.530332][ T9390] pte_alloc_one+0x22/0x380 [ 387.530384][ T9390] __do_fault+0xd1/0x2a0 [ 387.530408][ T9390] do_pte_missing+0x659/0x28f0 [ 387.530430][ T9390] ? unwind_next_frame+0x8f/0x2550 [ 387.530459][ T9390] handle_mm_fault+0xd28/0x13f0 [ 387.530496][ T9390] ? handle_mm_fault+0xe8/0x13f0 [ 387.530525][ T9390] ? __pfx_handle_mm_fault+0x10/0x10 [ 387.530551][ T9390] ? mtree_load+0x12a/0x780 [ 387.530603][ T9390] __get_user_pages+0x166b/0x2590 [ 387.530683][ T9390] faultin_page_range+0x26a/0x8f0 [ 387.530716][ T9390] ? blk_start_plug+0x6e/0x1b0 [ 387.530782][ T9390] madvise_do_behavior+0x2e4/0x540 [ 387.530809][ T9390] ? __pfx_madvise_do_behavior+0x10/0x10 [ 387.530828][ T9390] ? down_read+0x156/0x200 [ 387.530872][ T9390] do_madvise+0x26f/0x330 [ 387.530899][ T9390] ? __pfx_do_madvise+0x10/0x10 [ 387.530930][ T9390] ? __pfx_ksys_write+0x10/0x10 [ 387.530963][ T9390] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.530984][ T9390] __x64_sys_madvise+0xa6/0xc0 [ 387.531006][ T9390] do_syscall_64+0x174/0x580 [ 387.531032][ T9390] ? trace_irq_disable+0x3b/0x140 [ 387.531061][ T9390] ? clear_bhb_loop+0x70/0xc0 [ 387.531083][ T9390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 387.531102][ T9390] RIP: 0033:0x7faf94d3e0d9 [ 387.531120][ T9390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 387.531135][ T9390] RSP: 002b:00007faf92f96028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 387.531155][ T9390] RAX: ffffffffffffffda RBX: 00007faf94fc5fa0 RCX: 00007faf94d3e0d9 [ 387.531168][ T9390] RDX: 0000000000000017 RSI: 0000000000c00000 RDI: 0000200000000000 [ 387.531180][ T9390] RBP: 00007faf92f96090 R08: 0000000000000000 R09: 0000000000000000 [ 387.531191][ T9390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 387.531202][ T9390] R13: 00007faf94fc6038 R14: 00007faf94fc5fa0 R15: 00007ffc88876dc8 [ 387.531231][ T9390] [ 388.408539][ T9411] netlink: 'syz.2.1297': attribute type 3 has an invalid length. [ 388.547532][ T9418] FAULT_INJECTION: forcing a failure. [ 388.547532][ T9418] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 388.547574][ T9418] CPU: 0 UID: 0 PID: 9418 Comm: syz.1.1296 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 388.547600][ T9418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 388.547614][ T9418] Call Trace: [ 388.547623][ T9418] [ 388.547633][ T9418] dump_stack_lvl+0xe8/0x150 [ 388.547672][ T9418] should_fail_ex+0x467/0x600 [ 388.547712][ T9418] _copy_from_user+0x2d/0xb0 [ 388.547738][ T9418] ___sys_sendmsg+0x1c6/0x360 [ 388.547788][ T9418] ? __lock_acquire+0x683/0x2ce0 [ 388.547817][ T9418] ? __pfx____sys_sendmsg+0x10/0x10 [ 388.547882][ T9418] ? __fget_files+0x2a/0x420 [ 388.547904][ T9418] ? __fget_files+0x3a8/0x420 [ 388.547937][ T9418] __x64_sys_sendmsg+0x1b7/0x290 [ 388.547968][ T9418] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 388.548014][ T9418] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.548040][ T9418] do_syscall_64+0x174/0x580 [ 388.548073][ T9418] ? trace_irq_disable+0x3b/0x140 [ 388.548107][ T9418] ? clear_bhb_loop+0x70/0xc0 [ 388.548134][ T9418] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.548155][ T9418] RIP: 0033:0x7fe643ebe0d9 [ 388.548172][ T9418] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 388.548188][ T9418] RSP: 002b:00007fe6420d4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 388.548207][ T9418] RAX: ffffffffffffffda RBX: 00007fe644146180 RCX: 00007fe643ebe0d9 [ 388.548221][ T9418] RDX: 0000000002000000 RSI: 0000200000000400 RDI: 0000000000000008 [ 388.548232][ T9418] RBP: 00007fe6420d4090 R08: 0000000000000000 R09: 0000000000000000 [ 388.548243][ T9418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 388.548254][ T9418] R13: 00007fe644146218 R14: 00007fe644146180 R15: 00007ffdc3059d98 [ 388.548279][ T9418] [ 388.707263][ T9420] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1299'. [ 388.766847][ T9420] hub 8-0:1.0: USB hub found [ 388.772400][ T9420] hub 8-0:1.0: 1 port detected [ 390.803463][ T9461] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[5587] was attempted by ""[9461] [ 390.887043][ T9464] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[5587] was attempted by ""[9464] [ 391.521825][ T9483] hub 8-0:1.0: USB hub found [ 391.540268][ T9483] hub 8-0:1.0: 1 port detected [ 391.650895][ T5768] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 391.769709][ T9476] netlink: 'syz.1.1323': attribute type 11 has an invalid length. [ 391.769734][ T9476] netlink: 'syz.1.1323': attribute type 4 has an invalid length. [ 391.945999][ T5768] usb 3-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 391.968360][ T5768] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 391.968392][ T5768] usb 3-1: Product: syz [ 391.968408][ T5768] usb 3-1: Manufacturer: syz [ 391.968424][ T5768] usb 3-1: SerialNumber: syz [ 392.291716][ T5768] usb 3-1: selecting invalid altsetting 1 [ 392.291745][ T5768] speedtch 3-1:1.0: speedtch_bind: setting interface to 1 failed (-22)! [ 392.291867][ T5768] speedtch 3-1:1.0: usbatm_usb_probe: bind failed: -22! [ 392.291971][ T5768] speedtch 3-1:1.0: probe with driver speedtch failed with error -22 [ 392.337857][ T5768] usb 3-1: selecting invalid altsetting 1 [ 392.337883][ T5768] speedtch 3-1:1.1: speedtch_bind: setting interface to 1 failed (-22)! [ 392.365123][ T5768] speedtch 3-1:1.1: usbatm_usb_probe: bind failed: -22! [ 392.365205][ T5768] speedtch 3-1:1.1: probe with driver speedtch failed with error -22 [ 392.392070][ T5768] usb 3-1: USB disconnect, device number 27 [ 392.942657][ T9507] FAULT_INJECTION: forcing a failure. [ 392.942657][ T9507] name failslab, interval 1, probability 0, space 0, times 0 [ 392.942696][ T9507] CPU: 1 UID: 0 PID: 9507 Comm: syz.4.1333 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 392.942723][ T9507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 392.942737][ T9507] Call Trace: [ 392.942746][ T9507] [ 392.942756][ T9507] dump_stack_lvl+0xe8/0x150 [ 392.942796][ T9507] should_fail_ex+0x467/0x600 [ 392.942836][ T9507] should_failslab+0xa8/0x100 [ 392.942865][ T9507] kmem_cache_alloc_noprof+0xa4/0x650 [ 392.942901][ T9507] ? do_getname+0x2e/0x250 [ 392.943052][ T9507] ? do_getname+0x2e/0x250 [ 392.943091][ T9507] do_getname+0x2e/0x250 [ 392.943122][ T9507] ? __se_sys_renameat2+0x28/0x2c0 [ 392.943159][ T9507] __se_sys_renameat2+0x34/0x2c0 [ 392.943193][ T9507] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.943217][ T9507] do_syscall_64+0x174/0x580 [ 392.943250][ T9507] ? trace_irq_disable+0x3b/0x140 [ 392.943285][ T9507] ? clear_bhb_loop+0x70/0xc0 [ 392.943314][ T9507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.943336][ T9507] RIP: 0033:0x7faf94d3e0d9 [ 392.943359][ T9507] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 392.943378][ T9507] RSP: 002b:00007faf92f75028 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 392.943404][ T9507] RAX: ffffffffffffffda RBX: 00007faf94fc6090 RCX: 00007faf94d3e0d9 [ 392.943420][ T9507] RDX: ffffffffffffff9c RSI: 00002000000003c0 RDI: ffffffffffffff9c [ 392.943436][ T9507] RBP: 00007faf92f75090 R08: 0000000000000000 R09: 0000000000000000 [ 392.943449][ T9507] R10: 0000200000000400 R11: 0000000000000246 R12: 0000000000000001 [ 392.943463][ T9507] R13: 00007faf94fc6128 R14: 00007faf94fc6090 R15: 00007ffc88876dc8 [ 392.943507][ T9507] [ 393.892697][ T9521] hub 8-0:1.0: USB hub found [ 393.893580][ T9521] hub 8-0:1.0: 1 port detected [ 393.961730][ T9523] netlink: 'syz.1.1341': attribute type 6 has an invalid length. [ 393.961754][ T9523] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1341'. [ 394.106632][ T9525] netlink: 'syz.0.1343': attribute type 30 has an invalid length. [ 394.107604][ T9525] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1343'. [ 394.344620][ T9530] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1345'. [ 394.393829][ T9530] hub 8-0:1.0: USB hub found [ 394.396715][ T9530] hub 8-0:1.0: 1 port detected [ 395.554149][ T9531] FAULT_INJECTION: forcing a failure. [ 395.554149][ T9531] name failslab, interval 1, probability 0, space 0, times 0 [ 395.554205][ T9531] CPU: 1 UID: 0 PID: 9531 Comm: syz.0.1344 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 395.554232][ T9531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 395.554245][ T9531] Call Trace: [ 395.554254][ T9531] [ 395.554263][ T9531] dump_stack_lvl+0xe8/0x150 [ 395.554303][ T9531] should_fail_ex+0x467/0x600 [ 395.554341][ T9531] should_failslab+0xa8/0x100 [ 395.554370][ T9531] __kmalloc_noprof+0xfe/0x780 [ 395.554393][ T9531] ? vmci_handle_arr_create+0x71/0x140 [ 395.554427][ T9531] ? vmci_handle_arr_create+0x71/0x140 [ 395.554472][ T9531] vmci_handle_arr_create+0x71/0x140 [ 395.554512][ T9531] vmci_ctx_put+0x11f/0xc00 [ 395.554543][ T9531] ? rt_spin_lock+0x1e0/0x400 [ 395.554573][ T9531] ? __pfx_vmci_ctx_put+0x10/0x10 [ 395.554632][ T9531] vmci_host_close+0x91/0x140 [ 395.554656][ T9531] ? __pfx_vmci_host_close+0x10/0x10 [ 395.554679][ T9531] __fput+0x42a/0xa80 [ 395.554709][ T9531] fput_close_sync+0x11f/0x240 [ 395.554732][ T9531] ? __pfx_fput_close_sync+0x10/0x10 [ 395.554755][ T9531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.554780][ T9531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.554806][ T9531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.554831][ T9531] __x64_sys_close+0x7e/0x110 [ 395.554855][ T9531] do_syscall_64+0x174/0x580 [ 395.554896][ T9531] ? clear_bhb_loop+0x70/0xc0 [ 395.554924][ T9531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.554948][ T9531] RIP: 0033:0x7f299219e0d9 [ 395.554969][ T9531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 395.554988][ T9531] RSP: 002b:00007f29903f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 395.555014][ T9531] RAX: ffffffffffffffda RBX: 00007f2992425fa0 RCX: 00007f299219e0d9 [ 395.555031][ T9531] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 395.555044][ T9531] RBP: 00007f29903f6090 R08: 0000000000000000 R09: 0000000000000000 [ 395.555059][ T9531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 395.555072][ T9531] R13: 00007f2992426038 R14: 00007f2992425fa0 R15: 00007fff71078408 [ 395.555108][ T9531] [ 396.110976][ T5717] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 396.266337][ T5717] usb 2-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 396.288180][ T5717] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 396.288211][ T5717] usb 2-1: Product: syz [ 396.288228][ T5717] usb 2-1: Manufacturer: syz [ 396.288244][ T5717] usb 2-1: SerialNumber: syz [ 396.391550][ T9541] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1347'. [ 396.564801][ T5717] usb 2-1: selecting invalid altsetting 1 [ 396.564829][ T5717] speedtch 2-1:1.0: speedtch_bind: setting interface to 1 failed (-22)! [ 396.564917][ T5717] speedtch 2-1:1.0: usbatm_usb_probe: bind failed: -22! [ 396.564980][ T5717] speedtch 2-1:1.0: probe with driver speedtch failed with error -22 [ 396.621192][ T5717] usb 2-1: selecting invalid altsetting 1 [ 396.621220][ T5717] speedtch 2-1:1.1: speedtch_bind: setting interface to 1 failed (-22)! [ 396.621967][ T5717] speedtch 2-1:1.1: usbatm_usb_probe: bind failed: -22! [ 396.622034][ T5717] speedtch 2-1:1.1: probe with driver speedtch failed with error -22 [ 396.661544][ T5717] usb 2-1: USB disconnect, device number 23 [ 396.986039][ T9552] jffs2: notice: (9552) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 397.114015][ T9552] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1352'. [ 397.181770][ T9552] netlink: 'syz.3.1352': attribute type 11 has an invalid length. [ 397.538256][ T9563] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1354'. [ 398.999668][ T9592] hub 8-0:1.0: USB hub found [ 399.020192][ T9592] hub 8-0:1.0: 1 port detected [ 401.331714][ T9596] nvme nvme0: failed to connect socket: -512 [ 402.514539][ T9617] netlink: 16054 bytes leftover after parsing attributes in process `syz.0.1379'. [ 402.688971][ T9625] jffs2: notice: (9625) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 402.748649][ T9623] input: syz1 as /devices/virtual/input/input28 [ 402.911168][ T9635] netlink: 'syz.2.1382': attribute type 11 has an invalid length. [ 402.936847][ T9625] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1382'. [ 403.453997][ T9646] hub 8-0:1.0: USB hub found [ 403.454433][ T9646] hub 8-0:1.0: 1 port detected [ 404.358566][ T9657] jffs2: notice: (9657) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 404.443221][ T9653] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1390'. [ 404.505875][ T9661] netlink: 'syz.1.1393': attribute type 11 has an invalid length. [ 404.519773][ T9665] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1392'. [ 404.547424][ T9666] netlink: 16054 bytes leftover after parsing attributes in process `syz.2.1394'. [ 404.631260][ T5768] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 404.663711][ T9657] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1393'. [ 404.793139][ T5768] usb 4-1: Using ep0 maxpacket: 8 [ 404.808812][ T5768] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 404.844442][ T5768] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 404.844516][ T5768] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 404.895163][ T5768] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 404.895195][ T5768] usb 4-1: Product: syz [ 404.895211][ T5768] usb 4-1: Manufacturer: syz [ 404.895227][ T5768] usb 4-1: SerialNumber: syz [ 405.056042][ T5768] usbtest 4-1:1.0: couldn't get endpoints, -22 [ 405.056175][ T5768] usbtest 4-1:1.0: probe with driver usbtest failed with error -22 [ 405.224481][ T5768] usb 4-1: USB disconnect, device number 22 [ 405.355065][ T9676] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1399'. [ 405.930958][ T36] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 406.080911][ T36] usb 3-1: Using ep0 maxpacket: 32 [ 406.081894][ T36] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 406.083420][ T36] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 406.089282][ T36] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.089311][ T36] usb 3-1: Product: syz [ 406.089328][ T36] usb 3-1: Manufacturer: syz [ 406.089343][ T36] usb 3-1: SerialNumber: syz [ 406.119285][ T9693] netlink: 16054 bytes leftover after parsing attributes in process `syz.1.1407'. [ 406.172303][ T36] usb 3-1: config 0 descriptor?? [ 406.188689][ T36] gs_usb 3-1:0.0: Required endpoints not found [ 406.355142][ T9697] jffs2: notice: (9697) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 406.435823][ T198] usb 3-1: USB disconnect, device number 28 [ 406.627328][ T9703] netlink: 'syz.0.1409': attribute type 11 has an invalid length. [ 406.918674][ T9706] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1410'. [ 407.150917][ T9697] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1409'. [ 407.606124][ T9725] netlink: 16054 bytes leftover after parsing attributes in process `syz.1.1420'. [ 407.622482][ T9721] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1417'. [ 407.880929][ T36] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 408.060857][ T36] usb 4-1: Using ep0 maxpacket: 8 [ 408.061736][ T36] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 408.065135][ T36] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 408.065196][ T36] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 408.069312][ T36] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.069340][ T36] usb 4-1: Product: syz [ 408.069356][ T36] usb 4-1: Manufacturer: syz [ 408.069371][ T36] usb 4-1: SerialNumber: syz [ 408.182256][ T36] usbtest 4-1:1.0: couldn't get endpoints, -22 [ 408.182353][ T36] usbtest 4-1:1.0: probe with driver usbtest failed with error -22 [ 408.184638][ T9741] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1426'. [ 408.440503][ T9244] usb 4-1: USB disconnect, device number 23 [ 408.551010][ T9742] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1425'. [ 408.571119][ T36] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 408.674627][ T9757] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1430'. [ 409.204502][ T9771] FAULT_INJECTION: forcing a failure. [ 409.204502][ T9771] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 409.204543][ T9771] CPU: 0 UID: 0 PID: 9771 Comm: syz.4.1438 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 409.204568][ T9771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 409.204583][ T9771] Call Trace: [ 409.204591][ T9771] [ 409.204601][ T9771] dump_stack_lvl+0xe8/0x150 [ 409.204640][ T9771] should_fail_ex+0x467/0x600 [ 409.204681][ T9771] _copy_from_user+0x2d/0xb0 [ 409.204706][ T9771] __sys_bpf+0x2e7/0xd90 [ 409.204815][ T9771] ? __pfx___sys_bpf+0x10/0x10 [ 409.204840][ T9771] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 409.204881][ T9771] ? rt_mutex_slowunlock+0x219/0x460 [ 409.204929][ T9771] ? ksys_write+0x248/0x270 [ 409.204960][ T9771] ? __pfx_ksys_write+0x10/0x10 [ 409.204993][ T9771] __x64_sys_bpf+0xba/0xd0 [ 409.205053][ T9771] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.205078][ T9771] do_syscall_64+0x174/0x580 [ 409.205110][ T9771] ? trace_irq_disable+0x3b/0x140 [ 409.205154][ T9771] ? clear_bhb_loop+0x70/0xc0 [ 409.205180][ T9771] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.205202][ T9771] RIP: 0033:0x7faf94d3e0d9 [ 409.205222][ T9771] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 409.205240][ T9771] RSP: 002b:00007faf92f96028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 409.205264][ T9771] RAX: ffffffffffffffda RBX: 00007faf94fc5fa0 RCX: 00007faf94d3e0d9 [ 409.205280][ T9771] RDX: 0000000000000050 RSI: 0000200000000180 RDI: 000000000000000a [ 409.205294][ T9771] RBP: 00007faf92f96090 R08: 0000000000000000 R09: 0000000000000000 [ 409.205306][ T9771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 409.205318][ T9771] R13: 00007faf94fc6038 R14: 00007faf94fc5fa0 R15: 00007ffc88876dc8 [ 409.205351][ T9771] [ 409.333461][ T36] usb 3-1: Using ep0 maxpacket: 8 [ 409.359834][ T36] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 409.438012][ T36] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 409.438070][ T36] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 409.471357][ T36] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.471388][ T36] usb 3-1: Product: syz [ 409.471405][ T36] usb 3-1: Manufacturer: syz [ 409.471421][ T36] usb 3-1: SerialNumber: syz [ 409.576911][ T36] usbtest 3-1:1.0: couldn't get endpoints, -22 [ 409.576975][ T36] usbtest 3-1:1.0: probe with driver usbtest failed with error -22 [ 409.776220][ T5768] usb 3-1: USB disconnect, device number 29 [ 409.884118][ T9775] netlink: 16054 bytes leftover after parsing attributes in process `syz.3.1440'. [ 410.296386][ T9787] hub 8-0:1.0: USB hub found [ 410.298783][ T9787] hub 8-0:1.0: 1 port detected [ 411.378668][ T9796] input: syz1 as /devices/virtual/input/input29 [ 412.383379][ T9826] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1462'. [ 412.460113][ T9826] hub 8-0:1.0: USB hub found [ 412.462721][ T9826] hub 8-0:1.0: 1 port detected [ 413.382000][ T9835] input: syz1 as /devices/virtual/input/input30 [ 413.753916][ T9845] sch_tbf: peakrate 7 is lower than or equals to rate 7 ! [ 414.127562][ T9864] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1476'. [ 414.156746][ T9864] hub 8-0:1.0: USB hub found [ 414.164842][ T9864] hub 8-0:1.0: 1 port detected [ 414.417069][ T9861] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1475'. [ 414.917634][ T9861] veth1_vlan: left allmulticast mode [ 415.100007][ T9861] macvlan0: left allmulticast mode [ 415.228558][ T9861] netlink: 'syz.3.1475': attribute type 1 has an invalid length. [ 415.323276][ T9873] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1478'. [ 416.518408][ T9882] input: syz1 as /devices/virtual/input/input31 [ 416.706442][ T9889] sch_tbf: peakrate 7 is lower than or equals to rate 7 ! [ 416.987572][ T9900] input: syz1 as /devices/virtual/input/input32 [ 417.847452][ T9922] input: syz1 as /devices/virtual/input/input33 [ 418.312311][ T9936] input: syz1 as /devices/virtual/input/input34 [ 418.471033][ T5853] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 418.642406][ T5853] usb 4-1: Using ep0 maxpacket: 32 [ 418.643268][ T5853] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 418.645490][ T5853] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 418.680982][ T5853] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.681014][ T5853] usb 4-1: Product: syz [ 418.681031][ T5853] usb 4-1: Manufacturer: syz [ 418.681049][ T5853] usb 4-1: SerialNumber: syz [ 418.689702][ T5853] usb 4-1: config 0 descriptor?? [ 418.725389][ T5853] gs_usb 4-1:0.0: Required endpoints not found [ 418.795559][ T9942] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1509'. [ 418.923128][ T9953] input: syz1 as /devices/virtual/input/input35 [ 418.955029][ T9] usb 4-1: USB disconnect, device number 24 [ 419.385344][ T9961] netlink: ct family unspecified [ 419.385383][ T9961] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 419.851030][ T37] audit: type=1326 audit(1786377509.098:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9972 comm="syz.4.1522" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf94d3e0d9 code=0x7ffc0000 [ 419.851093][ T37] audit: type=1326 audit(1786377509.098:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9972 comm="syz.4.1522" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf94d3e0d9 code=0x7ffc0000 [ 419.851143][ T37] audit: type=1326 audit(1786377509.098:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9972 comm="syz.4.1522" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf94d3e0d9 code=0x7ffc0000 [ 419.851198][ T37] audit: type=1326 audit(1786377509.098:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9972 comm="syz.4.1522" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7faf94d3e0d9 code=0x7ffc0000 [ 419.851253][ T37] audit: type=1326 audit(1786377509.098:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9972 comm="syz.4.1522" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf94d3e0d9 code=0x7ffc0000 [ 419.851305][ T37] audit: type=1326 audit(1786377509.098:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9972 comm="syz.4.1522" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf94d3e0d9 code=0x7ffc0000 [ 419.851359][ T37] audit: type=1326 audit(1786377509.098:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9972 comm="syz.4.1522" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=273 compat=0 ip=0x7faf94d3e0d9 code=0x7ffc0000 [ 419.851422][ T37] audit: type=1326 audit(1786377509.098:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9972 comm="syz.4.1522" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf94d3e0d9 code=0x7ffc0000 [ 419.851479][ T37] audit: type=1326 audit(1786377509.098:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9972 comm="syz.4.1522" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf94d3e0d9 code=0x7ffc0000 [ 419.851529][ T37] audit: type=1326 audit(1786377509.098:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9972 comm="syz.4.1522" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7faf94d3e0d9 code=0x7ffc0000 [ 420.803406][T10005] hub 8-0:1.0: USB hub found [ 420.816722][T10005] hub 8-0:1.0: 1 port detected [ 421.572560][ T9986] syz.1.1527 (9986) used greatest stack depth: 19584 bytes left [ 422.582813][T10038] netlink: 16054 bytes leftover after parsing attributes in process `syz.0.1547'. [ 423.391042][ T5853] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 423.541007][ T5853] usb 2-1: Using ep0 maxpacket: 16 [ 423.542000][ T5853] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 423.544784][ T5853] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 423.544819][ T5853] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 423.549683][ T5853] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.549720][ T5853] usb 2-1: Product: syz [ 423.549736][ T5853] usb 2-1: Manufacturer: syz [ 423.549751][ T5853] usb 2-1: SerialNumber: syz [ 423.626877][ T5853] usb 2-1: config 0 descriptor?? [ 423.675074][ T5853] em28xx 2-1:0.0: error: skipping audio endpoint 0x83, because it uses bulk transfers ! [ 424.166363][T10064] netlink: 16054 bytes leftover after parsing attributes in process `syz.0.1560'. [ 424.884995][ T5853] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 425.031851][ T5853] usb 3-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 425.036644][ T5853] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.036675][ T5853] usb 3-1: Product: syz [ 425.036691][ T5853] usb 3-1: Manufacturer: syz [ 425.036707][ T5853] usb 3-1: SerialNumber: syz [ 426.026374][ T5853] usb 3-1: selecting invalid altsetting 1 [ 426.026404][ T5853] speedtch 3-1:1.0: speedtch_bind: setting interface to 1 failed (-22)! [ 426.026485][ T5853] speedtch 3-1:1.0: usbatm_usb_probe: bind failed: -22! [ 426.026547][ T5853] speedtch 3-1:1.0: probe with driver speedtch failed with error -22 [ 426.108835][ T5853] usb 3-1: selecting invalid altsetting 1 [ 426.108860][ T5853] speedtch 3-1:1.1: speedtch_bind: setting interface to 1 failed (-22)! [ 426.151953][ T5853] speedtch 3-1:1.1: usbatm_usb_probe: bind failed: -22! [ 426.152108][ T5853] speedtch 3-1:1.1: probe with driver speedtch failed with error -22 [ 426.321005][ T198] usb 2-1: USB disconnect, device number 24 [ 426.402897][ T5853] usb 3-1: USB disconnect, device number 30 [ 427.681060][ T6106] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 427.832978][ T6106] usb 2-1: Using ep0 maxpacket: 32 [ 427.833827][ T6106] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 427.836540][ T6106] usb 2-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 427.836597][ T6106] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 427.836626][ T6106] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 427.836654][ T6106] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 427.836678][ T6106] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 427.916784][ T6106] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.916814][ T6106] usb 2-1: Product: syz [ 427.916830][ T6106] usb 2-1: Manufacturer: syz [ 427.916847][ T6106] usb 2-1: SerialNumber: syz [ 427.959676][ T6106] usb 2-1: config 0 descriptor?? [ 428.296451][T10153] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1596'. [ 429.070612][T10173] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1605'. [ 429.340930][ T198] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 429.490890][ T198] usb 3-1: Using ep0 maxpacket: 8 [ 429.491732][ T198] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 429.495086][ T198] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 429.495175][ T198] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 429.497772][ T198] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.497799][ T198] usb 3-1: Product: syz [ 429.497815][ T198] usb 3-1: Manufacturer: syz [ 429.497831][ T198] usb 3-1: SerialNumber: syz [ 429.583648][ T198] usbtest 3-1:1.0: couldn't get endpoints, -22 [ 429.583768][ T198] usbtest 3-1:1.0: probe with driver usbtest failed with error -22 [ 429.668945][T10187] jffs2: notice: (10187) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 429.809885][ T198] usb 3-1: USB disconnect, device number 31 [ 429.847991][T10187] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1613'. [ 430.445595][ T5853] usb 2-1: USB disconnect, device number 25 [ 431.512261][ T37] kauditd_printk_skb: 252 callbacks suppressed [ 431.512286][ T37] audit: type=1326 audit(1786377520.758:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10249 comm="syz.0.1641" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f299219e0d9 code=0x0 [ 431.914996][T10258] netlink: 16054 bytes leftover after parsing attributes in process `syz.1.1643'. [ 432.632521][T10275] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1648'. [ 434.108344][ T5591] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 434.143774][ T5591] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 434.148091][ T5591] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 434.169286][ T5591] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 434.178702][ T5591] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 434.199282][T10294] netlink: 'syz.3.1661': attribute type 6 has an invalid length. [ 434.199304][T10294] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1661'. [ 435.003306][T10303] jffs2: notice: (10303) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 435.255094][T10303] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1660'. [ 436.955481][ T5601] Bluetooth: hci5: command tx timeout [ 436.987843][T10319] nvme nvme0: failed to connect socket: -512 [ 437.745243][T10347] hub 8-0:1.0: USB hub found [ 437.760386][T10346] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1675'. [ 437.774401][T10347] hub 8-0:1.0: 1 port detected [ 438.032496][ T36] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 438.185515][ T36] usb 2-1: not running at top speed; connect to a high speed hub [ 438.185559][ T36] usb 2-1: New USB device found, idVendor=12d1, idProduct=4b3b, bcdDevice=e7.d6 [ 438.187668][ T36] usb 2-1: config 6 has an invalid interface number: 11 but max is 0 [ 438.187699][ T36] usb 2-1: config 6 has an invalid interface number: 205 but max is 0 [ 438.187722][ T36] usb 2-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 438.187745][ T36] usb 2-1: config 6 has no interface number 0 [ 438.187762][ T36] usb 2-1: config 6 has no interface number 1 [ 438.187860][ T36] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 438.187891][ T36] usb 2-1: config 6 interface 11 altsetting 8 has an endpoint descriptor with address 0x76, changing to 0x6 [ 438.187919][ T36] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x6 has invalid maxpacket 59513, setting to 64 [ 438.187949][ T36] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 438.187978][ T36] usb 2-1: too many endpoints for config 6 interface 205 altsetting 46: 113, using maximum allowed: 30 [ 438.188021][ T36] usb 2-1: config 6 interface 205 altsetting 46 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 438.188060][ T36] usb 2-1: config 6 interface 205 altsetting 46 has 1 endpoint descriptor, different from the interface descriptor's value: 113 [ 438.188090][ T36] usb 2-1: config 6 interface 11 has no altsetting 0 [ 438.188110][ T36] usb 2-1: config 6 interface 205 has no altsetting 0 [ 438.381886][ T36] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.381914][ T36] usb 2-1: Product: 梅⟸衆甁ꥸ⯒॔䄠贈넃쫬㏵ᢟ䄻ᳪ萯둮뛙䗏럵안띸顙沰ꊬ荽ꅗ橀㛩緺ऩꊡ罤台颱鐜3쉗⸆ⁿ넿ᗉ뾵᪖㐅쟼劘驹鎉拕샄路✳쳿帒ﵑⓖ剋嘢頗裚㯗규૥㵃࠵楂ᎆ舄췌괼㛇읲钁Ꟑ켃搡亽꾕퍩䞇㧔᪾돐㨢믈쵮䡃備鑌퀠⍫ঽ⟤珐뻗௯㿍꫶ﲭ鐙忤Ɥ뙎 [ 438.381942][ T36] usb 2-1: Manufacturer:   [ 438.381953][ T36] usb 2-1: SerialNumber: 瞡檢ᙵꟋ䍰갴蛹遰ꍹт現ଽ褠韊璪돟譵䨟鞉ୁ秫ܷ먍왤쾊愎䮑楛耠ඩ̻ိ磻淎ꏾ쟼⢦ꦩ쪲蹣䠟閂 [ 438.472800][T10346] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 438.472933][T10346] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 438.669498][ T6889] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 438.733367][ T36] option 2-1:6.11: GSM modem (1-port) converter detected [ 438.892048][ C1] ------------[ cut here ]------------ [ 438.892065][ C1] DEBUG_LOCKS_WARN_ON(1) [ 438.892158][ C1] WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x382/0x2ce0, CPU#1: ktimers/1/29 [ 438.892237][ C1] Modules linked in: [ 438.892266][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 438.892290][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 438.892309][ C1] RIP: 0010:__lock_acquire+0x389/0x2ce0 [ 438.892335][ C1] Code: 83 3d fa 84 07 18 00 75 27 90 e8 a2 ae 1d 03 85 c0 74 1c 83 3d eb fd 0d 0e 00 75 13 48 8d 3d 3e 48 11 0e 48 c7 c6 d4 f6 99 8d <67> 48 0f b9 3a 90 31 c0 0f b6 98 c4 00 00 00 41 8b 45 20 25 ff 1f [ 438.892357][ C1] RSP: 0018:ffffc90000a3f6b8 EFLAGS: 00010046 [ 438.892379][ C1] RAX: 0000000000000001 RBX: 0000000000040000 RCX: ffff88801d2b3e00 [ 438.892396][ C1] RDX: 0000000000000100 RSI: ffffffff8d99f6d4 RDI: ffffffff8fb2a8e0 [ 438.892414][ C1] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000100 [ 438.892428][ C1] R10: dffffc0000000000 R11: fffffbfff1f5ebd1 R12: 0000000000000981 [ 438.892446][ C1] R13: ffff88801d2b4af8 R14: ffff88801d2b3e00 R15: ffff88801d2b4a08 [ 438.892465][ C1] FS: 0000000000000000(0000) GS:ffff888125d46000(0000) knlGS:0000000000000000 [ 438.892484][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 438.892501][ C1] CR2: 000020000012b030 CR3: 000000002858a000 CR4: 00000000003526f0 [ 438.892527][ C1] Call Trace: [ 438.892535][ C1] [ 438.892546][ C1] ? kasan_save_track+0x4f/0x80 [ 438.892645][ C1] ? __kasan_slab_free+0x5c/0x80 [ 438.892671][ C1] ? __lock_acquire+0x683/0x2ce0 [ 438.892707][ C1] ? tcp_tsq_handler+0x29/0x200 [ 438.892800][ C1] lock_acquire+0x106/0x350 [ 438.892820][ C1] ? tcp_tsq_handler+0x29/0x200 [ 438.892855][ C1] ? register_lock_class+0x31/0x2e0 [ 438.892947][ C1] rt_spin_lock+0x83/0x400 [ 438.892973][ C1] ? tcp_tsq_handler+0x29/0x200 [ 438.893006][ C1] ? try_to_take_rt_mutex+0x842/0xb00 [ 438.893033][ C1] ? __pfx_rt_spin_lock+0x10/0x10 [ 438.893060][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 438.893095][ C1] tcp_tsq_handler+0x29/0x200 [ 438.893129][ C1] tcp_tsq_workfn+0x384/0x410 [ 438.893165][ C1] ? __pfx_tcp_tsq_workfn+0x10/0x10 [ 438.893199][ C1] ? rcu_is_watching+0x15/0xb0 [ 438.893260][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 438.893285][ C1] process_scheduled_works+0xa8e/0x14e0 [ 438.893325][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 438.893350][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 438.893390][ C1] bh_worker+0x46a/0x880 [ 438.893450][ C1] tasklet_action+0xc/0x70 [ 438.893530][ C1] handle_softirqs+0x1d9/0x6c0 [ 438.893562][ C1] run_ktimerd+0x69/0x100 [ 438.893591][ C1] smpboot_thread_fn+0x57c/0xa80 [ 438.893665][ C1] ? smpboot_thread_fn+0x4e/0xa80 [ 438.893697][ C1] kthread+0x388/0x470 [ 438.893761][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 438.893789][ C1] ? __pfx_kthread+0x10/0x10 [ 438.893821][ C1] ret_from_fork+0x514/0xb70 [ 438.893893][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 438.893932][ C1] ? __switch_to+0xc89/0x1420 [ 438.894011][ C1] ? __pfx_kthread+0x10/0x10 [ 438.894043][ C1] ret_from_fork_asm+0x1a/0x30 [ 438.894085][ C1] [ 438.894104][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 438.894124][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 438.894152][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 438.894167][ C1] Call Trace: [ 438.894175][ C1] [ 438.894184][ C1] vpanic+0x56c/0xa60 [ 438.894227][ C1] ? __pfx__printk+0x10/0x10 [ 438.894252][ C1] ? __pfx_vpanic+0x10/0x10 [ 438.894284][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 438.894310][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 438.894339][ C1] panic+0xc5/0xd0 [ 438.894372][ C1] ? __pfx_panic+0x10/0x10 [ 438.894410][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 438.894447][ C1] __warn+0x315/0x4c0 [ 438.894480][ C1] ? __lock_acquire+0x382/0x2ce0 [ 438.894504][ C1] ? __lock_acquire+0x382/0x2ce0 [ 438.894524][ C1] __report_bug+0x276/0x570 [ 438.894628][ C1] ? __lock_acquire+0x382/0x2ce0 [ 438.894650][ C1] ? __pfx___report_bug+0x10/0x10 [ 438.894688][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 438.894722][ C1] ? unwind_next_frame+0x8f/0x2550 [ 438.894749][ C1] report_bug_entry+0x19a/0x290 [ 438.894782][ C1] ? __lock_acquire+0x389/0x2ce0 [ 438.894802][ C1] ? __lock_acquire+0x38e/0x2ce0 [ 438.894823][ C1] handle_bug+0xce/0x200 [ 438.894851][ C1] exc_invalid_op+0x1a/0x50 [ 438.894872][ C1] asm_exc_invalid_op+0x1a/0x20 [ 438.894899][ C1] RIP: 0010:__lock_acquire+0x389/0x2ce0 [ 438.894930][ C1] Code: 83 3d fa 84 07 18 00 75 27 90 e8 a2 ae 1d 03 85 c0 74 1c 83 3d eb fd 0d 0e 00 75 13 48 8d 3d 3e 48 11 0e 48 c7 c6 d4 f6 99 8d <67> 48 0f b9 3a 90 31 c0 0f b6 98 c4 00 00 00 41 8b 45 20 25 ff 1f [ 438.894951][ C1] RSP: 0018:ffffc90000a3f6b8 EFLAGS: 00010046 [ 438.894973][ C1] RAX: 0000000000000001 RBX: 0000000000040000 RCX: ffff88801d2b3e00 [ 438.894991][ C1] RDX: 0000000000000100 RSI: ffffffff8d99f6d4 RDI: ffffffff8fb2a8e0 [ 438.895009][ C1] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000100 [ 438.895024][ C1] R10: dffffc0000000000 R11: fffffbfff1f5ebd1 R12: 0000000000000981 [ 438.895041][ C1] R13: ffff88801d2b4af8 R14: ffff88801d2b3e00 R15: ffff88801d2b4a08 [ 438.895069][ C1] ? __lock_acquire+0x36e/0x2ce0 [ 438.895090][ C1] ? kasan_save_track+0x4f/0x80 [ 438.895126][ C1] ? __kasan_slab_free+0x5c/0x80 [ 438.895150][ C1] ? __lock_acquire+0x683/0x2ce0 [ 438.895178][ C1] ? tcp_tsq_handler+0x29/0x200 [ 438.895211][ C1] lock_acquire+0x106/0x350 [ 438.895232][ C1] ? tcp_tsq_handler+0x29/0x200 [ 438.895267][ C1] ? register_lock_class+0x31/0x2e0 [ 438.895307][ C1] rt_spin_lock+0x83/0x400 [ 438.895331][ C1] ? tcp_tsq_handler+0x29/0x200 [ 438.895365][ C1] ? try_to_take_rt_mutex+0x842/0xb00 [ 438.895393][ C1] ? __pfx_rt_spin_lock+0x10/0x10 [ 438.895420][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 438.895453][ C1] tcp_tsq_handler+0x29/0x200 [ 438.895488][ C1] tcp_tsq_workfn+0x384/0x410 [ 438.895521][ C1] ? __pfx_tcp_tsq_workfn+0x10/0x10 [ 438.895553][ C1] ? rcu_is_watching+0x15/0xb0 [ 438.895577][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 438.895601][ C1] process_scheduled_works+0xa8e/0x14e0 [ 438.895639][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 438.895664][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 438.895705][ C1] bh_worker+0x46a/0x880 [ 438.895737][ C1] tasklet_action+0xc/0x70 [ 438.895765][ C1] handle_softirqs+0x1d9/0x6c0 [ 438.895796][ C1] run_ktimerd+0x69/0x100 [ 438.895825][ C1] smpboot_thread_fn+0x57c/0xa80 [ 438.895856][ C1] ? smpboot_thread_fn+0x4e/0xa80 [ 438.895888][ C1] kthread+0x388/0x470 [ 438.895928][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 438.895955][ C1] ? __pfx_kthread+0x10/0x10 [ 438.895988][ C1] ret_from_fork+0x514/0xb70 [ 438.896022][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 438.896055][ C1] ? __switch_to+0xc89/0x1420 [ 438.896084][ C1] ? __pfx_kthread+0x10/0x10 [ 438.896117][ C1] ret_from_fork_asm+0x1a/0x30 [ 438.896159][ C1] [ 438.896352][ C1] Kernel Offset: disabled