last executing test programs: 4m9.349834552s ago: executing program 3 (id=714): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000440)=ANY=[], 0x48) (async) setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000440)=ANY=[], 0x48) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f00000003c0)={0x4, @pix_mp={0x9, 0xfffffff1, 0x32314752, 0x2, 0x6, [{0x8, 0x6f04}, {0x1, 0x10004}, {0x0, 0xd50}, {0xb, 0x7ff}, {0x0, 0x3}, {0x7, 0x16aa}, {0x7, 0xfffffffa}, {0x105d, 0x2}], 0x81, 0x6, 0x1, 0x1, 0x7}}) (async) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f00000003c0)={0x4, @pix_mp={0x9, 0xfffffff1, 0x32314752, 0x2, 0x6, [{0x8, 0x6f04}, {0x1, 0x10004}, {0x0, 0xd50}, {0xb, 0x7ff}, {0x0, 0x3}, {0x7, 0x16aa}, {0x7, 0xfffffffa}, {0x105d, 0x2}], 0x81, 0x6, 0x1, 0x1, 0x7}}) r2 = socket(0xa, 0x3, 0x87) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) (async) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) eventfd(0x0) (async) r5 = eventfd(0x0) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f0000000240)=r5) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000200)={0x0, 0x1, 0x0, &(0x7f0000000500)=""/68, 0x0, 0x60000}) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f00000001c0)={0x0, r5}) (async) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f00000001c0)={0x0, r5}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000680)) (async) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000340)=0x1) (async) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$VHOST_SET_LOG_BASE(r4, 0x4008af25, &(0x7f0000000040)=0x0) ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000240)=0x1d) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x4c, 0x2, 0x6, 0x801, 0x0, 0xffef, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x4c}}, 0x4004804) r6 = syz_open_dev$video(&(0x7f00000000c0), 0x1, 0x8000) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$EBT_SO_SET_ENTRIES(r7, 0x0, 0x80, &(0x7f0000000ec0)=@nat={'nat\x00', 0x19, 0x3, 0x0, [0x200000000240, 0x0, 0x0, 0x200000000d9c, 0x200000000e72], 0x0, 0x0, 0x0}, 0xcda) ioctl$VIDIOC_S_FMT(r6, 0xc0d05640, &(0x7f00000006c0)={0x8, @pix={0x0, 0x0, 0x33565348, 0x0, 0x0, 0x0, 0x9, 0xfeedcafe, 0x0, 0xffffff80, 0x1, 0x7}}) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000180)={0x0, @bt={0x7fffffff, 0x5, 0x0, 0x3, 0x4, 0x4, 0x4, 0xffff, 0xb3a0, 0x5, 0x7, 0x80, 0x9, 0x0, 0x1, 0x8, {0x8, 0x7fff}, 0x0, 0x3}}) r8 = userfaultfd(0x800) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000300)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bond0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000000)={@mcast2, 0x40, r9}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4050000000000007110380000000000ae000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x9, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4050000000000007110380000000000ae000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x9, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 4m9.108157715s ago: executing program 3 (id=716): r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) shutdown(r1, 0x1) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000040010000008000f0fffeffe809000000fff5dd0000001000010003081000418efffe0004fcff", 0x58}], 0x1) 4m8.822429833s ago: executing program 3 (id=718): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_async', 0x149a82, 0x0) write$cgroup_int(r1, 0x0, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x4040084) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14, 0x0, 0x0, 0x0, 0x25dfdbfb}, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000"], 0x3c}}, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x58, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x1f, 0xff90}}, @IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r7}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x58}, 0x1, 0x0, 0x0, 0x600}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000cc0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000c40)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7f, 0x2, 0x5b, 0x7, '\x00', "4cdfdb14"}}, 0x0}, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) 4m6.583195644s ago: executing program 3 (id=725): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000040)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a00100000000280", 0x2a}, {&(0x7f0000000400)="03000000", 0x4}], 0x2}, 0x0) r1 = socket(0xa, 0x3, 0x3a) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x183c81) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r4, 0x402c5342, &(0x7f0000000480)={0x3, 0xf, 0x1, {0x6, 0x9}, 0x0, 0x10001}) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x41) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x232) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000600)={{0xa, 0x0, 0x8, @local}, {0xa, 0x0, 0x0, @empty}, 0x1}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000000)={{0xa, 0x4e24, 0x100, @local, 0x4}, {0xa, 0x4e23, 0x7, @empty, 0xd473}, 0x0, {[0x4, 0x7, 0x3, 0x0, 0xe10, 0xe, 0x3, 0x5]}}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e20, 0x0, @empty}, 0x1, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xe3]}}, 0x5c) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000000)="2e00000012008188e6b42aa73772cc9f1b2f8b48430000005e140602240000000e000a000f000000028000001294", 0xfffffffffffffed4}], 0x1}, 0x90) 4m4.371781346s ago: executing program 3 (id=729): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x1}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000020000000200000800040001000000", 0x24) 4m3.767547929s ago: executing program 3 (id=733): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000280)='cgroup.clone_children\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0x100000000) write$cgroup_int(r1, &(0x7f00000000c0)=0x6, 0x12) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x4001, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000000c0)={'syz0\x00', {0xfff7, 0xc, 0x100, 0x81}, 0x1d, [0x7b, 0xb7e2, 0x3, 0x9, 0x100, 0x3, 0x1, 0x7, 0x9, 0x2, 0x7, 0xa, 0x3, 0x0, 0x7f, 0xd, 0x7fff, 0x6, 0x6, 0x5, 0x6, 0x6, 0x7, 0x6, 0xff, 0x2, 0xa5f2b87a, 0x409, 0x0, 0xfc75, 0x8, 0x9, 0x4, 0x2, 0xffffffff, 0x81, 0xfffff765, 0x2, 0x3, 0x6, 0xa, 0x2, 0x5, 0x0, 0x3ff, 0x6, 0x7, 0x8000, 0xfffffffd, 0x80, 0x8, 0x8, 0x9, 0x7, 0x101, 0xc3c, 0x1733, 0x7fff, 0x7ffc, 0x1, 0x6, 0x5, 0x1, 0x4], [0x8, 0x3, 0x8, 0x8, 0x0, 0x8, 0x4, 0x0, 0x24, 0x10, 0x6, 0x7, 0x8, 0xe62, 0xffffff73, 0x1000, 0x6, 0x13e5, 0x3, 0x3, 0x1000, 0x7, 0x1, 0x3b40, 0x4, 0x1000, 0x5, 0x7fff, 0x8, 0x5a, 0xffff2505, 0x7fffffff, 0x6995, 0x1, 0x80000000, 0x8, 0xdab, 0x5, 0x2, 0x76c4, 0xfffffffd, 0x5, 0x3, 0x10000, 0xd, 0x2, 0x9, 0x10, 0x4000e, 0x9, 0x7, 0xa, 0x9, 0x3, 0x8, 0x3, 0x2, 0x3a6, 0x0, 0xc0d, 0xfffffffd, 0x9, 0xc, 0xfffffffb], [0x3, 0x6, 0x6, 0x9, 0x1000, 0x0, 0x80000000, 0x5, 0x7f, 0xa, 0xfc, 0x1003, 0xf1, 0x6, 0x6, 0x10000, 0x72, 0xc, 0x633, 0xd, 0x7, 0x6, 0x80000000, 0x6, 0x0, 0x7, 0x8, 0x2ef3adcb, 0x10, 0x2, 0x8, 0x8, 0x74, 0x4, 0x7, 0x7ff, 0xfffffff2, 0x63, 0x7, 0x2, 0x3, 0xfffffff3, 0x20a7fd9e, 0xfffffffd, 0x2, 0xa1, 0x0, 0x9d, 0x7, 0xa8a, 0x2, 0x6, 0x77, 0x8, 0x1ff, 0x7, 0x7, 0x2, 0x0, 0x3, 0x8, 0x2, 0x3, 0x5], [0x4, 0x4, 0x5, 0x8000, 0x493e, 0x3, 0x35ff4447, 0x7, 0x5, 0x5, 0x5d3a, 0x5, 0x9, 0x3ff, 0xb88f, 0xffff0000, 0x9, 0xf7df, 0x2, 0x10, 0x8, 0x2, 0xff, 0x6, 0x4, 0x4, 0x200, 0x0, 0x7, 0x4e6, 0x8, 0x40000000, 0x5ef, 0x8000, 0xc, 0x41, 0x400, 0x1, 0x5, 0x0, 0x9a8, 0x99f, 0x231, 0x3ff, 0x8, 0x1, 0xffff0001, 0x1, 0x1, 0x10, 0x8, 0x5396, 0x6161, 0x9, 0x101, 0x206, 0x8, 0x431, 0x6, 0x5, 0x4, 0x7b, 0x7fc, 0x9]}, 0x45c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e40000000201010800000000000000000a000000d00001800c000280050001000000000014000180080001000000000008000200000000002c00018014000300ff01000000000000000000000000000114000400ff0100000000000000000000000000010c00028005000100000000004700028005000100010000000600064000000000060005"], 0xe4}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r2, 0xc018937c, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) 4m3.145517335s ago: executing program 32 (id=733): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000280)='cgroup.clone_children\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0x100000000) write$cgroup_int(r1, &(0x7f00000000c0)=0x6, 0x12) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x4001, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000000c0)={'syz0\x00', {0xfff7, 0xc, 0x100, 0x81}, 0x1d, [0x7b, 0xb7e2, 0x3, 0x9, 0x100, 0x3, 0x1, 0x7, 0x9, 0x2, 0x7, 0xa, 0x3, 0x0, 0x7f, 0xd, 0x7fff, 0x6, 0x6, 0x5, 0x6, 0x6, 0x7, 0x6, 0xff, 0x2, 0xa5f2b87a, 0x409, 0x0, 0xfc75, 0x8, 0x9, 0x4, 0x2, 0xffffffff, 0x81, 0xfffff765, 0x2, 0x3, 0x6, 0xa, 0x2, 0x5, 0x0, 0x3ff, 0x6, 0x7, 0x8000, 0xfffffffd, 0x80, 0x8, 0x8, 0x9, 0x7, 0x101, 0xc3c, 0x1733, 0x7fff, 0x7ffc, 0x1, 0x6, 0x5, 0x1, 0x4], [0x8, 0x3, 0x8, 0x8, 0x0, 0x8, 0x4, 0x0, 0x24, 0x10, 0x6, 0x7, 0x8, 0xe62, 0xffffff73, 0x1000, 0x6, 0x13e5, 0x3, 0x3, 0x1000, 0x7, 0x1, 0x3b40, 0x4, 0x1000, 0x5, 0x7fff, 0x8, 0x5a, 0xffff2505, 0x7fffffff, 0x6995, 0x1, 0x80000000, 0x8, 0xdab, 0x5, 0x2, 0x76c4, 0xfffffffd, 0x5, 0x3, 0x10000, 0xd, 0x2, 0x9, 0x10, 0x4000e, 0x9, 0x7, 0xa, 0x9, 0x3, 0x8, 0x3, 0x2, 0x3a6, 0x0, 0xc0d, 0xfffffffd, 0x9, 0xc, 0xfffffffb], [0x3, 0x6, 0x6, 0x9, 0x1000, 0x0, 0x80000000, 0x5, 0x7f, 0xa, 0xfc, 0x1003, 0xf1, 0x6, 0x6, 0x10000, 0x72, 0xc, 0x633, 0xd, 0x7, 0x6, 0x80000000, 0x6, 0x0, 0x7, 0x8, 0x2ef3adcb, 0x10, 0x2, 0x8, 0x8, 0x74, 0x4, 0x7, 0x7ff, 0xfffffff2, 0x63, 0x7, 0x2, 0x3, 0xfffffff3, 0x20a7fd9e, 0xfffffffd, 0x2, 0xa1, 0x0, 0x9d, 0x7, 0xa8a, 0x2, 0x6, 0x77, 0x8, 0x1ff, 0x7, 0x7, 0x2, 0x0, 0x3, 0x8, 0x2, 0x3, 0x5], [0x4, 0x4, 0x5, 0x8000, 0x493e, 0x3, 0x35ff4447, 0x7, 0x5, 0x5, 0x5d3a, 0x5, 0x9, 0x3ff, 0xb88f, 0xffff0000, 0x9, 0xf7df, 0x2, 0x10, 0x8, 0x2, 0xff, 0x6, 0x4, 0x4, 0x200, 0x0, 0x7, 0x4e6, 0x8, 0x40000000, 0x5ef, 0x8000, 0xc, 0x41, 0x400, 0x1, 0x5, 0x0, 0x9a8, 0x99f, 0x231, 0x3ff, 0x8, 0x1, 0xffff0001, 0x1, 0x1, 0x10, 0x8, 0x5396, 0x6161, 0x9, 0x101, 0x206, 0x8, 0x431, 0x6, 0x5, 0x4, 0x7b, 0x7fc, 0x9]}, 0x45c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e40000000201010800000000000000000a000000d00001800c000280050001000000000014000180080001000000000008000200000000002c00018014000300ff01000000000000000000000000000114000400ff0100000000000000000000000000010c00028005000100000000004700028005000100010000000600064000000000060005"], 0xe4}}, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r2, 0xc018937c, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) 5.023829347s ago: executing program 4 (id=2361): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x300, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x2, 0x1007fff, 0x16, "b0bf2eac000000030000f1beff4000"}) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x8000c64) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0x40305829, &(0x7f0000000240)={0x17c04, 0xffffffffffffffff, 0x20009, 0x40006000006, 0x5, 0x4}) r1 = syz_open_pts(r0, 0x2201) dup3(r1, r0, 0x0) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') r4 = memfd_create(&(0x7f0000000380)='D\xa3\xd5Wj\x00\x00x0\xc1\xac*\x1a\vG\xa9~vB\xbc\t\x00\x00\x00VoA\xaa\xbc\xee[\xe1\xa2\xe0\xff\x04\x00\x00\x00\\i\xcf\t\xb0\xa9 +H/\x1a\xe7\x95\xce\"\"\xbd\xf9\xd0\xc0\xa9\b\x98\xfc:\x1b\xc4\x80!\xfd\xa4\xcaN\x84\xadS\x8bqE\x99\x01t\xb1\x1f|\x99PL\x92\x8f\xc2\xf9\xcd\x8cj\x03X\x05\x17mwI\xf0\x01\xe5z\xcdJ)\xc7\xfa)\xaa}\xef\xbb\xf5\xcd\xb1o5\x18\xd6\v\x85q\x98\x9bB\xb9\xea\xe7\xff\x7f\x00\x00T\xc0\xd2\t?\bpBl\xf4*8\xc6\xe5\x06P\xc11\f^\x7f\x8e\xc1\xd1Wra\x19)\xe3\x8f\xd9\x9f\x15\x1e\xf2\x18\r\xad\b\xe0\x96NH\x85\r+\xfc\xb3\xdd\xddhg \x03\xa7\x92\xff\x00+h\xb7@#K\x9cMY\xd3\x9b\b-G\xb1\xdaS\x81\xb2\x93\xb83\x8a\x94*\x8d\\\b\xff/\xa1\xc0\xf9&\xd3M\xf6\n\xff\x83k\xe6\rDa\x16\xbd\x00\x02\xdf\b~\xd5)\xa4\x80\xad\x97\'\x1b\xfd}\x96&\xd2\x0eGp\x8e\x1a\x19o\xf1\x14\xe2]J\xf2\xb5h\x9bt*\xd2\xfbT\x01ci\x87\x18\xc9\x13=\x1b\xadl;}\x9d\xbe\x9a\xee\x1a\xfc\x96 \x93\x12@\x19|f\x98\xdc,\x82SlA\x19\xcb\xfe\xccSKO}\xb2U\xd6\xc5\xa7=\xf8s\x1dp\xe0\x14\xe5\x92\xfd)\bB\xcd\xc2\xb6\x85$%nV\xd3*\x00`OE\x8e\xf0\xf9\xd2!KZ%\xad\xa1\x92b\x1e%\x9f!\xd8mV$\x1d?\xc2\f\xcc\xc5x\x9fJ#\xce\x90\xc5\x82\xfb\x97\xd2\xb7\xb5\xed\xb5\'J\xfc\xf4Z.\rS\x88\f\xd0zK\xc7\x81\xbe\xd5\xc2\xce\x89\xbc\x1e\xb78\xf6Z\xd5\x1b\xf1\x9bMD\f\xf6\xc5V\xe1\x12j\xdfW\x87\xf09\n\x1e\x1b\f\xe5p\xab\x9e\xe5}\x96\x9b\xea\x86\x0f\xca\xcf\x16\x96\x0e6\x8d\x11\xd2&\"eKKV\x8b?]<\xa7]\x93\xad\x1d\xfe\x13\xee\xca\xdc\x97\xa9\a\b\xac\xdd\xa0\xfe\x97\xa1?\xa2F\xae\xb7f\x85\xda', 0x0) write(r4, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x0) r5 = dup3(r3, r2, 0x0) fchdir(r5) creat(&(0x7f0000000040)='./bus\x00', 0x0) 4.931737611s ago: executing program 4 (id=2362): openat(0xffffffffffffff9c, &(0x7f0000000000)='./myconfig/usb_gadget/g1/functions/uac2.usb0/c_srate\x00', 0x101042, 0x15) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="010000000c0000000300000007"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_MAC_ACL(0xffffffffffffffff, 0x0, 0x20000010) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000100), 0x3f, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000020c0)={r0, &(0x7f0000000000), &(0x7f0000002000)=""/154}, 0x20) 4.768785908s ago: executing program 4 (id=2366): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, 0x0, 0x40) r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e1d, 0x40000009, @local, 0x4}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4e, &(0x7f0000000040)=0x78, 0x4) bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00', 0x4}, 0x1c) syz_emit_ethernet(0x9a, &(0x7f0000000340)={@random="5b685c7e778f", @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, '\x00', 0x64, 0x11, 0x0, @local, @mcast2, {[], {0x4e24, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x1, 0x1, "20788607b7d52ad8a6c20fb31639feff8e783fcc27407d5f2a589c41b1ffd7d0", "02d657da10fdd6ec27ece85bed6af1fb", {"ffbfd4906a7f817e859e5f68d8e3cc5a", "04fcc205d5e358b52e644fe353345ce3"}}}}}}}}, 0x0) 4.586044395s ago: executing program 4 (id=2369): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000340)={'erspan0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x8, 0x80, 0x101, 0x2, {{0xa, 0x4, 0x0, 0x38, 0x28, 0x65, 0x0, 0x2, 0x2f, 0x0, @loopback, @remote, {[@lsrr={0x83, 0x13, 0x8, [@multicast2, @local, @broadcast, @local]}]}}}}}) write$tun(r0, &(0x7f0000000280)=ANY=[], 0xfd6c) 4.351605919s ago: executing program 2 (id=2373): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x1, 0x19, &(0x7f00000005c0)=ANY=[@ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000030000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010041f68500000082000000bf91000000000000b7020000000000008500000085"], &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl(r5, 0x4048aecb, &(0x7f0000000400)) ioctl$KVM_GET_SREGS(r5, 0x8138ae83, &(0x7f0000000700)) r6 = userfaultfd(0x1) mbind(&(0x7f000070d000/0x1000)=nil, 0x1000, 0x3, &(0x7f0000000100)=0x6, 0xe410, 0x5) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000007feffff720af0fff8ffffff71a4f0ff0000000061100000000000001d400500000000004704000001ed00000f030000000000081d440000000000006b0a00fe000000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d012"], &(0x7f00000001c0)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000d507df08c410448200dc010203"], 0x0) syz_usb_control_io(r7, 0x0, 0x0) r8 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r8, 0x8982, &(0x7f0000000140)={0x0, 'veth0_to_batadv\x00', {}, 0xe}) bind$inet6(r8, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r8, &(0x7f0000000000)={0xa, 0x4e21, 0x7, @loopback, 0x4000002}, 0x1c) getsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f0000000480)={{{@in=@multicast2, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@empty}}, 0x0) quotactl_fd$Q_GETFMT(r0, 0xffffffff80000400, r9, &(0x7f00000006c0)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0xfca804a0, 0x8, 0x8, &(0x7f0000000040)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.305854545s ago: executing program 0 (id=2375): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='fdinfo\x00') fchdir(r0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x20, 0x4000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xfff1, 0xc}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x1, 0x40055}, &(0x7f00000000c0)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f211066865578ac0109029c000100000400090400bf900b64ea0009058703"], 0x0) connect$netlink(0xffffffffffffffff, 0x0, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000240)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r5, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r1, 0x1000001, 0xfffffffe, 0x4b, 0x0, 0x0) r6 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) getdents(r6, 0x0, 0x0) 4.284949984s ago: executing program 4 (id=2376): close(0xffffffffffffffff) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000ac0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'bond0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000180)=ANY=[@ANYBLOB="171cd88da2a9e3592fb2d01489ae419b91403b875e9f5affffffffffffffb3aa7e5fee7ad6fea51c60d62331110241ef1ebcef4a560bbe3d0d247ab70fe3612052de2b83274da69c083f3aad699e2ec6c95ac64efeed440e5aa7e9bbaca41210eedafe017b3ae31b6ba57efe57df8bf97289", @ANYRES16=r2, @ANYBLOB="0100d2f2d16eb32902ce2f0000000c00018008000100", @ANYRES32=r4, @ANYRES8=r2], 0x20}}, 0x24040002) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, r4}, 0xc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) writev(r5, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x6, 0x68, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000080)="123eb1000000", 0x0, 0x10000, 0x30520cf7f25f0c64, 0x0, 0x0}) r7 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x1, r8, 0x0, 0x61000006, 0x0) ptrace(0x10, r8) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_usb_control_io(r7, 0x0, 0x0) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r9, &(0x7f0000000480)=""/74, 0x4a) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r10, 0x6, 0x13, &(0x7f0000000100)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_ULP(r10, 0x6, 0x1f, &(0x7f00000003c0), 0x3) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_usb_ep_write$ath9k_ep1(r7, 0x82, 0x0, 0x0) 2.871939458s ago: executing program 0 (id=2379): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000180)={0x44, &(0x7f0000000480)=ANY=[@ANYBLOB="000a06"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv6_newaddr={0x48, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {}, [@IFA_LOCAL={0x14, 0xb, @local}, @IFA_RT_PRIORITY={0x8, 0x9, 0x4}, @IFA_ADDRESS={0x14, 0x1, @loopback}]}, 0x48}, 0x1, 0x0, 0x0, 0x20008041}, 0x4008000) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x143082, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000040)={0x10000010}) landlock_create_ruleset(&(0x7f0000000040)={0x1801a, 0x2, 0x3}, 0x18, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r4, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r5 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x7a22, 0xc000, 0x7, 0x337}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, 0x0}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)=[{0x0}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0) r6 = socket$inet(0x2, 0x800, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000140)=@assoc_value, &(0x7f0000000300)=0x8) syz_usb_connect(0x3, 0x3f, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0xc048aec8, &(0x7f0000000700)={0x6, 0x0, @ioapic={0x4, 0x2, 0x100, 0x6, 0x0, [{0x1, 0x4, 0x5, '\x00', 0x81}, {0x7, 0x45, 0x0, '\x00', 0x7f}, {0x4, 0x5, 0x2, '\x00', 0x1}, {0xc6, 0x4, 0x3, '\x00', 0xf5}, {0x4, 0x0, 0xd, '\x00', 0x7}, {0x3, 0x5, 0x3e, '\x00', 0xa}, {0x81, 0x7, 0x5, '\x00', 0x9}, {0x1, 0xe, 0x6}, {0x6, 0x9, 0xf}, {0x2, 0x9, 0x2, '\x00', 0x5}, {0x4, 0x10, 0xc, '\x00', 0x4}, {0x1, 0x0, 0x0, '\x00', 0x3}, {0x4, 0x0, 0xde, '\x00', 0x80}, {0x2, 0x16, 0x40, '\x00', 0x9}, {0x80, 0x9, 0x6, '\x00', 0x49}, {0x2, 0x5, 0xa, '\x00', 0x4}, {0x60, 0x3, 0x5, '\x00', 0xb}, {0x16, 0x1, 0x9, '\x00', 0xfe}, {0x8c, 0x3, 0x7f}, {0x9, 0x0, 0x3, '\x00', 0x7}, {0x92, 0x4, 0xff, '\x00', 0x2}, {0x9, 0x10, 0x4, '\x00', 0x7}, {0x6, 0x9, 0x1}, {0x40, 0x0, 0x7, '\x00', 0xe}]}}) socket$nl_xfrm(0x10, 0x3, 0x6) r7 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r7, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="640000001000ffff25bd70df2500010000000000", @ANYRES32=0x0, @ANYBLOB="7a0a0500212b0000440012800b000100697036746e6c000034000280140003000000000000000000000800000000003f14000200fe80"], 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x24000000) 2.685261506s ago: executing program 5 (id=2381): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0x2, 0xffffffffec100f4b, 0xd, 0xe000, 0xf, 0x2, 0x0, 0x0, 0x40, 0x20ffff}}, 0x50) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x100, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) gettid() ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x8, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x44, 0x3, 0x1, 0x801, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_TUPLE_MASTER={0x30, 0xe, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @remote}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040004}, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0xfffffffffffffffe, 0x5479, 0x8000041035, 0x200000000006, 0x0, 0x32b, 0xb, 0xffffffff, 0x200000bf4, 0xfff, 0x8000000000005, 0x80000006c], 0x3000, 0x80495}) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r7, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) bind$xdp(r7, &(0x7f0000000280)={0x2c, 0x1f, r9, 0x27}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r4, r9, 0x25, 0xf, @val=@perf_event={0x400}}, 0x18) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xf, 0x3, &(0x7f0000001300)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xa}, 0x94) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.42391687s ago: executing program 5 (id=2382): r0 = socket$pppl2tp(0x18, 0x1, 0x1) bind$alg(0xffffffffffffffff, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x2, @multicast2}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x2040) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)=ANY=[@ANYRES16=r3, @ANYBLOB], 0x28}}, 0x8000) r4 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) bind$netlink(r7, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r7, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r6, &(0x7f0000024c80)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000024d40)=ANY=[@ANYBLOB="4400000010000d042abd7000077bf70000000000", @ANYRES32=r8, @ANYBLOB="01000000000000002400128009000100626f6e640000000014000280050001000600000008000b00", @ANYRES32=r5], 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newlink={0x3c, 0x10, 0x401, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40018}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r11}]}, 0x3c}, 0x1, 0x0, 0x800000000000000}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000e00)=ANY=[@ANYBLOB="44000000100001042abd70000000000000000000", @ANYRES32=r5, @ANYBLOB="0028000000000000140012800c0001006d6163766c616e00", @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r12], 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) 2.347525895s ago: executing program 5 (id=2383): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0xfdffffffffffffff, {0x2, 0xfffd, @empty}, {0x2, 0x4000, @loopback}, {0x2, 0x0, @private}, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x500, 0x6}) 2.276305629s ago: executing program 5 (id=2384): eventfd(0xffff276d) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x10000, &(0x7f0000006680)) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x12, 0x8031, 0xffffffffffffffff, 0x6a855000) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async) mlockall(0x2) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x2}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0x8, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {0xffe0, 0xb}, {0x7, 0xfff1}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x54815}, 0x0) (async) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'syzkaller0\x00'}) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r9, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r9, 0x0) write(r9, &(0x7f0000000000)="01", 0x1) (async) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), r2) syz_usb_connect$cdc_ecm(0x5, 0x5a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000202505a1a4400000000101090248000101006015090400001a02020000052406000005240004000d240f01800000000100fcff500424020209058103ff03000306090582020000020d0309050302", @ANYRESHEX=0x0], 0x0) (async) pread64(r1, &(0x7f0000000240)=""/25, 0x19, 0x0) 2.029098909s ago: executing program 1 (id=2385): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000080)={0x29, 0x0, [{0x296, 0x0, 0x2}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000007c0)=[@text32={0x20, 0x0}], 0x1, 0x9, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.791100557s ago: executing program 1 (id=2386): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="5400000010000304000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="15020000fe0f00001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x54}, 0x1, 0xba01, 0x0, 0x4004}, 0x4000000) 1.624086688s ago: executing program 1 (id=2387): connect$inet6(0xffffffffffffffff, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) symlink(&(0x7f0000000500)='./file0/file0\x00', &(0x7f0000000540)='./file0\x00') removexattr(&(0x7f0000000140)='./file0/file0\x00', &(0x7f00000001c0)=@random={'osx.', '\x00'}) 1.600810079s ago: executing program 1 (id=2388): r0 = socket$packet(0x11, 0xa, 0x300) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1c}}) write$tun(r2, &(0x7f00000004c0)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) recvmmsg(r1, &(0x7f0000001a80)=[{{0x0, 0x0, &(0x7f0000001940)=[{&(0x7f0000000280)=""/92}, {&(0x7f0000000500)=""/139}, {&(0x7f0000000840)=""/234}, {&(0x7f0000000940)=""/4096}], 0x2e, &(0x7f0000001ac0)=""/212, 0x0, 0x2e00}, 0x2}], 0x3fffffffffffffd, 0x10162, 0x0) 1.445377838s ago: executing program 1 (id=2389): fanotify_init(0x2, 0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4) mprotect(&(0x7f00001ad000/0x3000)=nil, 0x3000, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000080)=@req={0x800000, 0x1, 0x1000, 0x800}, 0x10) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x3, 0x11, r1, 0x0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x4000) write(r3, 0x0, 0x0) read(r2, &(0x7f0000800000)=""/8, 0x8) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x11, 0x0, 0x1, 0x1, 0x0, 0x0}, 0x14) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000001980)=[{{0x0, 0x20, 0x0, 0x0, &(0x7f0000000000)=""/26, 0x11}}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f00000000c0)=""/47}, {&(0x7f0000000100)=""/224}, {&(0x7f0000000200)=""/4096}, {&(0x7f0000001200)=""/124}, {&(0x7f0000001280)=""/60}]}}, {{&(0x7f0000001380)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x0, &(0x7f0000001840)=[{&(0x7f0000001400)=""/149}, {&(0x7f0000001b00)=""/118, 0xffffffe2}, {&(0x7f0000001540)=""/188}, {&(0x7f0000001600)=""/57}, {&(0x7f0000001640)=""/135}, {&(0x7f00000014c0)=""/101}, {&(0x7f0000001780)=""/171}], 0x0, &(0x7f00000018c0)=""/176}}], 0x15cbc1ab4c0933f, 0x0, 0x0) 1.122053325s ago: executing program 4 (id=2390): recvmmsg$unix(0xffffffffffffffff, &(0x7f0000006740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000005100)}}], 0x1, 0x40000102, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x1f, 0x0, @thr={&(0x7f0000000140)="c8af40902d364f4f4e4924e66e", &(0x7f0000000640)="7b3bd94e27198f0129ee2dcb2c760c4f0d0c3b8821fddb5eb0cdb5ab3777fa5b3bffb63a375c4eedf9448db4eddf20989b1412b90c2cded743e4abb255dc40c37df977a99cebe5d98972cfc77c43e79a87109863200824546b5e687aefab920360b424c8e952f1be0802e84869f4504e63e7ae98c02ab001f176e8d0f0bdcb64cbe8d063bb365857a3176fe5181f33d4f51d4fb01e31716c7b639f7c874be7357fc34ce5470bec64745a2f853aa7c4727f71a89629b67087a758df1aff10f6ce39f944c75111e934a72e263df36cf71c61c3b3625faafa31c137043542e6b1ca70ff15a93f0cd9142ffc805bfd18cee362a939d5483d67326f6b"}}, &(0x7f00000001c0)) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a3200000000140000001100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200fffe540004802800018007000100637400001c0002800800014000000002080002400000000705000300010000002800018007000100637400001c0002800800024000000011080004400000000c05000300010000000900010073797a30000000000900020073797a32"], 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x0) timer_create(0x7, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd000000000000010902240001000000000904004001030000000921010000012205000905810300"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f00000002c0)={0xfffffffffffffe99, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="00221200000083"], 0x0}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[], 0x0) r4 = syz_open_dev$I2C(&(0x7f00000001c0), 0xb, 0x880c0) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000000)={&(0x7f00000004c0)=[{0x3, 0xe000, 0x0, 0x0}], 0x1}) sendto$inet6(r0, &(0x7f0000000400)="2ae0", 0x2, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x1c) recvmmsg(r0, &(0x7f0000006700)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/31, 0x1f}, 0x11}], 0x621, 0x10162, 0x0) 1.005353395s ago: executing program 2 (id=2391): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) getpid() ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="600000001000010828bd7000feffffff00000000", @ANYRES32=0x0, @ANYBLOB="000000000420040008001b000000000024002b80080001"], 0x60}, 0x1, 0x0, 0x0, 0x20}, 0x20004004) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000200)={&(0x7f00007c3000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000100)=""/229, 0xe5}, &(0x7f0000000240)=0x40) 712.488239ms ago: executing program 2 (id=2392): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x2200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 671.044592ms ago: executing program 2 (id=2393): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x503, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6230}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_ROLE={0x8, 0x4, 0x1}, @IFLA_GTP_FD0={0x8}]}}}]}, 0x40}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000010003b1500"/20, @ANYRES32=0x0, @ANYBLOB="662700000000000024001280090001007866726d0000000014000280040003"], 0x44}}, 0x0) 633.684019ms ago: executing program 2 (id=2394): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x80, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000640)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) syz_ublk_setup_queues(r1, r6, &(0x7f0000000580)={0x0, 0x9e80, 0x820, 0x3, 0x27a, 0x0, r2}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfafb, 0x8, 0x3, 0x338}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x61a, 0x0, 0x1, 0xd0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xd920, 0x4, 0x401, 0x8f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6583, 0x80058, 0x0, 0x205, 0x0, r1}}], 0x4, &(0x7f0000001d00)={0x2e, 0x0, 0x0, r1, 0x1220, 0x0, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, '\x00', {0x1, 0x455, 0x0, 0x0}}, 0x0) 573.083015ms ago: executing program 0 (id=2395): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x88020000, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558) 451.622435ms ago: executing program 0 (id=2396): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x101, 0x0, 0x64000000, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWCHAIN={0x14}], {0x14}}, 0xa4}}, 0x0) 349.027502ms ago: executing program 0 (id=2397): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@bridge_delneigh={0x11, 0x1c, 0xcafe28741a3524c9, 0x70bd2b, 0x25dfdbfb, {0x7, 0x0, 0x0, 0x0, 0x1c, 0x1e, 0xa}}, 0x1c}, 0x1, 0x0, 0x0, 0xc0041}, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_expedited', 0x204203, 0x0) close(0x3) mq_open(&(0x7f0000000000)='batadv_slave_1\xbb', 0x8c2, 0x30, 0x0) lseek(r2, 0x0, 0x3) fcntl$notify(r1, 0x402, 0x40000008) openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x18) 345.593469ms ago: executing program 1 (id=2398): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000740)={0x20, r2, 0x1, 0x0, 0xffffffff, {{}, {@void, @val={0xc, 0x99, {0x2001, 0x56}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4000065}, 0x4008000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x100, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xb6) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x54, r2, 0x20, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3, 0x11}}}}, [@NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0xc}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x1}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x7}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_USER_PRIO={0xfedf, 0xd3, 0x2}]}, 0x54}}, 0x40000) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xa, 0x80000000, 0x1}, 0x50) setns(0xc9, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x200040, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xffff, 0x3fd, 0x0, 0xb2, 0x0, 0x2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x9, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r5, &(0x7f0000000340)={0xa, 0x4e23, 0x80000100, @loopback, 0xfffffffe}, 0x1c) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r5, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000380)={0x6, 0x0}, 0x8) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000840)=ANY=[@ANYBLOB="c841ea752a215f9ff851f9140b22cac2d2f03d8bf05eedbfa98ecf3bc837943c2c7cc7dc964b26834b7afc6da37b30b8ccfbb54e02e128d5f5ba8c3838360ca8d809e9ab305f5ce207baeeaec15e2022428e113be1338a665f43ed80f4d9d3df5b4beee0803485e768602f4ef112864bee02838d42e2ecb15d5d611be4391e4688958ecce7cb5d05ddb566cb8457f923e19ddde809748ebc5800e6b7daa0c520d669ab911fc5cb9bce391c9825cd06720aa095cd6b405897daf803307dd445eb8af29a21838e7b5afb876e60d467ca97357f7bc14cef174ded3eea22101481f7c654aa0df9598c630c7442ce7113e0035950a30840233135d6a47300fda6", @ANYRESOCT=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r5, 0x84, 0x65, &(0x7f0000000080)=[@in={0x2, 0x4e23, @private=0xa010100}], 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r7, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x5}, 0x50) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="28000000030801010000000000000000000000000c00040700000040000000000500030006000000"], 0x28}}, 0x0) r8 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io$rtl8150(r8, 0x0, 0x0) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r10 = accept4(r9, 0x0, 0x0, 0x0) sendmsg(r10, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000780)="5505ae09aa72616584e7c5a91b77597ee5a6e0b629e7715d910942a2d8013b68c277f3df04b5e68b3215407e5ebe685dda35fe2a112045bf3e666eb0f979d4dcec775ff7ab352c71c528f39a88d5cfa9b9b18edd95466836af088fc7e2543bbcf960293b0d", 0x1}, {0x0}, {&(0x7f0000000540)="2800e92d0e4e699bdfa2d2572027017e2820e721cd13d5c98e96474424094acfc4abff95145abd6d11fe190dc080e9559d725851c9", 0xffffff7f}, {&(0x7f0000000580)="edc9463b69d9d57b2e11517c9f4d90c00e7f11ee39d3a5094125962818bc84da61cdce3e9e159f213ce6bfb5229af5c2234d73c77ed04a6bcec6cdc71cd7ac85a42463141bda64c4e7320ee1f1b973219e633115128c6cab33a1d6abaa9924e4d9a4b9912c2af86ce191e02e735718fab9be05c08c594b09d3214a83d6d54332148c8af16a9283574c62cc4ae765410e6ef30f9c7349d865d27769543d0735580313813e38839eeeab760c7c747ecd2dabb4e414f3d02f9940cabb43f3b988b495837c5da3e6bb9862eafe8bd88ba520c391691b38240fa9241916851ff12a18eb01de129bff9819d7428e8e6100", 0xee}, {&(0x7f0000000680)="aeadcd74904a5da247", 0x9}], 0x5}, 0x0) 206.281498ms ago: executing program 5 (id=2399): creat(0x0, 0xecf86c37d53049cc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x7f7) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a20000000000a01040000000000000000020000000900010085797a300000000040000000030a01040000000000000000020000000900010073797a30000000000900030073797a"], 0x9c}}, 0x0) syz_open_dev$sndpcmc(0x0, 0x1, 0x2) 115.749226ms ago: executing program 0 (id=2400): close(0xffffffffffffffff) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000ac0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'bond0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000180)=ANY=[@ANYBLOB="171cd88da2a9e3592fb2d01489ae419b91403b875e9f5affffffffffffffb3aa7e5fee7ad6fea51c60d62331110241ef1ebcef4a560bbe3d0d247ab70fe3612052de2b83274da69c083f3aad699e2ec6c95ac64efeed440e5aa7e9bbaca41210eedafe017b3ae31b6ba57efe57df8bf97289", @ANYRES16=r2, @ANYBLOB="0100d2f2d16eb32902ce2f0000000c00018008000100", @ANYRES32=r4, @ANYRES8=r2], 0x20}}, 0x24040002) setsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, r4}, 0xc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) writev(r5, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x6, 0x68, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000080)="123eb1000000", 0x0, 0x10000, 0x30520cf7f25f0c64, 0x0, 0x0}) r7 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x1, r8, 0x0, 0x61000006, 0x0) ptrace(0x10, r8) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_usb_control_io(r7, 0x0, 0x0) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r9, &(0x7f0000000480)=""/74, 0x4a) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r10, 0x6, 0x1f, &(0x7f00000003c0), 0x3) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_usb_ep_write$ath9k_ep1(r7, 0x82, 0x0, 0x0) 18.665476ms ago: executing program 2 (id=2401): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20a40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x30, 0x2, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x3}, [@CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x4}, @CTA_EXPECT_FN={0x8, 0xb, 'sip\x00'}, @CTA_EXPECT_HELP_NAME={0xa, 0x6, 'Q.931\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x20040800) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x4046885}, 0x8050) ioctl$KVM_RUN(r3, 0xae80, 0x0) 0s ago: executing program 5 (id=2402): ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc4c85513, &(0x7f0000000c80)={{0x3, 0x1, 0x1, 0x3557, 'syz1\x00', 0x5}, 0x1, [0x2, 0x84, 0x1c00000000000000, 0x7fffffffffffffff, 0x3, 0x3896, 0x5, 0x3, 0x8, 0xffffffff, 0xfffffffffffffff7, 0x9, 0x7ff, 0x80, 0x2fc2f8ae, 0x1, 0x101, 0xa70, 0x7fffffffffffffff, 0xa1, 0xfffffffffffffff8, 0x40, 0x2, 0x7, 0x10, 0x9, 0x8, 0x2, 0x6, 0x6, 0x6, 0x5, 0x2, 0x101, 0xffff, 0x144be44d, 0xc3b, 0x400000000003, 0x800000, 0x12, 0x2, 0x8, 0xbb9, 0x2, 0x8, 0x9, 0xb1e, 0x8, 0xf, 0x651, 0x8, 0x8000, 0xc, 0xffffffffffffffff, 0x4, 0x0, 0x400, 0x1, 0x5, 0x80000000, 0x5, 0x81, 0x5, 0x1, 0x6, 0xb, 0x4, 0x5af0512f, 0x8001, 0x5, 0xfffd, 0x8, 0x129, 0x100000001, 0x81, 0x803, 0x1, 0x800, 0xf5, 0x7, 0x1, 0x401, 0xf, 0x4, 0x2c, 0x5, 0x8, 0x2, 0x3, 0x5, 0x80000000, 0xed, 0x9, 0x7, 0x3, 0x7, 0x500000000000000, 0x100, 0xfffffffffffffffb, 0xd05, 0xf, 0xf95, 0x4, 0x5, 0x8, 0x61, 0x1, 0xe, 0x8, 0x1, 0x2, 0x0, 0x400000000, 0x13ff, 0xa, 0xf52, 0x80, 0x6, 0x1000, 0x401, 0xe51b, 0x9, 0x7, 0x3, 0x9, 0x5, 0x9, 0x1ff]}) r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000080)={0x24, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x1, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x108) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000100)={0xeb, 0x0, [{0x1, 0x0, 0x5, 0x7, 0x800, 0x7fffffff, 0x2}]}) ioctl$MON_IOCH_MFLUSH(0xffffffffffffffff, 0x9208, 0x8) ioctl$KVM_SIGNAL_MSI(0xffffffffffffffff, 0x4020aea5, &(0x7f0000000000)={0x8000000, 0xdddd0000, 0xf, 0x0, 0x74000000}) kernel console output (not intermixed with test programs): 1656][T12182] RDX: 0000000000000000 RSI: 0000200000000700 RDI: 0000000000000003 [ 439.441663][T12182] RBP: 00007fb85d82d090 R08: 0000000000000000 R09: 0000000000000000 [ 439.441669][T12182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 439.441679][T12182] R13: 00007fb85cc26038 R14: 00007fb85cc25fa0 R15: 00007fb85cd4fa48 [ 439.441711][T12182] [ 439.449605][T12176] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2008'. [ 439.495148][T12176] vlan0: entered allmulticast mode [ 439.495167][T12176] bond7: entered allmulticast mode [ 439.566297][ T5696] hub 2-1:0.0: config failed, can't read hub descriptor (err -90) [ 439.719391][ T5616] Bluetooth: hci0: unexpected event for opcode 0x3102 [ 439.796269][ T5696] usbhid 2-1:0.0: can't add hid device: -71 [ 439.796382][ T5696] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 439.821855][ T5696] usb 2-1: USB disconnect, device number 90 [ 439.961389][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.961444][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.363102][T12198] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2014'. [ 440.406611][T12201] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2015'. [ 440.774910][T12209] could not allocate digest TFM handle michael_mic [ 440.929838][ T9254] usb 2-1: new full-speed USB device number 91 using dummy_hcd [ 441.029107][T12221] FAULT_INJECTION: forcing a failure. [ 441.029107][T12221] name failslab, interval 1, probability 0, space 100, times 0 [ 441.029141][T12221] CPU: 0 UID: 0 PID: 12221 Comm: syz.5.2021 Tainted: G L syzkaller #0 PREEMPT(full) [ 441.029166][T12221] Tainted: [L]=SOFTLOCKUP [ 441.029173][T12221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 441.029184][T12221] Call Trace: [ 441.029200][T12221] [ 441.029209][T12221] dump_stack_lvl+0xe8/0x150 [ 441.029241][T12221] should_fail_ex+0x410/0x560 [ 441.029267][T12221] should_failslab+0xa8/0x100 [ 441.029288][T12221] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 441.029313][T12221] kmem_cache_alloc_noprof+0xa1/0x600 [ 441.029340][T12221] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 441.029363][T12221] ? kmem_cache_alloc_noprof+0x156/0x600 [ 441.029388][T12221] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 441.029421][T12221] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 441.029458][T12221] mmu_topup_memory_caches+0x21/0x170 [ 441.029478][T12221] kvm_mmu_load+0x9d/0x21e0 [ 441.029499][T12221] ? kvm_msr_allowed+0x9a/0x490 [ 441.029519][T12221] ? kvm_msr_allowed+0x9a/0x490 [ 441.029537][T12221] ? kvm_msr_allowed+0x9a/0x490 [ 441.029554][T12221] ? kvm_msr_allowed+0x3f4/0x490 [ 441.029573][T12221] ? kvm_msr_allowed+0x9a/0x490 [ 441.029591][T12221] ? kvm_apic_has_interrupt+0x740/0x770 [ 441.029630][T12221] vcpu_run+0x4f68/0x79b0 [ 441.029686][T12221] ? update_se+0x90/0x1020 [ 441.029744][T12221] ? __pfx_vcpu_run+0x10/0x10 [ 441.029772][T12221] ? lock_acquire+0x115/0x350 [ 441.029808][T12221] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 441.029840][T12221] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 441.029870][T12221] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 441.029893][T12221] kvm_vcpu_ioctl+0xa61/0xfd0 [ 441.029919][T12221] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 441.029937][T12221] ? hook_file_ioctl+0x1f2/0x600 [ 441.029979][T12221] ? __fget_files+0x2a/0x420 [ 441.030009][T12221] ? __fget_files+0x2a/0x420 [ 441.030034][T12221] ? __fget_files+0x3a2/0x420 [ 441.030058][T12221] ? __fget_files+0x2a/0x420 [ 441.030088][T12221] ? bpf_lsm_file_ioctl+0x9/0x20 [ 441.030115][T12221] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 441.030138][T12221] __se_sys_ioctl+0xfc/0x170 [ 441.030162][T12221] do_syscall_64+0x166/0x520 [ 441.030184][T12221] ? trace_irq_disable+0x3b/0x140 [ 441.030210][T12221] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.030232][T12221] ? clear_bhb_loop+0x70/0xc0 [ 441.030256][T12221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.030276][T12221] RIP: 0033:0x7fb85c99e159 [ 441.030294][T12221] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.030311][T12221] RSP: 002b:00007fb85d82d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 441.030335][T12221] RAX: ffffffffffffffda RBX: 00007fb85cc25fa0 RCX: 00007fb85c99e159 [ 441.030350][T12221] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 441.030363][T12221] RBP: 00007fb85d82d090 R08: 0000000000000000 R09: 0000000000000000 [ 441.030377][T12221] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 441.030389][T12221] R13: 00007fb85cc26038 R14: 00007fb85cc25fa0 R15: 00007fb85cd4fa48 [ 441.030421][T12221] [ 441.092348][ T9254] usb 2-1: device descriptor read/64, error -71 [ 441.332596][ T9254] usb 2-1: new full-speed USB device number 92 using dummy_hcd [ 441.376450][T12227] tipc: Enabling of bearer rejected, failed to enable media [ 441.394681][T12209] x_tables: duplicate underflow at hook 2 [ 441.489915][ T9254] usb 2-1: device descriptor read/64, error -71 [ 441.517605][T12233] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2024'. [ 441.600218][ T9254] usb usb2-port1: attempt power cycle [ 441.660621][ T5696] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 441.669460][T12238] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2026'. [ 441.812281][ T5696] usb 5-1: Using ep0 maxpacket: 16 [ 441.812798][ T5696] usb 5-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 441.813797][ T5696] usb 5-1: config 166 has an invalid interface number: 177 but max is 1 [ 441.813812][ T5696] usb 5-1: config 166 has an invalid interface number: 34 but max is 1 [ 441.813822][ T5696] usb 5-1: config 166 has an invalid descriptor of length 0, skipping remainder of the config [ 441.813833][ T5696] usb 5-1: config 166 has no interface number 0 [ 441.813842][ T5696] usb 5-1: config 166 has no interface number 1 [ 441.813868][ T5696] usb 5-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 441.813879][ T5696] usb 5-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 441.813898][ T5696] usb 5-1: config 166 interface 34 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 441.813912][ T5696] usb 5-1: config 166 interface 177 has no altsetting 0 [ 441.813922][ T5696] usb 5-1: config 166 interface 34 has no altsetting 0 [ 441.816362][ T5696] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.816377][ T5696] usb 5-1: Product: syz [ 441.816385][ T5696] usb 5-1: Manufacturer: syz [ 441.816393][ T5696] usb 5-1: SerialNumber: syz [ 441.950011][ T9254] usb 2-1: new full-speed USB device number 93 using dummy_hcd [ 441.971001][ T9254] usb 2-1: device descriptor read/8, error -71 [ 442.032548][ T5696] ums-realtek 5-1:166.177: USB Mass Storage device detected [ 442.127375][ T5696] ums-realtek 5-1:166.34: USB Mass Storage device detected [ 442.196585][ T5696] uvcvideo 5-1:166.34: Found UVC 0.00 device syz (0bda:0138) [ 442.196609][ T5696] uvcvideo 5-1:166.34: No valid video chain found. [ 442.208091][ T5696] usb 5-1: USB disconnect, device number 90 [ 442.223560][ T9254] usb 2-1: new full-speed USB device number 94 using dummy_hcd [ 442.252824][ T9254] usb 2-1: device descriptor read/8, error -71 [ 442.370143][ T9254] usb usb2-port1: unable to enumerate USB device [ 442.950900][T12238] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 443.000920][ T9254] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 443.093306][T12256] netlink: 120 bytes leftover after parsing attributes in process `syz.0.2032'. [ 443.143321][T12256] bond0: option lacp_active: invalid value (9) [ 443.169825][ T9254] usb 5-1: Using ep0 maxpacket: 16 [ 443.170374][ T9254] usb 5-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 443.174057][ T9254] usb 5-1: config 157 has an invalid interface number: 16 but max is 0 [ 443.174083][ T9254] usb 5-1: config 157 has no interface number 0 [ 443.179252][ T9254] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.179277][ T9254] usb 5-1: Product: syz [ 443.179292][ T9254] usb 5-1: Manufacturer: syz [ 443.179307][ T9254] usb 5-1: SerialNumber: syz [ 443.976474][T12273] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2035'. [ 444.259880][ T5696] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 444.409799][ T5696] usb 2-1: Using ep0 maxpacket: 8 [ 444.410502][ T5696] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 444.412073][ T5696] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 444.412116][ T5696] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.419657][ T5696] usb 2-1: config 0 descriptor?? [ 444.502273][T12281] debugfs: '1ùà^!' already exists in 'ieee80211' [ 444.633461][ T5696] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 444.920101][ T5696] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 444.943740][ T989] usb 2-1: USB disconnect, device number 95 [ 445.070836][ T5696] usb 6-1: Using ep0 maxpacket: 32 [ 445.071637][ T5696] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 445.072585][ T5696] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 445.072621][ T5696] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 445.072657][ T5696] usb 6-1: config 0 interface 0 altsetting 191 endpoint 0x1 has invalid maxpacket 28265, setting to 64 [ 445.072675][ T5696] usb 6-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 445.072689][ T5696] usb 6-1: config 0 interface 0 has no altsetting 0 [ 445.074587][ T5696] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 445.074612][ T5696] usb 6-1: Product: syz [ 445.074626][ T5696] usb 6-1: Manufacturer: syz [ 445.074640][ T5696] usb 6-1: SerialNumber: syz [ 445.077774][ T5696] usb 6-1: config 0 descriptor?? [ 445.118212][ T5696] ldusb 6-1:0.0: Interrupt in endpoint not found [ 445.293410][T12287] syzkaller0: left promiscuous mode [ 445.293434][T12287] syzkaller0: left allmulticast mode [ 445.304093][ T989] usb 6-1: USB disconnect, device number 32 [ 445.539985][ T5696] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 445.689847][ T5696] usb 1-1: Using ep0 maxpacket: 16 [ 445.690355][ T5696] usb 1-1: New USB device found, idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 445.692839][ T5696] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.692853][ T5696] usb 1-1: Product: syz [ 445.692861][ T5696] usb 1-1: Manufacturer: syz [ 445.692869][ T5696] usb 1-1: SerialNumber: syz [ 445.695083][ T5696] usb 1-1: config 0 descriptor?? [ 445.699126][ T5696] usb 1-1: selecting invalid altsetting 1 [ 445.699143][ T5696] technisat-usb2: could not set alternate setting to 0 [ 445.770894][ T9252] usb 5-1: USB disconnect, device number 91 [ 445.830766][T12293] netlink: 'syz.4.2042': attribute type 12 has an invalid length. [ 445.830789][T12293] netlink: 'syz.4.2042': attribute type 29 has an invalid length. [ 445.830802][T12293] netlink: 'syz.4.2042': attribute type 2 has an invalid length. [ 445.830815][T12293] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2042'. [ 445.915370][ T5696] technisat-usb2: firmware version: 0.0 [ 445.915412][ T5696] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state. [ 446.046471][T12301] netlink: 'syz.4.2044': attribute type 4 has an invalid length. [ 446.062866][T12301] netlink: 'syz.4.2044': attribute type 4 has an invalid length. [ 446.328936][ T5696] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 446.329591][ T5696] dvbdev: DVB: registering new adapter (Technisat SkyStar USB HD (DVB-S/S2)) [ 446.329641][ T5696] usb 1-1: media controller created [ 446.365396][ T5696] technisat-usb2: i2c-error: out failed 53 = -22 [ 446.365458][ T5696] dvb-usb: MAC address reading failed. [ 446.398119][ T5696] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 446.433221][T12306] netlink: 'syz.2.2047': attribute type 29 has an invalid length. [ 446.494322][ T5696] DVB: Unable to find symbol stv090x_attach() [ 446.494611][ T5696] dvb-usb: no frontend was attached by 'Technisat SkyStar USB HD (DVB-S/S2)' [ 446.559807][ T5696] rc_core: IR keymap rc-technisat-usb2 not found [ 446.559827][ T5696] Registered IR keymap rc-empty [ 446.560869][ T5696] rc rc0: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 446.562381][ T5696] input: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input74 [ 446.564449][ T5696] dvb-usb: schedule remote query interval to 100 msecs. [ 446.565034][ T5696] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully initialized and connected. [ 446.567257][ T5696] usb 1-1: USB disconnect, device number 82 [ 446.653569][ T5696] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully deinitialized and disconnected. [ 446.655757][ T7997] udevd[7997]: setting owner of /dev/bus/usb/001/082 to uid=0, gid=0 failed: No such file or directory [ 446.719802][ T9252] usb 2-1: new full-speed USB device number 96 using dummy_hcd [ 446.876120][ T9252] usb 2-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 446.876674][ T9252] usb 2-1: config 0 has no interfaces? [ 446.885227][ T9252] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.885252][ T9252] usb 2-1: Product: syz [ 446.885266][ T9252] usb 2-1: Manufacturer: syz [ 446.885281][ T9252] usb 2-1: SerialNumber: syz [ 446.891590][ T9252] usb 2-1: config 0 descriptor?? [ 447.113456][ T9252] usb 2-1: USB disconnect, device number 96 [ 447.228371][T12316] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2050'. [ 447.236025][T12316] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2050'. [ 447.236235][T12316] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2050'. [ 447.470104][ T9254] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 447.569824][ T9252] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 447.619832][ T9254] usb 1-1: Using ep0 maxpacket: 8 [ 447.620457][ T9254] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 447.621250][ T9254] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 447.621270][ T9254] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 447.621323][ T9254] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 447.621351][ T9254] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 447.621375][ T9254] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 447.621401][ T9254] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 447.621422][ T9254] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 447.621436][ T9254] usb 1-1: config 168 interface 0 has no altsetting 0 [ 447.622178][ T9254] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 447.622197][ T9254] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 447.622216][ T9254] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 447.622230][ T9254] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 447.622244][ T9254] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 447.622257][ T9254] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 447.622270][ T9254] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 447.622285][ T9254] usb 1-1: config 168 interface 0 has no altsetting 0 [ 447.623046][ T9254] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 447.623066][ T9254] usb 1-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 447.623085][ T9254] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 447.623099][ T9254] usb 1-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 447.623120][ T9254] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 447.623133][ T9254] usb 1-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 447.623147][ T9254] usb 1-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 447.623161][ T9254] usb 1-1: config 168 interface 0 has no altsetting 0 [ 447.625671][ T9254] usb 1-1: string descriptor 0 read error: -22 [ 447.625827][ T9254] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.668148][ T9254] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 447.755853][ T9252] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 447.763165][ T9252] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 447.763192][ T9252] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 447.763210][ T9252] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 447.763250][ T9252] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 447.763275][ T9252] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 447.765981][ T9252] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 447.766004][ T9252] usb 6-1: Product: syz [ 447.766018][ T9252] usb 6-1: Manufacturer: syz [ 447.781628][ T9252] cdc_wdm 6-1:1.0: skipping garbage [ 447.781647][ T9252] cdc_wdm 6-1:1.0: skipping garbage [ 447.785361][ T9252] cdc_wdm 6-1:1.0: cdc-wdm1: USB WDM device [ 447.785380][ T9252] cdc_wdm 6-1:1.0: Unknown control protocol [ 447.853318][ T9252] usb 1-1: USB disconnect, device number 83 [ 448.097994][T12336] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2056'. [ 448.187700][T12330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.188094][T12330] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 448.192395][T12330] sysfs: cannot create duplicate filename '/class/ieee80211/1ùà^!‚lü1”' [ 448.192417][T12330] CPU: 1 UID: 0 PID: 12330 Comm: syz.5.2053 Tainted: G L syzkaller #0 PREEMPT(full) [ 448.192452][T12330] Tainted: [L]=SOFTLOCKUP [ 448.192460][T12330] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 448.192473][T12330] Call Trace: [ 448.192482][T12330] [ 448.192492][T12330] dump_stack_lvl+0xe8/0x150 [ 448.192528][T12330] sysfs_warn_dup+0x8e/0xa0 [ 448.192560][T12330] sysfs_do_create_link_sd+0xc0/0x110 [ 448.192592][T12330] device_add_class_symlinks+0x1cf/0x240 [ 448.192621][T12330] device_add+0x467/0xb80 [ 448.192644][T12330] wiphy_register+0x1fc8/0x2ff0 [ 448.192690][T12330] ? __pfx_wiphy_register+0x10/0x10 [ 448.192720][T12330] ? __pfx_netdev_run_todo+0x10/0x10 [ 448.192750][T12330] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 448.192782][T12330] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 448.192818][T12330] ieee80211_register_hw+0x3d3d/0x4a50 [ 448.192853][T12330] ? ieee80211_register_hw+0x19f1/0x4a50 [ 448.192900][T12330] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 448.192923][T12330] ? __asan_memset+0x22/0x50 [ 448.192953][T12330] ? __hrtimer_setup+0x1b7/0x260 [ 448.192979][T12330] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 448.193006][T12330] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 448.193057][T12330] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 448.193080][T12330] ? kstrndup+0xbd/0x160 [ 448.193106][T12330] ? kstrndup+0xbd/0x160 [ 448.193128][T12330] hwsim_new_radio_nl+0xd8b/0xf90 [ 448.193164][T12330] genl_family_rcv_msg_doit+0x233/0x340 [ 448.193195][T12330] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 448.193230][T12330] ? bpf_lsm_capable+0x9/0x20 [ 448.193248][T12330] ? security_capable+0x7e/0x2c0 [ 448.193277][T12330] genl_rcv_msg+0x614/0x7a0 [ 448.193305][T12330] ? __pfx_genl_rcv_msg+0x10/0x10 [ 448.193327][T12330] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 448.193363][T12330] netlink_rcv_skb+0x226/0x4a0 [ 448.193391][T12330] ? __pfx_genl_rcv_msg+0x10/0x10 [ 448.193415][T12330] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 448.193466][T12330] ? down_read+0x2be/0x330 [ 448.193494][T12330] genl_rcv+0x28/0x40 [ 448.193514][T12330] netlink_unicast+0x7bd/0x940 [ 448.193552][T12330] netlink_sendmsg+0x813/0xb40 [ 448.193590][T12330] ? __pfx_netlink_sendmsg+0x10/0x10 [ 448.193628][T12330] ? apparmor_socket_sendmsg+0x98/0x360 [ 448.193652][T12330] ? __pfx_netlink_sendmsg+0x10/0x10 [ 448.193680][T12330] sock_sendmsg_nosec+0x13a/0x180 [ 448.193713][T12330] ____sys_sendmsg+0x54e/0x850 [ 448.193744][T12330] ? __pfx_____sys_sendmsg+0x10/0x10 [ 448.193778][T12330] ? import_iovec+0x73/0xa0 [ 448.193806][T12330] ___sys_sendmsg+0x2a5/0x360 [ 448.193830][T12330] ? __lock_acquire+0x747/0x2de0 [ 448.193855][T12330] ? __pfx____sys_sendmsg+0x10/0x10 [ 448.193885][T12330] ? futex_wait+0x2a2/0x390 [ 448.193941][T12330] ? __fget_files+0x2a/0x420 [ 448.193967][T12330] ? __fget_files+0x3a2/0x420 [ 448.194004][T12330] __x64_sys_sendmsg+0x1b1/0x290 [ 448.194031][T12330] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 448.194078][T12330] do_syscall_64+0x166/0x520 [ 448.194099][T12330] ? trace_irq_disable+0x3b/0x140 [ 448.194120][T12330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.194140][T12330] ? clear_bhb_loop+0x70/0xc0 [ 448.194165][T12330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.194185][T12330] RIP: 0033:0x7fb85c99e159 [ 448.194204][T12330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 448.194222][T12330] RSP: 002b:00007fb85d82d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 448.194243][T12330] RAX: ffffffffffffffda RBX: 00007fb85cc25fa0 RCX: 00007fb85c99e159 [ 448.194257][T12330] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000007 [ 448.194270][T12330] RBP: 00007fb85ca3503b R08: 0000000000000000 R09: 0000000000000000 [ 448.194282][T12330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 448.194294][T12330] R13: 00007fb85cc26038 R14: 00007fb85cc25fa0 R15: 00007fb85cd4fa48 [ 448.194326][T12330] [ 448.849350][T12352] loop0: detected capacity change from 0 to 3904 [ 448.900781][T12352] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 448.900799][T12352] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 448.900807][T12352] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 448.900838][T12352] loop0: [ 450.562188][T12375] bond2: option mode: unable to set because the bond device has slaves [ 450.902521][ T9254] usb 6-1: USB disconnect, device number 33 [ 450.959671][T12383] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 451.808287][T12414] FAULT_INJECTION: forcing a failure. [ 451.808287][T12414] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 451.808323][T12414] CPU: 1 UID: 0 PID: 12414 Comm: syz.4.2079 Tainted: G L syzkaller #0 PREEMPT(full) [ 451.808351][T12414] Tainted: [L]=SOFTLOCKUP [ 451.808359][T12414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 451.808370][T12414] Call Trace: [ 451.808378][T12414] [ 451.808387][T12414] dump_stack_lvl+0xe8/0x150 [ 451.808421][T12414] should_fail_ex+0x410/0x560 [ 451.808448][T12414] prepare_alloc_pages+0x223/0x600 [ 451.808477][T12414] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 451.808500][T12414] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 451.808525][T12414] ? __pfx_policy_nodemask+0x10/0x10 [ 451.808546][T12414] ? __kvm_mmu_topup_memory_cache+0x461/0x600 [ 451.808571][T12414] ? rcu_is_watching+0x16/0xb0 [ 451.808603][T12414] ? __kvm_mmu_topup_memory_cache+0x461/0x600 [ 451.808628][T12414] ? trace_kmalloc+0x2a/0xf0 [ 451.808660][T12414] alloc_pages_mpol+0x21e/0x390 [ 451.808689][T12414] alloc_pages_noprof+0xb1/0x2b0 [ 451.808715][T12414] get_free_pages_noprof+0xf/0x80 [ 451.808736][T12414] __kvm_mmu_topup_memory_cache+0x252/0x600 [ 451.808773][T12414] mmu_topup_memory_caches+0xd6/0x170 [ 451.808787][T12414] kvm_mmu_load+0x9d/0x21e0 [ 451.808799][T12414] ? kvm_msr_allowed+0x9a/0x490 [ 451.808809][T12414] ? kvm_msr_allowed+0x3f4/0x490 [ 451.808819][T12414] ? kvm_msr_allowed+0x9a/0x490 [ 451.808828][T12414] ? kvm_msr_allowed+0x9a/0x490 [ 451.808841][T12414] ? kvm_apic_has_interrupt+0x740/0x770 [ 451.808861][T12414] vcpu_run+0x4f68/0x79b0 [ 451.808893][T12414] ? update_se+0x90/0x1020 [ 451.808945][T12414] ? __pfx_vcpu_run+0x10/0x10 [ 451.808974][T12414] ? lock_acquire+0x115/0x350 [ 451.809000][T12414] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 451.809019][T12414] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 451.809035][T12414] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 451.809049][T12414] kvm_vcpu_ioctl+0xa61/0xfd0 [ 451.809063][T12414] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 451.809074][T12414] ? hook_file_ioctl+0x1f2/0x600 [ 451.809102][T12414] ? __fget_files+0x2a/0x420 [ 451.809119][T12414] ? __fget_files+0x2a/0x420 [ 451.809132][T12414] ? __fget_files+0x3a2/0x420 [ 451.809145][T12414] ? __fget_files+0x2a/0x420 [ 451.809160][T12414] ? bpf_lsm_file_ioctl+0x9/0x20 [ 451.809176][T12414] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 451.809187][T12414] __se_sys_ioctl+0xfc/0x170 [ 451.809201][T12414] do_syscall_64+0x166/0x520 [ 451.809213][T12414] ? trace_irq_disable+0x3b/0x140 [ 451.809224][T12414] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.809235][T12414] ? clear_bhb_loop+0x70/0xc0 [ 451.809248][T12414] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.809259][T12414] RIP: 0033:0x7feb24b9e159 [ 451.809270][T12414] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 451.809279][T12414] RSP: 002b:00007feb25a39028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 451.809293][T12414] RAX: ffffffffffffffda RBX: 00007feb24e25fa0 RCX: 00007feb24b9e159 [ 451.809301][T12414] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 451.809308][T12414] RBP: 00007feb25a39090 R08: 0000000000000000 R09: 0000000000000000 [ 451.809314][T12414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 451.809321][T12414] R13: 00007feb24e26038 R14: 00007feb24e25fa0 R15: 00007feb24f4fa48 [ 451.809337][T12414] [ 452.141707][ T9249] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 452.192888][T12423] x_tables: ip_tables: HMARK.0 target: invalid size 64 (kernel) != (user) 16 [ 452.235241][T12425] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2083'. [ 452.304888][ T9249] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 452.311142][ T9249] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 452.311172][ T9249] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 452.318232][ T9249] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.318256][ T9249] usb 1-1: Product: syz [ 452.318270][ T9249] usb 1-1: Manufacturer: syz [ 452.318284][ T9249] usb 1-1: SerialNumber: syz [ 452.328205][ T9249] usb 1-1: config 0 descriptor?? [ 452.331129][T12421] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 452.331268][T12421] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 452.549292][T12421] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 452.549356][T12421] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 452.723992][T12443] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2088'. [ 452.851403][T12448] input: syz1 as /devices/virtual/input/input75 [ 452.984857][ T9249] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 453.072655][T12442] syz.1.2087 (12442): drop_caches: 2 [ 453.196971][ T9249] dm9601 1-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 453.232432][ T9249] usb 1-1: USB disconnect, device number 84 [ 453.237509][T12455] ALSA: mixer_oss: invalid OSS volume '' [ 453.333783][T12452] netlink: 'syz.4.2091': attribute type 34 has an invalid length. [ 453.333799][T12452] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2091'. [ 453.679287][T12471] x_tables: unsorted underflow at hook 1 [ 454.319815][ T9249] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 454.480750][ T9249] usb 5-1: New USB device found, idVendor=1e59, idProduct=0002, bcdDevice=98.ed [ 454.481917][ T9249] usb 5-1: config 253 has an invalid interface number: 130 but max is 0 [ 454.481942][ T9249] usb 5-1: config 253 has no interface number 0 [ 454.481997][ T9249] usb 5-1: config 253 interface 130 has no altsetting 0 [ 454.484380][ T9249] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.484406][ T9249] usb 5-1: Product: syz [ 454.484415][ T9249] usb 5-1: Manufacturer: syz [ 454.484422][ T9249] usb 5-1: SerialNumber: syz [ 454.579776][ T5696] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 454.730579][ T5696] usb 6-1: New USB device found, idVendor=056a, idProduct=030c, bcdDevice= 0.00 [ 454.731784][ T5696] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 454.731815][ T5696] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 454.731859][ T5696] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.738558][ T5696] usb 6-1: config 0 descriptor?? [ 455.130241][ T9249] dvb-usb: found a 'EvolutePC TVWay+' in cold state, will try to load a firmware [ 455.136582][ T9249] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 455.136627][ T9249] dib0700: firmware download failed at 7 with -22 [ 455.165654][ T9249] usb 5-1: USB disconnect, device number 92 [ 455.327702][T12502] FAULT_INJECTION: forcing a failure. [ 455.327702][T12502] name failslab, interval 1, probability 0, space 100, times 0 [ 455.327738][T12502] CPU: 0 UID: 0 PID: 12502 Comm: syz.1.2103 Tainted: G L syzkaller #0 PREEMPT(full) [ 455.327766][T12502] Tainted: [L]=SOFTLOCKUP [ 455.327772][T12502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 455.327782][T12502] Call Trace: [ 455.327787][T12502] [ 455.327792][T12502] dump_stack_lvl+0xe8/0x150 [ 455.327813][T12502] should_fail_ex+0x410/0x560 [ 455.327831][T12502] should_failslab+0xa8/0x100 [ 455.327845][T12502] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 455.327862][T12502] kmem_cache_alloc_noprof+0xa1/0x600 [ 455.327878][T12502] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 455.327892][T12502] ? kmem_cache_alloc_noprof+0x156/0x600 [ 455.327907][T12502] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 455.327938][T12502] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 455.328040][T12502] mmu_topup_memory_caches+0x21/0x170 [ 455.328057][T12502] kvm_mmu_load+0x9d/0x21e0 [ 455.328070][T12502] ? kvm_msr_allowed+0x9a/0x490 [ 455.328081][T12502] ? kvm_msr_allowed+0x9a/0x490 [ 455.328092][T12502] ? kvm_msr_allowed+0x9a/0x490 [ 455.328101][T12502] ? kvm_msr_allowed+0x3f4/0x490 [ 455.328111][T12502] ? kvm_msr_allowed+0x9a/0x490 [ 455.328121][T12502] ? kvm_apic_has_interrupt+0x740/0x770 [ 455.328142][T12502] vcpu_run+0x4f68/0x79b0 [ 455.328193][T12502] ? __pfx_vcpu_run+0x10/0x10 [ 455.328208][T12502] ? lock_acquire+0x115/0x350 [ 455.328228][T12502] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 455.328246][T12502] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 455.328262][T12502] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 455.328277][T12502] kvm_vcpu_ioctl+0xa61/0xfd0 [ 455.328291][T12502] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 455.328301][T12502] ? hook_file_ioctl+0x1f2/0x600 [ 455.328324][T12502] ? __fget_files+0x2a/0x420 [ 455.328348][T12502] ? __fget_files+0x2a/0x420 [ 455.328361][T12502] ? __fget_files+0x3a2/0x420 [ 455.328374][T12502] ? __fget_files+0x2a/0x420 [ 455.328389][T12502] ? bpf_lsm_file_ioctl+0x9/0x20 [ 455.328404][T12502] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 455.328416][T12502] __se_sys_ioctl+0xfc/0x170 [ 455.328429][T12502] do_syscall_64+0x166/0x520 [ 455.328441][T12502] ? trace_irq_disable+0x3b/0x140 [ 455.328452][T12502] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.328463][T12502] ? clear_bhb_loop+0x70/0xc0 [ 455.328475][T12502] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.328486][T12502] RIP: 0033:0x7f6150f9e159 [ 455.328497][T12502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 455.328507][T12502] RSP: 002b:00007f6151e5e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 455.328520][T12502] RAX: ffffffffffffffda RBX: 00007f6151225fa0 RCX: 00007f6150f9e159 [ 455.328528][T12502] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 455.328535][T12502] RBP: 00007f6151e5e090 R08: 0000000000000000 R09: 0000000000000000 [ 455.328541][T12502] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 455.328548][T12502] R13: 00007f6151226038 R14: 00007f6151225fa0 R15: 00007f615134fa48 [ 455.328564][T12502] [ 455.755787][T12506] syzkaller0: entered promiscuous mode [ 455.755829][T12506] syzkaller0: entered allmulticast mode [ 455.801838][T12505] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 456.243793][ T5696] usbhid 6-1:0.0: can't add hid device: -71 [ 456.243894][ T5696] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 456.284385][ T5696] usb 6-1: USB disconnect, device number 34 [ 456.494972][T12528] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2108'. [ 456.920372][ T9251] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 457.072164][ T9251] usb 6-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 457.074676][ T9251] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 457.074703][ T9251] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 457.100007][ T9251] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.100034][ T9251] usb 6-1: Product: syz [ 457.100049][ T9251] usb 6-1: Manufacturer: syz [ 457.100063][ T9251] usb 6-1: SerialNumber: syz [ 457.141370][T12542] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2114'. [ 457.141479][T12542] openvswitch: netlink: Message has 4 unknown bytes. [ 457.328429][T12548] ALSA: mixer_oss: invalid OSS volume '' [ 457.351361][T12550] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2116'. [ 457.381631][ T9251] usblp 6-1:1.0: usblp0: USB Bidirectional printer dev 35 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 457.838205][T12546] netlink: 112 bytes leftover after parsing attributes in process `syz.0.2115'. [ 458.136664][T12562] fuse: Invalid rootmode [ 458.830218][ T9252] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 458.928956][T12574] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2121'. [ 458.989833][ T9252] usb 5-1: Using ep0 maxpacket: 16 [ 458.990582][ T9252] usb 5-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 458.993413][ T9252] usb 5-1: config 0 has an invalid interface number: 107 but max is 0 [ 458.993615][ T9252] usb 5-1: config 0 has no interface number 0 [ 458.993657][ T9252] usb 5-1: config 0 interface 107 altsetting 0 endpoint 0x88 has an invalid bInterval 55, changing to 9 [ 458.993682][ T9252] usb 5-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid maxpacket 8496, setting to 1024 [ 458.996053][ T9252] usb 5-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 458.996077][ T9252] usb 5-1: Product: syz [ 458.996092][ T9252] usb 5-1: Manufacturer: syz [ 458.996108][ T9252] usb 5-1: SerialNumber: syz [ 459.014860][ T9252] usb 5-1: config 0 descriptor?? [ 459.082568][ T9252] keyspan 5-1:0.107: Keyspan 4 port adapter converter detected [ 459.082943][ T9252] keyspan 5-1:0.107: found no endpoint descriptor for endpoint 81 [ 459.088138][ T9252] keyspan 5-1:0.107: found no endpoint descriptor for endpoint 1 [ 459.118690][ T9252] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 459.130976][ T9252] keyspan 5-1:0.107: found no endpoint descriptor for endpoint 2 [ 459.135419][ T9252] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 459.138252][ T9252] keyspan 5-1:0.107: found no endpoint descriptor for endpoint 4 [ 459.165304][ T9252] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 459.169047][ T9252] keyspan 5-1:0.107: found no endpoint descriptor for endpoint 6 [ 459.197711][ T9252] usb 5-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 459.301689][T12568] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.311625][T12568] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.448682][T12578] netlink: 'syz.0.2123': attribute type 8 has an invalid length. [ 459.448697][T12578] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2123'. [ 459.546883][T12568] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.562995][T12568] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.762562][ C0] usblp0: nonzero read bulk status received: -71 [ 459.763268][ T9251] usb 6-1: USB disconnect, device number 35 [ 460.120754][ T989] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 460.223994][T12596] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2131'. [ 460.224020][T12596] netlink: 580 bytes leftover after parsing attributes in process `syz.0.2131'. [ 460.271412][ T989] usb 2-1: New USB device found, idVendor=0e8d, idProduct=0608, bcdDevice= 1.00 [ 460.273309][ T989] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 460.273339][ T989] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 460.273379][ T989] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 460.346105][T12580] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 460.346256][T12580] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 460.439904][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 460.443338][ T5616] Bluetooth: hci5: Can't claim NULL iso interface [ 460.799867][ T9251] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 460.870404][T12614] netlink: 'syz.5.2139': attribute type 15 has an invalid length. [ 460.870427][T12614] netlink: 'syz.5.2139': attribute type 7 has an invalid length. [ 460.873081][T12614] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2139'. [ 460.949792][ T9251] usb 1-1: Using ep0 maxpacket: 32 [ 460.950481][ T9251] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 460.951596][ T9251] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 460.951625][ T9251] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 460.951685][ T9251] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 460.954429][ T9251] usb 1-1: config 0 descriptor?? [ 461.223646][ T31] audit: type=1800 audit(1789152085.803:2566): pid=12566 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2119" name="file1" dev="fuse" ino=0 res=0 errno=0 [ 461.371371][T12566] usblp0: removed [ 461.376510][ T989] usb 5-1: USB disconnect, device number 93 [ 461.391803][ T989] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 461.411809][ T989] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 461.453401][ T989] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 461.505212][ T989] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 461.508778][ T989] keyspan 5-1:0.107: device disconnected [ 461.527196][ T9251] savu 0003:1E7D:2D5A.0012: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.0-1/input0 [ 461.575551][ T5616] Bluetooth: hci5: Failed to get device id (-71) [ 461.575619][ T5616] Bluetooth: hci5: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported. [ 461.579098][ T9274] usb 2-1: USB disconnect, device number 97 [ 461.919811][ T989] usb 5-1: new full-speed USB device number 94 using dummy_hcd [ 462.092827][ T989] usb 5-1: not running at top speed; connect to a high speed hub [ 462.092864][ T989] usb 5-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 462.094359][ T989] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 462.096089][ T989] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.112257][ T989] uvcvideo 5-1:1.0: Found UVC 1.00 device (046d:0825) [ 462.314778][ T989] uvcvideo 5-1:1.0: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 462.317251][ T989] uvcvideo 5-1:1.1: Failed to query (GET_CUR) UVC probe control : -32 (exp. 26). [ 462.317305][ T989] uvcvideo 5-1:1.1: Failed to initialize the device (-5). [ 462.317887][ T989] uvcvideo 5-1:1.0: probe with driver uvcvideo failed with error -5 [ 462.323341][T12639] pim6reg: entered allmulticast mode [ 462.345536][T12639] pim6reg: left allmulticast mode [ 462.377208][ T9274] usb 1-1: USB disconnect, device number 85 [ 462.403834][T12643] netlink: 88 bytes leftover after parsing attributes in process `syz.5.2148'. [ 462.428874][T12647] netlink: 88 bytes leftover after parsing attributes in process `syz.5.2148'. [ 462.493802][T12651] FAULT_INJECTION: forcing a failure. [ 462.493802][T12651] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 462.493837][T12651] CPU: 0 UID: 0 PID: 12651 Comm: syz.0.2150 Tainted: G L syzkaller #0 PREEMPT(full) [ 462.493864][T12651] Tainted: [L]=SOFTLOCKUP [ 462.493872][T12651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 462.493884][T12651] Call Trace: [ 462.493892][T12651] [ 462.493901][T12651] dump_stack_lvl+0xe8/0x150 [ 462.493935][T12651] should_fail_ex+0x410/0x560 [ 462.493962][T12651] strncpy_from_user+0x36/0x2c0 [ 462.493988][T12651] do_getname+0x77/0x250 [ 462.494013][T12651] __se_sys_rmdir+0x1e/0x140 [ 462.494045][T12651] do_syscall_64+0x166/0x520 [ 462.494068][T12651] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.494089][T12651] ? clear_bhb_loop+0x70/0xc0 [ 462.494114][T12651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.494133][T12651] RIP: 0033:0x7ff672d9e159 [ 462.494152][T12651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 462.494170][T12651] RSP: 002b:00007ff673cf4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 462.494192][T12651] RAX: ffffffffffffffda RBX: 00007ff673026090 RCX: 00007ff672d9e159 [ 462.494207][T12651] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000040 [ 462.494220][T12651] RBP: 00007ff673cf4090 R08: 0000000000000000 R09: 0000000000000000 [ 462.494233][T12651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 462.494246][T12651] R13: 00007ff673026128 R14: 00007ff673026090 R15: 00007ff67314fa48 [ 462.494276][T12651] [ 462.811380][T12663] loop0: detected capacity change from 0 to 3904 [ 462.861230][T12663] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 462.861256][T12663] ldm_parse_privhead(): PRIVHEAD contains an invalid GUID. [ 462.861269][T12663] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 462.861320][T12663] loop0: [ 462.979832][ T9274] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 463.018913][T12667] netlink: 45349 bytes leftover after parsing attributes in process `syz.1.2155'. [ 463.018986][T12667] 0ªX¹¦Dö»: renamed from gretap0 [ 463.038255][ T9251] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 463.124236][T12671] netlink: NAT attributes may be specified only when CT COMMIT flag is also specified. [ 463.124259][T12671] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 463.139933][ T9274] usb 1-1: Using ep0 maxpacket: 16 [ 463.140620][ T9274] usb 1-1: New USB device found, idVendor=14f7, idProduct=0500, bcdDevice=44.85 [ 463.144499][ T9274] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.144522][ T9274] usb 1-1: Product: syz [ 463.144536][ T9274] usb 1-1: Manufacturer: syz [ 463.144550][ T9274] usb 1-1: SerialNumber: syz [ 463.169103][ T9274] usb 1-1: config 0 descriptor?? [ 463.178706][ T9274] usb 1-1: selecting invalid altsetting 1 [ 463.178725][ T9274] technisat-usb2: could not set alternate setting to 0 [ 463.220296][ T9251] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 463.225413][ T9251] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.225438][ T9251] usb 6-1: Product: syz [ 463.225461][ T9251] usb 6-1: Manufacturer: syz [ 463.225476][ T9251] usb 6-1: SerialNumber: syz [ 463.269561][ T9251] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 463.372303][ T9274] technisat-usb2: firmware version: 0.0 [ 463.372331][ T9274] dvb-usb: found a 'Technisat SkyStar USB HD (DVB-S/S2)' in warm state. [ 463.449994][ T9249] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 463.599931][ T9249] usb 2-1: Using ep0 maxpacket: 8 [ 463.601377][ T9249] usb 2-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 463.602574][ T9249] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 463.602621][ T9249] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 463.602646][ T9249] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 463.602715][ T9249] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 463.606065][ T9249] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.606080][ T9249] usb 2-1: Product: syz [ 463.606113][ T9249] usb 2-1: Manufacturer: syz [ 463.606124][ T9249] usb 2-1: SerialNumber: syz [ 463.609361][ T9249] usb 2-1: config 0 descriptor?? [ 463.610215][T12673] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 463.683269][T12661] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2152'. [ 463.727421][ T9271] usb 6-1: USB disconnect, device number 36 [ 463.811855][ T9249] powermate: Expected payload of 3--6 bytes, found 1024 bytes! [ 463.815597][T12674] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 463.816103][T12674] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 463.816139][ T9249] input: Griffin SoundKnob as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input76 [ 463.914836][T12674] kvm [12672]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010002) = 0x80ffffff [ 464.078812][T12683] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2160'. [ 464.098519][ T9274] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 464.109322][ T9274] dvbdev: DVB: registering new adapter (Technisat SkyStar USB HD (DVB-S/S2)) [ 464.109363][ T9274] usb 1-1: media controller created [ 464.109416][ T9274] technisat-usb2: i2c-error: out failed 53 = -22 [ 464.109463][ T9274] dvb-usb: MAC address reading failed. [ 464.138011][T12683] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2160'. [ 464.138036][T12683] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 464.174995][ T9274] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 464.252471][ T9274] DVB: Unable to find symbol stv090x_attach() [ 464.252844][ T9274] dvb-usb: no frontend was attached by 'Technisat SkyStar USB HD (DVB-S/S2)' [ 464.286895][ T9251] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 464.287259][ T9251] ath9k_htc: Failed to initialize the device [ 464.288726][ T9271] usb 6-1: ath9k_htc: USB layer deinitialized [ 464.379826][ T9274] rc_core: IR keymap rc-technisat-usb2 not found [ 464.379845][ T9274] Registered IR keymap rc-empty [ 464.382485][ T9274] rc rc0: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 464.386184][ T9274] input: Technisat SkyStar USB HD (DVB-S/S2) as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input77 [ 464.426316][ T9274] dvb-usb: schedule remote query interval to 100 msecs. [ 464.427094][ T9274] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully initialized and connected. [ 464.544260][ T9271] dvb-usb: error -32 while querying for an remote control event. [ 464.622344][ T9271] usb 5-1: USB disconnect, device number 94 [ 464.665608][ T9274] dvb-usb: error -32 while querying for an remote control event. [ 464.787810][ T989] dvb-usb: error -32 while querying for an remote control event. [ 464.892898][ T9271] dvb-usb: error -32 while querying for an remote control event. [ 465.011290][ T989] dvb-usb: error -32 while querying for an remote control event. [ 465.122895][ T989] dvb-usb: error -32 while querying for an remote control event. [ 465.237219][ T989] dvb-usb: error -32 while querying for an remote control event. [ 465.329550][T12711] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2172'. [ 465.341746][ T989] dvb-usb: error -32 while querying for an remote control event. [ 465.457395][ T989] dvb-usb: error -32 while querying for an remote control event. [ 465.557127][ T9251] usb 1-1: USB disconnect, device number 86 [ 465.718172][ T9251] dvb-usb: Technisat SkyStar USB HD (DVB-S/S2) successfully deinitialized and disconnected. [ 466.150050][ T9251] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 466.299875][ T9251] usb 1-1: Using ep0 maxpacket: 8 [ 466.301924][ T9251] usb 1-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 466.307205][ T9251] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.307239][ T9251] usb 1-1: Product: syz [ 466.307483][ T9251] usb 1-1: Manufacturer: syz [ 466.307571][ T9251] usb 1-1: SerialNumber: syz [ 466.317990][ T9251] usb 1-1: config 0 descriptor?? [ 466.337855][ T9251] radio-usb-si4713 1-1:0.0: Si4713 development board discovered: (10C4:8244) [ 466.346075][ C1] powermate: config urb returned -71 [ 466.348864][ C1] powermate: config urb returned -71 [ 466.349055][ C1] powermate: config urb returned -71 [ 466.349252][ C1] powermate: config urb returned -71 [ 466.355125][ T9249] usb 2-1: USB disconnect, device number 98 [ 466.355233][ C1] powermate 2-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 466.831149][T12750] ALSA: mixer_oss: invalid OSS volume 'L' [ 466.831168][T12750] ALSA: mixer_oss: invalid OSS volume 'È¡ÃHò_‡9R<Ëó×' [ 467.312982][ T9251] radio-usb-si4713 1-1:0.0: probe with driver radio-usb-si4713 failed with error -71 [ 467.313347][ T9251] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 467.353954][ T9251] usb 1-1: USB disconnect, device number 87 [ 467.885838][T12770] x_tables: unsorted underflow at hook 1 [ 467.903421][ T989] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 468.061777][ T989] usb 1-1: Using ep0 maxpacket: 8 [ 468.062487][ T989] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 468.063475][ T989] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 468.063520][ T989] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 468.100992][ T989] usb 1-1: config 0 descriptor?? [ 468.146508][T12773] netlink: 'syz.4.2191': attribute type 1 has an invalid length. [ 468.160520][ T9251] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 468.203031][T12773] 8021q: adding VLAN 0 to HW filter on device bond7 [ 468.276797][T12779] bond7: (slave gretap2): Enslaving as a backup interface with an up link [ 468.305998][T12773] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2191'. [ 468.310216][ T9251] usb 6-1: Using ep0 maxpacket: 32 [ 468.310355][ T13] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 468.315432][ T9251] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice= 0.40 [ 468.317028][ T9251] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 468.317053][ T9251] usb 6-1: config 1 has no interface number 0 [ 468.317090][ T9251] usb 6-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 468.317130][ T9251] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 122, changing to 7 [ 468.324338][ T9251] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.324362][ T9251] usb 6-1: Product: ãŒá¸žî‰†ä«ã£”⨳ì‚裶䜸꺆êªäƒ·ï’锅ἀ䒬顥ë½ä¨¼ë°¢é¼„åŸê›”í“î¶á¢œé¯°ï©ˆîº¨ê˜¨é«‡ê•¸ÊŒæ‚‡å¶ë£ºâ£¦æ“˜äº‚ê¡ [ 468.324408][ T9251] usb 6-1: Manufacturer: ã [ 468.324429][ T9251] usb 6-1: SerialNumber: á ‰ [ 468.385678][ T989] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 468.429807][ T13] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 468.545113][T12771] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.548345][T12771] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.575251][ T9251] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 468.692309][ T9251] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 468.692924][ T9251] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 468.788669][T12771] x_tables: duplicate underflow at hook 3 [ 468.803160][ T9252] usb 1-1: USB disconnect, device number 88 [ 468.838493][ T9251] snd_usb_pod 6-1:1.1: set_interface failed [ 468.838621][ T9251] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 468.838721][ T9251] snd_usb_pod 6-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 468.868686][ T9251] usb 6-1: USB disconnect, device number 37 [ 468.902634][ T7997] udevd[7997]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 469.069876][ T9249] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 469.128879][T12796] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2199'. [ 469.156502][T12787] netlink: 'syz.4.2195': attribute type 34 has an invalid length. [ 469.156525][T12787] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2195'. [ 469.219848][ T9249] usb 2-1: Using ep0 maxpacket: 32 [ 469.220692][ T9249] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 469.221684][ T9249] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 469.223740][ T9249] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 469.223764][ T9249] usb 2-1: Product: syz [ 469.223779][ T9249] usb 2-1: Manufacturer: syz [ 469.223794][ T9249] usb 2-1: SerialNumber: syz [ 469.229410][ T9249] usb 2-1: config 0 descriptor?? [ 469.231716][T12791] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 469.233936][ T9249] hub 2-1:0.0: bad descriptor, ignoring hub [ 469.233958][ T9249] hub 2-1:0.0: probe with driver hub failed with error -5 [ 469.446541][T12806] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2204'. [ 469.509080][T12791] ip_tables: iptables: counters copy to user failed while replacing table [ 469.593520][T12791] openvswitch: netlink: Missing key (keys=40, expected=100) [ 469.743377][T12816] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2208'. [ 469.850091][ T9249] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 470.000604][ T9249] usb 1-1: Using ep0 maxpacket: 16 [ 470.001512][ T9249] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 470.009425][ T9249] usb 1-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 470.009443][ T9249] usb 1-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 470.009456][ T9249] usb 1-1: config 0 interface 0 has no altsetting 0 [ 470.009474][ T9249] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 470.012009][ T9249] usb 1-1: config 0 descriptor?? [ 470.199953][ T989] usb 5-1: new full-speed USB device number 95 using dummy_hcd [ 470.206407][T12828] FAULT_INJECTION: forcing a failure. [ 470.206407][T12828] name failslab, interval 1, probability 0, space 100, times 0 [ 470.206440][T12828] CPU: 0 UID: 0 PID: 12828 Comm: syz.2.2213 Tainted: G L syzkaller #0 PREEMPT(full) [ 470.206501][T12828] Tainted: [L]=SOFTLOCKUP [ 470.206508][T12828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 470.206537][T12828] Call Trace: [ 470.206556][T12828] [ 470.206565][T12828] dump_stack_lvl+0xe8/0x150 [ 470.206608][T12828] should_fail_ex+0x410/0x560 [ 470.206646][T12828] should_failslab+0xa8/0x100 [ 470.206684][T12828] ? anon_vma_clone+0x3f3/0x9f0 [ 470.206716][T12828] kmem_cache_alloc_noprof+0xa1/0x600 [ 470.206755][T12828] ? anon_vma_clone+0x3f3/0x9f0 [ 470.206788][T12828] anon_vma_clone+0x3f3/0x9f0 [ 470.206830][T12828] __split_vma+0x3e0/0xa60 [ 470.206869][T12828] ? __pfx___split_vma+0x10/0x10 [ 470.206912][T12828] ? kernel_text_address+0xa5/0xe0 [ 470.206969][T12828] vma_modify+0x887/0x1f40 [ 470.207007][T12828] vma_modify_flags+0x2a4/0x3c0 [ 470.207034][T12828] ? __pfx_vma_modify_flags+0x10/0x10 [ 470.207082][T12828] mlock_fixup+0x40c/0x930 [ 470.207115][T12828] ? __pfx_mlock_fixup+0x10/0x10 [ 470.207147][T12828] ? mas_find+0x6d6/0xcb0 [ 470.207253][T12828] apply_vma_lock_flags+0x350/0x4a0 [ 470.207282][T12828] ? __pfx_apply_vma_lock_flags+0x10/0x10 [ 470.207317][T12828] ? __pfx_down_write_killable+0x10/0x10 [ 470.207354][T12828] do_mlock+0x54d/0x730 [ 470.207376][T12828] ? __fget_files+0x2a/0x420 [ 470.207408][T12828] ? __pfx_do_mlock+0x10/0x10 [ 470.207434][T12828] ? fput+0xa0/0xd0 [ 470.207463][T12828] ? __pfx_ksys_write+0x10/0x10 [ 470.207496][T12828] __x64_sys_mlock2+0xd8/0x100 [ 470.207521][T12828] do_syscall_64+0x166/0x520 [ 470.207541][T12828] ? trace_irq_disable+0x3b/0x140 [ 470.207560][T12828] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.207580][T12828] ? clear_bhb_loop+0x70/0xc0 [ 470.207604][T12828] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.207624][T12828] RIP: 0033:0x7f8e40d9e159 [ 470.207642][T12828] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 470.207658][T12828] RSP: 002b:00007f8e41ccf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000145 [ 470.207681][T12828] RAX: ffffffffffffffda RBX: 00007f8e41025fa0 RCX: 00007f8e40d9e159 [ 470.207697][T12828] RDX: 0000000000000001 RSI: 0000000000003000 RDI: 0000200000375000 [ 470.207710][T12828] RBP: 00007f8e41ccf090 R08: 0000000000000000 R09: 0000000000000000 [ 470.207723][T12828] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 470.207735][T12828] R13: 00007f8e41026038 R14: 00007f8e41025fa0 R15: 00007f8e4114fa48 [ 470.207776][T12828] [ 470.208623][ T31] audit: type=1326 audit(1789152094.783:2567): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12827 comm="syz.2.2213" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e40d9e159 code=0x7ffc0000 [ 470.208668][ T31] audit: type=1326 audit(1789152094.783:2568): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12827 comm="syz.2.2213" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e40d9e159 code=0x7ffc0000 [ 470.208733][ T31] audit: type=1326 audit(1789152094.783:2569): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12827 comm="syz.2.2213" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f8e40d5e98e code=0x7ffc0000 [ 470.208773][ T31] audit: type=1326 audit(1789152094.783:2570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12827 comm="syz.2.2213" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f8e40d5e98e code=0x7ffc0000 [ 470.208810][ T31] audit: type=1326 audit(1789152094.783:2571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12827 comm="syz.2.2213" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=325 compat=0 ip=0x7f8e40d9e159 code=0x7ffc0000 [ 470.208871][ T31] audit: type=1326 audit(1789152094.783:2572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12827 comm="syz.2.2213" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=0 compat=0 ip=0x7f8e40d5e98e code=0x7ffc0000 [ 470.208909][ T31] audit: type=1326 audit(1789152094.783:2573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12827 comm="syz.2.2213" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f8e40d5e98e code=0x7ffc0000 [ 470.208949][ T31] audit: type=1326 audit(1789152094.783:2574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12827 comm="syz.2.2213" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f8e40d5e98e code=0x7ffc0000 [ 470.209011][ T31] audit: type=1326 audit(1789152094.783:2575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12827 comm="syz.2.2213" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e40d9e159 code=0x7ffc0000 [ 470.244156][ T31] audit: type=1326 audit(1789152094.783:2576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12827 comm="syz.2.2213" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8e40d9e159 code=0x7ffc0000 [ 470.443619][ T9251] usb 2-1: USB disconnect, device number 99 [ 470.534424][ T9249] mcp2221 0003:04D8:00DD.0013: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 470.742484][T12811] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 470.742926][T12811] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 470.772707][ T9249] usb 1-1: USB disconnect, device number 89 [ 470.818010][ T989] usb 5-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 470.818840][ T989] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 470.818875][ T989] usb 5-1: can't read configurations, error -71 [ 471.038371][T12843] FAULT_INJECTION: forcing a failure. [ 471.038371][T12843] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 471.038395][T12843] CPU: 0 UID: 0 PID: 12843 Comm: syz.1.2217 Tainted: G L syzkaller #0 PREEMPT(full) [ 471.038411][T12843] Tainted: [L]=SOFTLOCKUP [ 471.038415][T12843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 471.038422][T12843] Call Trace: [ 471.038427][T12843] [ 471.038432][T12843] dump_stack_lvl+0xe8/0x150 [ 471.038453][T12843] should_fail_ex+0x410/0x560 [ 471.038469][T12843] _copy_from_user+0x2d/0xb0 [ 471.038483][T12843] ___sys_recvmsg+0x173/0x5a0 [ 471.038502][T12843] ? __pfx____sys_recvmsg+0x10/0x10 [ 471.038518][T12843] ? lock_acquire+0x115/0x350 [ 471.038543][T12843] do_recvmmsg+0x31a/0x7f0 [ 471.038562][T12843] ? __pfx_do_recvmmsg+0x10/0x10 [ 471.038581][T12843] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 471.038594][T12843] ? __fget_files+0x3a2/0x420 [ 471.038614][T12843] __x64_sys_recvmmsg+0x198/0x250 [ 471.038629][T12843] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 471.038649][T12843] do_syscall_64+0x166/0x520 [ 471.038660][T12843] ? trace_irq_disable+0x3b/0x140 [ 471.038674][T12843] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.038685][T12843] ? clear_bhb_loop+0x70/0xc0 [ 471.038698][T12843] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.038708][T12843] RIP: 0033:0x7f6150f9e159 [ 471.038720][T12843] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 471.038729][T12843] RSP: 002b:00007f6151e5e028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 471.038742][T12843] RAX: ffffffffffffffda RBX: 00007f6151225fa0 RCX: 00007f6150f9e159 [ 471.038750][T12843] RDX: 0000000000000256 RSI: 0000200000000d00 RDI: 0000000000000003 [ 471.038757][T12843] RBP: 00007f6151e5e090 R08: 0000000000000000 R09: 0000000000000000 [ 471.038763][T12843] R10: 0000000000010022 R11: 0000000000000246 R12: 0000000000000002 [ 471.038770][T12843] R13: 00007f6151226038 R14: 00007f6151225fa0 R15: 00007f615134fa48 [ 471.038785][T12843] [ 471.577801][T12856] netlink: 'syz.4.2222': attribute type 12 has an invalid length. [ 471.577824][T12856] netlink: 'syz.4.2222': attribute type 29 has an invalid length. [ 471.577838][T12856] netlink: 148 bytes leftover after parsing attributes in process `syz.4.2222'. [ 471.962062][ T9249] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 472.002348][T12868] netlink: 'syz.4.2227': attribute type 8 has an invalid length. [ 472.090166][ T9249] usb 1-1: device descriptor read/64, error -71 [ 472.321487][T12883] xt_hashlimit: size too large, truncated to 1048576 [ 472.330195][ T9249] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 472.357574][T12885] xt_CT: You must specify a L4 protocol and not use inversions on it [ 472.460551][ T9249] usb 1-1: device descriptor read/64, error -71 [ 472.570705][ T9249] usb usb1-port1: attempt power cycle [ 472.772558][T12892] ip_tables: iptables: counters copy to user failed while replacing table [ 472.913283][ T9249] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 472.932556][ T9249] usb 1-1: device descriptor read/8, error -71 [ 473.179982][ T9249] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 473.200692][ T9249] usb 1-1: device descriptor read/8, error -71 [ 473.310764][ T9249] usb usb1-port1: unable to enumerate USB device [ 473.364745][T12902] bond8: option tlb_dynamic_lb: invalid value (253) [ 473.366379][T12902] bond8 (unregistering): Released all slaves [ 473.440426][ T5675] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 473.589955][ T5675] usb 2-1: Using ep0 maxpacket: 32 [ 473.590959][ T5675] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 473.592750][ T5675] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 473.592788][ T5675] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 473.592823][ T5675] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 473.592850][ T5675] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 473.592876][ T5675] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 473.592907][ T5675] usb 2-1: config 0 interface 0 has no altsetting 0 [ 473.597415][ T5675] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 473.597441][ T5675] usb 2-1: Product: syz [ 473.597455][ T5675] usb 2-1: Manufacturer: syz [ 473.597470][ T5675] usb 2-1: SerialNumber: syz [ 473.606788][ T5675] usb 2-1: config 0 descriptor?? [ 473.612332][T12898] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 473.623383][ T5675] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 473.638725][ T5675] ldusb 2-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 473.829918][ T9271] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 473.851060][ T9249] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 473.867872][ T5675] usb 2-1: USB disconnect, device number 100 [ 473.886215][ T5675] ldusb 2-1:0.0: LD USB Device #0 now disconnected [ 473.979875][ T9271] usb 6-1: Using ep0 maxpacket: 16 [ 473.980551][ T9271] usb 6-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 473.981616][ T9271] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 473.981641][ T9271] usb 6-1: config 0 has no interface number 0 [ 473.984830][ T9271] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 473.984844][ T9271] usb 6-1: Product: syz [ 473.984852][ T9271] usb 6-1: Manufacturer: syz [ 473.984860][ T9271] usb 6-1: SerialNumber: syz [ 473.988293][ T9271] usb 6-1: config 0 descriptor?? [ 474.053160][ T9271] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 474.719458][T12929] netlink: 'syz.0.2245': attribute type 10 has an invalid length. [ 474.866737][T12934] fuse: Bad value for 'fd' [ 474.879061][T12936] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2248'. [ 474.879065][T12934] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2248'. [ 474.908405][T12936] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2248'. [ 474.908754][T12934] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2248'. [ 474.928585][ T60] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.928628][ T60] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.928660][ T60] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.928692][ T60] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 474.997804][T12909] program syz.5.2238 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 475.012488][ T9271] gspca_spca1528: reg_w err -71 [ 475.012631][ T9271] spca1528 6-1:0.1: probe with driver spca1528 failed with error -71 [ 475.015086][ T9271] usb 6-1: USB disconnect, device number 38 [ 475.100016][ T5675] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 475.139822][ T9249] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 475.150055][ T9251] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 475.250715][ T5675] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 475.251642][ T5675] usb 1-1: config 1 interface 0 altsetting 225 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 475.251668][ T5675] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x3 has invalid maxpacket 2560, setting to 64 [ 475.251682][ T5675] usb 1-1: config 1 interface 0 has no altsetting 0 [ 475.251699][ T5675] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.256405][ T5675] cdc_acm 1-1:1.0: probe with driver cdc_acm failed with error -22 [ 475.290021][ T9249] usb 5-1: Using ep0 maxpacket: 8 [ 475.294167][ T9249] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 475.300288][ T9251] usb 2-1: Using ep0 maxpacket: 8 [ 475.301130][ T9251] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 475.302686][ T9251] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 475.302721][ T9251] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 475.302756][ T9251] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 475.302810][ T9251] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 475.302833][ T9251] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 475.302858][ T9251] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 475.302883][ T9251] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 475.302909][ T9251] usb 2-1: config 168 interface 0 has no altsetting 0 [ 475.304175][ T9251] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 475.304234][ T9251] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 475.304268][ T9251] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 475.304294][ T9251] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 475.304324][ T9251] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 475.304372][ T9251] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 475.304398][ T9251] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 475.304423][ T9251] usb 2-1: config 168 interface 0 has no altsetting 0 [ 475.305998][ T9251] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 475.306029][ T9251] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 475.306064][ T9251] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 475.306088][ T9251] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 475.306138][ T9251] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 475.306163][ T9251] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 475.306188][ T9251] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 475.306213][ T9251] usb 2-1: config 168 interface 0 has no altsetting 0 [ 475.311399][ T9251] usb 2-1: string descriptor 0 read error: -22 [ 475.311546][ T9251] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.325484][ T9251] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 475.368531][ T9249] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 475.368577][ T9249] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 475.373206][ T9249] usb 5-1: config 0 descriptor?? [ 475.458114][T12935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 475.461538][T12935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 475.489520][ T5675] usb 1-1: string descriptor 0 read error: -71 [ 475.513396][ T5675] usb 1-1: USB disconnect, device number 94 [ 475.552931][ T9251] usb 2-1: USB disconnect, device number 101 [ 475.710547][T12947] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2251'. [ 475.710569][T12947] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2251'. [ 475.710587][T12947] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2251'. [ 475.710601][T12947] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2251'. [ 475.710700][T12947] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2251'. [ 475.822991][ T31] kauditd_printk_skb: 54 callbacks suppressed [ 475.823011][ T31] audit: type=1326 audit(1789152100.403:2631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12930 comm="syz.4.2246" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7feb24b9e159 code=0x0 [ 475.876698][ T9249] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 476.159808][ T9249] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 476.309865][ T9274] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 476.310988][ T9249] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 476.312029][ T9249] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 476.312044][ T9249] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 476.312055][ T9249] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 476.312079][ T9249] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 476.312092][ T9249] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 476.313285][ T9249] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 476.313299][ T9249] usb 6-1: Product: syz [ 476.313307][ T9249] usb 6-1: Manufacturer: syz [ 476.318739][ T9249] cdc_wdm 6-1:1.0: skipping garbage [ 476.318757][ T9249] cdc_wdm 6-1:1.0: skipping garbage [ 476.322731][ T9249] cdc_wdm 6-1:1.0: cdc-wdm1: USB WDM device [ 476.322750][ T9249] cdc_wdm 6-1:1.0: Unknown control protocol [ 476.349844][ T9251] usb 2-1: new full-speed USB device number 102 using dummy_hcd [ 476.459814][ T9274] usb 1-1: device descriptor read/64, error -71 [ 476.512088][T12958] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 476.517949][ T9251] usb 2-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 476.521651][ T9251] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 476.521685][ T9251] usb 2-1: can't read configurations, error -71 [ 476.699848][ T9274] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 476.730504][T12954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.731053][T12954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.735869][T12954] sysfs: cannot create duplicate filename '/class/ieee80211/1ùà^!‚lü1”' [ 476.735892][T12954] CPU: 1 UID: 0 PID: 12954 Comm: syz.5.2254 Tainted: G L syzkaller #0 PREEMPT(full) [ 476.735922][T12954] Tainted: [L]=SOFTLOCKUP [ 476.735930][T12954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 476.735943][T12954] Call Trace: [ 476.735954][T12954] [ 476.735963][T12954] dump_stack_lvl+0xe8/0x150 [ 476.736000][T12954] sysfs_warn_dup+0x8e/0xa0 [ 476.736032][T12954] sysfs_do_create_link_sd+0xc0/0x110 [ 476.736066][T12954] device_add_class_symlinks+0x1cf/0x240 [ 476.736092][T12954] device_add+0x467/0xb80 [ 476.736115][T12954] wiphy_register+0x1fc8/0x2ff0 [ 476.736161][T12954] ? __pfx_wiphy_register+0x10/0x10 [ 476.736201][T12954] ? __pfx_netdev_run_todo+0x10/0x10 [ 476.736231][T12954] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 476.736264][T12954] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 476.736299][T12954] ieee80211_register_hw+0x3d3d/0x4a50 [ 476.736334][T12954] ? ieee80211_register_hw+0x19f1/0x4a50 [ 476.736379][T12954] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 476.736404][T12954] ? __asan_memset+0x22/0x50 [ 476.736434][T12954] ? __hrtimer_setup+0x1b7/0x260 [ 476.736461][T12954] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 476.736488][T12954] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 476.736541][T12954] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 476.736564][T12954] ? kstrndup+0xbd/0x160 [ 476.736589][T12954] ? kstrndup+0xbd/0x160 [ 476.736613][T12954] hwsim_new_radio_nl+0xd8b/0xf90 [ 476.736651][T12954] genl_family_rcv_msg_doit+0x233/0x340 [ 476.736682][T12954] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 476.736720][T12954] ? bpf_lsm_capable+0x9/0x20 [ 476.736738][T12954] ? security_capable+0x7e/0x2c0 [ 476.736766][T12954] genl_rcv_msg+0x614/0x7a0 [ 476.736797][T12954] ? __pfx_genl_rcv_msg+0x10/0x10 [ 476.736820][T12954] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 476.736857][T12954] netlink_rcv_skb+0x226/0x4a0 [ 476.736889][T12954] ? __pfx_genl_rcv_msg+0x10/0x10 [ 476.736913][T12954] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 476.736956][T12954] ? down_read+0x2be/0x330 [ 476.736986][T12954] genl_rcv+0x28/0x40 [ 476.737006][T12954] netlink_unicast+0x7bd/0x940 [ 476.737044][T12954] netlink_sendmsg+0x813/0xb40 [ 476.737083][T12954] ? __pfx_netlink_sendmsg+0x10/0x10 [ 476.737121][T12954] ? apparmor_socket_sendmsg+0x98/0x360 [ 476.737145][T12954] ? __pfx_netlink_sendmsg+0x10/0x10 [ 476.737189][T12954] sock_sendmsg_nosec+0x13a/0x180 [ 476.737225][T12954] ____sys_sendmsg+0x54e/0x850 [ 476.737257][T12954] ? __pfx_____sys_sendmsg+0x10/0x10 [ 476.737293][T12954] ? import_iovec+0x73/0xa0 [ 476.737321][T12954] ___sys_sendmsg+0x2a5/0x360 [ 476.737345][T12954] ? __lock_acquire+0x747/0x2de0 [ 476.737368][T12954] ? __pfx____sys_sendmsg+0x10/0x10 [ 476.737400][T12954] ? futex_wait+0x2a2/0x390 [ 476.737460][T12954] ? __fget_files+0x2a/0x420 [ 476.737488][T12954] ? __fget_files+0x3a2/0x420 [ 476.737527][T12954] __x64_sys_sendmsg+0x1b1/0x290 [ 476.737558][T12954] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 476.737606][T12954] do_syscall_64+0x166/0x520 [ 476.737627][T12954] ? trace_irq_disable+0x3b/0x140 [ 476.737648][T12954] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.737668][T12954] ? clear_bhb_loop+0x70/0xc0 [ 476.737692][T12954] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 476.737712][T12954] RIP: 0033:0x7fb85c99e159 [ 476.737732][T12954] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 476.737750][T12954] RSP: 002b:00007fb85d82d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 476.737773][T12954] RAX: ffffffffffffffda RBX: 00007fb85cc25fa0 RCX: 00007fb85c99e159 [ 476.737788][T12954] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000007 [ 476.737802][T12954] RBP: 00007fb85ca3503b R08: 0000000000000000 R09: 0000000000000000 [ 476.737815][T12954] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 476.737827][T12954] R13: 00007fb85cc26038 R14: 00007fb85cc25fa0 R15: 00007fb85cd4fa48 [ 476.737858][T12954] [ 476.866503][ T9274] usb 1-1: device descriptor read/64, error -71 [ 476.979830][ T9274] usb usb1-port1: attempt power cycle [ 477.391808][T12965] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 477.410698][ T9274] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 477.430396][ T9274] usb 1-1: device descriptor read/8, error -71 [ 477.465834][T12967] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 477.626494][T12965] 8021q: adding VLAN 0 to HW filter on device bond8 [ 477.669822][ T9274] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 477.691666][ T9274] usb 1-1: device descriptor read/8, error -71 [ 477.800123][ T9274] usb usb1-port1: unable to enumerate USB device [ 477.835979][ T9274] usb 5-1: USB disconnect, device number 98 [ 478.087017][T12980] batadv_slave_0: entered promiscuous mode [ 478.087295][T12980] batadv_slave_0: left promiscuous mode [ 478.143959][T12984] bond1: option mode: unable to set because the bond device is up [ 478.233700][T12987] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2267'. [ 478.260554][T12987] vlan6: entered allmulticast mode [ 478.278701][T12989] FAULT_INJECTION: forcing a failure. [ 478.278701][T12989] name failslab, interval 1, probability 0, space 100, times 0 [ 478.278736][T12989] CPU: 1 UID: 0 PID: 12989 Comm: syz.4.2268 Tainted: G L syzkaller #0 PREEMPT(full) [ 478.278763][T12989] Tainted: [L]=SOFTLOCKUP [ 478.278770][T12989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 478.278781][T12989] Call Trace: [ 478.278790][T12989] [ 478.278798][T12989] dump_stack_lvl+0xe8/0x150 [ 478.278832][T12989] should_fail_ex+0x410/0x560 [ 478.278860][T12989] should_failslab+0xa8/0x100 [ 478.278887][T12989] __kmalloc_cache_noprof+0xa3/0x600 [ 478.278907][T12989] ? __kmalloc_cache_noprof+0x14d/0x600 [ 478.278941][T12989] ? sctp_add_bind_addr+0x8c/0x370 [ 478.278969][T12989] ? sctp_add_bind_addr+0x8c/0x370 [ 478.279000][T12989] sctp_add_bind_addr+0x8c/0x370 [ 478.279031][T12989] sctp_copy_local_addr_list+0x31a/0x4e0 [ 478.279062][T12989] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 478.279091][T12989] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 478.279120][T12989] ? sctp_v6_is_any+0x64/0x80 [ 478.279151][T12989] ? sctp_copy_one_addr+0x93/0x360 [ 478.279181][T12989] sctp_bind_addr_copy+0xb3/0x3c0 [ 478.279210][T12989] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 478.279239][T12989] sctp_connect_new_asoc+0x2ff/0x6b0 [ 478.279264][T12989] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 478.279287][T12989] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 478.279309][T12989] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 478.279329][T12989] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 478.279350][T12989] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 478.279377][T12989] ? security_sctp_bind_connect+0x7e/0x2c0 [ 478.279400][T12989] sctp_sendmsg+0x159b/0x2d00 [ 478.279432][T12989] ? __pfx_sctp_sendmsg+0x10/0x10 [ 478.279458][T12989] ? __lock_acquire+0x747/0x2de0 [ 478.279492][T12989] ? aa_sock_msg_perm+0xf5/0x210 [ 478.279515][T12989] ? sock_rps_record_flow+0x19/0x350 [ 478.279551][T12989] ? inet_sendmsg+0x298/0x320 [ 478.279578][T12989] ? apparmor_socket_sendmsg+0x98/0x360 [ 478.279602][T12989] ? __pfx_inet_sendmsg+0x10/0x10 [ 478.279630][T12989] sock_sendmsg_nosec+0x10e/0x180 [ 478.279663][T12989] ____sys_sendmsg+0x54e/0x850 [ 478.279693][T12989] ? __pfx_____sys_sendmsg+0x10/0x10 [ 478.279725][T12989] ? import_iovec+0x73/0xa0 [ 478.279755][T12989] ___sys_sendmsg+0x2a5/0x360 [ 478.279780][T12989] ? __lock_acquire+0x747/0x2de0 [ 478.279804][T12989] ? __pfx____sys_sendmsg+0x10/0x10 [ 478.279860][T12989] ? __fget_files+0x2a/0x420 [ 478.279886][T12989] ? __fget_files+0x3a2/0x420 [ 478.279929][T12989] __x64_sys_sendmsg+0x1b1/0x290 [ 478.279959][T12989] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 478.280007][T12989] do_syscall_64+0x166/0x520 [ 478.280029][T12989] ? trace_irq_disable+0x3b/0x140 [ 478.280050][T12989] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.280071][T12989] ? clear_bhb_loop+0x70/0xc0 [ 478.280096][T12989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.280117][T12989] RIP: 0033:0x7feb24b9e159 [ 478.280137][T12989] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 478.280156][T12989] RSP: 002b:00007feb25a39028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 478.280180][T12989] RAX: ffffffffffffffda RBX: 00007feb24e25fa0 RCX: 00007feb24b9e159 [ 478.280195][T12989] RDX: 0000000000008050 RSI: 00002000000000c0 RDI: 0000000000000003 [ 478.280209][T12989] RBP: 00007feb25a39090 R08: 0000000000000000 R09: 0000000000000000 [ 478.280223][T12989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 478.280235][T12989] R13: 00007feb24e26038 R14: 00007feb24e25fa0 R15: 00007feb24f4fa48 [ 478.280269][T12989] [ 478.680165][ T9249] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 478.692055][T13000] x_tables: unsorted underflow at hook 1 [ 478.829865][ T9249] usb 5-1: Using ep0 maxpacket: 16 [ 478.830573][ T9249] usb 5-1: New USB device found, idVendor=046d, idProduct=c51b, bcdDevice= 0.00 [ 478.831672][ T9249] usb 5-1: too many endpoints for config 0 interface 0 altsetting 16: 254, using maximum allowed: 30 [ 478.831711][ T9249] usb 5-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 478.831737][ T9249] usb 5-1: config 0 interface 0 has no altsetting 0 [ 478.831767][ T9249] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 478.836512][ T9249] usb 5-1: config 0 descriptor?? [ 478.951477][ T989] usb 6-1: USB disconnect, device number 39 [ 479.269248][ T9249] logitech-djreceiver 0003:046D:C51B.0014: ignoring exceeding usage max [ 479.327836][ T9249] logitech-djreceiver 0003:046D:C51B.0014: hidraw0: USB HID v0.01 Device [HID 046d:c51b] on usb-dummy_hcd.4-1/input0 [ 479.635719][T13026] netlink: 'syz.0.2281': attribute type 2 has an invalid length. [ 479.635741][T13026] netlink: 'syz.0.2281': attribute type 2 has an invalid length. [ 480.050625][ T989] usb 1-1: new full-speed USB device number 99 using dummy_hcd [ 480.226048][ T989] usb 1-1: unable to get BOS descriptor or descriptor too short [ 480.227143][ T989] usb 1-1: not running at top speed; connect to a high speed hub [ 480.227175][ T989] usb 1-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice= e.3d [ 480.228757][ T989] usb 1-1: config 1 has an invalid interface number: 93 but max is 0 [ 480.228781][ T989] usb 1-1: config 1 has no interface number 0 [ 480.228822][ T989] usb 1-1: config 1 interface 93 has no altsetting 0 [ 480.264433][ T989] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.264457][ T989] usb 1-1: Product: syz [ 480.264472][ T989] usb 1-1: Manufacturer: syz [ 480.264487][ T989] usb 1-1: SerialNumber: syz [ 480.489503][ T5675] usb 5-1: USB disconnect, device number 99 [ 481.573001][T13043] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 482.060058][ T9271] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 482.226754][ T9271] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 482.241168][ T9271] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 482.241222][ T9271] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 482.241242][ T9271] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 482.242284][ T9271] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 482.242314][ T9271] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 482.297687][ T9271] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 482.297705][ T9271] usb 2-1: Product: syz [ 482.297732][ T9271] usb 2-1: Manufacturer: syz [ 482.321159][ T9271] cdc_wdm 2-1:1.0: skipping garbage [ 482.321171][ T9271] cdc_wdm 2-1:1.0: skipping garbage [ 482.333469][T13056] syz.2.2288 (13056): drop_caches: 2 [ 482.349053][ T9271] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 482.349073][ T9271] cdc_wdm 2-1:1.0: Unknown control protocol [ 482.648220][ T989] peak_usb 1-1:1.93 can0: sending cmd f=0x6 n=0x1 failure: -22 [ 482.648250][ T989] peak_usb 1-1:1.93: unable to read PCAN-USB serial number (err -22) [ 482.669076][T13069] xt_hashlimit: overflow, try lower: 4/9223372036854775808 [ 482.672345][T13069] __nla_validate_parse: 4 callbacks suppressed [ 482.672360][T13069] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2295'. [ 482.752176][ T989] peak_usb 1-1:1.93: probe with driver peak_usb failed with error -22 [ 482.771397][ T989] usb 1-1: USB disconnect, device number 99 [ 482.776274][T13055] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 482.779064][T13055] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 482.816664][T13055] sysfs: cannot create duplicate filename '/class/ieee80211/1ùà^!‚lü1”' [ 482.816679][T13055] CPU: 1 UID: 0 PID: 13055 Comm: syz.1.2289 Tainted: G L syzkaller #0 PREEMPT(full) [ 482.816698][T13055] Tainted: [L]=SOFTLOCKUP [ 482.816702][T13055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 482.816710][T13055] Call Trace: [ 482.816715][T13055] [ 482.816720][T13055] dump_stack_lvl+0xe8/0x150 [ 482.816748][T13055] sysfs_warn_dup+0x8e/0xa0 [ 482.816771][T13055] sysfs_do_create_link_sd+0xc0/0x110 [ 482.816789][T13055] device_add_class_symlinks+0x1cf/0x240 [ 482.816804][T13055] device_add+0x467/0xb80 [ 482.816817][T13055] wiphy_register+0x1fc8/0x2ff0 [ 482.816843][T13055] ? __pfx_wiphy_register+0x10/0x10 [ 482.816859][T13055] ? __pfx_netdev_run_todo+0x10/0x10 [ 482.816875][T13055] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 482.816893][T13055] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 482.816913][T13055] ieee80211_register_hw+0x3d3d/0x4a50 [ 482.816932][T13055] ? ieee80211_register_hw+0x19f1/0x4a50 [ 482.816963][T13055] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 482.816977][T13055] ? __asan_memset+0x22/0x50 [ 482.816995][T13055] ? __hrtimer_setup+0x1b7/0x260 [ 482.817010][T13055] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 482.817026][T13055] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 482.817054][T13055] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 482.817066][T13055] ? kstrndup+0xbd/0x160 [ 482.817080][T13055] ? kstrndup+0xbd/0x160 [ 482.817092][T13055] hwsim_new_radio_nl+0xd8b/0xf90 [ 482.817112][T13055] genl_family_rcv_msg_doit+0x233/0x340 [ 482.817129][T13055] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 482.817149][T13055] ? bpf_lsm_capable+0x9/0x20 [ 482.817158][T13055] ? security_capable+0x7e/0x2c0 [ 482.817174][T13055] genl_rcv_msg+0x614/0x7a0 [ 482.817190][T13055] ? __pfx_genl_rcv_msg+0x10/0x10 [ 482.817201][T13055] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 482.817221][T13055] netlink_rcv_skb+0x226/0x4a0 [ 482.817238][T13055] ? __pfx_genl_rcv_msg+0x10/0x10 [ 482.817251][T13055] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 482.817274][T13055] ? down_read+0x2be/0x330 [ 482.817290][T13055] genl_rcv+0x28/0x40 [ 482.817300][T13055] netlink_unicast+0x7bd/0x940 [ 482.817321][T13055] netlink_sendmsg+0x813/0xb40 [ 482.817341][T13055] ? __pfx_netlink_sendmsg+0x10/0x10 [ 482.817361][T13055] ? apparmor_socket_sendmsg+0x98/0x360 [ 482.817375][T13055] ? __pfx_netlink_sendmsg+0x10/0x10 [ 482.817389][T13055] sock_sendmsg_nosec+0x13a/0x180 [ 482.817408][T13055] ____sys_sendmsg+0x54e/0x850 [ 482.817425][T13055] ? __pfx_____sys_sendmsg+0x10/0x10 [ 482.817443][T13055] ? import_iovec+0x73/0xa0 [ 482.817463][T13055] ___sys_sendmsg+0x2a5/0x360 [ 482.817477][T13055] ? __lock_acquire+0x747/0x2de0 [ 482.817491][T13055] ? __pfx____sys_sendmsg+0x10/0x10 [ 482.817507][T13055] ? futex_wait+0x2a2/0x390 [ 482.817538][T13055] ? __fget_files+0x2a/0x420 [ 482.817554][T13055] ? __fget_files+0x3a2/0x420 [ 482.817574][T13055] __x64_sys_sendmsg+0x1b1/0x290 [ 482.817590][T13055] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 482.817615][T13055] do_syscall_64+0x166/0x520 [ 482.817627][T13055] ? trace_irq_disable+0x3b/0x140 [ 482.817637][T13055] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 482.817649][T13055] ? clear_bhb_loop+0x70/0xc0 [ 482.817662][T13055] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 482.817673][T13055] RIP: 0033:0x7f6150f9e159 [ 482.817685][T13055] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 482.817694][T13055] RSP: 002b:00007f6151e5e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 482.817707][T13055] RAX: ffffffffffffffda RBX: 00007f6151225fa0 RCX: 00007f6150f9e159 [ 482.817716][T13055] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000008 [ 482.817723][T13055] RBP: 00007f615103503b R08: 0000000000000000 R09: 0000000000000000 [ 482.817730][T13055] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 482.817737][T13055] R13: 00007f6151226038 R14: 00007f6151225fa0 R15: 00007f615134fa48 [ 482.817755][T13055] [ 483.225673][T13073] netlink: 'syz.4.2296': attribute type 4 has an invalid length. [ 483.276742][T13077] netlink: 'syz.4.2296': attribute type 4 has an invalid length. [ 483.388260][T13079] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2299'. [ 483.649913][ T9249] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 483.802097][ T9249] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 483.803328][ T9249] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 483.803379][ T9249] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 483.812686][ T9249] usb 1-1: config 0 descriptor?? [ 483.887775][T13090] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2303'. [ 483.990671][ T9249] usb 2-1: USB disconnect, device number 104 [ 484.041988][ T9252] usb 1-1: USB disconnect, device number 100 [ 484.240897][T13102] FAULT_INJECTION: forcing a failure. [ 484.240897][T13102] name failslab, interval 1, probability 0, space 100, times 0 [ 484.240920][T13102] CPU: 1 UID: 0 PID: 13102 Comm: syz.2.2308 Tainted: G L syzkaller #0 PREEMPT(full) [ 484.240935][T13102] Tainted: [L]=SOFTLOCKUP [ 484.240939][T13102] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 484.240946][T13102] Call Trace: [ 484.240951][T13102] [ 484.240956][T13102] dump_stack_lvl+0xe8/0x150 [ 484.240976][T13102] should_fail_ex+0x410/0x560 [ 484.240992][T13102] should_failslab+0xa8/0x100 [ 484.241006][T13102] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 484.241023][T13102] kmem_cache_alloc_noprof+0xa1/0x600 [ 484.241042][T13102] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 484.241056][T13102] ? kmem_cache_alloc_noprof+0x156/0x600 [ 484.241071][T13102] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 484.241089][T13102] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 484.241110][T13102] mmu_topup_memory_caches+0x21/0x170 [ 484.241123][T13102] kvm_mmu_load+0x9d/0x21e0 [ 484.241135][T13102] ? kvm_msr_allowed+0x9a/0x490 [ 484.241146][T13102] ? kvm_msr_allowed+0x3f4/0x490 [ 484.241156][T13102] ? kvm_msr_allowed+0x9a/0x490 [ 484.241165][T13102] ? kvm_msr_allowed+0x9a/0x490 [ 484.241178][T13102] ? kvm_apic_has_interrupt+0x740/0x770 [ 484.241198][T13102] vcpu_run+0x4f68/0x79b0 [ 484.241249][T13102] ? __pfx_vcpu_run+0x10/0x10 [ 484.241264][T13102] ? lock_acquire+0x115/0x350 [ 484.241284][T13102] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 484.241302][T13102] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 484.241318][T13102] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 484.241332][T13102] kvm_vcpu_ioctl+0xa61/0xfd0 [ 484.241352][T13102] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 484.241363][T13102] ? hook_file_ioctl+0x1f2/0x600 [ 484.241385][T13102] ? __fget_files+0x2a/0x420 [ 484.241401][T13102] ? __fget_files+0x2a/0x420 [ 484.241414][T13102] ? __fget_files+0x3a2/0x420 [ 484.241427][T13102] ? __fget_files+0x2a/0x420 [ 484.241448][T13102] ? bpf_lsm_file_ioctl+0x9/0x20 [ 484.241474][T13102] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 484.241485][T13102] __se_sys_ioctl+0xfc/0x170 [ 484.241498][T13102] do_syscall_64+0x166/0x520 [ 484.241510][T13102] ? trace_irq_disable+0x3b/0x140 [ 484.241520][T13102] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.241531][T13102] ? clear_bhb_loop+0x70/0xc0 [ 484.241544][T13102] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.241555][T13102] RIP: 0033:0x7f8e40d9e159 [ 484.241565][T13102] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 484.241575][T13102] RSP: 002b:00007f8e41ccf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 484.241587][T13102] RAX: ffffffffffffffda RBX: 00007f8e41025fa0 RCX: 00007f8e40d9e159 [ 484.241595][T13102] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 484.241602][T13102] RBP: 00007f8e41ccf090 R08: 0000000000000000 R09: 0000000000000000 [ 484.241609][T13102] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 484.241615][T13102] R13: 00007f8e41026038 R14: 00007f8e41025fa0 R15: 00007f8e4114fa48 [ 484.241631][T13102] [ 484.460547][ T989] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 484.649831][ T9271] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 484.665551][T13109] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2311'. [ 484.713551][T13111] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 484.734570][ T989] usb 5-1: unable to get BOS descriptor or descriptor too short [ 484.734602][ T989] usb 5-1: New USB device found, idVendor=07ca, idProduct=2835, bcdDevice=ea.e7 [ 484.735491][ T989] usb 5-1: config 3 has an invalid interface number: 73 but max is 1 [ 484.735516][ T989] usb 5-1: config 3 has no interface number 1 [ 484.735564][ T989] usb 5-1: config 3 interface 73 altsetting 14 endpoint 0x2 has an invalid bInterval 136, changing to 7 [ 484.735587][ T989] usb 5-1: config 3 interface 0 has no altsetting 0 [ 484.735596][ T989] usb 5-1: config 3 interface 73 has no altsetting 0 [ 484.738172][ T989] usb 5-1: string descriptor 0 read error: -22 [ 484.738292][ T989] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.789844][ T9252] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 484.828613][ T989] usb 5-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 484.828699][ T989] dvb_usb_af9035 5-1:3.0: probe with driver dvb_usb_af9035 failed with error -22 [ 484.849463][ T9271] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 484.859482][ T9271] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 484.859533][ T9271] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.884169][ T9271] usb 1-1: config 0 descriptor?? [ 484.887303][ T9271] aiptek 1-1:0.0: interface has no int in endpoints, but must have minimum 1 [ 484.940944][ T9252] usb 6-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 484.941872][ T9252] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 484.941900][ T9252] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 484.941924][ T9252] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 484.947821][ T9252] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.947846][ T9252] usb 6-1: Product: syz [ 484.947860][ T9252] usb 6-1: Manufacturer: syz [ 484.947875][ T9252] usb 6-1: SerialNumber: syz [ 484.956172][ T9252] usb 6-1: config 0 descriptor?? [ 484.956898][T13107] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 484.957024][T13107] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 484.958389][ T9252] usb 6-1: ucan: probing device on interface #0 [ 485.042516][ T9251] usb 5-1: USB disconnect, device number 100 [ 485.098711][ T5675] usb 1-1: USB disconnect, device number 101 [ 485.163949][ T9252] usb 6-1: ucan: could not read protocol version, ret=0 [ 485.163965][ T9252] usb 6-1: ucan: probe failed; try to update the device firmware [ 485.179853][ T9249] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 485.340602][ T9249] usb 2-1: New USB device found, idVendor=0b95, idProduct=7720, bcdDevice= 0.00 [ 485.343633][ T9249] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.343660][ T9249] usb 2-1: Product: syz [ 485.343674][ T9249] usb 2-1: Manufacturer: syz [ 485.343689][ T9249] usb 2-1: SerialNumber: syz [ 485.548992][ T9249] asix 2-1:1.0: probe with driver asix failed with error -71 [ 485.557606][ T9249] usb 2-1: USB disconnect, device number 105 [ 485.712979][T13123] x_tables: duplicate underflow at hook 2 [ 485.851769][T13128] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2318'. [ 486.040671][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 486.059239][ T9250] dvb-usb: did not find the firmware file 'dvb-usb-SkyStar_USB_HD_FW_v17_63.HEX.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 486.067370][ T9250] usb 3-1: USB disconnect, device number 73 [ 486.410026][ T9250] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 486.489836][ T9251] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 486.542279][ T9250] usb 3-1: device descriptor read/64, error -71 [ 486.642976][ T9251] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 486.646398][ T9251] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 486.646423][ T9251] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 486.646443][ T9251] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 486.646486][ T9251] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 486.646511][ T9251] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 486.648972][ T9251] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 486.648996][ T9251] usb 2-1: Product: syz [ 486.649010][ T9251] usb 2-1: Manufacturer: syz [ 486.711227][ T9251] cdc_wdm 2-1:1.0: skipping garbage [ 486.711247][ T9251] cdc_wdm 2-1:1.0: skipping garbage [ 486.730480][ T9251] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 486.730501][ T9251] cdc_wdm 2-1:1.0: Unknown control protocol [ 486.781115][ T9250] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 486.814257][T13140] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2322'. [ 486.909919][ T9250] usb 3-1: device descriptor read/64, error -71 [ 487.020228][ T9250] usb usb3-port1: attempt power cycle [ 487.042656][T13149] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2326'. [ 487.100465][ T9251] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 487.104525][T13138] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 487.106110][T13138] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.142598][T13138] sysfs: cannot create duplicate filename '/class/ieee80211/1ùà^!‚lü1”' [ 487.142621][T13138] CPU: 0 UID: 0 PID: 13138 Comm: syz.1.2321 Tainted: G L syzkaller #0 PREEMPT(full) [ 487.142651][T13138] Tainted: [L]=SOFTLOCKUP [ 487.142659][T13138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 487.142672][T13138] Call Trace: [ 487.142681][T13138] [ 487.142690][T13138] dump_stack_lvl+0xe8/0x150 [ 487.142732][T13138] sysfs_warn_dup+0x8e/0xa0 [ 487.142765][T13138] sysfs_do_create_link_sd+0xc0/0x110 [ 487.142803][T13138] device_add_class_symlinks+0x1cf/0x240 [ 487.142830][T13138] device_add+0x467/0xb80 [ 487.142855][T13138] wiphy_register+0x1fc8/0x2ff0 [ 487.142903][T13138] ? __pfx_wiphy_register+0x10/0x10 [ 487.142934][T13138] ? __pfx_netdev_run_todo+0x10/0x10 [ 487.142964][T13138] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 487.142999][T13138] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 487.143033][T13138] ieee80211_register_hw+0x3d3d/0x4a50 [ 487.143070][T13138] ? ieee80211_register_hw+0x19f1/0x4a50 [ 487.143124][T13138] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 487.143150][T13138] ? __asan_memset+0x22/0x50 [ 487.143180][T13138] ? __hrtimer_setup+0x1b7/0x260 [ 487.143209][T13138] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 487.143237][T13138] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 487.143290][T13138] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 487.143314][T13138] ? kstrndup+0xbd/0x160 [ 487.143340][T13138] ? kstrndup+0xbd/0x160 [ 487.143363][T13138] hwsim_new_radio_nl+0xd8b/0xf90 [ 487.143402][T13138] genl_family_rcv_msg_doit+0x233/0x340 [ 487.143435][T13138] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 487.143471][T13138] ? bpf_lsm_capable+0x9/0x20 [ 487.143489][T13138] ? security_capable+0x7e/0x2c0 [ 487.143520][T13138] genl_rcv_msg+0x614/0x7a0 [ 487.143551][T13138] ? __pfx_genl_rcv_msg+0x10/0x10 [ 487.143574][T13138] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 487.143597][T13138] ? irqentry_exit+0x218/0x910 [ 487.143630][T13138] netlink_rcv_skb+0x226/0x4a0 [ 487.143660][T13138] ? __pfx_genl_rcv_msg+0x10/0x10 [ 487.143684][T13138] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 487.143727][T13138] ? down_read+0x2be/0x330 [ 487.143755][T13138] genl_rcv+0x28/0x40 [ 487.143776][T13138] netlink_unicast+0x7bd/0x940 [ 487.143815][T13138] netlink_sendmsg+0x813/0xb40 [ 487.143856][T13138] ? __pfx_netlink_sendmsg+0x10/0x10 [ 487.143896][T13138] ? apparmor_socket_sendmsg+0x98/0x360 [ 487.143921][T13138] ? __pfx_netlink_sendmsg+0x10/0x10 [ 487.143951][T13138] sock_sendmsg_nosec+0x13a/0x180 [ 487.143987][T13138] ____sys_sendmsg+0x54e/0x850 [ 487.144020][T13138] ? __pfx_____sys_sendmsg+0x10/0x10 [ 487.144058][T13138] ? import_iovec+0x73/0xa0 [ 487.144096][T13138] ___sys_sendmsg+0x2a5/0x360 [ 487.144122][T13138] ? __lock_acquire+0x747/0x2de0 [ 487.144149][T13138] ? __pfx____sys_sendmsg+0x10/0x10 [ 487.144181][T13138] ? futex_wait+0x2a2/0x390 [ 487.144239][T13138] ? __fget_files+0x2a/0x420 [ 487.144267][T13138] ? __fget_files+0x3a2/0x420 [ 487.144304][T13138] __x64_sys_sendmsg+0x1b1/0x290 [ 487.144333][T13138] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 487.144385][T13138] do_syscall_64+0x166/0x520 [ 487.144406][T13138] ? trace_irq_disable+0x3b/0x140 [ 487.144444][T13138] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.144467][T13138] ? clear_bhb_loop+0x70/0xc0 [ 487.144493][T13138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.144513][T13138] RIP: 0033:0x7f6150f9e159 [ 487.144532][T13138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 487.144550][T13138] RSP: 002b:00007f6151e5e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 487.144573][T13138] RAX: ffffffffffffffda RBX: 00007f6151225fa0 RCX: 00007f6150f9e159 [ 487.144588][T13138] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000008 [ 487.144600][T13138] RBP: 00007f615103503b R08: 0000000000000000 R09: 0000000000000000 [ 487.144612][T13138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 487.144624][T13138] R13: 00007f6151226038 R14: 00007f6151225fa0 R15: 00007f615134fa48 [ 487.144656][T13138] [ 487.261805][ T9251] usb 5-1: Using ep0 maxpacket: 16 [ 487.265753][ T9251] usb 5-1: New USB device found, idVendor=046d, idProduct=c51b, bcdDevice= 0.00 [ 487.269826][ T9251] usb 5-1: too many endpoints for config 0 interface 0 altsetting 16: 254, using maximum allowed: 30 [ 487.269866][ T9251] usb 5-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 487.269892][ T9251] usb 5-1: config 0 interface 0 has no altsetting 0 [ 487.269924][ T9251] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.276878][ T9251] usb 5-1: config 0 descriptor?? [ 487.361156][ T9250] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 487.570002][ T9250] usb 3-1: device not accepting address 76, error -71 [ 487.677929][ T5675] usb 6-1: USB disconnect, device number 40 [ 487.746062][ T9251] logitech-djreceiver 0003:046D:C51B.0015: ignoring exceeding usage max [ 487.774281][ T9251] logitech-djreceiver 0003:046D:C51B.0015: hidraw0: USB HID v0.01 Device [HID 046d:c51b] on usb-dummy_hcd.4-1/input0 [ 488.201707][ T9271] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 488.352387][ T5696] usb 5-1: USB disconnect, device number 101 [ 488.371708][ T9271] usb 6-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 488.379222][ T9271] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 488.379272][ T9271] usb 6-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 488.379299][ T9271] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.640252][T13175] loop0: detected capacity change from 0 to 7 [ 488.644158][ T5696] usb 2-1: USB disconnect, device number 106 [ 488.666352][T13175] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 488.666384][T13175] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 488.666493][T13175] Dev loop0: unable to read RDB block 7 [ 488.666528][T13175] loop0: unable to read partition table [ 488.666733][T13175] loop0: partition table beyond EOD, truncated [ 488.666759][T13175] loop_reread_partitions: partition scan of loop0 (þ被xü—ŸÑà– ) failed (rc=-5) [ 489.225081][ T9271] ttusb_dec_send_command: result bulk message failed: error -71 [ 489.225313][ T9271] ttusb-dec 6-1:1.0: probe with driver ttusb-dec failed with error -71 [ 489.251172][ T5696] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 489.259114][ T9271] usb 6-1: USB disconnect, device number 41 [ 489.399893][ T5696] usb 3-1: Using ep0 maxpacket: 32 [ 489.400599][ T5696] usb 3-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 489.401596][ T5696] usb 3-1: config index 0 descriptor too short (expected 156, got 27) [ 489.401633][ T5696] usb 3-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 489.401670][ T5696] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 489.401697][ T5696] usb 3-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 489.401723][ T5696] usb 3-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 489.401750][ T5696] usb 3-1: config 0 interface 0 has no altsetting 0 [ 489.403819][ T5696] usb 3-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 489.403845][ T5696] usb 3-1: Product: syz [ 489.403860][ T5696] usb 3-1: Manufacturer: syz [ 489.403875][ T5696] usb 3-1: SerialNumber: syz [ 489.518689][ T5696] usb 3-1: config 0 descriptor?? [ 489.527047][T13181] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 489.537355][ T5696] ldusb 3-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 489.549567][ T5696] ldusb 3-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 489.579169][ T31] audit: type=1326 audit(1789152114.153:2632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13191 comm="syz.1.2341" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6150f9e159 code=0x7ffc0000 [ 489.605350][ T31] audit: type=1326 audit(1789152114.153:2633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13191 comm="syz.1.2341" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6150f9e159 code=0x7ffc0000 [ 489.605396][ T31] audit: type=1326 audit(1789152114.173:2634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13191 comm="syz.1.2341" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f6150f9e159 code=0x7ffc0000 [ 489.605435][ T31] audit: type=1326 audit(1789152114.173:2635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13191 comm="syz.1.2341" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6150f9e159 code=0x7ffc0000 [ 489.605472][ T31] audit: type=1326 audit(1789152114.173:2636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13191 comm="syz.1.2341" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6150f9e159 code=0x7ffc0000 [ 489.785243][ T9250] usb 3-1: USB disconnect, device number 78 [ 489.786346][ C0] ldusb 3-1:0.0: usb_submit_urb failed (-19) [ 489.801549][ T9250] ldusb 3-1:0.0: LD USB Device #0 now disconnected [ 489.919918][T13202] sctp: [Deprecated]: syz.4.2345 (pid 13202) Use of struct sctp_assoc_value in delayed_ack socket option. [ 489.919918][T13202] Use struct sctp_sack_info instead [ 490.223212][ T31] audit: type=1326 audit(1789152114.803:2637): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13215 comm="syz.0.2351" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff672d9e159 code=0x7ffc0000 [ 490.223262][ T31] audit: type=1326 audit(1789152114.803:2638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13215 comm="syz.0.2351" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff672d9e159 code=0x7ffc0000 [ 490.224486][ T31] audit: type=1326 audit(1789152114.803:2639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13215 comm="syz.0.2351" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff672d9e159 code=0x7ffc0000 [ 490.224617][ T31] audit: type=1326 audit(1789152114.803:2640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13215 comm="syz.0.2351" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff672d9e159 code=0x7ffc0000 [ 490.227464][ T31] audit: type=1326 audit(1789152114.803:2641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13215 comm="syz.0.2351" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=195 compat=0 ip=0x7ff672d9e159 code=0x7ffc0000 [ 491.809909][ T9271] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 491.830140][ T5696] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 491.889944][ T9251] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 491.890125][ T9274] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 491.972447][ T9271] usb 6-1: Using ep0 maxpacket: 16 [ 491.973084][ T9271] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 491.975468][ T9271] usb 6-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 491.975486][ T9271] usb 6-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 491.975498][ T9271] usb 6-1: config 0 interface 0 has no altsetting 0 [ 491.975516][ T9271] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.977713][ T9271] usb 6-1: config 0 descriptor?? [ 492.030961][ T5696] usb 3-1: Using ep0 maxpacket: 8 [ 492.039801][ T9251] usb 5-1: Using ep0 maxpacket: 8 [ 492.041506][ T5696] usb 3-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 492.041540][ T5696] usb 3-1: no configurations [ 492.041552][ T5696] usb 3-1: can't read configurations, error -22 [ 492.060234][ T9251] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 492.061329][ T9251] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 492.061369][ T9251] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.077648][ T9274] usb 1-1: Using ep0 maxpacket: 32 [ 492.096908][ T9274] usb 1-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 492.106240][ T9251] usb 5-1: config 0 descriptor?? [ 492.119403][ T9274] usb 1-1: config index 0 descriptor too short (expected 156, got 27) [ 492.119533][ T9274] usb 1-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 492.119571][ T9274] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 103, changing to 10 [ 492.119597][ T9274] usb 1-1: config 0 interface 0 altsetting 191 endpoint 0x87 has invalid maxpacket 26217, setting to 1024 [ 492.119643][ T9274] usb 1-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 492.119669][ T9274] usb 1-1: config 0 interface 0 has no altsetting 0 [ 492.185925][ T9274] usb 1-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 492.185951][ T9274] usb 1-1: Product: syz [ 492.185966][ T9274] usb 1-1: Manufacturer: syz [ 492.185980][ T9274] usb 1-1: SerialNumber: syz [ 492.188635][ T9274] usb 1-1: config 0 descriptor?? [ 492.189552][T13272] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 492.225898][ T9274] ldusb 1-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 492.227589][ T9274] ldusb 1-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 492.247231][ T5696] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 492.390689][ T9271] mcp2221 0003:04D8:00DD.0016: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 492.409004][ T9250] usb 1-1: USB disconnect, device number 102 [ 492.409111][ C1] ldusb 1-1:0.0: usb_submit_urb failed (-19) [ 492.410568][ T5696] usb 3-1: Using ep0 maxpacket: 8 [ 492.415849][ T9250] ldusb 1-1:0.0: LD USB Device #0 now disconnected [ 492.423540][ T5696] usb 3-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 492.423576][ T5696] usb 3-1: no configurations [ 492.423583][ T5696] usb 3-1: can't read configurations, error -22 [ 492.445712][ T9251] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 492.449512][ T5696] usb usb3-port1: attempt power cycle [ 492.589875][T13269] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 492.590320][T13269] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 492.595126][ T9251] usb 6-1: USB disconnect, device number 42 [ 492.819933][ T5696] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 492.840647][ T5696] usb 3-1: Using ep0 maxpacket: 8 [ 492.841144][ T5696] usb 3-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 492.841166][ T5696] usb 3-1: no configurations [ 492.841173][ T5696] usb 3-1: can't read configurations, error -22 [ 492.981779][ T5696] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 493.003026][ T5696] usb 3-1: Using ep0 maxpacket: 8 [ 493.003448][ T5696] usb 3-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 493.003509][ T5696] usb 3-1: no configurations [ 493.003522][ T5696] usb 3-1: can't read configurations, error -22 [ 493.003684][ T5696] usb usb3-port1: unable to enumerate USB device [ 493.199881][ T9251] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 493.350480][ T9251] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 493.351580][ T9251] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.355448][ T9251] usb 1-1: config 0 descriptor?? [ 493.461581][T13298] 8021q: adding VLAN 0 to HW filter on device bond1 [ 493.773891][T13288] netlink: 'syz.0.2379': attribute type 11 has an invalid length. [ 494.013381][T13310] tipc: Started in network mode [ 494.013400][T13310] tipc: Node identity 363cdabc618f, cluster identity 4711 [ 494.013669][T13310] tipc: Enabled bearer , priority 0 [ 494.013984][T13311] syzkaller0: entered promiscuous mode [ 494.014001][T13311] syzkaller0: entered allmulticast mode [ 494.097958][T13314] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2386'. [ 494.105678][T13314] vlan0: entered allmulticast mode [ 494.329965][ T9274] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 494.482499][ T9274] usb 6-1: Using ep0 maxpacket: 32 [ 494.483358][ T9274] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 494.486357][ T9274] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 494.486388][ T9274] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 494.486433][ T9274] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 494.486456][ T9274] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 30768, setting to 1024 [ 494.486480][ T9274] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 494.486503][ T9274] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 26 [ 494.487844][ T9274] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 494.487867][ T9274] usb 6-1: SerialNumber: syz [ 494.528030][T13304] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 494.537898][ T9274] cdc_acm 6-1:1.0: Control and data interfaces are not separated! [ 494.576705][ T9274] cdc_acm 6-1:1.0: probe with driver cdc_acm failed with error -12 [ 494.607144][T13324] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2379'. [ 494.667706][T13324] ip6tnl2: entered allmulticast mode [ 494.686872][ T9251] usb 1-1: Cannot set autoneg [ 494.687150][ T9251] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 494.708866][ T5696] usb 5-1: USB disconnect, device number 102 [ 494.723402][ T9251] usb 1-1: USB disconnect, device number 103 [ 494.746859][ T9252] usb 6-1: USB disconnect, device number 43 [ 494.768999][T13303] tipc: Resetting bearer [ 494.831123][T13303] tipc: Disabling bearer [ 495.007661][T13329] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2391'. [ 495.007690][T13329] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2391'. [ 495.007975][T13329] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 495.108933][T13332] loop0: detected capacity change from 0 to 1 [ 495.145827][T13332] ldm_validate_privheads(): Disk read failed. [ 495.145865][T13332] loop0: [ 495.145876][T13332] loop0: partition table partially beyond EOD, truncated [ 495.198499][T13334] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2393'. [ 495.262426][ T5696] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 495.322574][T13339] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 495.410127][ T5696] usb 5-1: Using ep0 maxpacket: 16 [ 495.411675][ T5696] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 495.415868][ T5696] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 495.415887][ T5696] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 495.415900][ T5696] usb 5-1: config 0 interface 0 has no altsetting 0 [ 495.415919][ T5696] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.419477][ T5696] usb 5-1: config 0 descriptor?? [ 495.845599][ T5696] mcp2221 0003:04D8:00DD.0017: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 495.915182][T13352] [ 495.918309][T13352] ============================= [ 495.923233][T13352] WARNING: suspicious RCU usage [ 495.928249][T13352] syzkaller #0 Tainted: G L [ 495.934252][T13352] ----------------------------- [ 495.939142][T13352] net/netfilter/nf_conntrack_netlink.c:3395 suspicious rcu_dereference_check() usage! [ 495.948719][T13352] [ 495.948719][T13352] other info that might help us debug this: [ 495.948719][T13352] [ 495.958995][T13352] [ 495.958995][T13352] rcu_scheduler_active = 2, debug_locks = 1 [ 495.967151][T13352] locks held by syz.2.2401/13352: 2, last CPU#0: [ 495.973632][T13352] #0: ffffffff9aee8320 (nfnl_subsys_ctnetlink_exp){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa69/0x12b0 [ 495.984520][T13352] #1: ffffffff8ea74d58 (nf_conntrack_expect_lock){+...}-{3:3}, at: nf_ct_expect_iterate_net+0x38/0x180 [ 495.995846][T13352] [ 495.995846][T13352] stack backtrace: [ 496.001865][T13352] CPU: 0 UID: 0 PID: 13352 Comm: syz.2.2401 Tainted: G L syzkaller #0 PREEMPT(full) [ 496.011119][ T9252] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 496.020421][T13352] Tainted: [L]=SOFTLOCKUP [ 496.024745][T13352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 496.034789][T13352] Call Trace: [ 496.038060][T13352] [ 496.040986][T13352] dump_stack_lvl+0xe8/0x150 [ 496.045614][T13352] lockdep_rcu_suspicious+0x140/0x1d0 [ 496.050994][T13352] expect_iter_name+0xfb/0x100 [ 496.055842][T13352] nf_ct_expect_iterate_net+0xf2/0x180 [ 496.061296][T13352] ? __pfx_expect_iter_name+0x10/0x10 [ 496.066661][T13352] ctnetlink_del_expect+0x45d/0x640 [ 496.071847][T13352] ? __pfx_ctnetlink_del_expect+0x10/0x10 [ 496.077558][T13352] nfnetlink_rcv_msg+0xcc2/0x12b0 [ 496.082572][T13352] ? unwind_get_return_address+0x4d/0x90 [ 496.088222][T13352] ? nfnetlink_rcv_msg+0x228/0x12b0 [ 496.093441][T13352] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 496.098909][T13352] netlink_rcv_skb+0x226/0x4a0 [ 496.103664][T13352] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 496.109110][T13352] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 496.114405][T13352] ? bpf_lsm_capable+0x9/0x20 [ 496.119081][T13352] ? security_capable+0x7e/0x2c0 [ 496.124033][T13352] nfnetlink_rcv+0x2b9/0x28c0 [ 496.128719][T13352] ? __dev_queue_xmit+0x29b/0x3820 [ 496.133840][T13352] ? __local_bh_enable_ip+0xd6/0x140 [ 496.139135][T13352] ? lockdep_hardirqs_on+0x7b/0x110 [ 496.144336][T13352] ? __dev_queue_xmit+0x29b/0x3820 [ 496.149453][T13352] ? __local_bh_enable_ip+0xd6/0x140 [ 496.154740][T13352] ? __dev_queue_xmit+0x29b/0x3820 [ 496.159767][ T9252] usb 1-1: Using ep0 maxpacket: 8 [ 496.161804][ T9252] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 496.162864][ T9252] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 496.162906][ T9252] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.168802][ T9252] usb 1-1: config 0 descriptor?? [ 496.197572][T13352] ? __dev_queue_xmit+0x1edc/0x3820 [ 496.202789][T13352] ? do_syscall_64+0x166/0x520 [ 496.207557][T13352] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.213633][T13352] ? __dev_queue_xmit+0x29b/0x3820 [ 496.218759][T13352] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 496.223883][T13352] ? __pfx___dev_queue_xmit+0x10/0x10 [ 496.229276][T13352] ? ref_tracker_free+0x689/0x830 [ 496.234311][T13352] ? __pfx_ref_tracker_free+0x10/0x10 [ 496.239706][T13352] ? __skb_clone+0x449/0x6c0 [ 496.244313][T13352] ? skb_clone+0x246/0x3a0 [ 496.248735][T13352] ? __netlink_deliver_tap+0x811/0x860 [ 496.254205][T13352] ? netlink_deliver_tap+0x2e/0x1b0 [ 496.259423][T13352] ? netlink_deliver_tap+0x2e/0x1b0 [ 496.264632][T13352] ? netlink_deliver_tap+0x2e/0x1b0 [ 496.269847][T13352] netlink_unicast+0x7bd/0x940 [ 496.274637][T13352] netlink_sendmsg+0x813/0xb40 [ 496.279414][T13352] ? __pfx_netlink_sendmsg+0x10/0x10 [ 496.284712][T13352] ? apparmor_socket_sendmsg+0x26d/0x360 [ 496.290348][T13352] ? __pfx_netlink_sendmsg+0x10/0x10 [ 496.295643][T13352] sock_sendmsg_nosec+0x13a/0x180 [ 496.300677][T13352] ____sys_sendmsg+0x54e/0x850 [ 496.305447][T13352] ? __pfx_____sys_sendmsg+0x10/0x10 [ 496.310738][T13352] ? import_iovec+0x73/0xa0 [ 496.315247][T13352] ___sys_sendmsg+0x2a5/0x360 [ 496.319923][T13352] ? __lock_acquire+0x747/0x2de0 [ 496.324867][T13352] ? __pfx____sys_sendmsg+0x10/0x10 [ 496.330068][T13352] ? futex_wait+0x2a2/0x390 [ 496.334607][T13352] ? __fget_files+0x2a/0x420 [ 496.339204][T13352] ? __fget_files+0x3a2/0x420 [ 496.343891][T13352] __x64_sys_sendmsg+0x1b1/0x290 [ 496.348836][T13352] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 496.354316][T13352] do_syscall_64+0x166/0x520 [ 496.358912][T13352] ? trace_irq_disable+0x3b/0x140 [ 496.363929][T13352] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.369993][T13352] ? clear_bhb_loop+0x70/0xc0 [ 496.374670][T13352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.380569][T13352] RIP: 0033:0x7f8e40d9e159 [ 496.384991][T13352] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 496.404605][T13352] RSP: 002b:00007f8e41ccf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 496.413031][T13352] RAX: ffffffffffffffda RBX: 00007f8e41025fa0 RCX: 00007f8e40d9e159 [ 496.421006][T13352] RDX: 0000000020040800 RSI: 00002000000001c0 RDI: 0000000000000005 [ 496.428976][T13352] RBP: 00007f8e40e3503b R08: 0000000000000000 R09: 0000000000000000 [ 496.436944][T13352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 496.444907][T13352] R13: 00007f8e41026038 R14: 00007f8e41025fa0 R15: 00007f8e4114fa48 [ 496.452974][T13352] [ 496.469455][ T31] kauditd_printk_skb: 22 callbacks suppressed [ 496.469472][ T31] audit: type=1326 audit(1789152121.043:2664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13349 comm="syz.0.2400" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff672d9e159 code=0x0 [ 496.511894][T13327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.512300][T13327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 496.514521][ T989] usb 5-1: USB disconnect, device number 103 [ 496.560256][ T9274] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 496.572157][ T9252] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 496.709878][ T9274] usb 2-1: Using ep0 maxpacket: 16 [ 496.710422][ T9274] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 496.711427][ T9274] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 496.713317][ T9274] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.713341][ T9274] usb 2-1: Product: syz [ 496.713356][ T9274] usb 2-1: Manufacturer: syz [ 496.713370][ T9274] usb 2-1: SerialNumber: syz [ 496.715265][ T9274] usb 2-1: config 0 descriptor?? [ 496.719161][ T9274] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 496.719179][ T9274] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 497.444798][ T9274] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 497.505416][ T9274] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 497.505450][ T9274] em28xx 2-1:0.0: board has no eeprom [ 497.560123][ T9274] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 497.560151][ T9274] em28xx 2-1:0.0: dvb set to bulk mode. [ 497.560978][ T989] em28xx 2-1:0.0: Binding DVB extension [ 497.590104][ T9274] usb 2-1: USB disconnect, device number 107 [ 497.609932][ T9274] em28xx 2-1:0.0: Disconnecting em28xx [ 497.657202][ T989] em28xx 2-1:0.0: Registering input extension [ 497.659382][ T9274] em28xx 2-1:0.0: Closing input extension [ 497.687431][ T9274] em28xx: Freeing device [ 498.777854][ T9252] usb 1-1: USB disconnect, device number 104 [ 501.401058][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.401126][ T1313] ieee802154 phy1 wpan1: encryption failed: -22