last executing test programs: 13m53.924226895s ago: executing program 2 (id=266): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x440, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0xfffffffffffffffc, 0x2, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x8, 0x1, 0xfffffffffffffffe, 0x1ffffffffffffffe, 0x5, 0x8d], 0x8000000}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 13m53.531126461s ago: executing program 2 (id=269): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) socket$packet(0x11, 0x2, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = getpid() bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', 0x0, 0x0, 0x0, 0x0, 0x0, r1}}, 0x40) prlimit64(r1, 0xe, &(0x7f0000000380)={0x9, 0x100008f}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r2) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYBLOB="f5af24bd7018000000000e00000008000300", @ANYRES32=r3, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r6, 0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x44004) r7 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r7, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) 13m52.017510249s ago: executing program 2 (id=271): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) sendmmsg$inet(r0, &(0x7f0000000e80)=[{{&(0x7f0000000100)={0x2, 0x4e26, @multicast1}, 0x10, &(0x7f00000009c0)=[{&(0x7f0000000140)="2b3dcb037cf6eefdd865abf4cb8b1d17613cba0add0fc611e8e8edeb824ba694c30ed1d75eafde7ef357f25d275ad90b0ad65c4e3181039007d9096ab1a098bbd39415dc16914bbe91674f0deb1055864e2dc88798e3b3bf82e866c36f30af92cf204c04b58ef42e2744042bb5d5af77aff174539bd796f35aedbcaef63cce67d65f3321eb7700beef47308d9fc2b6d1a18e0484c097d27c0b2fc3b708c2897b9f55dd06c88b6db07b64431bff78a7eea64b1300bd6de2393e21f640e8b377e934245cd31a70d7f4823df271b235bd3d0b356a6bf5e7bd476d4ab8dd640f746dc0b90e080a494f", 0xe7}, {&(0x7f0000000700)="fd3f12b11bb32a8a76e016794ce0643bb98d1c07715d51090783781fefb0a7b2b3e618c882ed4d2251b83d733eb420ce93c78f2f93f899e2bf36f1c58b9703d0bab566913ef2cb5b3e51b06e5925d81e6e4fd80f16431e01f64990254de92d67902dd61b93f3006dfe188282923bb8aa3c7af13dec03b0521221868f11d0301d273e3f6726d107520e8b6aed0a1b", 0x8e}, {&(0x7f0000000440)}, {&(0x7f00000000c0)="1da91706353d671ffb11e4f447350c1aae5cc28f91a212a31f3550b813a7c81cf5d7fa00"/47, 0x2f}, {&(0x7f0000000b40)="853d812375877866806fdff43051b4023fa2334c45b8d31dff2233f12c7ffec14b58976722a067ecd394dcf55ad8bc6adf88e0dd053d47e5ddc3b08ac01e128339844430d1033bc401927fd38018f2b0e9b713aa160d7b265e90ca90a88cbb0b1493ccdd35f17ed434451c742e3d9c7607fb338490fb578a48c1853a42bbd171367e33a75c9cde0160143ad61ffad513ae1059f9e31087c6448fae895aa68e70fa53628160525c97bf79f68247bf691e8e46c94c3c0fa018fd9d10c19d7bf717ef1da47e10b55a09cb5e411146c03b26abef74a1b955c2202b9a4838f5b2495c6728602328820e2df2acfb22138f1d86c29f73641d1a55e8deadd320d9e951b33370ccebbd05a4d4358c514b5c7b695a9ec90b36ac77e9dd4e03569065d281b1b727a1692e26b8f363d7540e8ca2e806164a6fc46f8e2d2a6c128daf63a398077a13fbc0d539bda7fb8b904638e612482b548f1a089ec8d80fe0e6baf6379a037ce7efdf6ede864f2c8736b1abb71991ba15f2fd1372314390de9a3fa1a4eefc12dfd5bbf5c6606a4a5d2e08742f02fbc8aaa140a652369a2200736851cf259dde2999c8b2539d7702d0b37aae943e160e14d24b3eaa0b025d55a16c924f16e9eecebbc52b2069ba5223df0e252c78372aa13958a89a2b3a2044aa2275817ac942b261d2f2c25c45984b8af9dfa7652f7530aa4e714ad4c66b65ebaf42e223e415f1326bfd00d98bdaa4396a23aaa3623d0324beb61843f685a4e577247ae9b833aee04e55ae6d336d73513fbdcc62af87d2ba946a9c25d175e66990c636df62f853377274c1a04fb1fb235ee080cad746e239cdc728474812e995ac0c67", 0x25e}], 0x5}}], 0x1, 0x40080a0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000080)=0x4, 0x4) sendmmsg(r0, 0x0, 0x0, 0x40) 13m48.318246058s ago: executing program 2 (id=275): bpf$TOKEN_CREATE(0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x3, 0x7fffffff}]}) close_range(r4, 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000e0982, 0x0) syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x13f) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r5, 0x0, &(0x7f00000000c0)) 13m45.238288485s ago: executing program 2 (id=277): epoll_create1(0x80000) socket$kcm(0x10, 0x2, 0x10) socket$inet6(0xa, 0x2, 0x0) syz_open_dev$mtd(&(0x7f0000000000), 0x492, 0x20800) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40815}, 0xc000) r0 = syz_ublk_setup_io_uring(0x1d, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000040)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xe2e, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x1, 0x700, 0x3, 0x132}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1ba0, 0x20000, 0x2100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7301, 0x1, 0xffffdffe, 0x351}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2a75, 0x100, 0x0, 0x1f0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8, 0x2, 0x250, 0x0, r0}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, r7, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, r4, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 13m44.337987608s ago: executing program 2 (id=280): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000000)={0x600, 0x1000000}) 13m27.178429149s ago: executing program 32 (id=280): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000000)={0x600, 0x1000000}) 2m57.909664688s ago: executing program 1 (id=1261): socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) socket$nl_generic(0x10, 0x3, 0x10) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x5, 0x8, 0x80}, 0x0, &(0x7f00000002c0)={0x3fe, 0x30e3, 0x0, 0x3, 0x8, 0x0, 0x80000001, 0xfffffffffffffff8}, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(r2, 0x40084146, &(0x7f0000000140)=0xfff) 2m53.837959957s ago: executing program 1 (id=1269): syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./proc\x00', 0x180) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r1, &(0x7f0000000000)='7', 0x1) bpf$MAP_CREATE(0x0, 0x0, 0x50) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x4) 2m53.354025388s ago: executing program 1 (id=1270): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x22, &(0x7f0000000300)=0x1, 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x16481, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x2) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, r5) socket$netlink(0x10, 0x3, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r6) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x100000001, 0x210000, 0x1, 0xd, 0x200}, 0x1c) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x8c, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r7]) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, r6}, 0x94) 2m51.412307571s ago: executing program 1 (id=1272): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r0, &(0x7f0000002f40)={0x0, 0x0, &(0x7f0000001b40)=[{&(0x7f0000000840)="eb5b", 0x2}], 0x1}, 0x4800) close(r1) write$cgroup_devices(r0, 0x0, 0x0) 2m51.025356804s ago: executing program 1 (id=1273): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x25, &(0x7f0000000180)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$tcp_congestion(0xffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$tcp_congestion(r4, &(0x7f0000000100)='reno\x00', 0xfdef) 2m49.480597877s ago: executing program 1 (id=1275): syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x4000000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r2, 0x4030ae7b, &(0x7f00000000c0)={0x8, 0xe, 0x200, 0x8, 0x400}) syz_open_dev$dvb_demux(0x0, 0xcd79, 0x141000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) 2m34.214496338s ago: executing program 33 (id=1275): syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x4000000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_CLOCK(r2, 0x4030ae7b, &(0x7f00000000c0)={0x8, 0xe, 0x200, 0x8, 0x400}) syz_open_dev$dvb_demux(0x0, 0xcd79, 0x141000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) 1m51.617818228s ago: executing program 5 (id=1383): prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x128}, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x80) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)) prlimit64(0x0, 0x3, &(0x7f0000000140)={0x2, 0x3}, 0x0) close(0xffffffffffffffff) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') pread64(r3, &(0x7f0000000080)=""/102356, 0x18fd4, 0xc2a) 1m49.732938583s ago: executing program 5 (id=1389): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mq_getsetattr(r0, 0x0, 0x0) 1m49.338028279s ago: executing program 5 (id=1392): openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000001c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000100), 0x12) r2 = openat$cgroup_int(r0, &(0x7f00000000c0)='cpuset.memory_spread_slab\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)=ANY=[@ANYBLOB='1'], 0x31) 1m47.40208065s ago: executing program 5 (id=1394): socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(0x0, 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) socket$nl_generic(0x10, 0x3, 0x10) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x5, 0x8, 0x80}, 0x0, &(0x7f00000002c0)={0x3fe, 0x30e3, 0x0, 0x3, 0x8, 0x0, 0x80000001, 0xfffffffffffffff8}, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(r2, 0x40084146, &(0x7f0000000140)=0xfff) 1m46.386127333s ago: executing program 5 (id=1397): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x90) syz_clone(0x1000011, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000440)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) r3 = dup(r2) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r3) write(r0, &(0x7f0000000000)='3', 0x4e) 1m46.243417195s ago: executing program 5 (id=1398): socket$inet_smc(0x2b, 0x1, 0x0) mkdir(&(0x7f0000000000)='./dev\x00', 0x1fe) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/console\x00', 0x1, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x2, 0x367}}], 0x1, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) 1m30.537872733s ago: executing program 34 (id=1398): socket$inet_smc(0x2b, 0x1, 0x0) mkdir(&(0x7f0000000000)='./dev\x00', 0x1fe) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/console\x00', 0x1, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x1000, 0x8000002, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x2001, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x35bc, 0x1, 0x0, 0x5f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1cf, 0x4000, 0x0, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x8200, 0x2, 0x367}}], 0x1, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004", @ANYRES32=0x0], 0x48) 6.528738032s ago: executing program 3 (id=1608): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_INPUT(r0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x2219, 0x7721, 0x16, 0x0, 0x0) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='0.0.0.0:0:/\x00', 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x0) syz_emit_ethernet(0x7e, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r3, &(0x7f0000000000)='3', 0x4e) socket$inet(0x2, 0xa, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, 0x0) dup(r3) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) 6.102552603s ago: executing program 0 (id=1609): getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xd, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r3, 0x0, 0x8004) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWSET={0x60, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa}, [@NFTA_SET_USERDATA={0x18, 0xd, 0x1, 0x0, "fc448e13cb512b3fc9382f21ed6286ec2ad3588b"}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x6}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x81}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x3d}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x88}}, 0xc010) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) sendmsg$NL80211_CMD_REGISTER_FRAME(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x48000) 6.088198906s ago: executing program 3 (id=1610): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="070600000000000000002d00000005002b0000000000060006000000000008002f00040000000c00050000000000000000000a0001007770616e30"], 0x4c}}, 0x20048840) 5.953467963s ago: executing program 3 (id=1612): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x22, &(0x7f0000000300)=0x1, 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x16481, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x2) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, r5) socket$netlink(0x10, 0x3, 0x0) r6 = openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) close(r6) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000040)=@req3={0x410000, 0x100000001, 0x210000, 0x1, 0xd, 0x200}, 0x1c) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x8c, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r7]) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, r6}, 0x94) 4.757478469s ago: executing program 0 (id=1613): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) syz_emit_ethernet(0x0, 0x0, 0x0) 4.736379094s ago: executing program 0 (id=1614): socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) socket$nl_generic(0x10, 0x3, 0x10) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x5, 0x8, 0x80}, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(r2, 0x40084146, &(0x7f0000000140)=0xfff) 4.619102796s ago: executing program 3 (id=1615): getpid() r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-aesni)\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setuid(0xee01) r4 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000008c0)=@newqdisc={0x48, 0x14, 0xf0b, 0xfffffffe, 0x0, {0x2, 0x0, 0x0, 0x0, {0x0, 0x7}, {0x1, 0x5}, {0xe, 0xd}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x0, 0x0, 0x1ffe, 0x0, 0x1d64765e, 0x1}}, {0x4}}]}]}, 0x48}}, 0x8000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_GET(r5, 0x4b72, &(0x7f0000000600)={0x1, 0x0, 0x0, 0x18, 0x2000278, 0x0}) 3.095398819s ago: executing program 4 (id=1617): r0 = socket(0x2, 0x3, 0xff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='proc\x00', 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0) 2.929047447s ago: executing program 0 (id=1618): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000040000701feffffff0000"], 0x38}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0xfe12) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x24, 0x28, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfff1}, {0xfff2, 0xfff1}}}, 0x24}}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 2.848554624s ago: executing program 4 (id=1619): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0) sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000"], 0x38}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) 2.458110964s ago: executing program 4 (id=1620): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="070600000000000000002d00000005002b0000000000060006000000000008002f00040000000c00050000000000000000000a0001007770616e30"], 0x4c}}, 0x20048840) 2.429486672s ago: executing program 3 (id=1621): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x40000) ioctl$DRM_IOCTL_VERSION(r0, 0xc0406400, &(0x7f00000001c0)={0x800, 0x9, 0x0, 0x0, 0x0, 0x58, &(0x7f0000000140)=""/88, 0xd0, 0xffffffffffffffff}) 2.271956197s ago: executing program 4 (id=1622): r0 = msgget$private(0x0, 0x44) msgsnd(r0, &(0x7f0000000380)={0x1}, 0x8, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) msgsnd(r0, &(0x7f0000001040)={0x2}, 0x8, 0x800) 2.092239627s ago: executing program 4 (id=1623): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x22, &(0x7f0000000300)=0x1, 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x16481, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x2) ptrace$pokeuser(0x6, r3, 0x388, 0x41d9fda7) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, r5) socket$netlink(0x10, 0x3, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r6) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r7, 0x107, 0xd, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x8c, &(0x7f00000000c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r7]) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, r6}, 0x94) 2.089991053s ago: executing program 0 (id=1624): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0), 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000"], 0x14}, 0x1, 0x0, 0x0, 0x4015}, 0x24040004) recvmmsg(r3, &(0x7f0000002080)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x7aaf804d}, {{0x0, 0x0, 0x0}, 0xd}, {{0x0, 0x0, &(0x7f00000005c0)}, 0x81}], 0x4, 0x12002, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x93) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0xa, 0x4e21, 0x80000, @loopback, 0x3}, 0x1c, 0x0}, 0x440e0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 482.811868ms ago: executing program 4 (id=1625): syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r0 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0xcd79, 0x141000) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x8010) ioctl$DVB_DEMUX_DMX_SET_FILTER(r0, 0x403c6f2b, &(0x7f0000000080)={0x3, {"e249a38e7b0252a0eea064156561fd0a", "ea6f962fefc5a5a1d5cc0a6a16debd47", "47375848a00f6e08b5c9c718f83a0311"}, 0xfffffff9, 0x5}) 2.200589ms ago: executing program 3 (id=1626): socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r2 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) socket$nl_generic(0x10, 0x3, 0x10) write$snddsp(r2, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r2, 0x4144, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x5, 0x8, 0x80}, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(r2, 0x40084146, &(0x7f0000000140)=0xfff) 0s ago: executing program 0 (id=1627): syz_open_dev$vim2m(&(0x7f0000000000), 0xb173, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x15, 0x3, 'sh\x00', 0x1, 0x4, 0x6d}, 0x2c) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000080)={0x8, 0x6, 0x2}, 0x10) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000000)={{0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e21, 0x3, 'wrr\x00', 0xd, 0x81, 0x2e}, {@rand_addr=0xac1414aa, 0x4e23, 0x3, 0x1cb, 0x12d5c, 0x12d59}}, 0x44) kernel console output (not intermixed with test programs): urer: syz [ 537.779994][ T5854] usb 2-1: SerialNumber: syz [ 538.242556][ T5854] usbhid 2-1:1.0: can't add hid device: -71 [ 538.242638][ T5854] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 538.311946][ T5854] usb 2-1: USB disconnect, device number 7 [ 544.260464][ T1312] nvmet: connect request for invalid subsystem t! [ 544.264470][ T8550] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "t" [ 545.345177][ T8578] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 548.986652][ T5854] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 549.018421][ T45] bridge_slave_1: left allmulticast mode [ 549.018463][ T45] bridge_slave_1: left promiscuous mode [ 549.018752][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 549.146620][ T5854] usb 1-1: Using ep0 maxpacket: 8 [ 549.147501][ T5854] usb 1-1: New USB device found, idVendor=0b0e, idProduct=ffff, bcdDevice= 0.40 [ 549.149090][ T5854] usb 1-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 549.149122][ T5854] usb 1-1: config 1 interface 0 has no altsetting 0 [ 549.152197][ T5854] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.152233][ T5854] usb 1-1: Product: syz [ 549.152247][ T5854] usb 1-1: Manufacturer: syz [ 549.152262][ T5854] usb 1-1: SerialNumber: syz [ 549.562842][ T5854] usbhid 1-1:1.0: can't add hid device: -71 [ 549.562977][ T5854] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 549.592805][ T45] bridge_slave_0: left allmulticast mode [ 549.592848][ T45] bridge_slave_0: left promiscuous mode [ 549.593635][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 549.630845][ T5854] usb 1-1: USB disconnect, device number 14 [ 551.799950][ T45] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 552.962587][ T45] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 553.111295][ T45] bond0 (unregistering): Released all slaves [ 553.437876][ T8441] bridge0: port 1(bridge_slave_0) entered blocking state [ 553.438003][ T8441] bridge0: port 1(bridge_slave_0) entered disabled state [ 553.438224][ T8441] bridge_slave_0: entered allmulticast mode [ 553.441127][ T8441] bridge_slave_0: entered promiscuous mode [ 554.456008][ T5247] 8021q: adding VLAN 0 to HW filter on device eth5 [ 554.460396][ T8441] bridge0: port 2(bridge_slave_1) entered blocking state [ 554.460538][ T8441] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.460730][ T8441] bridge_slave_1: entered allmulticast mode [ 554.483898][ T8441] bridge_slave_1: entered promiscuous mode [ 554.770179][ T8441] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 554.772655][ T8441] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 554.924875][ T8441] team0: Port device team_slave_0 added [ 555.089147][ T8441] team0: Port device team_slave_1 added [ 556.648559][ T8441] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 556.648579][ T8441] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 556.648608][ T8441] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 556.946582][ T45] hsr_slave_0: left promiscuous mode [ 557.001749][ T45] hsr_slave_1: left promiscuous mode [ 557.004660][ T45] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 557.054113][ T45] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 563.199718][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.199798][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.477801][ T45] team0 (unregistering): Port device team_slave_1 removed [ 563.528324][ T45] team0 (unregistering): Port device team_slave_0 removed [ 563.930994][ T8441] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 563.931016][ T8441] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 563.931046][ T8441] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 563.934862][ T5247] 8021q: adding VLAN 0 to HW filter on device eth6 [ 565.418535][ T8441] hsr_slave_0: entered promiscuous mode [ 565.424535][ T8441] hsr_slave_1: entered promiscuous mode [ 565.430604][ T8441] debugfs: 'hsr0' already exists in 'hsr' [ 565.430633][ T8441] Cannot create hsr debugfs directory [ 582.033203][ T5603] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 582.064738][ T5603] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 582.085125][ T5603] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 582.126114][ T5603] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 582.127193][ T5603] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 584.264416][ T60] Bluetooth: hci0: command tx timeout [ 586.969136][ T60] Bluetooth: hci0: command tx timeout [ 587.707059][ T8818] netlink: 'syz.1.731': attribute type 29 has an invalid length. [ 587.715932][ T8818] netlink: 'syz.1.731': attribute type 29 has an invalid length. [ 587.738696][ T8818] netlink: 'syz.1.731': attribute type 29 has an invalid length. [ 588.372663][ T949] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 588.537546][ T949] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 588.539127][ T949] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 588.539156][ T949] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 588.539176][ T949] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 588.539229][ T949] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 588.542083][ T949] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 588.542108][ T949] usb 2-1: Product: syz [ 588.542124][ T949] usb 2-1: Manufacturer: syz [ 588.636304][ T949] cdc_wdm 2-1:1.0: skipping garbage [ 588.636330][ T949] cdc_wdm 2-1:1.0: skipping garbage [ 588.688876][ T949] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 588.688962][ T949] cdc_wdm 2-1:1.0: Unknown control protocol [ 589.046522][ T60] Bluetooth: hci0: command tx timeout [ 589.111329][ T8827] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 589.114405][ T8827] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 589.173717][ T6708] usb 2-1: USB disconnect, device number 8 [ 589.826640][ T6708] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 590.006732][ T6708] usb 4-1: Using ep0 maxpacket: 32 [ 590.007758][ T6708] usb 4-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 590.009275][ T6708] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 591.211943][ T60] Bluetooth: hci0: command tx timeout [ 591.272802][ T6708] usb 4-1: config 0 descriptor?? [ 591.368560][ T6708] as10x_usb: device has been detected [ 591.370035][ T6708] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 591.462513][ T6708] usb 4-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 591.517027][ T6708] as10x_usb: error during firmware upload part1 [ 591.517724][ T6708] Registered device nBox DVB-T Dongle [ 593.517998][ T5854] usb 4-1: USB disconnect, device number 7 [ 593.876758][ T5854] Unregistered device nBox DVB-T Dongle [ 593.881219][ T5854] as10x_usb: device has been disconnected [ 595.136667][ T8785] bridge0: port 1(bridge_slave_0) entered blocking state [ 595.136757][ T8785] bridge0: port 1(bridge_slave_0) entered disabled state [ 595.136898][ T8785] bridge_slave_0: entered allmulticast mode [ 595.177521][ T8785] bridge_slave_0: entered promiscuous mode [ 595.201515][ T8785] bridge0: port 2(bridge_slave_1) entered blocking state [ 595.209822][ T8785] bridge0: port 2(bridge_slave_1) entered disabled state [ 595.210039][ T8785] bridge_slave_1: entered allmulticast mode [ 595.243008][ T8785] bridge_slave_1: entered promiscuous mode [ 595.686811][ T8785] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 595.717481][ T8785] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 597.806113][ T8785] team0: Port device team_slave_0 added [ 597.935714][ T8785] team0: Port device team_slave_1 added [ 598.159542][ T8785] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 598.159557][ T8785] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 598.159573][ T8785] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 598.276242][ T8785] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 598.276261][ T8785] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 598.276284][ T8785] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 598.666945][ T183] bridge_slave_1: left allmulticast mode [ 598.666987][ T183] bridge_slave_1: left promiscuous mode [ 598.667277][ T183] bridge0: port 2(bridge_slave_1) entered disabled state [ 598.855198][ T183] bridge_slave_0: left allmulticast mode [ 598.855238][ T183] bridge_slave_0: left promiscuous mode [ 598.855532][ T183] bridge0: port 1(bridge_slave_0) entered disabled state [ 599.610857][ T8962] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 599.711940][ T183] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 600.942353][ T183] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 601.158748][ T183] bond0 (unregistering): Released all slaves [ 601.227120][ T8976] Bluetooth: MGMT ver 1.23 [ 601.260690][ T8785] hsr_slave_0: entered promiscuous mode [ 601.267122][ T8785] hsr_slave_1: entered promiscuous mode [ 601.268065][ T8785] debugfs: 'hsr0' already exists in 'hsr' [ 601.268089][ T8785] Cannot create hsr debugfs directory [ 601.865815][ T5247] 8021q: adding VLAN 0 to HW filter on device eth5 [ 602.019996][ T183] hsr_slave_0: left promiscuous mode [ 602.063238][ T183] hsr_slave_1: left promiscuous mode [ 602.064637][ T183] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 602.090312][ T183] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 604.413275][ T183] team0 (unregistering): Port device team_slave_1 removed [ 604.551843][ T183] team0 (unregistering): Port device team_slave_0 removed [ 609.145669][ T9021] FAULT_INJECTION: forcing a failure. [ 609.145669][ T9021] name failslab, interval 1, probability 0, space 0, times 0 [ 609.145711][ T9021] CPU: 0 UID: 0 PID: 9021 Comm: syz.4.783 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 609.145737][ T9021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 609.145750][ T9021] Call Trace: [ 609.145759][ T9021] [ 609.145769][ T9021] dump_stack_lvl+0xe8/0x150 [ 609.145807][ T9021] should_fail_ex+0x46b/0x600 [ 609.145842][ T9021] should_failslab+0xa8/0x100 [ 609.145876][ T9021] ? vm_area_alloc+0x24/0x140 [ 609.145908][ T9021] kmem_cache_alloc_noprof+0x9e/0x690 [ 609.145938][ T9021] ? vm_area_alloc+0x24/0x140 [ 609.145975][ T9021] vm_area_alloc+0x24/0x140 [ 609.146007][ T9021] mmap_region+0x12e1/0x2220 [ 609.146042][ T9021] ? do_raw_spin_lock+0x12b/0x2f0 [ 609.146069][ T9021] ? __pfx_mmap_region+0x10/0x10 [ 609.146095][ T9021] ? rcu_is_watching+0x16/0xb0 [ 609.146128][ T9021] ? trace_hrtimer_start+0x82/0x200 [ 609.146157][ T9021] ? hrtimer_start_range_ns_common+0x7d3/0xb70 [ 609.146200][ T9021] ? lockdep_hardirqs_on+0x7b/0x110 [ 609.146295][ T9021] ? futex_unqueue+0x22/0x240 [ 609.146366][ T9021] ? cap_mmap_addr+0xb6/0x100 [ 609.146399][ T9021] ? bpf_lsm_mmap_addr+0x9/0x50 [ 609.146419][ T9021] ? security_mmap_addr+0x71/0x240 [ 609.146455][ T9021] do_mmap+0xe0e/0x1310 [ 609.146492][ T9021] ? __pfx_do_mmap+0x10/0x10 [ 609.146527][ T9021] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 609.146576][ T9021] ? rwbase_write_lock+0x550/0x720 [ 609.146614][ T9021] vm_mmap_pgoff+0x275/0x4e0 [ 609.146648][ T9021] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 609.146675][ T9021] ? rcu_is_watching+0x16/0xb0 [ 609.146715][ T9021] ? __x64_sys_mmap+0x7f/0x140 [ 609.146745][ T9021] do_syscall_64+0x166/0x520 [ 609.146765][ T9021] ? trace_irq_disable+0x3b/0x140 [ 609.146793][ T9021] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.146816][ T9021] ? clear_bhb_loop+0x70/0xc0 [ 609.146845][ T9021] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.146867][ T9021] RIP: 0033:0x7f31a4b5e159 [ 609.146889][ T9021] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 609.146908][ T9021] RSP: 002b:00007f31a2db6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 609.146933][ T9021] RAX: ffffffffffffffda RBX: 00007f31a4de5fa0 RCX: 00007f31a4b5e159 [ 609.146949][ T9021] RDX: 0000000000000003 RSI: 0000000000001000 RDI: 0000000000000000 [ 609.146963][ T9021] RBP: 00007f31a4bf506b R08: ffffffffffffffff R09: 0000000000000000 [ 609.146978][ T9021] R10: 0000000000000032 R11: 0000000000000246 R12: 0000000000000000 [ 609.146992][ T9021] R13: 00007f31a4de6038 R14: 00007f31a4de5fa0 R15: 00007ffe016313d8 [ 609.147029][ T9021] [ 621.538924][ T9143] netlink: 'syz.1.809': attribute type 29 has an invalid length. [ 621.572269][ T9143] netlink: 'syz.1.809': attribute type 29 has an invalid length. [ 621.576296][ T9143] netlink: 'syz.1.809': attribute type 29 has an invalid length. [ 623.478932][ T8785] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 623.554649][ T8785] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 623.567211][ T8785] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 623.633271][ T8785] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 623.639757][ T8785] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 623.677013][ T8785] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 623.685297][ T8785] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 624.873283][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.873454][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.979146][ T8785] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 625.542191][ T8785] 8021q: adding VLAN 0 to HW filter on device bond0 [ 625.637666][ T8785] 8021q: adding VLAN 0 to HW filter on device team0 [ 625.708330][ T1291] bridge0: port 1(bridge_slave_0) entered blocking state [ 625.708496][ T1291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 625.733923][ T1302] bridge0: port 2(bridge_slave_1) entered blocking state [ 625.734158][ T1302] bridge0: port 2(bridge_slave_1) entered forwarding state [ 630.152711][ T9208] netlink: 'syz.4.821': attribute type 29 has an invalid length. [ 630.153733][ T9208] netlink: 'syz.4.821': attribute type 29 has an invalid length. [ 630.172934][ T9208] netlink: 'syz.4.821': attribute type 29 has an invalid length. [ 631.022709][ T8785] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 633.529631][ T8785] veth0_vlan: entered promiscuous mode [ 633.550937][ T8785] veth1_vlan: entered promiscuous mode [ 634.242328][ T8785] veth0_macvtap: entered promiscuous mode [ 634.308482][ T8785] veth1_macvtap: entered promiscuous mode [ 634.434065][ T8785] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 634.472921][ T8785] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 634.648043][ T1302] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.937312][ T1312] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.937366][ T1312] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.937405][ T1312] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 640.654859][ T1272] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 640.654885][ T1272] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 644.393595][ T5603] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 644.427601][ T5603] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 644.431318][ T5603] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 644.477349][ T5603] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 644.480738][ T5603] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 645.919622][ T9307] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 646.795508][ T5603] Bluetooth: hci5: command tx timeout [ 647.221522][ T9306] gadgetfs: bound to dummy_udc driver [ 647.596564][ T5775] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 647.597048][ C0] gadgetfs: connected [ 647.597667][ T5775] gadgetfs: disconnected [ 647.756920][ C0] gadgetfs: connected [ 647.758802][ T5775] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 647.760689][ T5775] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 647.760734][ T5775] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 647.868881][ T9326] netlink: 28 bytes leftover after parsing attributes in process `syz.4.852'. [ 647.890940][ T9306] gadgetfs: suspended from state 3 [ 647.891462][ T9306] gadgetfs: disconnected [ 647.893983][ T5775] usb 1-1: can't set config #1, error -71 [ 647.916204][ T5775] usb 1-1: USB disconnect, device number 15 [ 648.602454][ T12] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 648.748291][ T9330] syz.4.854 (9330) used greatest stack depth: 16648 bytes left [ 649.034773][ T5603] Bluetooth: hci5: command tx timeout [ 651.036574][ T5603] Bluetooth: hci5: command tx timeout [ 653.116515][ T5603] Bluetooth: hci5: command tx timeout [ 653.415301][ T12] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 653.553253][ T9371] syz.3.865 (9371) used greatest stack depth: 16384 bytes left [ 655.096119][ T5775] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 655.286748][ T5854] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 655.355337][ T5775] usb 4-1: Using ep0 maxpacket: 32 [ 655.394911][ T5775] usb 4-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 655.396583][ T5775] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 655.396607][ T5775] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 655.396625][ T5775] usb 4-1: config 0 has no interface number 0 [ 655.396689][ T5775] usb 4-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 655.402233][ T5775] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 655.402259][ T5775] usb 4-1: Product: syz [ 655.402273][ T5775] usb 4-1: Manufacturer: syz [ 655.402286][ T5775] usb 4-1: SerialNumber: syz [ 655.429052][ T5775] usb 4-1: config 0 descriptor?? [ 655.539949][ T5854] usb 5-1: unable to get BOS descriptor or descriptor too short [ 655.548449][ T5854] usb 5-1: not running at top speed; connect to a high speed hub [ 655.548489][ T5854] usb 5-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=e1.7b [ 655.594583][ T5854] usb 5-1: config 199 has an invalid interface number: 169 but max is 1 [ 655.594617][ T5854] usb 5-1: config 199 has an invalid interface number: 102 but max is 1 [ 655.594641][ T5854] usb 5-1: config 199 has no interface number 0 [ 655.594661][ T5854] usb 5-1: config 199 has no interface number 1 [ 655.594714][ T5854] usb 5-1: config 199 interface 169 has no altsetting 0 [ 655.594737][ T5854] usb 5-1: config 199 interface 102 has no altsetting 0 [ 655.604279][ T5854] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 655.604310][ T5854] usb 5-1: Product: syz [ 655.604341][ T5854] usb 5-1: Manufacturer: syz [ 655.604355][ T5854] usb 5-1: SerialNumber: syz [ 655.875522][ T12] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 655.951779][ T9387] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 655.955038][ T9387] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 656.307715][ T5775] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.119/input/input13 [ 656.498983][ T9388] warning: `syz.3.868' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 657.452812][ T12] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 658.104808][ T5775] usb 4-1: USB disconnect, device number 8 [ 658.270885][ T5854] usb_ehset_test 5-1:199.169: probe with driver usb_ehset_test failed with error -32 [ 658.329532][ T5854] usb_ehset_test 5-1:199.102: probe with driver usb_ehset_test failed with error -32 [ 658.465306][ T5854] usb 5-1: USB disconnect, device number 12 [ 661.080300][ T9411] program syz.4.872 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 661.080627][ T9411] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 664.567763][ T9283] bridge0: port 1(bridge_slave_0) entered blocking state [ 664.567966][ T9283] bridge0: port 1(bridge_slave_0) entered disabled state [ 664.568195][ T9283] bridge_slave_0: entered allmulticast mode [ 664.571319][ T9283] bridge_slave_0: entered promiscuous mode [ 664.605823][ T9283] bridge0: port 2(bridge_slave_1) entered blocking state [ 664.605983][ T9283] bridge0: port 2(bridge_slave_1) entered disabled state [ 664.606202][ T9283] bridge_slave_1: entered allmulticast mode [ 664.630733][ T9283] bridge_slave_1: entered promiscuous mode [ 664.847474][ T12] bridge_slave_1: left allmulticast mode [ 664.847515][ T12] bridge_slave_1: left promiscuous mode [ 664.847802][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 665.028517][ T12] bridge_slave_0: left allmulticast mode [ 665.028560][ T12] bridge_slave_0: left promiscuous mode [ 665.028824][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 665.727179][ T9457] program syz.3.887 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 665.727481][ T9457] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 671.408424][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 671.550750][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 671.609589][ T12] bond0 (unregistering): Released all slaves [ 671.796096][ T9283] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 672.121531][ T9283] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 673.369174][ T9283] team0: Port device team_slave_0 added [ 673.395048][ T9283] team0: Port device team_slave_1 added [ 673.826791][ T5871] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 673.976511][ T5871] usb 4-1: Using ep0 maxpacket: 8 [ 673.977342][ T5871] usb 4-1: New USB device found, idVendor=0b0e, idProduct=ffff, bcdDevice= 0.40 [ 673.978997][ T5871] usb 4-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 673.979029][ T5871] usb 4-1: config 1 interface 0 has no altsetting 0 [ 673.981712][ T5871] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.981737][ T5871] usb 4-1: Product: syz [ 673.981752][ T5871] usb 4-1: Manufacturer: syz [ 673.981768][ T5871] usb 4-1: SerialNumber: syz [ 674.194432][ T9283] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 674.194452][ T9283] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.194476][ T9283] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 674.242007][ T9283] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 674.242026][ T9283] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.242054][ T9283] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 674.373614][ T5871] usbhid 4-1:1.0: can't add hid device: -71 [ 674.373753][ T5871] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 674.463206][ T5871] usb 4-1: USB disconnect, device number 9 [ 676.232847][ T9283] hsr_slave_0: entered promiscuous mode [ 676.251419][ T9283] hsr_slave_1: entered promiscuous mode [ 676.266593][ T9283] debugfs: 'hsr0' already exists in 'hsr' [ 676.266626][ T9283] Cannot create hsr debugfs directory [ 679.271490][ T12] hsr_slave_0: left promiscuous mode [ 684.066561][ T12] hsr_slave_1: left promiscuous mode [ 684.067582][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 684.067603][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 684.135907][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 684.135931][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 684.269054][ T12] veth1_macvtap: left promiscuous mode [ 684.269305][ T12] veth0_macvtap: left promiscuous mode [ 684.269463][ T12] veth1_vlan: left promiscuous mode [ 684.269576][ T12] veth0_vlan: left promiscuous mode [ 687.700395][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 687.700475][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 689.815606][ T12] team0 (unregistering): Port device team_slave_1 removed [ 689.887305][ T12] team0 (unregistering): Port device team_slave_0 removed [ 691.026171][ T9561] gadgetfs: bound to dummy_udc driver [ 694.642781][ T5247] 8021q: adding VLAN 0 to HW filter on device eth5 [ 694.654408][ T9572] netlink: 4 bytes leftover after parsing attributes in process `syz.0.917'. [ 694.887840][ T9580] netlink: 72 bytes leftover after parsing attributes in process `syz.0.920'. [ 695.217103][ T9584] netlink: 64 bytes leftover after parsing attributes in process `syz.0.920'. [ 699.729545][ T198] IPVS: starting estimator thread 0... [ 699.926644][ T9606] IPVS: using max 8 ests per chain, 19200 per kthread [ 700.501103][ T9612] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 703.845261][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 703.900380][ T60] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 703.918574][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 703.945166][ T60] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 703.964955][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 705.796290][ T9659] FAULT_INJECTION: forcing a failure. [ 705.796290][ T9659] name failslab, interval 1, probability 0, space 0, times 0 [ 705.796320][ T9659] CPU: 1 UID: 0 PID: 9659 Comm: syz.3.931 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 705.796336][ T9659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 705.796349][ T9659] Call Trace: [ 705.796358][ T9659] [ 705.796367][ T9659] dump_stack_lvl+0xe8/0x150 [ 705.796405][ T9659] should_fail_ex+0x46b/0x600 [ 705.796441][ T9659] should_failslab+0xa8/0x100 [ 705.796482][ T9659] __kmalloc_noprof+0xfb/0x790 [ 705.796512][ T9659] ? snd_pcm_hw_refine+0xa18/0x17d0 [ 705.796595][ T9659] ? snd_pcm_hw_refine+0xa18/0x17d0 [ 705.796626][ T9659] snd_pcm_hw_refine+0xa18/0x17d0 [ 705.796669][ T9659] ? __pfx_snd_pcm_hw_refine+0x10/0x10 [ 705.796756][ T9659] snd_pcm_hw_param_first+0x3ab/0xb10 [ 705.796820][ T9659] snd_pcm_hw_param_near+0x434/0x4d0 [ 705.796879][ T9659] snd_pcm_oss_change_params_locked+0x1e07/0x3c80 [ 705.796943][ T9659] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 705.796971][ T9659] ? do_raw_spin_lock+0x12b/0x2f0 [ 705.797010][ T9659] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 705.797048][ T9659] ? mutex_lock_interruptible_nested+0x152/0x1d0 [ 705.797075][ T9659] ? snd_pcm_oss_write+0x207/0xb40 [ 705.797103][ T9659] snd_pcm_oss_write+0x274/0xb40 [ 705.797145][ T9659] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 705.797172][ T9659] vfs_write+0x29f/0xbb0 [ 705.797204][ T9659] ? __pfx_vfs_write+0x10/0x10 [ 705.797231][ T9659] ? __fget_files+0x2a/0x420 [ 705.797257][ T9659] ? __fget_files+0x2a/0x420 [ 705.797278][ T9659] ? __fget_files+0x3a8/0x420 [ 705.797301][ T9659] ? __fget_files+0x2a/0x420 [ 705.797333][ T9659] ksys_write+0x156/0x270 [ 705.797359][ T9659] ? __pfx_ksys_write+0x10/0x10 [ 705.797394][ T9659] do_syscall_64+0x166/0x520 [ 705.797413][ T9659] ? trace_irq_disable+0x3b/0x140 [ 705.797438][ T9659] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 705.797458][ T9659] ? clear_bhb_loop+0x70/0xc0 [ 705.797485][ T9659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 705.797506][ T9659] RIP: 0033:0x7ff86b86e159 [ 705.797529][ T9659] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 705.797548][ T9659] RSP: 002b:00007ff869ac6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 705.797572][ T9659] RAX: ffffffffffffffda RBX: 00007ff86baf5fa0 RCX: 00007ff86b86e159 [ 705.797588][ T9659] RDX: 0000000000088020 RSI: 0000200000002000 RDI: 0000000000000004 [ 705.797603][ T9659] RBP: 00007ff86b90506b R08: 0000000000000000 R09: 0000000000000000 [ 705.797615][ T9659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 705.797628][ T9659] R13: 00007ff86baf6038 R14: 00007ff86baf5fa0 R15: 00007ffeb0448cb8 [ 705.797665][ T9659] [ 706.166560][ T60] Bluetooth: hci0: command tx timeout [ 708.236506][ T60] Bluetooth: hci0: command tx timeout [ 709.332631][ T12] bridge_slave_1: left allmulticast mode [ 709.332674][ T12] bridge_slave_1: left promiscuous mode [ 709.332976][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 709.727516][ T12] bridge_slave_0: left allmulticast mode [ 709.727544][ T12] bridge_slave_0: left promiscuous mode [ 709.727724][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 710.702145][ T60] Bluetooth: hci0: command tx timeout [ 711.189326][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 711.586704][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 711.691890][ T9713] program syz.1.939 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 711.696702][ T9713] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 713.254404][ T60] Bluetooth: hci0: command tx timeout [ 713.301631][ T12] bond0 (unregistering): Released all slaves [ 714.348811][ T12] hsr_slave_0: left promiscuous mode [ 714.388167][ T12] hsr_slave_1: left promiscuous mode [ 714.391344][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 714.437576][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 718.104539][ T9754] FAULT_INJECTION: forcing a failure. [ 718.104539][ T9754] name failslab, interval 1, probability 0, space 0, times 0 [ 718.104649][ T9754] CPU: 0 UID: 0 PID: 9754 Comm: syz.4.948 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 718.104677][ T9754] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 718.104690][ T9754] Call Trace: [ 718.104699][ T9754] [ 718.104709][ T9754] dump_stack_lvl+0xe8/0x150 [ 718.104749][ T9754] should_fail_ex+0x46b/0x600 [ 718.104785][ T9754] should_failslab+0xa8/0x100 [ 718.104820][ T9754] ? do_getname+0x2e/0x250 [ 718.104853][ T9754] kmem_cache_alloc_noprof+0x9e/0x690 [ 718.104883][ T9754] ? do_getname+0x2e/0x250 [ 718.104924][ T9754] do_getname+0x2e/0x250 [ 718.104955][ T9754] ? getname_flags+0x11/0x20 [ 718.104992][ T9754] do_sys_openat2+0xcc/0x200 [ 718.105026][ T9754] ? lockdep_hardirqs_on+0x7b/0x110 [ 718.105061][ T9754] ? __pfx_do_sys_openat2+0x10/0x10 [ 718.105110][ T9754] __x64_sys_openat+0x138/0x170 [ 718.105151][ T9754] do_syscall_64+0x166/0x520 [ 718.105173][ T9754] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.105196][ T9754] ? clear_bhb_loop+0x70/0xc0 [ 718.105232][ T9754] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.105255][ T9754] RIP: 0033:0x7f31a4b1e98e [ 718.105277][ T9754] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 718.105298][ T9754] RSP: 002b:00007f31a2d94ec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 718.105325][ T9754] RAX: ffffffffffffffda RBX: 00007f31a2d956c0 RCX: 00007f31a4b1e98e [ 718.105342][ T9754] RDX: 0000000000000002 RSI: 00007f31a2d94f90 RDI: ffffffffffffff9c [ 718.105358][ T9754] RBP: 00007f31a4bf506b R08: 0000000000000000 R09: 0000000000000000 [ 718.105373][ T9754] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 718.105388][ T9754] R13: 00007f31a4de6128 R14: 00007f31a4de6090 R15: 00007ffe016313d8 [ 718.105424][ T9754] [ 719.114836][ T12] team0 (unregistering): Port device team_slave_1 removed [ 719.301617][ T12] team0 (unregistering): Port device team_slave_0 removed [ 722.676755][ T9778] program syz.4.949 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 722.677046][ T9778] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 722.875860][ T9638] bridge0: port 1(bridge_slave_0) entered blocking state [ 722.875939][ T9638] bridge0: port 1(bridge_slave_0) entered disabled state [ 722.876068][ T9638] bridge_slave_0: entered allmulticast mode [ 722.885539][ T9638] bridge_slave_0: entered promiscuous mode [ 722.905188][ T9638] bridge0: port 2(bridge_slave_1) entered blocking state [ 722.905408][ T9638] bridge0: port 2(bridge_slave_1) entered disabled state [ 722.905599][ T9638] bridge_slave_1: entered allmulticast mode [ 722.921426][ T9638] bridge_slave_1: entered promiscuous mode [ 723.049842][ T9638] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 723.054359][ T9638] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 723.388579][ T9638] team0: Port device team_slave_0 added [ 723.392539][ T9638] team0: Port device team_slave_1 added [ 723.979219][ T9638] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 723.979258][ T9638] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 723.979304][ T9638] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 724.061888][ T9638] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 724.061910][ T9638] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 724.061939][ T9638] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 724.340149][ T9638] hsr_slave_0: entered promiscuous mode [ 724.486954][ T9638] hsr_slave_1: entered promiscuous mode [ 724.488125][ T9638] debugfs: 'hsr0' already exists in 'hsr' [ 724.488152][ T9638] Cannot create hsr debugfs directory [ 726.187131][ T9812] kvm: apic: phys broadcast and lowest prio [ 728.703620][ T5775] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 728.868585][ T5775] usb 4-1: Using ep0 maxpacket: 32 [ 728.869385][ T5775] usb 4-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 728.870476][ T5775] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 728.870493][ T5775] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 728.870504][ T5775] usb 4-1: config 0 has no interface number 0 [ 728.870531][ T5775] usb 4-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 728.873678][ T5775] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 728.873693][ T5775] usb 4-1: Product: syz [ 728.873702][ T5775] usb 4-1: Manufacturer: syz [ 728.873710][ T5775] usb 4-1: SerialNumber: syz [ 728.984527][ T5775] usb 4-1: config 0 descriptor?? [ 729.161566][ T5775] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.119/input/input14 [ 729.592658][ T9826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 729.618826][ T9826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 731.170495][ T9638] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 731.211742][ T5718] usb 4-1: USB disconnect, device number 10 [ 731.384304][ T9638] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 731.405993][ T9638] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 731.415301][ T9837] netlink: 72 bytes leftover after parsing attributes in process `syz.3.971'. [ 731.739434][ T9839] netlink: 64 bytes leftover after parsing attributes in process `syz.3.971'. [ 733.594020][ T9638] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 733.609089][ T9638] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 733.798920][ T9638] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 733.817317][ T9638] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 735.019981][ T9638] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 739.002532][ T9638] 8021q: adding VLAN 0 to HW filter on device bond0 [ 739.100527][ T9638] 8021q: adding VLAN 0 to HW filter on device team0 [ 739.125563][ T1035] bridge0: port 1(bridge_slave_0) entered blocking state [ 739.125711][ T1035] bridge0: port 1(bridge_slave_0) entered forwarding state [ 739.161620][ T1333] bridge0: port 2(bridge_slave_1) entered blocking state [ 739.161862][ T1333] bridge0: port 2(bridge_slave_1) entered forwarding state [ 744.536959][ T9638] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 747.817974][ T9905] FAULT_INJECTION: forcing a failure. [ 747.817974][ T9905] name fail_futex, interval 1, probability 0, space 0, times 0 [ 747.818015][ T9905] CPU: 1 UID: 0 PID: 9905 Comm: syz.0.978 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 747.818042][ T9905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 747.818056][ T9905] Call Trace: [ 747.818066][ T9905] [ 747.818075][ T9905] dump_stack_lvl+0xe8/0x150 [ 747.818116][ T9905] should_fail_ex+0x46b/0x600 [ 747.818152][ T9905] get_futex_key+0x1b4/0x1580 [ 747.818193][ T9905] ? is_bpf_text_address+0x26/0x2b0 [ 747.818231][ T9905] ? __pfx_get_futex_key+0x10/0x10 [ 747.818260][ T9905] ? is_bpf_text_address+0x292/0x2b0 [ 747.818292][ T9905] ? is_bpf_text_address+0x26/0x2b0 [ 747.818328][ T9905] ? kernel_text_address+0xa5/0xe0 [ 747.818360][ T9905] futex_wait_setup+0x4a/0x590 [ 747.818393][ T9905] ? __futex_wait+0xe1/0x410 [ 747.818425][ T9905] __futex_wait+0x161/0x410 [ 747.818458][ T9905] ? __pfx___futex_wait+0x10/0x10 [ 747.818490][ T9905] ? __pfx_futex_wake_mark+0x10/0x10 [ 747.818521][ T9905] ? futex_hash+0x4e/0x2b0 [ 747.818555][ T9905] ? futex_hash+0x4e/0x2b0 [ 747.818581][ T9905] ? futex_hash+0x275/0x2b0 [ 747.818613][ T9905] futex_wait+0x121/0x390 [ 747.818641][ T9905] ? __pfx_futex_wait+0x10/0x10 [ 747.818684][ T9905] do_futex+0x3e7/0x4e0 [ 747.818711][ T9905] ? __pfx_do_futex+0x10/0x10 [ 747.818728][ T9905] ? kmem_cache_free+0x187/0x6d0 [ 747.818770][ T9905] ? do_sys_openat2+0x14e/0x200 [ 747.818808][ T9905] __se_sys_futex+0x3a8/0x450 [ 747.818837][ T9905] ? __pfx___se_sys_futex+0x10/0x10 [ 747.818858][ T9905] ? rcu_is_watching+0x16/0xb0 [ 747.818895][ T9905] ? __x64_sys_futex+0x21/0xf0 [ 747.818922][ T9905] do_syscall_64+0x166/0x520 [ 747.818944][ T9905] ? trace_irq_disable+0x3b/0x140 [ 747.818972][ T9905] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 747.818995][ T9905] ? clear_bhb_loop+0x70/0xc0 [ 747.819024][ T9905] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 747.819046][ T9905] RIP: 0033:0x7f414e29e159 [ 747.819069][ T9905] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 747.819089][ T9905] RSP: 002b:00007f414c4f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 747.819114][ T9905] RAX: ffffffffffffffda RBX: 00007f414e525fa8 RCX: 00007f414e29e159 [ 747.819131][ T9905] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f414e525fa8 [ 747.819147][ T9905] RBP: 00007f414e525fa0 R08: 0000000000000000 R09: 0000000000000000 [ 747.819163][ T9905] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 747.819177][ T9905] R13: 00007f414e526038 R14: 00007fffe29a62a0 R15: 00007fffe29a6388 [ 747.819212][ T9905] [ 748.519693][ T9638] veth0_vlan: entered promiscuous mode [ 748.591518][ T9638] veth1_vlan: entered promiscuous mode [ 750.803760][ T9638] veth0_macvtap: entered promiscuous mode [ 750.971173][ T9638] veth1_macvtap: entered promiscuous mode [ 751.133769][ T9638] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 751.165865][ T9638] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 751.229481][ T67] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.229536][ T67] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.229577][ T67] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.229617][ T67] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.767113][ T9931] netlink: 72 bytes leftover after parsing attributes in process `syz.1.981'. [ 752.173521][ T9934] netlink: 64 bytes leftover after parsing attributes in process `syz.1.981'. [ 752.786090][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.786172][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 754.135727][ T45] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 754.135755][ T45] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 756.094715][ T1272] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 756.094741][ T1272] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 760.256665][ T9975] netlink: 72 bytes leftover after parsing attributes in process `syz.5.1003'. [ 760.556720][ T9978] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1003'. [ 764.502485][ T9998] FAULT_INJECTION: forcing a failure. [ 764.502485][ T9998] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 764.502637][ T9998] CPU: 0 UID: 0 PID: 9998 Comm: syz.5.1008 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 764.502665][ T9998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 764.502678][ T9998] Call Trace: [ 764.502688][ T9998] [ 764.502698][ T9998] dump_stack_lvl+0xe8/0x150 [ 764.502738][ T9998] should_fail_ex+0x46b/0x600 [ 764.502775][ T9998] _copy_from_user+0x2d/0xb0 [ 764.502809][ T9998] bpf_vlog_reverse_ubuf+0xb1/0x3e0 [ 764.502848][ T9998] bpf_vlog_finalize+0x189/0x3f0 [ 764.502882][ T9998] bpf_log_attr_finalize+0x80/0x1e0 [ 764.502913][ T9998] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 764.502947][ T9998] ? btf_parse_hdr+0x5f2/0x810 [ 764.502982][ T9998] btf_new_fd+0x35e/0xc10 [ 764.503021][ T9998] __sys_bpf+0xd2e/0xd90 [ 764.503063][ T9998] ? __pfx___sys_bpf+0x10/0x10 [ 764.503097][ T9998] ? do_futex+0x3e7/0x4e0 [ 764.503167][ T9998] ? rcu_is_watching+0x16/0xb0 [ 764.503213][ T9998] __x64_sys_bpf+0xba/0xd0 [ 764.503247][ T9998] do_syscall_64+0x166/0x520 [ 764.503269][ T9998] ? trace_irq_disable+0x3b/0x140 [ 764.503311][ T9998] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 764.503334][ T9998] ? clear_bhb_loop+0x70/0xc0 [ 764.503366][ T9998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 764.503389][ T9998] RIP: 0033:0x7fde2da3e159 [ 764.503411][ T9998] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 764.503431][ T9998] RSP: 002b:00007fde2bc96028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 764.503458][ T9998] RAX: ffffffffffffffda RBX: 00007fde2dcc5fa0 RCX: 00007fde2da3e159 [ 764.503475][ T9998] RDX: 0000000000000028 RSI: 0000200000000180 RDI: 0000000000000012 [ 764.503491][ T9998] RBP: 00007fde2dad506b R08: 0000000000000000 R09: 0000000000000000 [ 764.503506][ T9998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 764.503520][ T9998] R13: 00007fde2dcc6038 R14: 00007fde2dcc5fa0 R15: 00007ffcf0cd2ea8 [ 764.503558][ T9998] [ 764.849396][T10000] syzkaller0: entered promiscuous mode [ 764.849418][T10000] syzkaller0: entered allmulticast mode [ 766.660715][T10021] netlink: 72 bytes leftover after parsing attributes in process `syz.5.1016'. [ 767.062751][T10030] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1016'. [ 769.307245][T10046] FAULT_INJECTION: forcing a failure. [ 769.307245][T10046] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 769.307287][T10046] CPU: 0 UID: 0 PID: 10046 Comm: syz.0.1021 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 769.307318][T10046] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 769.307333][T10046] Call Trace: [ 769.307342][T10046] [ 769.307353][T10046] dump_stack_lvl+0xe8/0x150 [ 769.307394][T10046] should_fail_ex+0x46b/0x600 [ 769.307431][T10046] _copy_from_user+0x2d/0xb0 [ 769.307466][T10046] bpf_vlog_reverse_ubuf+0x110/0x3e0 [ 769.307505][T10046] bpf_vlog_finalize+0x189/0x3f0 [ 769.307539][T10046] bpf_log_attr_finalize+0x80/0x1e0 [ 769.307570][T10046] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 769.307603][T10046] ? btf_parse_hdr+0x5f2/0x810 [ 769.307639][T10046] btf_new_fd+0x35e/0xc10 [ 769.307679][T10046] __sys_bpf+0xd2e/0xd90 [ 769.307722][T10046] ? __pfx___sys_bpf+0x10/0x10 [ 769.307756][T10046] ? do_futex+0x458/0x4e0 [ 769.307810][T10046] ? rcu_is_watching+0x16/0xb0 [ 769.307852][T10046] __x64_sys_bpf+0xba/0xd0 [ 769.307884][T10046] do_syscall_64+0x166/0x520 [ 769.307906][T10046] ? trace_irq_disable+0x3b/0x140 [ 769.307934][T10046] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.307957][T10046] ? clear_bhb_loop+0x70/0xc0 [ 769.307985][T10046] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 769.308008][T10046] RIP: 0033:0x7f414e29e159 [ 769.308030][T10046] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 769.308050][T10046] RSP: 002b:00007f414c4f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 769.308076][T10046] RAX: ffffffffffffffda RBX: 00007f414e525fa0 RCX: 00007f414e29e159 [ 769.308094][T10046] RDX: 0000000000000028 RSI: 0000200000000180 RDI: 0000000000000012 [ 769.308109][T10046] RBP: 00007f414e33506b R08: 0000000000000000 R09: 0000000000000000 [ 769.308124][T10046] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 769.308139][T10046] R13: 00007f414e526038 R14: 00007f414e525fa0 R15: 00007fffe29a6388 [ 769.308175][T10046] [ 769.764247][T10058] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1019'. [ 771.480133][T10058] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1019'. [ 772.685624][T10075] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1030'. [ 773.594566][T10078] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1030'. [ 774.666608][T10089] LUN: removable file: (no medium) [ 779.226495][T10123] FAULT_INJECTION: forcing a failure. [ 779.226495][T10123] name fail_futex, interval 1, probability 0, space 0, times 0 [ 779.226537][T10123] CPU: 0 UID: 0 PID: 10123 Comm: syz.1.1045 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 779.226564][T10123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 779.226578][T10123] Call Trace: [ 779.226587][T10123] [ 779.226598][T10123] dump_stack_lvl+0xe8/0x150 [ 779.226648][T10123] should_fail_ex+0x46b/0x600 [ 779.226684][T10123] get_futex_key+0x1b4/0x1580 [ 779.226729][T10123] ? __pfx_get_futex_key+0x10/0x10 [ 779.226765][T10123] ? lock_acquire+0x115/0x350 [ 779.226794][T10123] ? futex_unqueue+0x22/0x240 [ 779.226830][T10123] futex_wait_setup+0x4a/0x590 [ 779.226857][T10123] ? futex_unqueue+0x22/0x240 [ 779.226889][T10123] ? futex_unqueue+0x22/0x240 [ 779.226917][T10123] ? futex_unqueue+0x22/0x240 [ 779.226948][T10123] ? __futex_wait+0xe1/0x410 [ 779.226983][T10123] __futex_wait+0x161/0x410 [ 779.227016][T10123] ? __pfx___futex_wait+0x10/0x10 [ 779.227047][T10123] ? __pfx_futex_wake_mark+0x10/0x10 [ 779.227081][T10123] ? futex_hash+0x4e/0x2b0 [ 779.227112][T10123] ? futex_hash+0x4e/0x2b0 [ 779.227141][T10123] ? futex_hash+0x275/0x2b0 [ 779.227178][T10123] futex_wait+0x121/0x390 [ 779.227206][T10123] ? __pfx_futex_wait+0x10/0x10 [ 779.227251][T10123] do_futex+0x3e7/0x4e0 [ 779.227278][T10123] ? __pfx_do_futex+0x10/0x10 [ 779.227299][T10123] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 779.227335][T10123] __se_sys_futex+0x3a8/0x450 [ 779.227363][T10123] ? ksys_write+0x248/0x270 [ 779.227390][T10123] ? __pfx___se_sys_futex+0x10/0x10 [ 779.227413][T10123] ? __pfx_ksys_write+0x10/0x10 [ 779.227445][T10123] ? __x64_sys_futex+0x21/0xf0 [ 779.227470][T10123] do_syscall_64+0x166/0x520 [ 779.227489][T10123] ? trace_irq_disable+0x3b/0x140 [ 779.227516][T10123] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 779.227538][T10123] ? clear_bhb_loop+0x70/0xc0 [ 779.227566][T10123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 779.227588][T10123] RIP: 0033:0x7f2ec494e159 [ 779.227619][T10123] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 779.227639][T10123] RSP: 002b:00007f2ec2ba60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 779.227666][T10123] RAX: ffffffffffffffda RBX: 00007f2ec4bd5fa8 RCX: 00007f2ec494e159 [ 779.227683][T10123] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f2ec4bd5fa8 [ 779.227698][T10123] RBP: 00007f2ec4bd5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 779.227713][T10123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 779.227727][T10123] R13: 00007f2ec4bd6038 R14: 00007fffcfff5770 R15: 00007fffcfff5858 [ 779.227764][T10123] [ 779.353283][T10125] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1046'. [ 779.678412][T10127] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1046'. [ 782.530089][T10149] capability: warning: `syz.0.1052' uses 32-bit capabilities (legacy support in use) [ 785.748940][T10166] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1059'. [ 787.109618][T10172] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1059'. [ 795.694296][ T5603] Bluetooth: hci0: command tx timeout [ 796.553761][T10213] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1072'. [ 796.851475][T10215] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1072'. [ 802.006489][ T5718] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 802.176454][ T5718] usb 4-1: Using ep0 maxpacket: 32 [ 802.177610][ T5718] usb 4-1: device descriptor read/all, error -71 [ 802.381300][T10244] program syz.0.1081 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 802.381589][T10244] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 802.838253][T10248] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1084'. [ 802.961078][T10254] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1085'. [ 803.315110][T10257] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1085'. [ 807.368887][ T5697] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 807.570795][ T5697] usb 1-1: Using ep0 maxpacket: 32 [ 807.586707][ T5697] usb 1-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 807.588972][ T5697] usb 1-1: config 0 has an invalid interface number: 119 but max is 0 [ 807.589002][ T5697] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 807.589023][ T5697] usb 1-1: config 0 has no interface number 0 [ 807.589073][ T5697] usb 1-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 807.657567][ T5697] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 807.657596][ T5697] usb 1-1: Product: syz [ 807.657606][ T5697] usb 1-1: Manufacturer: syz [ 807.657614][ T5697] usb 1-1: SerialNumber: syz [ 807.696593][ T5697] usb 1-1: config 0 descriptor?? [ 807.762898][ T5697] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.119/input/input15 [ 808.240098][T10282] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 808.240544][T10282] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 808.406507][ T949] usb 1-1: USB disconnect, device number 16 [ 809.144446][T10292] program syz.1.1095 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 809.144766][T10292] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 810.996535][ T1969] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 811.171899][ T1969] usb 5-1: Using ep0 maxpacket: 32 [ 811.172940][ T1969] usb 5-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 811.174703][ T1969] usb 5-1: config 0 has an invalid interface number: 119 but max is 0 [ 811.174731][ T1969] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 811.174752][ T1969] usb 5-1: config 0 has no interface number 0 [ 811.174801][ T1969] usb 5-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 811.213420][ T1969] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 811.213450][ T1969] usb 5-1: Product: syz [ 811.213464][ T1969] usb 5-1: Manufacturer: syz [ 811.213477][ T1969] usb 5-1: SerialNumber: syz [ 811.247195][ T1969] usb 5-1: config 0 descriptor?? [ 811.270612][T10325] tmpfs: Unsupported parameter 'huge' [ 811.439693][ T1969] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.119/input/input16 [ 811.732345][T10330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 811.743919][T10330] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 811.866563][ T5854] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 811.971936][ T5684] usb 5-1: USB disconnect, device number 13 [ 812.107584][ T5854] usb 1-1: unable to get BOS descriptor or descriptor too short [ 812.113646][ T5854] usb 1-1: not running at top speed; connect to a high speed hub [ 812.113693][ T5854] usb 1-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=e1.7b [ 812.152633][ T5854] usb 1-1: config 199 has an invalid interface number: 169 but max is 1 [ 812.152668][ T5854] usb 1-1: config 199 has an invalid interface number: 102 but max is 1 [ 812.152689][ T5854] usb 1-1: config 199 has no interface number 0 [ 812.152707][ T5854] usb 1-1: config 199 has no interface number 1 [ 812.152782][ T5854] usb 1-1: config 199 interface 169 has no altsetting 0 [ 812.152801][ T5854] usb 1-1: config 199 interface 102 has no altsetting 0 [ 812.238622][ T5854] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 812.238657][ T5854] usb 1-1: Product: syz [ 812.238674][ T5854] usb 1-1: Manufacturer: syz [ 812.238690][ T5854] usb 1-1: SerialNumber: syz [ 814.819855][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 814.827649][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 815.120214][ T5854] usb_ehset_test 1-1:199.169: probe with driver usb_ehset_test failed with error -32 [ 815.165889][ T5854] usb_ehset_test 1-1:199.102: probe with driver usb_ehset_test failed with error -32 [ 815.202444][ T5854] usb 1-1: USB disconnect, device number 17 [ 817.050226][T10372] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1126'. [ 817.369057][T10379] tmpfs: Unsupported parameter 'huge' [ 820.202953][ T9264] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 820.596503][ T9264] usb 6-1: device not accepting address 2, error -71 [ 826.529039][T10421] IPVS: sync thread started: state = MASTER, mcast_ifn = bridge_slave_0, syncid = 0, id = 0 [ 826.566719][T10422] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1139'. [ 828.395159][T10428] tmpfs: Unsupported parameter 'huge' [ 828.837851][ T9264] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 829.433464][ T9264] usb 2-1: unable to get BOS descriptor or descriptor too short [ 829.435992][ T9264] usb 2-1: not running at top speed; connect to a high speed hub [ 829.436034][ T9264] usb 2-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=e1.7b [ 829.480897][ T9264] usb 2-1: config 199 has an invalid interface number: 169 but max is 1 [ 829.480932][ T9264] usb 2-1: config 199 has an invalid interface number: 102 but max is 1 [ 829.480954][ T9264] usb 2-1: config 199 has no interface number 0 [ 829.480972][ T9264] usb 2-1: config 199 has no interface number 1 [ 829.481020][ T9264] usb 2-1: config 199 interface 169 has no altsetting 0 [ 829.481041][ T9264] usb 2-1: config 199 interface 102 has no altsetting 0 [ 829.934732][ T9264] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 829.934768][ T9264] usb 2-1: Product: syz [ 829.982372][ T9264] usb 2-1: can't set config #199, error -71 [ 829.994605][ T9264] usb 2-1: USB disconnect, device number 9 [ 830.998138][T10457] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1152'. [ 834.791905][T10480] tmpfs: Unsupported parameter 'huge' [ 836.636512][ T5854] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 837.846740][ T5854] usb 2-1: device descriptor read/all, error -71 [ 838.388769][T10495] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1165'. [ 845.606463][ T1333] IPVS: starting estimator thread 0... [ 846.106548][T10518] IPVS: using max 7 ests per chain, 16800 per kthread [ 847.237342][T10531] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.1167'. [ 851.567456][T10555] ALSA: mixer_oss: invalid OSS volume '' [ 855.247516][ T5684] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 855.399064][ T5684] usb 6-1: Using ep0 maxpacket: 32 [ 855.399863][ T5684] usb 6-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 855.402043][ T5684] usb 6-1: config 0 has an invalid interface number: 119 but max is 0 [ 855.402061][ T5684] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 855.402073][ T5684] usb 6-1: config 0 has no interface number 0 [ 855.402100][ T5684] usb 6-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 856.687825][ T5684] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 856.687858][ T5684] usb 6-1: Product: syz [ 856.687875][ T5684] usb 6-1: Manufacturer: syz [ 856.747770][ T5684] usb 6-1: config 0 descriptor?? [ 856.758494][ T5684] usb 6-1: can't set config #0, error -71 [ 856.826894][ T5684] usb 6-1: USB disconnect, device number 4 [ 859.141354][T10603] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1198'. [ 860.096934][T10607] capability: warning: `syz.5.1199' uses deprecated v2 capabilities in a way that may be insecure [ 863.950304][T10622] tmpfs: Unsupported parameter 'huge' [ 864.292901][T10629] ALSA: mixer_oss: invalid OSS volume '' [ 864.309186][ T9264] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 864.487317][ T9264] usb 4-1: unable to get BOS descriptor or descriptor too short [ 864.488140][ T9264] usb 4-1: not running at top speed; connect to a high speed hub [ 864.488180][ T9264] usb 4-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=e1.7b [ 864.530907][ T9264] usb 4-1: config 199 has an invalid interface number: 169 but max is 1 [ 864.530942][ T9264] usb 4-1: config 199 has an invalid interface number: 102 but max is 1 [ 864.530965][ T9264] usb 4-1: config 199 has no interface number 0 [ 864.530983][ T9264] usb 4-1: config 199 has no interface number 1 [ 864.531033][ T9264] usb 4-1: config 199 interface 169 has no altsetting 0 [ 864.531053][ T9264] usb 4-1: config 199 interface 102 has no altsetting 0 [ 864.633759][ T9264] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 864.633793][ T9264] usb 4-1: Product: syz [ 864.633819][ T9264] usb 4-1: Manufacturer: syz [ 864.633835][ T9264] usb 4-1: SerialNumber: syz [ 869.282773][T10643] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1209'. [ 869.681051][ T9264] usb_ehset_test 4-1:199.169: probe with driver usb_ehset_test failed with error -32 [ 869.726569][ T9264] usb_ehset_test 4-1:199.102: probe with driver usb_ehset_test failed with error -32 [ 869.749401][ T9264] usb 4-1: USB disconnect, device number 13 [ 875.775678][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 875.775753][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 876.911572][T10680] tmpfs: Unsupported parameter 'huge' [ 877.266430][ T5775] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 877.460816][ T5775] usb 5-1: unable to get BOS descriptor or descriptor too short [ 877.461341][ T5775] usb 5-1: not running at top speed; connect to a high speed hub [ 877.461366][ T5775] usb 5-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=e1.7b [ 877.463111][ T5775] usb 5-1: config 199 has an invalid interface number: 169 but max is 1 [ 877.463128][ T5775] usb 5-1: config 199 has an invalid interface number: 102 but max is 1 [ 877.463143][ T5775] usb 5-1: config 199 has no interface number 0 [ 877.463153][ T5775] usb 5-1: config 199 has no interface number 1 [ 877.463179][ T5775] usb 5-1: config 199 interface 169 has no altsetting 0 [ 877.463191][ T5775] usb 5-1: config 199 interface 102 has no altsetting 0 [ 877.468394][ T5775] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 877.468422][ T5775] usb 5-1: Product: syz [ 877.468436][ T5775] usb 5-1: Manufacturer: syz [ 877.468449][ T5775] usb 5-1: SerialNumber: syz [ 878.449469][T10688] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1221'. [ 881.186458][ T5775] usb_ehset_test 5-1:199.169: probe with driver usb_ehset_test failed with error -32 [ 881.267031][ T5775] usb_ehset_test 5-1:199.102: probe with driver usb_ehset_test failed with error -32 [ 881.290684][ T5775] usb 5-1: USB disconnect, device number 14 [ 885.906459][ T5697] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 885.934479][T10739] tmpfs: Unsupported parameter 'huge' [ 886.063877][ T5697] usb 2-1: Using ep0 maxpacket: 32 [ 886.067073][ T5697] usb 2-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 886.072064][ T5697] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 886.122019][ T5697] usb 2-1: config 0 descriptor?? [ 886.284018][ T5871] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 886.338834][ T5697] as10x_usb: device has been detected [ 886.374111][ T5697] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 886.721113][ T5871] usb 6-1: unable to get BOS descriptor or descriptor too short [ 886.721793][ T5871] usb 6-1: not running at top speed; connect to a high speed hub [ 886.721833][ T5871] usb 6-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=e1.7b [ 887.205996][ T5871] usb 6-1: config 199 has an invalid interface number: 169 but max is 1 [ 887.206033][ T5871] usb 6-1: config 199 has an invalid interface number: 102 but max is 1 [ 887.206055][ T5871] usb 6-1: config 199 has no interface number 0 [ 887.206072][ T5871] usb 6-1: config 199 has no interface number 1 [ 887.206120][ T5871] usb 6-1: config 199 interface 169 has no altsetting 0 [ 887.206151][ T5871] usb 6-1: config 199 interface 102 has no altsetting 0 [ 887.218517][ T5871] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 887.218551][ T5871] usb 6-1: Product: syz [ 887.218568][ T5871] usb 6-1: Manufacturer: syz [ 887.218583][ T5871] usb 6-1: SerialNumber: syz [ 887.952614][ T5697] usb 2-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 888.048724][ T5697] as10x_usb: error during firmware upload part1 [ 888.049879][ T5697] Registered device nBox DVB-T Dongle [ 888.549096][ T5871] usb_ehset_test 6-1:199.169: probe with driver usb_ehset_test failed with error -32 [ 890.102933][ T5871] usb_ehset_test 6-1:199.102: probe with driver usb_ehset_test failed with error -32 [ 890.157739][ T5871] usb 6-1: USB disconnect, device number 5 [ 890.801744][ T5871] usb 2-1: USB disconnect, device number 12 [ 890.919190][ T5871] Unregistered device nBox DVB-T Dongle [ 890.929205][ T5871] as10x_usb: device has been disconnected [ 894.198455][T10789] ERROR: Out of memory at tomoyo_memory_ok. [ 894.198477][T10789] ERROR: Domain ' /sbin/init /etc/init.d/rcS /etc/init.d/S50sshd /sbin/start-stop-daemon /usr/sbin/sshd /usr/libexec/sshd-session /bin/sh /root/ci-upstream-kasan-gce-smack-root/syz-executor /root/ci-upstream-kasan-gce-smack-root/syz-executor /newroot/283/file0' not defined. [ 894.537352][T10793] tmpfs: Unsupported parameter 'huge' [ 895.136568][ T9264] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 895.306049][ T9264] usb 1-1: unable to get BOS descriptor or descriptor too short [ 895.315623][ T9264] usb 1-1: not running at top speed; connect to a high speed hub [ 895.315666][ T9264] usb 1-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=e1.7b [ 895.353868][ T9264] usb 1-1: config 199 has an invalid interface number: 169 but max is 1 [ 895.353901][ T9264] usb 1-1: config 199 has an invalid interface number: 102 but max is 1 [ 895.353922][ T9264] usb 1-1: config 199 has no interface number 0 [ 895.353940][ T9264] usb 1-1: config 199 has no interface number 1 [ 895.353988][ T9264] usb 1-1: config 199 interface 169 has no altsetting 0 [ 895.354007][ T9264] usb 1-1: config 199 interface 102 has no altsetting 0 [ 895.419687][ T9264] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 895.419721][ T9264] usb 1-1: Product: syz [ 895.419737][ T9264] usb 1-1: Manufacturer: syz [ 895.419753][ T9264] usb 1-1: SerialNumber: syz [ 897.824045][ T9264] usb_ehset_test 1-1:199.169: probe with driver usb_ehset_test failed with error -32 [ 897.873623][ T9264] usb_ehset_test 1-1:199.102: probe with driver usb_ehset_test failed with error -32 [ 899.516460][ T5775] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 899.614687][ T9264] usb 1-1: USB disconnect, device number 18 [ 899.686429][ T5775] usb 4-1: Using ep0 maxpacket: 32 [ 899.691849][ T5775] usb 4-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 899.693031][ T5775] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 899.720700][ T5775] usb 4-1: config 0 descriptor?? [ 899.758440][ T5775] as10x_usb: device has been detected [ 899.759019][ T5775] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 899.813941][ T5775] usb 4-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 899.860240][ T5775] as10x_usb: error during firmware upload part1 [ 899.868737][ T5775] Registered device nBox DVB-T Dongle [ 901.419804][T10830] FAULT_INJECTION: forcing a failure. [ 901.419804][T10830] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 901.419858][T10830] CPU: 1 UID: 0 PID: 10830 Comm: syz.0.1259 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 901.419885][T10830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 901.419899][T10830] Call Trace: [ 901.419909][T10830] [ 901.419919][T10830] dump_stack_lvl+0xe8/0x150 [ 901.419959][T10830] should_fail_ex+0x46b/0x600 [ 901.419996][T10830] _copy_from_user+0x2d/0xb0 [ 901.420030][T10830] __sys_bpf+0x2e7/0xd90 [ 901.420073][T10830] ? __pfx___sys_bpf+0x10/0x10 [ 901.420109][T10830] ? do_futex+0x3e7/0x4e0 [ 901.420163][T10830] ? rcu_is_watching+0x16/0xb0 [ 901.420204][T10830] __x64_sys_bpf+0xba/0xd0 [ 901.420237][T10830] do_syscall_64+0x166/0x520 [ 901.420257][T10830] ? trace_irq_disable+0x3b/0x140 [ 901.420286][T10830] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 901.420309][T10830] ? clear_bhb_loop+0x70/0xc0 [ 901.420337][T10830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 901.420357][T10830] RIP: 0033:0x7f414e29e159 [ 901.420380][T10830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 901.420399][T10830] RSP: 002b:00007f414c4f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 901.420424][T10830] RAX: ffffffffffffffda RBX: 00007f414e525fa0 RCX: 00007f414e29e159 [ 901.420441][T10830] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000f [ 901.420454][T10830] RBP: 00007f414e33506b R08: 0000000000000000 R09: 0000000000000000 [ 901.420469][T10830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 901.420482][T10830] R13: 00007f414e526038 R14: 00007f414e525fa0 R15: 00007fffe29a6388 [ 901.420518][T10830] [ 901.575589][ T5775] usb 4-1: USB disconnect, device number 14 [ 901.701064][ T5775] Unregistered device nBox DVB-T Dongle [ 901.710270][ T5775] as10x_usb: device has been disconnected [ 903.837567][T10848] tmpfs: Unsupported parameter 'huge' [ 905.791769][T10858] FAULT_INJECTION: forcing a failure. [ 905.791769][T10858] name failslab, interval 1, probability 0, space 0, times 0 [ 905.791815][T10858] CPU: 0 UID: 0 PID: 10858 Comm: syz.1.1269 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 905.791843][T10858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 905.791857][T10858] Call Trace: [ 905.791866][T10858] [ 905.791877][T10858] dump_stack_lvl+0xe8/0x150 [ 905.791915][T10858] should_fail_ex+0x46b/0x600 [ 905.791949][T10858] should_failslab+0xa8/0x100 [ 905.791986][T10858] __kvmalloc_node_noprof+0x176/0x890 [ 905.792022][T10858] ? fanout_add+0x74b/0x13d0 [ 905.792140][T10858] ? fanout_add+0x74b/0x13d0 [ 905.792174][T10858] ? fanout_add+0x16c/0x13d0 [ 905.792211][T10858] fanout_add+0x74b/0x13d0 [ 905.792253][T10858] ? _copy_from_user+0x94/0xb0 [ 905.792291][T10858] packet_setsockopt+0xc34/0x1510 [ 905.792324][T10858] ? __pfx_packet_setsockopt+0x10/0x10 [ 905.792354][T10858] ? __pfx___sys_bpf+0x10/0x10 [ 905.792398][T10858] ? do_futex+0x3e7/0x4e0 [ 905.792429][T10858] ? lock_acquire+0x115/0x350 [ 905.792468][T10858] ? __fget_files+0x2a/0x420 [ 905.792496][T10858] ? __fget_files+0x2a/0x420 [ 905.792518][T10858] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 905.792540][T10858] ? __pfx_packet_setsockopt+0x10/0x10 [ 905.792575][T10858] do_sock_setsockopt+0x17c/0x1b0 [ 905.792605][T10858] __x64_sys_setsockopt+0x143/0x1b0 [ 905.792635][T10858] do_syscall_64+0x166/0x520 [ 905.792656][T10858] ? trace_irq_disable+0x3b/0x140 [ 905.792685][T10858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 905.792709][T10858] ? clear_bhb_loop+0x70/0xc0 [ 905.792737][T10858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 905.792760][T10858] RIP: 0033:0x7f2ec494e159 [ 905.792783][T10858] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 905.792802][T10858] RSP: 002b:00007f2ec2ba6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 905.792829][T10858] RAX: ffffffffffffffda RBX: 00007f2ec4bd5fa0 RCX: 00007f2ec494e159 [ 905.792846][T10858] RDX: 0000000000000012 RSI: 0000000000000107 RDI: 0000000000000003 [ 905.792861][T10858] RBP: 00007f2ec49e506b R08: 0000000000000004 R09: 0000000000000000 [ 905.792876][T10858] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 905.792890][T10858] R13: 00007f2ec4bd6038 R14: 00007f2ec4bd5fa0 R15: 00007fffcfff5858 [ 905.792926][T10858] [ 905.856615][ T1969] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 906.031656][ T1969] usb 5-1: unable to get BOS descriptor or descriptor too short [ 906.034572][ T1969] usb 5-1: not running at top speed; connect to a high speed hub [ 906.034610][ T1969] usb 5-1: New USB device found, idVendor=1a0a, idProduct=0104, bcdDevice=e1.7b [ 906.044860][ T1969] usb 5-1: config 199 has an invalid interface number: 169 but max is 1 [ 906.044888][ T1969] usb 5-1: config 199 has an invalid interface number: 102 but max is 1 [ 906.044906][ T1969] usb 5-1: config 199 has no interface number 0 [ 906.044922][ T1969] usb 5-1: config 199 has no interface number 1 [ 906.044964][ T1969] usb 5-1: config 199 interface 169 has no altsetting 0 [ 906.044981][ T1969] usb 5-1: config 199 interface 102 has no altsetting 0 [ 906.055789][ T1969] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.055817][ T1969] usb 5-1: Product: syz [ 906.055831][ T1969] usb 5-1: Manufacturer: syz [ 906.055845][ T1969] usb 5-1: SerialNumber: syz [ 907.926657][ T1969] usb_ehset_test 5-1:199.169: probe with driver usb_ehset_test failed with error -32 [ 907.973611][ T1969] usb_ehset_test 5-1:199.102: probe with driver usb_ehset_test failed with error -32 [ 908.029377][ T1969] usb 5-1: USB disconnect, device number 15 [ 910.019635][T10878] FAULT_INJECTION: forcing a failure. [ 910.019635][T10878] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 910.019664][T10878] CPU: 0 UID: 0 PID: 10878 Comm: syz.0.1267 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 910.019679][T10878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 910.019702][T10878] Call Trace: [ 910.019708][T10878] [ 910.019714][T10878] dump_stack_lvl+0xe8/0x150 [ 910.019737][T10878] should_fail_ex+0x46b/0x600 [ 910.019756][T10878] _copy_from_user+0x2d/0xb0 [ 910.019774][T10878] __se_sys_prlimit64+0x12f/0xbc0 [ 910.019791][T10878] ? __se_sys_futex+0x3a8/0x450 [ 910.019804][T10878] ? __pfx___se_sys_prlimit64+0x10/0x10 [ 910.019821][T10878] ? rcu_is_watching+0x16/0xb0 [ 910.019846][T10878] do_syscall_64+0x166/0x520 [ 910.019857][T10878] ? trace_irq_disable+0x3b/0x140 [ 910.019872][T10878] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 910.019884][T10878] ? clear_bhb_loop+0x70/0xc0 [ 910.019899][T10878] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 910.019918][T10878] RIP: 0033:0x7f414e29e159 [ 910.019931][T10878] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 910.019942][T10878] RSP: 002b:00007f414c4f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012e [ 910.019957][T10878] RAX: ffffffffffffffda RBX: 00007f414e525fa0 RCX: 00007f414e29e159 [ 910.019966][T10878] RDX: 0000200000000140 RSI: 000000000000000e RDI: 0000000000000000 [ 910.019974][T10878] RBP: 00007f414e33506b R08: 0000000000000000 R09: 0000000000000000 [ 910.019981][T10878] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 910.019989][T10878] R13: 00007f414e526038 R14: 00007f414e525fa0 R15: 00007fffe29a6388 [ 910.020007][T10878] [ 913.865387][T10906] tmpfs: Unsupported parameter 'huge' [ 916.656976][ T1969] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 916.938118][ T1969] usb 1-1: device descriptor read/all, error -71 [ 917.276623][ T5775] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 918.976449][ T5775] usb 2-1: Using ep0 maxpacket: 32 [ 918.977515][ T5775] usb 2-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 919.003220][ T5775] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 919.033223][ T5775] usb 2-1: config 0 descriptor?? [ 919.073929][ T5775] as10x_usb: device has been detected [ 919.083831][ T5775] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 919.115201][ T5775] usb 2-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 919.229660][ T5775] as10x_usb: error during firmware upload part1 [ 919.230482][ T5775] Registered device nBox DVB-T Dongle [ 920.375366][T10950] sg_write: data in/out 768/2 bytes for SCSI command 0x0-- guessing data in; [ 920.375366][T10950] program syz.5.1288 not setting count and/or reply_len properly [ 925.005230][ T5775] usb 2-1: USB disconnect, device number 13 [ 925.086878][T10949] syz.5.1288 (10949): drop_caches: 2 [ 925.166552][ T5775] Unregistered device nBox DVB-T Dongle [ 925.178975][ T5775] as10x_usb: device has been disconnected [ 925.789990][ T60] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 925.848098][ T60] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 925.853272][ T60] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 925.855852][ T60] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 925.878825][ T60] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 926.615247][T10982] ALSA: mixer_oss: invalid OSS volume '' [ 928.076708][ T60] Bluetooth: hci5: command tx timeout [ 931.012594][ T60] Bluetooth: hci5: command tx timeout [ 931.073321][T11007] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1309'. [ 931.559440][ T90] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 932.542277][ T90] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 933.041370][ T60] Bluetooth: hci5: command tx timeout [ 934.422541][ T90] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 935.172755][ T60] Bluetooth: hci5: command tx timeout [ 936.156192][ T90] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 937.831464][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 937.831546][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 942.731107][T11090] FAULT_INJECTION: forcing a failure. [ 942.731107][T11090] name fail_futex, interval 1, probability 0, space 0, times 0 [ 942.731150][T11090] CPU: 1 UID: 0 PID: 11090 Comm: syz.5.1338 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 942.731178][T11090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 942.731192][T11090] Call Trace: [ 942.731201][T11090] [ 942.731211][T11090] dump_stack_lvl+0xe8/0x150 [ 942.731248][T11090] should_fail_ex+0x46b/0x600 [ 942.731282][T11090] get_futex_key+0x1b4/0x1580 [ 942.731317][T11090] ? __pfx_futex_wake_mark+0x10/0x10 [ 942.731349][T11090] ? __pfx_get_futex_key+0x10/0x10 [ 942.731396][T11090] futex_wake+0x119/0x600 [ 942.731429][T11090] ? __pfx_futex_wake+0x10/0x10 [ 942.731472][T11090] do_futex+0x458/0x4e0 [ 942.731501][T11090] ? __pfx_do_futex+0x10/0x10 [ 942.731532][T11090] __se_sys_futex+0x3a8/0x450 [ 942.731560][T11090] ? __fget_files+0x2a/0x420 [ 942.731584][T11090] ? __pfx___se_sys_futex+0x10/0x10 [ 942.731604][T11090] ? __fget_files+0x2a/0x420 [ 942.731626][T11090] ? rcu_is_watching+0x16/0xb0 [ 942.731666][T11090] ? __x64_sys_futex+0x21/0xf0 [ 942.731692][T11090] do_syscall_64+0x166/0x520 [ 942.731714][T11090] ? trace_irq_disable+0x3b/0x140 [ 942.731741][T11090] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 942.731762][T11090] ? clear_bhb_loop+0x70/0xc0 [ 942.731790][T11090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 942.731812][T11090] RIP: 0033:0x7fde2da3e159 [ 942.731835][T11090] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 942.731854][T11090] RSP: 002b:00007fde2bc960e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 942.731881][T11090] RAX: ffffffffffffffda RBX: 00007fde2dcc5fa8 RCX: 00007fde2da3e159 [ 942.731898][T11090] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fde2dcc5fac [ 942.731913][T11090] RBP: 00007fde2dcc5fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 942.731929][T11090] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 942.731945][T11090] R13: 00007fde2dcc6038 R14: 00007ffcf0cd2dc0 R15: 00007ffcf0cd2ea8 [ 942.731981][T11090] [ 947.104506][ T90] bridge_slave_1: left allmulticast mode [ 947.104548][ T90] bridge_slave_1: left promiscuous mode [ 947.104855][ T90] bridge0: port 2(bridge_slave_1) entered disabled state [ 947.300700][ T90] bridge_slave_0: left allmulticast mode [ 947.300743][ T90] bridge_slave_0: left promiscuous mode [ 947.301034][ T90] bridge0: port 1(bridge_slave_0) entered disabled state [ 952.657057][ T60] Bluetooth: hci5: command tx timeout [ 954.177317][ T90] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 954.265555][ T90] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 954.312629][ T90] bond0 (unregistering): Released all slaves [ 954.387973][T10966] bridge0: port 1(bridge_slave_0) entered blocking state [ 954.388118][T10966] bridge0: port 1(bridge_slave_0) entered disabled state [ 954.388334][T10966] bridge_slave_0: entered allmulticast mode [ 954.398988][T11165] FAULT_INJECTION: forcing a failure. [ 954.398988][T11165] name fail_futex, interval 1, probability 0, space 0, times 0 [ 954.399025][T11165] CPU: 1 UID: 0 PID: 11165 Comm: syz.3.1355 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 954.399049][T11165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 954.399061][T11165] Call Trace: [ 954.399069][T11165] [ 954.399078][T11165] dump_stack_lvl+0xe8/0x150 [ 954.399113][T11165] should_fail_ex+0x46b/0x600 [ 954.399149][T11165] get_futex_key+0x1b4/0x1580 [ 954.399189][T11165] ? __pfx_get_futex_key+0x10/0x10 [ 954.399218][T11165] ? update_se+0x90/0xef0 [ 954.399250][T11165] futex_wait_setup+0x4a/0x590 [ 954.399279][T11165] ? __futex_wait+0xe1/0x410 [ 954.399306][T11165] __futex_wait+0x161/0x410 [ 954.399334][T11165] ? __pfx___futex_wait+0x10/0x10 [ 954.399361][T11165] ? __pfx_futex_wake_mark+0x10/0x10 [ 954.399391][T11165] ? try_to_wake_up+0x84b/0x1430 [ 954.399426][T11165] futex_wait+0x121/0x390 [ 954.399452][T11165] ? __pfx_futex_wait+0x10/0x10 [ 954.399485][T11165] ? handle_mm_fault+0xeb/0x28c0 [ 954.399515][T11165] do_futex+0x3e7/0x4e0 [ 954.399539][T11165] ? __pfx_do_futex+0x10/0x10 [ 954.399567][T11165] __se_sys_futex+0x3a8/0x450 [ 954.399591][T11165] ? exc_page_fault+0x6a/0xc0 [ 954.399618][T11165] ? __pfx___se_sys_futex+0x10/0x10 [ 954.399646][T11165] ? __x64_sys_futex+0x21/0xf0 [ 954.399667][T11165] do_syscall_64+0x166/0x520 [ 954.399685][T11165] ? trace_irq_disable+0x3b/0x140 [ 954.399708][T11165] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 954.399728][T11165] ? clear_bhb_loop+0x70/0xc0 [ 954.399751][T11165] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 954.399771][T11165] RIP: 0033:0x7ff86b86e159 [ 954.399790][T11165] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 954.399815][T11165] RSP: 002b:00007ff869ac60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 954.399837][T11165] RAX: ffffffffffffffda RBX: 00007ff86baf5fa8 RCX: 00007ff86b86e159 [ 954.399851][T11165] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007ff86baf5fa8 [ 954.399864][T11165] RBP: 00007ff86baf5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 954.399878][T11165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 954.399890][T11165] R13: 00007ff86baf6038 R14: 00007ffeb0448bd0 R15: 00007ffeb0448cb8 [ 954.399921][T11165] [ 954.452666][T10966] bridge_slave_0: entered promiscuous mode [ 954.699442][ T5247] 8021q: adding VLAN 0 to HW filter on device eth5 [ 954.727138][T10966] bridge0: port 2(bridge_slave_1) entered blocking state [ 954.727299][T10966] bridge0: port 2(bridge_slave_1) entered disabled state [ 954.727508][T10966] bridge_slave_1: entered allmulticast mode [ 954.759546][T10966] bridge_slave_1: entered promiscuous mode [ 954.825755][T10966] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 954.841620][T10966] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 954.902348][T10966] team0: Port device team_slave_0 added [ 954.913372][T10966] team0: Port device team_slave_1 added [ 954.971502][T10966] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 954.971523][T10966] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 954.971553][T10966] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 954.974045][T10966] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 954.974062][T10966] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 954.974091][T10966] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 955.255503][T11178] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1358'. [ 955.352201][T10966] hsr_slave_0: entered promiscuous mode [ 955.355346][T10966] hsr_slave_1: entered promiscuous mode [ 955.370821][T10966] debugfs: 'hsr0' already exists in 'hsr' [ 955.370853][T10966] Cannot create hsr debugfs directory [ 958.945123][T11193] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.1363'. [ 959.308530][ T90] IPVS: stopping master sync thread 9612 ... [ 960.333514][T11202] FAULT_INJECTION: forcing a failure. [ 960.333514][T11202] name fail_futex, interval 1, probability 0, space 0, times 0 [ 960.333558][T11202] CPU: 0 UID: 0 PID: 11202 Comm: syz.4.1367 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 960.333586][T11202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 960.333600][T11202] Call Trace: [ 960.333609][T11202] [ 960.333618][T11202] dump_stack_lvl+0xe8/0x150 [ 960.333659][T11202] should_fail_ex+0x46b/0x600 [ 960.333695][T11202] get_futex_key+0x1b4/0x1580 [ 960.333740][T11202] ? __pfx_get_futex_key+0x10/0x10 [ 960.333787][T11202] futex_wake+0x119/0x600 [ 960.333811][T11202] ? lock_acquire+0x115/0x350 [ 960.333856][T11202] ? __pfx_futex_wake+0x10/0x10 [ 960.333885][T11202] ? __fget_files+0x2a/0x420 [ 960.333912][T11202] ? __fget_files+0x2a/0x420 [ 960.333935][T11202] ? __fget_files+0x3a8/0x420 [ 960.333958][T11202] ? __fget_files+0x2a/0x420 [ 960.333985][T11202] do_futex+0x458/0x4e0 [ 960.334006][T11202] ? fput+0xa0/0xd0 [ 960.334040][T11202] ? __pfx_do_futex+0x10/0x10 [ 960.334061][T11202] ? __x64_sys_mq_getsetattr+0x1bd/0x270 [ 960.334096][T11202] __se_sys_futex+0x3a8/0x450 [ 960.334127][T11202] ? __pfx___se_sys_futex+0x10/0x10 [ 960.334160][T11202] ? __x64_sys_futex+0x21/0xf0 [ 960.334186][T11202] do_syscall_64+0x166/0x520 [ 960.334207][T11202] ? trace_irq_disable+0x3b/0x140 [ 960.334235][T11202] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 960.334257][T11202] ? clear_bhb_loop+0x70/0xc0 [ 960.334285][T11202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 960.334307][T11202] RIP: 0033:0x7f31a4b5e159 [ 960.334329][T11202] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 960.334348][T11202] RSP: 002b:00007f31a2db60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 960.334375][T11202] RAX: ffffffffffffffda RBX: 00007f31a4de5fa8 RCX: 00007f31a4b5e159 [ 960.334392][T11202] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f31a4de5fac [ 960.334407][T11202] RBP: 00007f31a4de5fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 960.334423][T11202] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 960.334437][T11202] R13: 00007f31a4de6038 R14: 00007ffe016312f0 R15: 00007ffe016313d8 [ 960.334472][T11202] [ 960.826842][T11203] syzkaller1: entered promiscuous mode [ 960.826869][T11203] syzkaller1: entered allmulticast mode [ 965.367243][ T5247] 8021q: adding VLAN 0 to HW filter on device eth6 [ 966.414407][T11262] program syz.5.1374 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 966.644319][T11262] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 969.726825][T11297] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.1387'. [ 969.913368][T11302] FAULT_INJECTION: forcing a failure. [ 969.913368][T11302] name fail_futex, interval 1, probability 0, space 0, times 0 [ 969.913411][T11302] CPU: 1 UID: 0 PID: 11302 Comm: syz.5.1389 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 969.913438][T11302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 969.913451][T11302] Call Trace: [ 969.913460][T11302] [ 969.913469][T11302] dump_stack_lvl+0xe8/0x150 [ 969.913508][T11302] should_fail_ex+0x46b/0x600 [ 969.913543][T11302] get_futex_key+0x1b4/0x1580 [ 969.913588][T11302] ? __pfx_get_futex_key+0x10/0x10 [ 969.913632][T11302] futex_wake+0x119/0x600 [ 969.913666][T11302] ? lock_acquire+0x115/0x350 [ 969.913698][T11302] ? __pfx_futex_wake+0x10/0x10 [ 969.913725][T11302] ? __fget_files+0x2a/0x420 [ 969.913752][T11302] ? __fget_files+0x2a/0x420 [ 969.913774][T11302] ? __fget_files+0x3a8/0x420 [ 969.913796][T11302] ? __fget_files+0x2a/0x420 [ 969.913821][T11302] do_futex+0x458/0x4e0 [ 969.913842][T11302] ? fput+0xa0/0xd0 [ 969.913875][T11302] ? __pfx_do_futex+0x10/0x10 [ 969.913896][T11302] ? __x64_sys_mq_getsetattr+0x1bd/0x270 [ 969.913928][T11302] __se_sys_futex+0x3a8/0x450 [ 969.913956][T11302] ? __pfx___se_sys_futex+0x10/0x10 [ 969.913987][T11302] ? __x64_sys_futex+0x21/0xf0 [ 969.914012][T11302] do_syscall_64+0x166/0x520 [ 969.914033][T11302] ? trace_irq_disable+0x3b/0x140 [ 969.914059][T11302] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 969.914082][T11302] ? clear_bhb_loop+0x70/0xc0 [ 969.914109][T11302] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 969.914130][T11302] RIP: 0033:0x7fde2da3e159 [ 969.914151][T11302] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 969.914171][T11302] RSP: 002b:00007fde2bc960e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 969.914202][T11302] RAX: ffffffffffffffda RBX: 00007fde2dcc5fa8 RCX: 00007fde2da3e159 [ 969.914219][T11302] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fde2dcc5fac [ 969.914234][T11302] RBP: 00007fde2dcc5fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 969.914250][T11302] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 969.914265][T11302] R13: 00007fde2dcc6038 R14: 00007ffcf0cd2dc0 R15: 00007ffcf0cd2ea8 [ 969.914302][T11302] [ 971.771065][T11312] ALSA: mixer_oss: invalid OSS volume '' [ 971.857963][ T90] hsr_slave_0: left promiscuous mode [ 971.897241][ T90] hsr_slave_1: left promiscuous mode [ 971.898576][ T90] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 971.898604][ T90] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 971.959119][ T90] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 971.959153][ T90] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 972.184830][ T90] veth1_macvtap: left promiscuous mode [ 972.216416][ T90] veth0_macvtap: left promiscuous mode [ 972.216733][ T90] veth1_vlan: left promiscuous mode [ 972.216965][ T90] veth0_vlan: left promiscuous mode [ 973.426036][T11345] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.1399'. [ 975.047237][ T90] team0 (unregistering): Port device team_slave_1 removed [ 975.118108][ T90] team0 (unregistering): Port device team_slave_0 removed [ 975.559893][ T5247] 8021q: adding VLAN 0 to HW filter on device eth7 [ 978.396124][T11378] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.1411'. [ 978.511140][T10966] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 978.868837][T10966] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 978.870089][T10966] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 979.463451][T10966] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 979.513072][T10966] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 979.763266][T10966] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 979.788647][T10966] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 979.907878][T10966] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 980.049197][T11396] ubi0: attaching mtd0 [ 980.049289][T11396] ubi0 error: ubi_attach_mtd_dev: bad VID header (3) or data offsets (67) [ 981.244805][ T5247] 8021q: adding VLAN 0 to HW filter on device eth8 [ 981.629205][ T90] IPVS: stop unused estimator thread 0... [ 981.661023][T10966] 8021q: adding VLAN 0 to HW filter on device bond0 [ 981.956413][T10966] 8021q: adding VLAN 0 to HW filter on device team0 [ 981.988023][ T1333] bridge0: port 1(bridge_slave_0) entered blocking state [ 981.989569][ T1333] bridge0: port 1(bridge_slave_0) entered forwarding state [ 982.170215][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 982.171954][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 983.527139][T11445] program syz.4.1422 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 983.527421][T11445] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 986.543302][T11472] kvm [11470]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0xffff00000000 [ 986.665307][ T5603] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 986.712890][ T5603] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 986.743155][ T5603] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 986.744495][ T5603] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 986.768984][ T5603] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 988.956440][ T60] Bluetooth: hci2: command tx timeout [ 990.410004][ T5603] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 990.511648][ T5603] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 990.523732][ T5603] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 990.525739][ T5603] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 990.554262][ T5603] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 991.036390][ T5603] Bluetooth: hci2: command tx timeout [ 993.204714][ T5603] Bluetooth: hci0: command tx timeout [ 993.205121][ T5603] Bluetooth: hci2: command tx timeout [ 993.656373][ T5684] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 993.806364][ T5684] usb 4-1: Using ep0 maxpacket: 32 [ 993.807242][ T5684] usb 4-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 993.809121][ T5684] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 993.809148][ T5684] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 993.809168][ T5684] usb 4-1: config 0 has no interface number 0 [ 993.809217][ T5684] usb 4-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 993.814162][ T5684] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 993.814189][ T5684] usb 4-1: Product: syz [ 993.814204][ T5684] usb 4-1: Manufacturer: syz [ 993.814219][ T5684] usb 4-1: SerialNumber: syz [ 993.919001][ T5684] usb 4-1: config 0 descriptor?? [ 993.964366][ T5684] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.119/input/input17 [ 994.081840][T11549] netlink: 'syz.4.1444': attribute type 32 has an invalid length. [ 994.319546][T11557] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 994.320323][T11557] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 995.138105][T10186] usb 4-1: USB disconnect, device number 15 [ 995.277022][ T5603] Bluetooth: hci0: command tx timeout [ 995.277128][ T60] Bluetooth: hci2: command tx timeout [ 997.464888][ T60] Bluetooth: hci0: command tx timeout [ 998.891259][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 998.891342][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 999.441805][T11608] FAULT_INJECTION: forcing a failure. [ 999.441805][T11608] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 999.441848][T11608] CPU: 0 UID: 0 PID: 11608 Comm: syz.3.1454 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 999.441875][T11608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 999.441889][T11608] Call Trace: [ 999.441898][T11608] [ 999.441908][T11608] dump_stack_lvl+0xe8/0x150 [ 999.441948][T11608] should_fail_ex+0x46b/0x600 [ 999.442000][T11608] _copy_from_user+0x2d/0xb0 [ 999.442034][T11608] __se_sys_prlimit64+0x12f/0xbc0 [ 999.442063][T11608] ? __se_sys_futex+0x3a8/0x450 [ 999.442087][T11608] ? __pfx___se_sys_prlimit64+0x10/0x10 [ 999.442118][T11608] ? rcu_is_watching+0x16/0xb0 [ 999.442166][T11608] do_syscall_64+0x166/0x520 [ 999.442186][T11608] ? trace_irq_disable+0x3b/0x140 [ 999.442215][T11608] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 999.442238][T11608] ? clear_bhb_loop+0x70/0xc0 [ 999.442267][T11608] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 999.442288][T11608] RIP: 0033:0x7ff86b86e159 [ 999.442311][T11608] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 999.442331][T11608] RSP: 002b:00007ff869ac6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012e [ 999.442357][T11608] RAX: ffffffffffffffda RBX: 00007ff86baf5fa0 RCX: 00007ff86b86e159 [ 999.442374][T11608] RDX: 0000200000000140 RSI: 000000000000000e RDI: 0000000000000000 [ 999.442389][T11608] RBP: 00007ff86b90506b R08: 0000000000000000 R09: 0000000000000000 [ 999.442403][T11608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 999.442417][T11608] R13: 00007ff86baf6038 R14: 00007ff86baf5fa0 R15: 00007ffeb0448cb8 [ 999.442453][T11608] [ 999.516954][ T60] Bluetooth: hci0: command tx timeout [ 1001.149650][ T90] bridge_slave_1: left allmulticast mode [ 1001.149692][ T90] bridge_slave_1: left promiscuous mode [ 1001.149999][ T90] bridge0: port 2(bridge_slave_1) entered disabled state [ 1001.236532][ T5684] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 1001.386390][ T5684] usb 4-1: Using ep0 maxpacket: 32 [ 1001.387309][ T5684] usb 4-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 1001.424202][ T5684] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 1001.424235][ T5684] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1001.424256][ T5684] usb 4-1: config 0 has no interface number 0 [ 1001.424431][ T5684] usb 4-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1001.489042][ T5684] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1001.489074][ T5684] usb 4-1: Product: syz [ 1001.489090][ T5684] usb 4-1: Manufacturer: syz [ 1001.489106][ T5684] usb 4-1: SerialNumber: syz [ 1002.708258][ T5684] usb 4-1: config 0 descriptor?? [ 1002.746545][ T90] bridge_slave_0: left allmulticast mode [ 1002.746591][ T90] bridge_slave_0: left promiscuous mode [ 1002.746860][ T90] bridge0: port 1(bridge_slave_0) entered disabled state [ 1002.785045][ T5684] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.119/input/input18 [ 1004.663230][ T1969] usb 4-1: USB disconnect, device number 16 [ 1007.097433][ T90] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1007.177327][ T90] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1007.200501][ T90] bond0 (unregistering): Released all slaves [ 1007.822592][T11689] FAULT_INJECTION: forcing a failure. [ 1007.822592][T11689] name failslab, interval 1, probability 0, space 0, times 0 [ 1007.822638][T11689] CPU: 1 UID: 0 PID: 11689 Comm: syz.0.1470 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1007.822666][T11689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1007.822678][T11689] Call Trace: [ 1007.822688][T11689] [ 1007.822698][T11689] dump_stack_lvl+0xe8/0x150 [ 1007.822735][T11689] should_fail_ex+0x46b/0x600 [ 1007.822768][T11689] should_failslab+0xa8/0x100 [ 1007.822804][T11689] __kmalloc_cache_noprof+0xa1/0x680 [ 1007.822835][T11689] ? n_hdlc_tty_open+0x8c/0x4d0 [ 1007.822888][T11689] ? n_hdlc_tty_open+0x8c/0x4d0 [ 1007.822919][T11689] n_hdlc_tty_open+0x8c/0x4d0 [ 1007.822941][T11689] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1007.822979][T11689] tty_ldisc_open+0xa1/0x100 [ 1007.823024][T11689] tty_set_ldisc+0x365/0x540 [ 1007.823052][T11689] tty_ioctl+0xc36/0xde0 [ 1007.823096][T11689] ? __pfx_tty_ioctl+0x10/0x10 [ 1007.823122][T11689] __se_sys_ioctl+0xff/0x170 [ 1007.823154][T11689] do_syscall_64+0x166/0x520 [ 1007.823172][T11689] ? trace_irq_disable+0x3b/0x140 [ 1007.823198][T11689] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1007.823220][T11689] ? clear_bhb_loop+0x70/0xc0 [ 1007.823246][T11689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1007.823268][T11689] RIP: 0033:0x7f414e29e159 [ 1007.823289][T11689] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1007.823309][T11689] RSP: 002b:00007f414c4f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1007.823336][T11689] RAX: ffffffffffffffda RBX: 00007f414e525fa0 RCX: 00007f414e29e159 [ 1007.823352][T11689] RDX: 0000200000000000 RSI: 0000000000005423 RDI: 0000000000000004 [ 1007.823366][T11689] RBP: 00007f414e33506b R08: 0000000000000000 R09: 0000000000000000 [ 1007.823387][T11689] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1007.823400][T11689] R13: 00007f414e526038 R14: 00007f414e525fa0 R15: 00007fffe29a6388 [ 1007.823437][T11689] [ 1007.837255][T11689] n_hdlc_tty_open: n_hdlc_alloc failed [ 1008.342962][T11494] bridge0: port 1(bridge_slave_0) entered blocking state [ 1008.343168][T11494] bridge0: port 1(bridge_slave_0) entered disabled state [ 1008.343376][T11494] bridge_slave_0: entered allmulticast mode [ 1008.354766][T11494] bridge_slave_0: entered promiscuous mode [ 1008.431177][T11494] bridge0: port 2(bridge_slave_1) entered blocking state [ 1008.431324][T11494] bridge0: port 2(bridge_slave_1) entered disabled state [ 1008.431526][T11494] bridge_slave_1: entered allmulticast mode [ 1008.448244][T11494] bridge_slave_1: entered promiscuous mode [ 1010.300143][ T90] hsr_slave_0: left promiscuous mode [ 1010.340760][ T90] hsr_slave_1: left promiscuous mode [ 1010.348756][ T90] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1010.387523][ T90] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1013.658830][ T90] team0 (unregistering): Port device team_slave_1 removed [ 1014.668689][ T90] team0 (unregistering): Port device team_slave_0 removed [ 1015.505968][T11494] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1015.552513][T11494] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1015.553332][T11476] bridge0: port 1(bridge_slave_0) entered blocking state [ 1015.553516][T11476] bridge0: port 1(bridge_slave_0) entered disabled state [ 1015.553777][T11476] bridge_slave_0: entered allmulticast mode [ 1015.559493][T11476] bridge_slave_0: entered promiscuous mode [ 1015.609587][T11476] bridge0: port 2(bridge_slave_1) entered blocking state [ 1015.609734][T11476] bridge0: port 2(bridge_slave_1) entered disabled state [ 1015.609938][T11476] bridge_slave_1: entered allmulticast mode [ 1015.617842][T11476] bridge_slave_1: entered promiscuous mode [ 1015.760085][T11494] team0: Port device team_slave_0 added [ 1016.981246][T11494] team0: Port device team_slave_1 added [ 1018.828641][T11476] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1018.947687][T11476] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1019.103109][T11494] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1019.103130][T11494] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1019.103159][T11494] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1019.246032][T11494] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1019.246054][T11494] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1019.246085][T11494] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1019.299363][T11476] team0: Port device team_slave_0 added [ 1019.354160][T11476] team0: Port device team_slave_1 added [ 1019.482561][T11769] netlink: 'syz.4.1493': attribute type 10 has an invalid length. [ 1019.482588][T11769] netlink: 55 bytes leftover after parsing attributes in process `syz.4.1493'. [ 1020.913862][T11476] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1020.913884][T11476] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1020.913914][T11476] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1021.031874][ T5247] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1022.152800][T11476] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1022.152821][T11476] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1022.152850][T11476] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1022.179375][T11494] hsr_slave_0: entered promiscuous mode [ 1022.180894][T11494] hsr_slave_1: entered promiscuous mode [ 1022.686529][ T5775] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1022.803431][T11476] hsr_slave_0: entered promiscuous mode [ 1022.813130][T11476] hsr_slave_1: entered promiscuous mode [ 1022.814085][T11476] debugfs: 'hsr0' already exists in 'hsr' [ 1022.814110][T11476] Cannot create hsr debugfs directory [ 1022.858156][ T5775] usb 4-1: Using ep0 maxpacket: 32 [ 1022.859125][ T5775] usb 4-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 1022.881396][ T5775] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 1022.881425][ T5775] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1022.881445][ T5775] usb 4-1: config 0 has no interface number 0 [ 1022.881494][ T5775] usb 4-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1022.885553][ T5775] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1022.885583][ T5775] usb 4-1: Product: syz [ 1022.885599][ T5775] usb 4-1: Manufacturer: syz [ 1022.885614][ T5775] usb 4-1: SerialNumber: syz [ 1022.900707][T11816] FAULT_INJECTION: forcing a failure. [ 1022.900707][T11816] name failslab, interval 1, probability 0, space 0, times 0 [ 1022.900743][T11816] CPU: 1 UID: 0 PID: 11816 Comm: syz.4.1503 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1022.900766][T11816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1022.900778][T11816] Call Trace: [ 1022.900786][T11816] [ 1022.900795][T11816] dump_stack_lvl+0xe8/0x150 [ 1022.900830][T11816] should_fail_ex+0x46b/0x600 [ 1022.900862][T11816] should_failslab+0xa8/0x100 [ 1022.900892][T11816] __kmalloc_cache_noprof+0xa1/0x680 [ 1022.900920][T11816] ? sctp_stream_init_ext+0x57/0x180 [ 1022.900938][T11816] ? sctp_stream_init_ext+0x57/0x180 [ 1022.900965][T11816] sctp_stream_init_ext+0x57/0x180 [ 1022.900988][T11816] sctp_sendmsg_to_asoc+0x88d/0x1880 [ 1022.901016][T11816] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1022.901047][T11816] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1022.901075][T11816] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 1022.901114][T11816] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 1022.901138][T11816] ? __local_bh_enable+0x1e3/0x2f0 [ 1022.901169][T11816] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 1022.901194][T11816] ? sctp_sendmsg_check_sflags+0x18a/0x330 [ 1022.901225][T11816] sctp_sendmsg+0x1759/0x2a50 [ 1022.901264][T11816] ? __pfx_futex_wake_mark+0x10/0x10 [ 1022.901287][T11816] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1022.901318][T11816] ? smack_socket_sendmsg+0x1a9/0x5a0 [ 1022.901348][T11816] ? __pfx_smack_socket_sendmsg+0x10/0x10 [ 1022.901376][T11816] ? lock_acquire+0x115/0x350 [ 1022.901413][T11816] ? sock_rps_record_flow+0x19/0x350 [ 1022.901495][T11816] ? inet_sendmsg+0x298/0x320 [ 1022.901516][T11816] ? __fget_files+0x2a/0x420 [ 1022.901538][T11816] ? __pfx_inet_sendmsg+0x10/0x10 [ 1022.901559][T11816] sock_sendmsg_nosec+0x10e/0x180 [ 1022.901590][T11816] __sys_sendto+0x41e/0x5d0 [ 1022.901625][T11816] ? __pfx___sys_sendto+0x10/0x10 [ 1022.901682][T11816] ? rcu_is_watching+0x16/0xb0 [ 1022.901717][T11816] __x64_sys_sendto+0xde/0x100 [ 1022.901751][T11816] do_syscall_64+0x166/0x520 [ 1022.901769][T11816] ? trace_irq_disable+0x3b/0x140 [ 1022.901794][T11816] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1022.901813][T11816] ? clear_bhb_loop+0x70/0xc0 [ 1022.901837][T11816] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1022.901856][T11816] RIP: 0033:0x7f31a4b5e159 [ 1022.901876][T11816] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1022.901897][T11816] RSP: 002b:00007f31a2db6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1022.901919][T11816] RAX: ffffffffffffffda RBX: 00007f31a4de5fa0 RCX: 00007f31a4b5e159 [ 1022.901934][T11816] RDX: 0000000000000001 RSI: 0000200000000200 RDI: 0000000000000004 [ 1022.901946][T11816] RBP: 00007f31a4bf506b R08: 0000000000000000 R09: 0000000000000000 [ 1022.901959][T11816] R10: 0000000000000802 R11: 0000000000000246 R12: 0000000000000000 [ 1022.901971][T11816] R13: 00007f31a4de6038 R14: 00007f31a4de5fa0 R15: 00007ffe016313d8 [ 1022.902004][T11816] [ 1023.258295][ T5775] usb 4-1: config 0 descriptor?? [ 1023.286015][ T5775] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.119/input/input19 [ 1023.624363][T11822] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1023.628750][T11822] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1027.073790][ T90] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1027.083773][ T9264] usb 4-1: USB disconnect, device number 17 [ 1028.129051][ T90] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1028.496342][T11848] tipc: Started in network mode [ 1028.496376][T11848] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 1028.497293][T11848] tipc: Enabled bearer , priority 0 [ 1028.850877][ T90] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1028.879360][T11864] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1513'. [ 1030.786462][ T9264] tipc: Node number set to 43690 [ 1031.451769][ T90] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1031.646886][ T5247] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1031.738282][T11893] Bluetooth: MGMT ver 1.23 [ 1036.986662][T11494] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1038.723877][T11494] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1038.790014][T11494] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1038.921009][T11494] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1039.552882][T11952] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1540'. [ 1039.849943][T11494] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1039.973420][T11494] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1040.504551][T11494] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1040.543455][T11494] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1040.555567][ T5247] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1044.251734][ T90] bridge_slave_1: left allmulticast mode [ 1044.251776][ T90] bridge_slave_1: left promiscuous mode [ 1044.252059][ T90] bridge0: port 2(bridge_slave_1) entered disabled state [ 1044.426841][ T90] bridge_slave_0: left allmulticast mode [ 1044.426902][ T90] bridge_slave_0: left promiscuous mode [ 1044.427198][ T90] bridge0: port 1(bridge_slave_0) entered disabled state [ 1044.633486][T11994] kvm [11992]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0xffff00000000 [ 1046.450840][ T5603] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1046.454005][ T5603] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1046.473503][ T5603] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1046.475964][ T5603] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1046.477720][ T5603] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1046.548205][ T90] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1046.747455][ T90] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1048.026341][ T90] bond0 (unregistering): Released all slaves [ 1049.767791][ T60] Bluetooth: hci5: command tx timeout [ 1049.793534][ T5247] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1050.920366][ T5603] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1050.954814][ T5603] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1050.963222][ T5603] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1051.003744][ T5603] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1051.004791][ T5603] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1051.840882][ T5603] Bluetooth: hci5: command tx timeout [ 1051.876405][ T5775] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 1052.026356][ T5775] usb 5-1: Using ep0 maxpacket: 32 [ 1052.027246][ T5775] usb 5-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 1052.028802][ T5775] usb 5-1: config 0 has an invalid interface number: 119 but max is 0 [ 1052.028828][ T5775] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1052.028848][ T5775] usb 5-1: config 0 has no interface number 0 [ 1052.028910][ T5775] usb 5-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1052.032013][ T5775] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1052.032040][ T5775] usb 5-1: Product: syz [ 1052.032056][ T5775] usb 5-1: Manufacturer: syz [ 1052.032070][ T5775] usb 5-1: SerialNumber: syz [ 1052.144733][ T5775] usb 5-1: config 0 descriptor?? [ 1052.197170][ T5775] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.119/input/input20 [ 1052.532497][T12071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1052.545020][T12071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1053.368187][ T5603] Bluetooth: hci6: command tx timeout [ 1053.956652][ T5603] Bluetooth: hci5: command tx timeout [ 1056.008939][ T5603] Bluetooth: hci6: command tx timeout [ 1056.008999][ T5603] Bluetooth: hci5: command tx timeout [ 1056.408769][ T5247] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1056.542938][ T1969] usb 5-1: USB disconnect, device number 16 [ 1056.851776][ T90] hsr_slave_0: left promiscuous mode [ 1056.898979][ T90] hsr_slave_1: left promiscuous mode [ 1056.902825][ T90] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1056.902857][ T90] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1056.961197][ T90] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1056.961230][ T90] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1057.099790][ T90] veth1_macvtap: left promiscuous mode [ 1057.099915][ T90] veth0_macvtap: left promiscuous mode [ 1057.100207][ T90] veth1_vlan: left promiscuous mode [ 1057.100414][ T90] veth0_vlan: left promiscuous mode [ 1059.108829][ T60] Bluetooth: hci6: command tx timeout [ 1059.726373][T12124] binder: 12120:12124 ioctl 4018620d 0 returned -22 [ 1060.269844][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 1060.269924][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 1061.197246][ T60] Bluetooth: hci6: command tx timeout [ 1061.431876][T12129] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1577'. [ 1062.496410][T10633] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1062.646725][T10633] usb 4-1: Using ep0 maxpacket: 32 [ 1062.647803][T10633] usb 4-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 1062.652162][T10633] usb 4-1: config 0 has an invalid interface number: 119 but max is 0 [ 1062.652193][T10633] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1062.652212][T10633] usb 4-1: config 0 has no interface number 0 [ 1062.652271][T10633] usb 4-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1062.662717][T10633] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1062.662745][T10633] usb 4-1: Product: syz [ 1062.662759][T10633] usb 4-1: Manufacturer: syz [ 1062.662772][T10633] usb 4-1: SerialNumber: syz [ 1062.686023][T10633] usb 4-1: config 0 descriptor?? [ 1062.712495][T10633] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.119/input/input21 [ 1063.919545][T12143] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1063.921574][T12143] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1064.407790][ T90] team0 (unregistering): Port device team_slave_1 removed [ 1064.426982][ T90] team0 (unregistering): Port device team_slave_0 removed [ 1064.884184][ T5775] usb 4-1: USB disconnect, device number 18 [ 1068.058113][ T90] IPVS: stop unused estimator thread 0... [ 1069.952362][ T5247] 8021q: adding VLAN 0 to HW filter on device eth14 [ 1070.178361][T12026] bridge0: port 1(bridge_slave_0) entered blocking state [ 1070.178522][T12026] bridge0: port 1(bridge_slave_0) entered disabled state [ 1070.178732][T12026] bridge_slave_0: entered allmulticast mode [ 1070.185127][T12026] bridge_slave_0: entered promiscuous mode [ 1070.275119][T12026] bridge0: port 2(bridge_slave_1) entered blocking state [ 1070.275267][T12026] bridge0: port 2(bridge_slave_1) entered disabled state [ 1070.275469][T12026] bridge_slave_1: entered allmulticast mode [ 1070.282049][T12026] bridge_slave_1: entered promiscuous mode [ 1072.757064][T12253] kvm [12252]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0xffff00000000 [ 1072.972142][T12046] bridge0: port 1(bridge_slave_0) entered blocking state [ 1072.972379][T12046] bridge0: port 1(bridge_slave_0) entered disabled state [ 1072.972577][T12046] bridge_slave_0: entered allmulticast mode [ 1072.980853][T12046] bridge_slave_0: entered promiscuous mode [ 1072.999893][T12268] FAULT_INJECTION: forcing a failure. [ 1072.999893][T12268] name failslab, interval 1, probability 0, space 0, times 0 [ 1072.999932][T12268] CPU: 1 UID: 0 PID: 12268 Comm: syz.3.1608 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1072.999957][T12268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1072.999970][T12268] Call Trace: [ 1072.999978][T12268] [ 1072.999986][T12268] dump_stack_lvl+0xe8/0x150 [ 1073.000021][T12268] should_fail_ex+0x46b/0x600 [ 1073.000053][T12268] should_failslab+0xa8/0x100 [ 1073.000085][T12268] __kvmalloc_node_noprof+0x176/0x890 [ 1073.000113][T12268] ? kmem_cache_alloc_noprof+0x3c6/0x690 [ 1073.000137][T12268] ? ceph_msg_new2+0x166/0x4d0 [ 1073.000157][T12268] ? ceph_msg_new2+0x166/0x4d0 [ 1073.000183][T12268] ceph_msg_new2+0x166/0x4d0 [ 1073.000208][T12268] ceph_monc_init+0x5f0/0xb10 [ 1073.000244][T12268] ceph_create_client+0x225/0x310 [ 1073.000274][T12268] ceph_get_tree+0x1ca/0x1a40 [ 1073.000298][T12268] ? cap_capable+0x123/0x460 [ 1073.000321][T12268] ? safesetid_security_capable+0xa9/0x1a0 [ 1073.000352][T12268] vfs_get_tree+0x92/0x2a0 [ 1073.000379][T12268] vfs_cmd_create+0xa2/0x200 [ 1073.000413][T12268] __se_sys_fsconfig+0x6bf/0x810 [ 1073.000446][T12268] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 1073.000476][T12268] ? rcu_is_watching+0x16/0xb0 [ 1073.000511][T12268] ? __x64_sys_fsconfig+0x20/0xc0 [ 1073.000540][T12268] do_syscall_64+0x166/0x520 [ 1073.000557][T12268] ? trace_irq_disable+0x3b/0x140 [ 1073.000581][T12268] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1073.000601][T12268] ? clear_bhb_loop+0x70/0xc0 [ 1073.000625][T12268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1073.000645][T12268] RIP: 0033:0x7ff86b86e159 [ 1073.000664][T12268] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1073.000680][T12268] RSP: 002b:00007ff869ac6028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 1073.000704][T12268] RAX: ffffffffffffffda RBX: 00007ff86baf5fa0 RCX: 00007ff86b86e159 [ 1073.000719][T12268] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 1073.000731][T12268] RBP: 00007ff86b90506b R08: 0000000000000000 R09: 0000000000000000 [ 1073.000744][T12268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1073.000756][T12268] R13: 00007ff86baf6038 R14: 00007ff86baf5fa0 R15: 00007ffeb0448cb8 [ 1073.000797][T12268] [ 1073.107363][T12046] bridge0: port 2(bridge_slave_1) entered blocking state [ 1073.107539][T12046] bridge0: port 2(bridge_slave_1) entered disabled state [ 1073.107741][T12046] bridge_slave_1: entered allmulticast mode [ 1073.112276][T12046] bridge_slave_1: entered promiscuous mode [ 1073.135960][T12026] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1073.205862][T12026] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1073.262740][T12046] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1073.329449][T12046] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1073.336144][T12026] team0: Port device team_slave_0 added [ 1074.527692][T12026] team0: Port device team_slave_1 added [ 1074.953652][ T45] IPVS: starting estimator thread 0... [ 1074.960876][T12046] team0: Port device team_slave_0 added [ 1075.034960][T12046] team0: Port device team_slave_1 added [ 1075.056561][T12295] IPVS: using max 8 ests per chain, 19200 per kthread [ 1076.596657][T12026] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1076.596679][T12026] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1076.596718][T12026] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1076.773138][T12026] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1076.773159][T12026] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1076.773189][T12026] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1076.883106][T12304] kvm [12303]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0xffff00000000 [ 1076.945738][T12046] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1076.945753][T12046] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1076.945769][T12046] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1077.013301][T12046] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1077.013322][T12046] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1077.013353][T12046] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1077.182745][T12026] hsr_slave_0: entered promiscuous mode [ 1077.184246][T12026] hsr_slave_1: entered promiscuous mode [ 1077.185249][T12026] debugfs: 'hsr0' already exists in 'hsr' [ 1077.185275][T12026] Cannot create hsr debugfs directory [ 1079.017037][T12046] hsr_slave_0: entered promiscuous mode [ 1079.020213][T12046] hsr_slave_1: entered promiscuous mode [ 1079.022857][T12046] debugfs: 'hsr0' already exists in 'hsr' [ 1079.022885][T12046] Cannot create hsr debugfs directory [ 1079.386385][ T1969] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 1079.542295][ T1969] usb 5-1: Using ep0 maxpacket: 32 [ 1079.543883][ T1969] usb 5-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1079.549793][ T1969] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1079.593453][ T12] IPVS: starting estimator thread 0... [ 1079.597978][ T1969] usb 5-1: config 0 descriptor?? [ 1079.661803][ T1969] as10x_usb: device has been detected [ 1079.665153][ T1969] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1079.676496][T12338] IPVS: using max 7 ests per chain, 16800 per kthread [ 1079.795306][ T1969] usb 5-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1079.822814][T12325] INFO: trying to register non-static key. [ 1079.828691][T12325] The code is fine but needs lockdep annotation, or maybe [ 1079.835852][T12325] you didn't initialize this object before use? [ 1079.842117][T12325] turning off the locking correctness validator. [ 1079.848473][T12325] CPU: 0 UID: 0 PID: 12325 Comm: syz.4.1625 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1079.858395][T12325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1079.868463][T12325] Call Trace: [ 1079.871749][T12325] [ 1079.874682][T12325] dump_stack_lvl+0xe8/0x150 [ 1079.879298][T12325] assign_lock_key+0x133/0x150 [ 1079.884088][T12325] register_lock_class+0xcc/0x2e0 [ 1079.889133][T12325] ? __lock_acquire+0x747/0x2de0 [ 1079.894080][T12325] __lock_acquire+0x10c/0x2de0 [ 1079.898856][T12325] ? __lock_acquire+0x747/0x2de0 [ 1079.903805][T12325] ? do_raw_spin_lock+0x12b/0x2f0 [ 1079.908848][T12325] lock_acquire+0x115/0x350 [ 1079.913361][T12325] ? as102_dvb_dmx_start_feed+0x70/0x290 [ 1079.919057][T12325] ? as102_dvb_dmx_start_feed+0x70/0x290 [ 1079.924706][T12325] ? as102_dvb_dmx_start_feed+0x70/0x290 [ 1079.930367][T12325] mutex_lock_interruptible_nested+0x5a/0x1d0 [ 1079.936461][T12325] ? as102_dvb_dmx_start_feed+0x70/0x290 [ 1079.942106][T12325] as102_dvb_dmx_start_feed+0x70/0x290 [ 1079.947576][T12325] dmx_section_feed_start_filtering+0x519/0x6b0 [ 1079.953896][T12325] dvb_dmxdev_filter_start+0xcdb/0x10d0 [ 1079.959457][T12325] ? dvb_dmxdev_filter_set+0x2d1/0x580 [ 1079.964922][T12325] dvb_demux_do_ioctl+0x473/0x540 [ 1079.969957][T12325] dvb_usercopy+0x199/0x2e0 [ 1079.974471][T12325] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 1079.980029][T12325] ? __pfx_dvb_usercopy+0x10/0x10 [ 1079.985071][T12325] ? __fget_files+0x3a8/0x420 [ 1079.989755][T12325] ? __fget_files+0x2a/0x420 [ 1079.994351][T12325] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 1079.999641][T12325] dvb_demux_ioctl+0x29/0x40 [ 1080.004240][T12325] __se_sys_ioctl+0xff/0x170 [ 1080.008843][T12325] do_syscall_64+0x166/0x520 [ 1080.013435][T12325] ? trace_irq_disable+0x3b/0x140 [ 1080.018471][T12325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1080.024540][T12325] ? clear_bhb_loop+0x70/0xc0 [ 1080.029222][T12325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1080.035122][T12325] RIP: 0033:0x7f31a4b5e159 [ 1080.039542][T12325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1080.059155][T12325] RSP: 002b:00007f31a2db6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1080.067599][T12325] RAX: ffffffffffffffda RBX: 00007f31a4de5fa0 RCX: 00007f31a4b5e159 [ 1080.075578][T12325] RDX: 0000200000000080 RSI: 00000000403c6f2b RDI: 0000000000000004 [ 1080.083556][T12325] RBP: 00007f31a4bf506b R08: 0000000000000000 R09: 0000000000000000 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1080.091532][T12325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1080.099522][T12325] R13: 00007f31a4de6038 R14: 00007f31a4de5fa0 R15: 00007ffe016313d8 [ 1080.107526][T12325] [ 1080.121029][ T1969] as10x_usb: error during firmware upload part1 [ 1080.121396][ T1969] Registered device nBox DVB-T Dongle [ 1080.186488][ T1969] usb 5-1: USB disconnect, device number 17 [ 1080.211896][ T1969] Unregistered device nBox DVB-T Dongle [ 1080.213118][ T1969] as10x_usb: device has been disconnected [ 1080.511099][T12026] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1080.589603][T12026] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1080.906417][ T90] bridge_slave_1: left allmulticast mode [ 1080.906448][ T90] bridge_slave_1: left promiscuous mode [ 1080.906610][ T90] bridge0: port 2(bridge_slave_1) entered disabled state [ 1081.017081][ T90] bridge_slave_0: left allmulticast mode [ 1081.017114][ T90] bridge_slave_0: left promiscuous mode [ 1081.017285][ T90] bridge0: port 1(bridge_slave_0) entered disabled state [ 1081.252856][ T90] bridge_slave_1: left allmulticast mode [ 1081.252890][ T90] bridge_slave_1: left promiscuous mode [ 1081.253053][ T90] bridge0: port 2(bridge_slave_1) entered disabled state [ 1081.357113][ T90] bridge_slave_0: left allmulticast mode [ 1081.357144][ T90] bridge_slave_0: left promiscuous mode [ 1081.357307][ T90] bridge0: port 1(bridge_slave_0) entered disabled state [ 1081.707758][ T90] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1081.786812][ T90] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1081.827097][ T90] bond0 (unregistering): Released all slaves [ 1082.017344][ T90] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1082.076776][ T90] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1082.137621][ T90] bond0 (unregistering): Released all slaves [ 1082.567987][T12281] tipc: Resetting bearer [ 1082.667878][T12281] tipc: Disabling bearer [ 1082.868418][ T5247] 8021q: adding VLAN 0 to HW filter on device eth15 [ 1083.247773][ T90] hsr_slave_0: left promiscuous mode [ 1083.286450][ T90] hsr_slave_1: left promiscuous mode [ 1083.287210][ T90] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1083.328641][ T90] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1083.526419][ T90] hsr_slave_0: left promiscuous mode [ 1083.566399][ T90] hsr_slave_1: left promiscuous mode [ 1083.567095][ T90] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1083.606837][ T90] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1083.888787][ T90] team0 (unregistering): Port device team_slave_1 removed [ 1083.906650][ T90] team0 (unregistering): Port device team_slave_0 removed [ 1084.127107][ T90] team0 (unregistering): Port device team_slave_1 removed [ 1084.146672][ T90] team0 (unregistering): Port device team_slave_0 removed [ 1084.539279][ T5247] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1087.008215][ T90] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.077977][ T5247] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1087.287976][ T90] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.337751][ T5247] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1087.580253][ T90] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.617434][ T5247] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1087.858833][ T90] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.907861][ T5247] 8021q: adding VLAN 0 to HW filter on device eth16 [ 1088.337874][ T90] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1088.392116][ T5247] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1088.607913][ T90] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1088.647984][ T5247] 8021q: adding VLAN 0 to HW filter on device eth18 [ 1088.888520][ T90] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1088.927609][ T5247] 8021q: adding VLAN 0 to HW filter on device eth19 [ 1089.169007][ T90] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1089.218032][ T5247] 8021q: adding VLAN 0 to HW filter on device eth20 [ 1089.617989][ T90] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1089.677955][ T5247] 8021q: adding VLAN 0 to HW filter on device eth21