last executing test programs: 44.657522488s ago: executing program 3 (id=2549): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x8) openat$cgroup(r3, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) ioctl$UFFDIO_WRITEPROTECT(r3, 0xc018aa06, &(0x7f0000000500)={{&(0x7f0000456000/0x1000)=nil, 0x1000}, 0x2}) sendmsg$SOCK_DIAG_BY_FAMILY(r3, &(0x7f0000000a80)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000a40)={&(0x7f00000006c0)={0x348, 0x14, 0x400, 0x70bd26, 0x25dfdbff, {0x10, 0x5}, [@INET_DIAG_REQ_BYTECODE={0xbe, 0x1, "8cfe43ddf1abdbafcfc076711d08b927e79e8a73088602088ee37081e31bcda4e9cc7bd71f73cf8925449ee288c71d14447603079b751ccc9403ec450301c5126ae29f49b13b9847437e211f09cd8ae8ef434dc2c38782a6557c2bac0751a837399e92663a61bd2e3d64d6d08f5beb079e9260769f7ba77f3516811acde6cfcea4878d8f15f61ab5dfb72ecfbe10f298bf6bd977db1f67402144fbae2bac0d49c239c9146f372bd03540b8256c2c485a2fedad5fca77a51d0583"}, @INET_DIAG_REQ_BYTECODE={0x6d, 0x1, "db464cd24bfa12a042d832f98710575b872c49a2129630dfd9565d6a5aa269b7e9eebeaada08f3353a9656c25f07f84f10a0b4f7e27857e3af88db88650abfbe19afaecdc5822bf5baf701df31623c54806bb9a37c2d31ce15a72964b56f7a7bd14e83d51e5af03508"}, @INET_DIAG_REQ_BYTECODE={0xcf, 0x1, "f6050430d3d00e279d254f4ce53e0bfea8aad80f6e3c09b2c53902bc1a5d492dbb6460fd1f1897e4339e21af7408fc226d9910bab8b1d2c0e2029f1398ca5d422c240887075bf1e9bf6aff61456d4b70ff8ee9bcb379e9a8053a745ba8195000ebbffcc685824889bc3c12fb45cab5c2a4ea3b20604eec0511e71043dc532bc7dce775768c048b1ac3a66ef5205f27823cf00b44705255796cd5ec048b6a8b592eca11b63819b11686e0e6b2da7fdbe65b258d53c15310d3105d50fd81eed10f06979d089238e71ea4013f"}, @INET_DIAG_REQ_BYTECODE={0x6c, 0x1, "d8da2fe759f73dd4d44e87e2f8ef9af20e5014eba447978a6f576abde742f0389e70562a08648c0248f4dd70190f919b98c89dee7c595eb2fed6e1d751c3594305baa7c61f096106693a3d62a1804c28f1ea361697ed33e93dcce7dae02904babaa83defcbf346b4"}, @INET_DIAG_REQ_BYTECODE={0xc6, 0x1, "230a0b2383c33eb4da4ec57221f6b398012bf8a0dfa67a2b7b0e0309e2ea0d8b5fb47591f0582895b63c0827ba5eaade636bce5f4578c01b8fcc3b5d320513549db2e737fde4e8d0925b8d12bd4a2efb62007b7adbb1eec1ba57277d3f847c4a2e21cf5082e4ebf9d4af825706d2723a5afdb557a0cc2e3466f53d0eb670ea7173a6c6ff052fe1bb51f45559fe282dfb1bd14061b277ca64b753e5ba65da1ee191a2568539f95fff1442576a88504a555975395a235fe5b6e7da62a150f2cd3e9e77"}]}, 0x348}, 0x1, 0x0, 0x0, 0x800}, 0x24040080) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f905, 0x7, '\x00', @p_u8=0x0}}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000000080)={0x3, 0x40, 0x4}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0x7, @loopback, 0x8}, 0x1c) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000600)=0x5) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0x20, &(0x7f0000000000)={@in={{0x2, 0x4e21, @private=0xa010100}}, 0x0, 0x0, 0x36, 0x0, "a30b3b28af4d2f246a016542daa845f387713f4048ff2ece1e75f1fc0100f41e4de6256109383664417165bba0dd5ace522fa788000000000033035551502f07b4001a00"}, 0xd8) ioctl$KVM_CAP_DIRTY_LOG_RING(r1, 0x4068aea3, &(0x7f0000000080)={0xc0, 0x0, 0x2000}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs2/custom1\x00', 0x2, 0x0) ioctl$BINDER_GET_FROZEN_INFO(r5, 0xc00c620f, &(0x7f00000005c0)) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f000001b240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a0904000000000000000002000000300004802c0001800900010068617368000000001c0002800800024000000009080004400000000408000740000000000900010073797a30000000000900020073797a32"], 0xef4c}}, 0x0) landlock_create_ruleset(&(0x7f0000000640)={0x606a, 0x2, 0x3, 0x20000, 0x1, 0x3}, 0x30, 0x2) r8 = syz_open_dev$sg(&(0x7f0000000200), 0x0, 0xa102) ioctl$SCSI_IOCTL_GET_PCI(r8, 0x5393, &(0x7f0000000000)) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]}) ioctl$KVM_SET_LAPIC(r6, 0x4400ae8f, &(0x7f0000000100)={"b46474f815e8d5535f0887c44335cc824dc6121bc72a77f532ff5dad4d643a9cab29d2310e04be14eb26c0af4985fe45e3b3b0680b3ec92725d74b9716e0f7c3119a2c9a0ae65ff4772e2e12733cb013c4308fe40863480747c0a7ddb9361b1578015ca1bb2c1677ebae096f08345476f567443842946ed946434c75916d1db83fe305920de65bfaf9bd940672216846cb16b8ae67cd3affc61375381f91b3b9f1cc5e38cafe5239aee71dcd481fbe1ecd2547ffbaad4469a74697c28fb9beefa6a5d736712a55eb9110c2cf7964062ba8cbc1c038e84f0f5db7fc7053118bf5221e3efa6fc3edb5d0ca3cde7054dd0751a332520aa8478b1775d552c5cc24d3c2df9eb333e5ca3aa06c1c2cf8526714f5caff2f55b41976fc20b64f1fc61d5b44f50953582a1825d32130a31abfeafd1987317879e29ac51b93c9659e023fff3ddb5e39dd19cc3ef1d883c78b9e073d08a9197fb3717df238b9831831214b186693be9dd2568bb77272e80df5dfed03e8c467627bedfbd93359a9f79a3aa37e873dc1357b37b43d813ea85267b0dc8b1c4cc51bd985328833beb2679b7fb762555bbea2da936b36f8f1673fd5f606b2b6eb23b72bf947206e8dbfeb40ca6f265a3485c8446e0f0da652860b88328073d2282c14b48a7774e62754a968b60e92205e8fafcdd70a55c3c4d1a4821ff44e6e3681f15ae091262e3a3290a24d8ceae30ebbf9d24287bb8a5d73c608d47d287f9e716cf02b4796a83fb0c05e45b89de9ef8bce834e6d7a0be6e30d2c66cb6e640cb01898454ad361bc0701d8fe56113335ae6adec59300db04691cc4a689034272a8e086a32ce7061b4f79fa8afbb48a6ce4b62bdc44af013d78980457e1fa61eb9204818606f4c3b03c0f33cd2a841ac9bc2b73151a96e31ab99e6ec969b5f2c3edd5f9abc69845e487af992758ba445368da93dae1d44360d52a534a88276b8aaf349841d8a4788c60408618437c442308dbf70efeda2e54e9b9e4fe5f76997c9dcb945a26bd75748c85d19ca8b99264dce50580e8d4dbda401dad7df31e9a7a6a3a83bfbdfb5394abd581ac0824fbcd75d2f5205c0b7c9188e6f26bfd97734d9a20433f6cdba9d14a5f32a4d97a57f4603b21146fd1aebf082e863d463c224ad623c17d8043d3bf083f0322408dd6ead6915ac6a4222ab51480eb6e11a8913348219515170d9df90d72d7363bbda3e327d19f98c0a856f98076380e788e602e8a2ae0a1930786874dc21a2e99abda15f35457cf1dcb440c4b41350d0eda352aad7f57a0adc8a6914da06460635ed21c4c11cd1a8ec778064c9f62efba2927828b23f94b16619a5520731c2c40ab8583c9f2e73233d74b84f4877ce6b35bb1180300"}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 43.640491355s ago: executing program 3 (id=2551): r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r1 = syz_open_dev$vim2m(&(0x7f00000002c0), 0xfffffffffffffff7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000000c0)={0x1, @win={{0xfffffffd, 0x7fff, 0x1, 0x4}, 0x0, 0x6, &(0x7f00000006c0)={{0x8, 0x2, 0x7fffffff, 0x1ff}, &(0x7f0000000640)={{0x1, 0x7fffffff, 0x1, 0xc}}}, 0x3, &(0x7f0000000700)="71f93113fb9ea19fdac38871e7910a09ad56ff250e95637d41c671ac9c4be2d84ab3302a86e01c35798dd33f0f0c175ca5e15ff28ae0e598085e185a51cc877165b629e830cccf3fcd3db0fb34ac4620dffe638a7dc671e771c789aa37c8c752e66ce080a7715a65d529b9c1f1276e6e65ca21b288102ec36469ead8b591d2750cd32eecd508e8e59348fb07a91e981b2fd28ca6efb9dc8e20579bcbb08eab3b4666e2f3464dab34ea45b9ebe3eed37c6c96596d5ecd1e3be09d5a5a980ab2a4d764cc25395b03b9ed79b1aa7025a491481ebcf0fa01b3952a646eafb2162cf5a6126164", 0x8}}) ioctl$int_in(r0, 0x5421, &(0x7f0000000180)=0x80000000) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000680)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x130) write(r2, &(0x7f00000003c0)='\\x01000000 2', 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="6c0000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="700000000001010400000000004f000002000004240001801400018008000100e000000108000200ac1414000c0002800500010000200000240002801400038008000100e000ff466a000054f5e8f59e88f4e16447ff08000200e00000010c000280050001000000000008000740000000000c00068008000200e0000001"], 0x70}}, 0x0) setresgid(0xffffffffffffffff, 0xee01, 0x0) setfsgid(0xee01) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f00000e1000/0x800000)=nil, 0x800000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x40000000) r6 = syz_pidfd_open(r5, 0x0) wait4(r5, 0x0, 0x2, 0x0) ioctl$FS_IOC_GETVERSION(r6, 0xc040ff0b, &(0x7f0000000180)) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$ocfs2_control(0xffffff9c, &(0x7f0000000100), 0x100, 0x0) sendmmsg$alg(r8, &(0x7f00000029c0)=[{0x0, 0x0, &(0x7f0000001200)=[{&(0x7f0000000140)="ab9c4775ab22f72bebf3713ae2b09cc275d0a277a710b525b46198f429d751191a74371d3f8861cb7b87a1f2ac28886cb84e099aaafd4e1d0b3cd9944eb83a8cbcd962dd670c1f5082fbd460e842831dbf7b23174acd3051b9153ca008062cbe26888430df7785fdb89ac65ebcf1c5dab9669e55cfba124d749bfc163ba084bddc8f2fd6adc1ba43189e1a6221400e5f4c325a5ec3f2381524614b794562f4041a5698a716863f8179ca88ff37a28f73c60d28e33fef9188bc96f6c5c523ee6f36d1885a2b1bc25f89edecd45e9987bd6bb71a0b1ada7908974c10a2e0c2b113d89a0c75d04c0d07005dcb3c451a4e27816cd696a2e6a4ddbc8d7f729e33499e0d6eb49a11e7d6c69ea2fae10a5ea569308990a5a6ed5413905764ad69950f130c10f4a2a40f99a5e3486f2d15f62427af0a6635eb94a05c7b66b217329064d0f0ae63b02391505f7a3b7309eda5b35e8856b63351854ba6c1797ffa9cbd68b668227805b4eb43583693bea53e1c169302633ccb611bc64432674b93156f1d03ed1d8fb1877a488b1a508329d707a021359d37c49a954878dd3afd85a2b178d3013071a7bc648a450b741c18a20c1462d72d99307847c86ac3a0a805d72b74c570c2cecf0a44ae26ffd24c5d057c08f2ac70d12298325a675e323ae25e652529d454999ce84c690b2fcfc60b08fa87160bd687ef63133903c6e98191433dfa80651b4b056167919cd7f0864e8b13bda5e3e4d1f795847dc70d8092890ea11b906cd904bcf081e98a8b59c620b3650b7b70559f58644802baadf2f9d5886fbee964e909a68ea889256ae7554b2f99560eb0a201c016064ffdf354c99fa6a16e5ffad0cb625548b1369a32b462ab3880de860b9a20156910f7b9ce88e87c903631073a807c54c3e641ccd35af8bc9ddcd651f6b83aaed59753c8f4e5d2e211935dfa977a9ed0b9e6ca74b19ae5c825cf384f2547bc74edb6435b4815251ececa3aea5b5d79a7fe4580048aff65f69c062d2c0e189d891c9122c1fce888fd893ae581dc467ee45276730579945c236dc5725b2fb35d8e21618e6d7b480b6efcfea26da37d9e75a395b3cd4ee8b834d3b0c18d8efe8af5f2f04d32ceb64c717983f3776b3ffd1257e406b5f955f122955f874786e51e96698980d79bfba7e36479e4167dcb6fa4714f0317792f3ef0d6973f563a80ab8d338645b3ea59f47f7838637c653d13a8edcced9fee36d4fd4c0a9fe88b76724faa5c428efee01df7bb4c8cee7bae3e2fae0ff44029fc9edea0b8e53b6e706b10f52062a77eea8c89206ecc84b5a6dbcbff35118e3cfdd278966f1cb3b1cacc231c60a744f4ac37a330dc385bc82afba8b845ecd719ed54413562cd9e2627bf946d4377e8501d14d514a0f34abbbfa017d2a8ac734525bf909daa6f82b9a0e1142ccb53ae02ff360d9c40c6a3cdd66fc119676d028993ea17825ed5cf06d3f6e63d0d59547654bfe4a89921845c5d08cea318f01f7e2bbbc97a6c3063488ed72f6cbf4239f0dbb35748be34dbe023cd6bff74b94f9da703a16b7b84ba9d6c2e83de7516ec990b737bea57fc5aa140e1121ecf5d363939e4083c1e1b474e5cd29725b4d96e3178447619dc7778ec4766f33934e79b541f93830337bde18dd312863269bde739fe840d9c8a1cce4515fe149a1b8b49fdca1a25df2f1f6f8576bce11afc296658dba474e6f56aec7f132014d5", 0x4c6}], 0x1, 0x0, 0x0, 0x20000800}], 0x1, 0x40800) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r9) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r9, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r10, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r11, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) r12 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r12, 0x40086602, &(0x7f0000000140)={'veth0_to_batadv\x00', 0x0}) r13 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(r7, &(0x7f0000000a40)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010026bd7000000000001700000008000300000000000e0001006e657464597673696d0000000f0002006e657464657673696d300000"], 0x3c}, 0x1, 0x0, 0x0, 0x4040885}, 0x40080) 39.46854479s ago: executing program 3 (id=2562): openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0) r0 = socket$kcm(0xa, 0x5, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000062d14406d0470084761000000010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000100)=0x8001, 0x4) sendmmsg$inet6(r2, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xb, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x20}}, 0x1}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000180)='2s', 0x2}], 0x1}}], 0x1, 0x8000) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x49, [0x3, 0xc95a, 0xfffffff3, 0x8, 0x80, 0x2, 0x1, 0x7f, 0xa, 0x4d, 0xfffffbf2, 0x5f, 0x0, 0x0, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x7, 0x7, 0x8, 0x3c5b, 0x1, 0x24, 0xffffffff, 0xfffffffe, 0x1f461e2c, 0x3, 0x51e, 0x4, 0x1000007, 0x3, 0x8001, 0x4c74, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x0, 0x7, 0x7, 0x103, 0x0, 0x5, 0x3d, 0x8f, 0x6, 0x1, 0x4, 0x5, 0x4, 0x5, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x10002, 0x12b, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0x3, 0xf9, 0xd, 0x2bf, 0x3, 0x1ff, 0x2, 0x3, 0x0, 0x7, 0x10000005, 0x2f, 0xe, 0x313, 0x4, 0xea4, 0xa, 0x5, 0x4, 0x80, 0x5, 0x400, 0x1, 0x7, 0x400001, 0xfc, 0x1005, 0x7ff, 0x5f31, 0x4, 0x29, 0x6, 0x1000007, 0x9, 0x4, 0x2, 0x8, 0x9, 0x7, 0x5, 0xfffffffd, 0x3, 0x8080, 0xffff, 0x2, 0x7f, 0x9, 0x8, 0x3, 0x4, 0x1, 0x7, 0x6, 0xb, 0x48c93690, 0x2, 0xff], [0x4, 0x1, 0x6, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d5, 0x9, 0x5, 0xde5e, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x8, 0x8, 0x86, 0xb, 0x1000000b, 0x3e7, 0x100005, 0x5, 0x4, 0x40002, 0x1, 0x8, 0x84, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2, 0x0, 0xa2, 0x6, 0x53cf697b, 0x5, 0x4, 0x54fe12da, 0xbf, 0x5, 0x3, 0x400000, 0xfffffff9, 0x8, 0x1, 0x5, 0x0, 0x6, 0xfffffffb, 0x6, 0x3, 0x101, 0x9, 0x4, 0x2], [0x9, 0xbb31, 0x3, 0xfffffffc, 0x20001005, 0x938, 0x6, 0xd36b, 0x51bf, 0x5, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x104, 0x80000000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x1, 0x1, 0xfffff801, 0x8000014c, 0x60a7, 0x6, 0x2, 0xffffffff, 0x80000006, 0x5, 0x8, 0xff, 0x3, 0x2, 0xffff, 0x3, 0x8, 0x100, 0x9602, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c0a, 0x0, 0x2, 0x1005, 0xb1c, 0x5, 0x1ff, 0xfff, 0xfff]}, 0x45c) r3 = syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) write$char_usb(r3, &(0x7f0000000040)="e2", 0x918) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) ioctl$EVIOCGMASK(r4, 0x80104592, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000480)={0x44, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6bdc, 0x2, 0x1, 0x103aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d, 0x0, r7}}], 0x1, 0x0, 0x0) ioctl$SYNC_IOC_FILE_INFO(r7, 0xc0383e04, &(0x7f0000000280)={""/32, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}]}) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890c, &(0x7f0000000000)) 35.291534611s ago: executing program 3 (id=2569): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x48, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x30, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT={0x4}]}, 0x48}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 34.105811838s ago: executing program 3 (id=2572): syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="d800000018007b7be00212ba0d0505040a003f00000f040b067c55a1bc0009001e0006990300000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b3162700e06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5005ccca262f3d40fad95667e04adcdf63cc1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e97031e9f05e9f16e0700000004000000", 0xd8}], 0x1, 0x0, 0x0, 0x2663}, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) mmap$binder(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x6) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 33.505901487s ago: executing program 1 (id=2574): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000540), r0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, 0x0, 0x880) 33.323434455s ago: executing program 3 (id=2576): mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='-2 -3\n', 0x6) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)='tcp 2049', 0x8) close(r1) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$RTC_WKALM_SET(r2, 0x40187013, &(0x7f0000000040)={0x1, 0x0, {0x0, 0xfffffffb, 0x0, 0x0, 0x5}}) r3 = openat(0xffffffffffffffff, &(0x7f0000000800)='./nfsd_dir/threads\x00', 0x48a182, 0x100) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000004a40)={0x0, 0x0, &(0x7f00000007c0), 0x0, 0x0, 0x0}) ioctl$INCFS_IOC_PERMIT_FILL(r0, 0x40046721, &(0x7f0000000040)={r3}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x200, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, 0x0, 0x0) write(r3, &(0x7f0000000900)='2\n', 0x2) close(r3) mkdir(&(0x7f0000000e00)='./proc_dir\x00', 0x1ff) mount(&(0x7f0000000f00)=@filename='none\x00', &(0x7f0000001000)='./proc_dir\x00', &(0x7f0000001100)='proc\x00', 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000200)='numa_maps\x00') close(r6) mkdir(&(0x7f0000001400)='./export_dir\x00', 0x1ff) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002cc0), 0x7}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc_dir/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r8) sendmsg$NLBL_CIPSOV4_C_ADD(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001dc0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000002c000c8014000b8008000a00ffc3000008000a005c12000014000b8008000900f5d50c5b0800090048e5964704000880"], 0x58}, 0x1, 0x0, 0x0, 0x20000010}, 0x10) write(r6, &(0x7f0000000b00)='* ./export_dir 2000000000 8194 0 0 1\n', 0x25) 32.897364893s ago: executing program 1 (id=2577): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r4 = fcntl$dupfd(r3, 0x0, r3) write$tun(r4, &(0x7f0000000680)={@void, @void, @mpls={[], @ipv6=@tipc_packet={0x3, 0x6, 'Z\vB', 0x3a, 0x6, 0x0, @loopback, @private1={0xfc, 0x1, '\x00', 0x1}, {[@dstopts={0x67, 0x2, '\x00', [@hao={0xc9, 0x10, @empty}]}], @payload_conn={{{0x1a, 0x0, 0x1, 0x1, 0x1, 0x6, 0x0, 0x2, 0x80, 0x0, 0x1, 0x7, 0x5, 0x0, 0xd5, 0xfffb, 0x2, 0x4e20, 0x4e24}}, [0x0, 0x0]}}}}}, 0x62) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$9p(r4, &(0x7f0000000000)="e780f13723bd882a752cc8f89b9f4b0124dc3492d6314f606cbb716166b7bbe2d105560cc5a8b6aa2c70945de5635b", 0x2f) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000086a82, 0x0) fadvise64(r5, 0x3, 0x1, 0x4) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="0a280010ffffffffffffffffffffffff86dd69000000012811"], 0x62) 31.300282786s ago: executing program 1 (id=2580): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0xa0, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x30, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT={0x5c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @local}}, {0x14, 0x4, @mcast2}}}]}, @CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 30.535108511s ago: executing program 1 (id=2581): r0 = socket(0x2c, 0xa, 0x5) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syz_tun\x00', 0x0}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r1) sendmsg$IPVS_CMD_DEL_DAEMON(r1, 0x0, 0x0) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f00000000c0)={0x1, 0x0, 0x6, r2, 0x1}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="20000000110001000000000000000000100000e60b"], 0x20}], 0x1}, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = eventfd(0x1000) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000180)={r6, 0x5, 0x2}) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000040)={[0x9, 0x4, 0xe9b, 0x22, 0x20000008, 0x7, 0x911d, 0x7, 0x8, 0xafa, 0x5, 0x1006, 0xc, 0x8, 0x8000, 0xffffffffffffffff], 0x1000, 0xc2302}) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x20005, 0xfffffff8, 0x0, 0xff, 0xff}) ioctl$KVM_RUN(r7, 0xae80, 0x0) socket$key(0xf, 0x3, 0x2) openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0x410500, 0x0) 25.452613135s ago: executing program 1 (id=2591): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b3, 0x0, 0x1, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000580)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x45}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r8) syz_ublk_setup_queues(r7, r5, &(0x7f0000000500)={0x0, 0x1fffd, 0x0, 0x3, 0x2000000}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x3, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf7ff, 0x8, 0xfffffffe, 0x33e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7c10, 0x10, 0x2, 0xe3, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x29a7, 0x8000, 0x1, 0x392}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x700, {}, 0x1f, r4, '\x00', {0x2, 0x0, 0x0, 0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x2f, {0x9, 0x0, 0x200001, 0xffff, 0x4, 0x400}}) 23.754172113s ago: executing program 1 (id=2594): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) (async) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @broadcast}, 0x2}}, 0x2e) (async) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200), 0x88042, 0x0) (rerun: 64) write$P9_RSTATu(r5, &(0x7f0000000bc0)={0x2ca, 0x7d, 0x0, {{0x500, 0xfa, 0x0, 0x6a, {0x40}, 0x10000000, 0x2000000, 0x0, 0x0, 0x1f, '\x04nodev{cvfox%\xff\xff\xff\x81\x02\x00'/31, 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x12, '\xfb\xe1a\xe9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf3\x13\xf6\x00', 0x5e, '\xf8\xf6~\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x9d,;\x9e\x1dR\xc3\xd6\xda\x9b\xf1\x99V\x88\xda\xcel\xde{\xa4\xa4\x00\xb4\xb0\xb4\xdb\xe6Od\xb1\xd6?&ym\xcb\xecI\x86#\xd6\xa88\xc6\x9ai\xdf\xcc\x9c\xddY\x06\xf1t\xa6f\xa8R\x9aEw4\a\xdb\xda\xb2\x88[\xaf\x05\x00\x00\x00\x00\x00'}, 0x1bb, 'odev-n\xb1{#\x00\xf9\xda\xa1\xee#&n\xcf\x85\xfe\xa6^\xb2\xd9y\xa3\b\x00\x00\x00\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xcb\x00\xe6s\xf3\xeap\xca\xae\x89H\x06\x87\xbd\x7f=\x7f)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcf\xa9V\xb9y\xdb\xf7\xeb\x1cs.\xa5\xb0\xd7#\x85\x01\x00\x00\x00\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x80z\x89\xca\x18M\xd8\x00\x00\x00\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f)\x9f\x06\x1fu\xb7y|\xe1\xe4\x11\xea\x91\x8e\xbd\x88\x8c\x1e\x15k\x84V\x93\x1d.\xa7&\xba\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9G\x8f}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00\x00\x00\x00\x00\x00\x00ta\xb0\xcc\xaa\xa1\x93:\x0e\x8a\x82k\x14\xd4\xfc\xb2\x98\x9f\xfa\xaa\x1a\xcf\xfa\x80T\xe9U\x9d\xfa\xe4iz\xa0\v\x03\xb3\xd8\x0eU$\xf8I_\xee~\x8d\x88\xcbZ\x04\x03\x02\xac\xb0\xd1&\x0f%\x84\xdbH\xe8\xd9\x06N\x8c\xe1x\xce9N\x85\xb9~H\x86D@I\x81\x0f%\xf1\xce\xca\x97]\xebI\x1a\x12[\xf0\xd7/\x87\xcc\x10\xb0\x15N\b\x93m\xaa\xdd\x8b\x1e\x97\x00'/443}}, 0x2ca) r6 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a70000000000090507", @ANYRES32], 0x0) syz_usb_control_io(r6, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000380)=ANY=[@ANYBLOB="e163fb0cae087e23f6067979de998ca0768d58b6e30eca751d188b3696ba805718c429704a4202eaebf30e3760189c95e8e9099dbf355f58d12907a307ee747f00010533ffc2b3d99f6d0f10cd10a3f809c48ee01bc14e2f1f450cce26df4579f115a052d375b22e1f852fe934a444b32b35074c37d63b4249eea224841e8b6f17558911372eb633c2e02d2feb1ced9c92c04eb27af1281d2c7fc55840bc83b8dfde544c50f853a25176ec71ff371972e6b363f8bea66eb7a46d53076406b7affdd8dbca5e455d15b217299feca60714273f27944d66a1f6a0151ea10af16eb162d9787a4924d7cfda466764f8eff007f668628ea70e0648e301ae0aa8bf9f1b2dc2ee7ee1641a305c62682e083b839201e936c091a7562c679713aac7a91c6a89e99dbf8de0ef925695ccf149908bc706607224941e0e0000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ncm(r6, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r6, 0x0, &(0x7f0000000080)={0x44, &(0x7f0000000140)={0x20, 0xa02da726a9b588e2, 0x1, "4e55d49f8c"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002cbd70100400000005000000080009000200000008000c00a80a0000060001000500000008000b0002000000140008"], 0x48}}, 0x20000034) (async, rerun: 32) syz_genetlink_get_family_id$tipc2(&(0x7f0000000b80), r0) (async, rerun: 32) r7 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r7) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r8, 0x701, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) (async) sendmsg$TIPC_NL_MON_GET(r7, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x68, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffff50}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x40}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100}]}, @TIPC_NLA_SOCK={0x20, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x800}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x399}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3eed}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x4}]}]}, 0x6b}, 0x1, 0x0, 0x0, 0x46004}, 0x1) mount(&(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./mnt\x00', &(0x7f0000000180)='cifs\x00', 0x0, 0x0) (async) r9 = socket$phonet_pipe(0x23, 0x5, 0x2) writev(r9, &(0x7f0000001cc0)=[{&(0x7f0000001bc0)="3b331750ef", 0x5}], 0x1) (async, rerun: 32) r10 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/mtdblock0\x00', 0x8800, 0x0) (async, rerun: 32) r11 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r11, r10, 0x0, 0x20000) 18.07572378s ago: executing program 32 (id=2576): mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd_dir/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='-2 -3\n', 0x6) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd_dir/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)='tcp 2049', 0x8) close(r1) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$RTC_WKALM_SET(r2, 0x40187013, &(0x7f0000000040)={0x1, 0x0, {0x0, 0xfffffffb, 0x0, 0x0, 0x5}}) r3 = openat(0xffffffffffffffff, &(0x7f0000000800)='./nfsd_dir/threads\x00', 0x48a182, 0x100) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000004a40)={0x0, 0x0, &(0x7f00000007c0), 0x0, 0x0, 0x0}) ioctl$INCFS_IOC_PERMIT_FILL(r0, 0x40046721, &(0x7f0000000040)={r3}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x200, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, 0x0, 0x0) write(r3, &(0x7f0000000900)='2\n', 0x2) close(r3) mkdir(&(0x7f0000000e00)='./proc_dir\x00', 0x1ff) mount(&(0x7f0000000f00)=@filename='none\x00', &(0x7f0000001000)='./proc_dir\x00', &(0x7f0000001100)='proc\x00', 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000200)='numa_maps\x00') close(r6) mkdir(&(0x7f0000001400)='./export_dir\x00', 0x1ff) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002cc0), 0x7}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./proc_dir/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r8) sendmsg$NLBL_CIPSOV4_C_ADD(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001dc0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000002c000c8014000b8008000a00ffc3000008000a005c12000014000b8008000900f5d50c5b0800090048e5964704000880"], 0x58}, 0x1, 0x0, 0x0, 0x20000010}, 0x10) write(r6, &(0x7f0000000b00)='* ./export_dir 2000000000 8194 0 0 1\n', 0x25) 18.011531634s ago: executing program 2 (id=2603): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b3, 0x0, 0x1, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000580)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x45}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r8) syz_ublk_setup_queues(r7, r5, &(0x7f0000000500)={0x0, 0x1fffd, 0x0, 0x3, 0x2000000}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x3, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf7ff, 0x8, 0xfffffffe, 0x33e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7c10, 0x10, 0x2, 0xe3, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x29a7, 0x8000, 0x1, 0x392}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x700, {}, 0x1f, r4, '\x00', {0x2, 0x0, 0x0, 0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x2f, {0x9, 0x0, 0x200001, 0xffff, 0x4, 0x400}}) 16.250133834s ago: executing program 2 (id=2604): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmmsg(r0, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002780)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f0000000340)=""/240, 0xf0}, {&(0x7f0000000440)=""/96, 0x60}, {0x0}, {&(0x7f00000016c0)=""/4087, 0xff7}], 0x5}, 0x1}], 0x1, 0x20, 0x0) 14.068247403s ago: executing program 2 (id=2606): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) setfsuid(0xee00) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}], 0x10) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2e}}], 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/bonding_masters\x00', 0x1, 0x0) write(r3, &(0x7f00000005c0)='+m', 0x2) rseq(&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2}, 0xffffffffffffff17, 0x0, 0x0) syz_clone(0x4400, 0x0, 0x0, 0x0, 0x0, 0x0) write$cgroup_subtree(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="2b5e65745f70721e8e5e712a94000000"], 0x1a) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x111, 0x1}}, 0x20) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c00000037000701f3fffffffedbd72501"], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0x20000085) 10.980132209s ago: executing program 0 (id=2609): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x8) ioctl$KVM_CHECK_EXTENSION_VM(r0, 0xae03, 0x2) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x3c041, 0x0) ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f0000000040)={0x1, 0x1, {0x33, 0x26, 0x8, 0x7, 0x8, 0x6, 0x1, 0x131, 0xffffffffffffffff}}) pread64(r1, &(0x7f0000000080)=""/244, 0xf4, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000180)={0x8dc60a7ce5d99b03, @sdr={0x34325258, 0xfffff818}}) ioctl$KVM_CAP_HYPERV_SEND_IPI(r0, 0x4068aea3, &(0x7f0000000280)) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$NILFS_IOCTL_GET_BDESCS(r2, 0xc0186e87, &(0x7f0000000480)={&(0x7f0000000300)=[{0x4, 0x2, 0x3a, 0x8, 0x9}, {0xd8e, 0xf3d3, 0x7fffffffffffffff, 0x8, 0x200}, {0x315, 0x8000, 0x1ff, 0x124, 0xa}, {0x53e2, 0xf, 0x0, 0x37cd, 0x9}, {0x0, 0x4, 0x5, 0xb, 0x8c5c}, {0x5, 0xffff, 0x7, 0x1, 0x4}, {0x4, 0x7c770fe4, 0x6, 0x8, 0x4}, {0x75, 0xebf, 0x1, 0x9, 0x6}, {0x73, 0x1, 0x3ff, 0x10000, 0x9}], 0x9, 0x28, 0x7, 0x1}) ioctl$KVM_CAP_PTP_KVM(r0, 0x4068aea3, &(0x7f00000004c0)) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) ioctl$VIDIOC_STREAMON(r3, 0x40045612, &(0x7f0000000580)=0x8) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000005c0)={{0x1, 0x1, 0x18, r0, {0x3}}, './file0\x00'}) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000600), &(0x7f0000000640)=0x4) r5 = signalfd4(r0, &(0x7f0000000680), 0x8, 0x180800) ioctl$TIOCSSOFTCAR(r5, 0x541a, &(0x7f00000006c0)=0xdd) splice(r2, &(0x7f0000000700)=0xdc7a, r1, &(0x7f0000000740)=0x6, 0xfff, 0x4) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r4, 0xc018937c, &(0x7f0000000780)={{0x1, 0x1, 0x18, r4}, './file0\x00'}) getsockopt$inet_mtu(r6, 0x0, 0xa, &(0x7f00000007c0), &(0x7f0000000800)=0x4) ioctl$SNDCTL_DSP_GETOPTR(r5, 0x800c5012, &(0x7f0000000840)) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000880)) ioctl$VIDIOC_ENUMSTD(r5, 0xc0485619, &(0x7f00000008c0)={0x7fffffff, 0xe2, "5024f6241ada370ab04720dc49f1eef68b0af9d353b50f4e", {0x1, 0x200}, 0x3004}) setsockopt$ARPT_SO_SET_REPLACE(r5, 0x0, 0x60, &(0x7f0000000980)={'filter\x00', 0x7, 0x4, 0x3f0, 0x0, 0x110, 0x0, 0x308, 0x308, 0x308, 0x4, &(0x7f0000000940), {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @mac=@remote, @multicast2, @loopback, 0x8, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@arp={@remote, @broadcast, 0xffffff00, 0x0, 0x9, 0x3, {@mac=@broadcast, {[0x0, 0x0, 0x0, 0xff, 0x0, 0xff]}}, {@mac, {[0xff, 0x0, 0xff, 0xff, 0x0, 0xff]}}, 0x9, 0x9, 0x401, 0x5, 0xffff, 0x8, 'macvtap0\x00', 'bridge_slave_1\x00', {0xff}, {}, 0x0, 0x200}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="ce6ada9e2229", @empty, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x8, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$FITRIM(r7, 0xc0185879, &(0x7f0000000dc0)={0x9, 0x0, 0x2}) ioctl$VIDIOC_G_FREQUENCY(r3, 0xc02c5638, &(0x7f0000000e00)={0x9, 0x4, 0x3}) r8 = syz_open_dev$video(&(0x7f0000000e40), 0x1, 0x20000) ioctl$VIDIOC_STREAMOFF(r8, 0x40045613, &(0x7f0000000e80)=0x3) setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f0000000ec0)=0x2, 0x4) 8.741934924s ago: executing program 0 (id=2610): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b3, 0x0, 0x1, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000580)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x45}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) pipe(&(0x7f00000007c0)) socket$inet_tcp(0x2, 0x1, 0x0) syz_ublk_setup_queues(r7, r5, &(0x7f0000000500)={0x0, 0x1fffd, 0x0, 0x3, 0x2000000}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x3, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf7ff, 0x8, 0xfffffffe, 0x33e}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7c10, 0x10, 0x2, 0xe3, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x29a7, 0x8000, 0x1, 0x392}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x700, {}, 0x1f, r4, '\x00', {0x2, 0x0, 0x0, 0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x2f, {0x9, 0x0, 0x200001, 0xffff, 0x4, 0x400}}) 6.13106745s ago: executing program 0 (id=2611): setns(0xc9, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000080)={0x84, @private=0xa010101, 0x15, 0x3, 'sh\x00', 0x0, 0x5, 0x3f}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e20, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@loopback, 0x4e20, 0x10000, 0x2, 0x2}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e25, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffc}, 0x80, 0x0}, 0x0) 5.459578933s ago: executing program 2 (id=2612): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x4000000000000102, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000300)={0x2, @pix_mp={0x0, 0xfffffffc, 0x0, 0x0, 0x0, [{}, {}, {}, {0x7}, {}, {}, {0x3}], 0x0, 0x0, 0x0, 0x0, 0x4}}) 4.918577529s ago: executing program 0 (id=2613): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000fc0), r0) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000000000)=0x0) sendmsg$NFC_CMD_SE_IO(r1, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)={0x2c, r2, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NFC_ATTR_SE_APDU={0x5, 0x19, 'j'}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r4}, @NFC_ATTR_SE_INDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x44040}, 0x2400cc84) 4.475097751s ago: executing program 2 (id=2614): mlockall(0x7) r0 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x8000000, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000001, 0x13, r0, 0x0) 3.760925363s ago: executing program 0 (id=2615): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@updsa={0x13c, 0x16, 0x1, 0x70bd28, 0x0, {{@in6=@mcast2, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {@in6=@mcast1, 0x0, 0x32}, @in=@broadcast, {0x0, 0x0, 0x281, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x100}, {0x0, 0x0, 0xfffffffe}, 0x0, 0x0, 0x2, 0x0, 0x10}, [@algo_auth_trunc={0x4c, 0x14, {{'sha384-avx\x00'}, 0x0, 0xc0}}]}, 0x13c}}, 0x0) 1.518726191s ago: executing program 2 (id=2616): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./tracing/instances/inst1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) 0s ago: executing program 0 (id=2617): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) write$9p(r0, &(0x7f0000000340)="208ba20eaa", 0x5) kernel console output (not intermixed with test programs): turned -16 [ 490.359634][T11938] EXT4-fs (nullb0): VFS: Can't find ext4 filesystem [ 490.600882][T11942] FAULT_INJECTION: forcing a failure. [ 490.600882][T11942] name failslab, interval 1, probability 0, space 0, times 0 [ 490.619228][T11942] CPU: 1 UID: 0 PID: 11942 Comm: syz.3.2060 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 490.619267][T11942] Tainted: [L]=SOFTLOCKUP [ 490.619277][T11942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 490.619292][T11942] Call Trace: [ 490.619302][T11942] [ 490.619313][T11942] dump_stack_lvl+0xe8/0x150 [ 490.619358][T11942] should_fail_ex+0x410/0x560 [ 490.619399][T11942] should_failslab+0xa8/0x100 [ 490.619423][T11942] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 490.619455][T11942] kmem_cache_alloc_noprof+0xa1/0x600 [ 490.619496][T11942] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 490.619526][T11942] ? kmem_cache_alloc_noprof+0x156/0x600 [ 490.619556][T11942] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 490.619598][T11942] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 490.619642][T11942] mmu_topup_memory_caches+0x21/0x170 [ 490.619681][T11942] kvm_mmu_load+0x9d/0x21e0 [ 490.619718][T11942] ? kvm_msr_allowed+0x9a/0x490 [ 490.619751][T11942] ? kvm_msr_allowed+0x9a/0x490 [ 490.619784][T11942] ? kvm_msr_allowed+0x9a/0x490 [ 490.619816][T11942] ? kvm_msr_allowed+0x3f4/0x490 [ 490.619849][T11942] ? kvm_msr_allowed+0x9a/0x490 [ 490.619882][T11942] ? kvm_apic_has_interrupt+0x740/0x770 [ 490.619922][T11942] vcpu_run+0x4f68/0x79b0 [ 490.619973][T11942] ? trace_pelt_se_tp+0x3b/0x150 [ 490.620008][T11942] ? update_se+0x90/0x1020 [ 490.620075][T11942] ? __pfx_vcpu_run+0x10/0x10 [ 490.620106][T11942] ? lock_acquire+0x115/0x350 [ 490.620156][T11942] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 490.620193][T11942] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 490.620228][T11942] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 490.620269][T11942] kvm_vcpu_ioctl+0xa61/0xfd0 [ 490.620310][T11942] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 490.620367][T11942] ? hook_file_ioctl+0x1f2/0x600 [ 490.620443][T11942] ? __fget_files+0x2a/0x420 [ 490.620475][T11942] ? __fget_files+0x2a/0x420 [ 490.620500][T11942] ? __fget_files+0x3a2/0x420 [ 490.620526][T11942] ? __fget_files+0x2a/0x420 [ 490.620557][T11942] ? bpf_lsm_file_ioctl+0x9/0x20 [ 490.620585][T11942] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 490.620621][T11942] __se_sys_ioctl+0xfc/0x170 [ 490.620658][T11942] do_syscall_64+0x166/0x520 [ 490.620681][T11942] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.620706][T11942] ? clear_bhb_loop+0x70/0xc0 [ 490.620735][T11942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.620759][T11942] RIP: 0033:0x7f5d2f39e0d9 [ 490.620781][T11942] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 490.620816][T11942] RSP: 002b:00007f5d3032f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 490.620849][T11942] RAX: ffffffffffffffda RBX: 00007f5d2f625fa0 RCX: 00007f5d2f39e0d9 [ 490.620867][T11942] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 490.620882][T11942] RBP: 00007f5d3032f090 R08: 0000000000000000 R09: 0000000000000000 [ 490.620898][T11942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 490.620913][T11942] R13: 00007f5d2f626038 R14: 00007f5d2f625fa0 R15: 00007fff4bbeaff8 [ 490.620948][T11942] [ 491.180403][ T5700] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 491.328969][ T5700] usb 2-1: Using ep0 maxpacket: 16 [ 491.343092][ T5700] usb 2-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 491.358326][ T5700] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.358380][ T5700] usb 2-1: Product: syz [ 491.358398][ T5700] usb 2-1: Manufacturer: syz [ 491.358427][ T5700] usb 2-1: SerialNumber: syz [ 491.373369][ T5700] usb 2-1: config 0 descriptor?? [ 491.601093][ T5700] ssu100 2-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 491.607048][ T5700] ssu100 2-1:0.0: probe with driver ssu100 failed with error -71 [ 491.625408][ T5700] usb 2-1: USB disconnect, device number 24 [ 493.168597][ T5628] Bluetooth: hci1: command 0x0406 tx timeout [ 493.176145][T11948] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 494.038847][T11948] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 494.060931][T11948] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 494.061077][T11948] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 494.074918][T11948] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 494.498472][ T5350] usb 2-1: new full-speed USB device number 25 using dummy_hcd [ 494.555470][T11987] Process accounting resumed [ 494.603024][T11994] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2079'. [ 494.652798][ T5350] usb 2-1: New USB device found, idVendor=0458, idProduct=501a, bcdDevice= 0.00 [ 494.655959][ T5350] usb 2-1: config 0 interface 0 altsetting 15 endpoint 0x81 has invalid maxpacket 1056, setting to 64 [ 494.656069][ T5350] usb 2-1: config 0 interface 0 altsetting 15 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 494.656152][ T5350] usb 2-1: config 0 interface 0 has no altsetting 0 [ 494.656331][ T5350] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.682511][ T5350] usb 2-1: config 0 descriptor?? [ 494.693325][T11982] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 494.947447][ T5350] kye 0003:0458:501A.0043: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 494.953160][ T5350] hid_parser_main: 417 callbacks suppressed [ 494.953231][ T5350] kye 0003:0458:501A.0043: unknown main item tag 0x2 [ 494.953328][ T5350] kye 0003:0458:501A.0043: unknown main item tag 0x7 [ 494.991931][ T5350] kye 0003:0458:501A.0043: hidraw0: USB HID v0.0c Device [HID 0458:501a] on usb-dummy_hcd.1-1/input0 [ 494.992018][ T5350] kye 0003:0458:501A.0043: tablet-enabling feature report not found [ 494.992055][ T5350] kye 0003:0458:501A.0043: tablet enabling failed [ 495.123686][ T5350] usb 2-1: USB disconnect, device number 25 [ 495.199802][T12011] fido_id[12011]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 495.249357][ T5628] Bluetooth: hci1: command 0x0406 tx timeout [ 495.259587][T12015] IPVS: nq: FWM 3 0x00000003 - no destination available [ 495.335145][T12017] openvswitch: netlink: Actions may not be safe on all matching packets [ 495.409781][T12019] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2088'. [ 495.795696][T12024] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 496.129959][ T5628] Bluetooth: hci0: command 0x0405 tx timeout [ 496.130017][ T5628] Bluetooth: hci3: command 0x0406 tx timeout [ 496.482272][T12040] FAULT_INJECTION: forcing a failure. [ 496.482272][T12040] name failslab, interval 1, probability 0, space 0, times 0 [ 496.482332][T12040] CPU: 0 UID: 0 PID: 12040 Comm: syz.2.2097 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 496.482366][T12040] Tainted: [L]=SOFTLOCKUP [ 496.482376][T12040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 496.482396][T12040] Call Trace: [ 496.482406][T12040] [ 496.482417][T12040] dump_stack_lvl+0xe8/0x150 [ 496.482452][T12040] should_fail_ex+0x410/0x560 [ 496.482495][T12040] should_failslab+0xa8/0x100 [ 496.482520][T12040] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 496.482554][T12040] kmem_cache_alloc_noprof+0xa1/0x600 [ 496.482584][T12040] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 496.482613][T12040] ? kmem_cache_alloc_noprof+0x156/0x600 [ 496.482643][T12040] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 496.482689][T12040] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 496.482733][T12040] mmu_topup_memory_caches+0x21/0x170 [ 496.482771][T12040] kvm_mmu_load+0x9d/0x21e0 [ 496.482808][T12040] ? kvm_msr_allowed+0x9a/0x490 [ 496.482842][T12040] ? kvm_msr_allowed+0x9a/0x490 [ 496.482876][T12040] ? kvm_msr_allowed+0x9a/0x490 [ 496.482908][T12040] ? kvm_msr_allowed+0x3f4/0x490 [ 496.482940][T12040] ? kvm_msr_allowed+0x9a/0x490 [ 496.482973][T12040] ? kvm_apic_has_interrupt+0x740/0x770 [ 496.483012][T12040] vcpu_run+0x4f68/0x79b0 [ 496.483077][T12040] ? update_se+0x90/0x1020 [ 496.483145][T12040] ? __pfx_vcpu_run+0x10/0x10 [ 496.483176][T12040] ? lock_acquire+0x115/0x350 [ 496.483229][T12040] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 496.483266][T12040] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 496.483300][T12040] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 496.483341][T12040] kvm_vcpu_ioctl+0xa61/0xfd0 [ 496.483382][T12040] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 496.483415][T12040] ? hook_file_ioctl+0x1f2/0x600 [ 496.483469][T12040] ? __fget_files+0x2a/0x420 [ 496.483499][T12040] ? __fget_files+0x2a/0x420 [ 496.483525][T12040] ? __fget_files+0x3a2/0x420 [ 496.483550][T12040] ? __fget_files+0x2a/0x420 [ 496.483580][T12040] ? bpf_lsm_file_ioctl+0x9/0x20 [ 496.483608][T12040] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 496.483643][T12040] __se_sys_ioctl+0xfc/0x170 [ 496.483685][T12040] do_syscall_64+0x166/0x520 [ 496.483707][T12040] ? trace_irq_disable+0x3b/0x140 [ 496.483740][T12040] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.483765][T12040] ? clear_bhb_loop+0x70/0xc0 [ 496.483794][T12040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.483817][T12040] RIP: 0033:0x7fe690f9e0d9 [ 496.483839][T12040] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 496.483860][T12040] RSP: 002b:00007fe691dcb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 496.483886][T12040] RAX: ffffffffffffffda RBX: 00007fe691225fa0 RCX: 00007fe690f9e0d9 [ 496.483904][T12040] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 496.483919][T12040] RBP: 00007fe691dcb090 R08: 0000000000000000 R09: 0000000000000000 [ 496.483935][T12040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 496.483950][T12040] R13: 00007fe691226038 R14: 00007fe691225fa0 R15: 00007fffe5c208e8 [ 496.483986][T12040] [ 496.539748][ T5728] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 496.707164][ T5728] usb 2-1: unable to get BOS descriptor or descriptor too short [ 496.707323][ T5728] usb 2-1: New USB device found, idVendor=1199, idProduct=0120, bcdDevice=f9.c9 [ 496.741963][ T5728] usb 2-1: config 9 has an invalid interface number: 16 but max is 0 [ 496.742047][ T5728] usb 2-1: config 9 has no interface number 0 [ 496.742173][ T5728] usb 2-1: config 9 interface 16 altsetting 7 endpoint 0x2 has invalid maxpacket 528, setting to 64 [ 496.742273][ T5728] usb 2-1: config 9 interface 16 has no altsetting 0 [ 496.752159][ T5728] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 496.752242][ T5728] usb 2-1: Product: syz [ 496.752285][ T5728] usb 2-1: Manufacturer: syz [ 496.752328][ T5728] usb 2-1: SerialNumber: syz [ 496.978650][T12043] loop0: detected capacity change from 0 to 1 [ 497.008869][T12037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 497.027192][T12037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 497.047457][ T5728] sierra 2-1:9.16: Sierra USB modem converter detected [ 497.060256][T12043] loop0: [ 497.060336][T12043] loop0: partition table partially beyond EOD, truncated [ 497.078297][ T5728] usb 2-1: Sierra USB modem converter now attached to ttyUSB0 [ 497.099447][ T5728] usb 2-1: Sierra USB modem converter now attached to ttyUSB1 [ 497.137430][ T5728] usb 2-1: USB disconnect, device number 26 [ 497.181058][ T5728] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 497.205890][ T5728] sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1 [ 497.218301][ T5728] sierra 2-1:9.16: device disconnected [ 498.020667][T12055] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 498.021184][T12055] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.208706][ T5626] Bluetooth: hci3: command 0x0406 tx timeout [ 498.748588][T12070] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 498.815493][T12074] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 499.238244][ T26] usb 2-1: new low-speed USB device number 27 using dummy_hcd [ 499.251111][ T5700] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 499.303539][T12087] Invalid logical block size (570425344) [ 499.388273][ T26] usb 2-1: Invalid ep0 maxpacket: 16 [ 499.400742][ T5700] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 499.412788][ T5700] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.412859][ T5700] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 499.412964][ T5700] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 499.412994][ T5700] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 499.437265][ T5700] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 499.437348][ T5700] usb 4-1: Manufacturer: syz [ 499.467743][ T5700] usb 4-1: config 0 descriptor?? [ 499.528125][ T26] usb 2-1: new low-speed USB device number 28 using dummy_hcd [ 499.689240][ T26] usb 2-1: Invalid ep0 maxpacket: 16 [ 499.695062][ T26] usb usb2-port1: attempt power cycle [ 499.803101][ T5700] rc_core: IR keymap rc-hauppauge not found [ 499.803141][ T5700] Registered IR keymap rc-empty [ 499.803323][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 499.828436][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 499.850556][ T5700] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 499.856626][ T5700] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input66 [ 499.869418][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 499.893097][T12081] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.894050][T12081] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.907125][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 499.929607][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 499.950917][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 499.969306][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 499.989146][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 500.015379][T12081] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2114'. [ 500.022431][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 500.038109][ T26] usb 2-1: new low-speed USB device number 29 using dummy_hcd [ 500.044035][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 500.058663][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 500.067046][T12104] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2124'. [ 500.078267][ T26] usb 2-1: Invalid ep0 maxpacket: 16 [ 500.088158][ T5700] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 500.127571][ T5700] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 500.127729][ T5700] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 500.166400][ T5700] usb 4-1: USB disconnect, device number 20 [ 500.208252][ T26] usb 2-1: new low-speed USB device number 30 using dummy_hcd [ 500.228836][ T26] usb 2-1: Invalid ep0 maxpacket: 16 [ 500.235424][ T26] usb usb2-port1: unable to enumerate USB device [ 500.332168][T12111] netlink: 'syz.2.2127': attribute type 1 has an invalid length. [ 500.332217][T12111] netlink: 'syz.2.2127': attribute type 2 has an invalid length. [ 500.356415][T12111] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 500.553209][ T32] audit: type=1326 audit(1787308756.403:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12116 comm="syz.2.2129" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=228 compat=0 ip=0x7fe691dd30f3 code=0x0 [ 500.607450][ T32] audit: type=1326 audit(1787308756.453:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12116 comm="syz.2.2129" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=228 compat=0 ip=0x7fe691dd30f3 code=0x0 [ 500.715137][T12121] cgroup: noprefix used incorrectly [ 501.578730][T12144] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.579244][T12144] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 501.590057][T12143] kvm: pic: level sensitive irq not supported [ 501.725521][T12150] sg_write: data in/out 503296/136 bytes for SCSI command 0x0-- guessing data in; [ 501.725521][T12150] program syz.3.2139 not setting count and/or reply_len properly [ 501.831046][T12154] overlayfs: upper fs does not support tmpfile. [ 501.965236][T12158] loop9: detected capacity change from 0 to 255852544 [ 502.312269][ T32] audit: type=1326 audit(1787308758.163:158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12161 comm="syz.3.2145" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=228 compat=0 ip=0x7f5d303370f3 code=0x0 [ 502.399191][ T32] audit: type=1326 audit(1787308758.253:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12161 comm="syz.3.2145" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=228 compat=0 ip=0x7f5d303370f3 code=0x0 [ 502.422600][T12167] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 502.423865][T12167] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.156362][T12183] comedi comedi1: 8255: I/O base address not correctly aligned [ 503.372997][T12192] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2155'. [ 503.706469][T12199] sg_write: data in/out 634368/136 bytes for SCSI command 0x0-- guessing data in; [ 503.706469][T12199] program syz.0.2158 not setting count and/or reply_len properly [ 504.030110][ T32] audit: type=1326 audit(1787308759.873:160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12207 comm="syz.1.2163" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=228 compat=0 ip=0x7f32310680f3 code=0x0 [ 504.084840][ T32] audit: type=1326 audit(1787308759.933:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12207 comm="syz.1.2163" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=228 compat=0 ip=0x7f32310680f3 code=0x0 [ 504.138462][T12191] syz.3.2154 (12191): drop_caches: 2 [ 504.200800][T12213] binder: BINDER_SET_CONTEXT_MGR bad uid 0 != 60929 [ 504.200842][T12213] binder: 12212:12213 ioctl 4018620d 200000000100 returned -1 [ 504.225081][T12213] binder: BINDER_SET_CONTEXT_MGR bad uid 0 != 60929 [ 504.225122][T12213] binder: 12212:12213 ioctl 4018620d 200000000140 returned -1 [ 504.547672][ T5728] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 504.707568][ T5728] usb 4-1: Using ep0 maxpacket: 8 [ 504.710440][ T5728] usb 4-1: New USB device found, idVendor=17ef, idProduct=6067, bcdDevice= 0.00 [ 504.715156][ T5728] usb 4-1: config 0 interface 0 altsetting 127 endpoint 0x81 has an invalid bInterval 19, changing to 8 [ 504.715253][ T5728] usb 4-1: config 0 interface 0 has no altsetting 0 [ 504.715457][ T5728] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 504.729508][ T5728] usb 4-1: config 0 descriptor?? [ 505.155033][ T5728] lenovo 0003:17EF:6067.0044: unknown main item tag 0x0 [ 505.155106][ T5728] lenovo 0003:17EF:6067.0044: unknown main item tag 0x0 [ 505.155168][ T5728] lenovo 0003:17EF:6067.0044: unknown main item tag 0x0 [ 505.155240][ T5728] lenovo 0003:17EF:6067.0044: unknown main item tag 0x0 [ 505.157235][ T5728] lenovo 0003:17EF:6067.0044: unknown main item tag 0x0 [ 505.157783][ T5728] lenovo 0003:17EF:6067.0044: unknown main item tag 0x0 [ 505.157873][ T5728] lenovo 0003:17EF:6067.0044: unknown main item tag 0x0 [ 505.157968][ T5728] lenovo 0003:17EF:6067.0044: unknown main item tag 0x0 [ 505.158058][ T5728] lenovo 0003:17EF:6067.0044: unknown main item tag 0x0 [ 505.158156][ T5728] lenovo 0003:17EF:6067.0044: unknown main item tag 0x0 [ 505.185760][ T5728] lenovo 0003:17EF:6067.0044: hidraw0: USB HID v0.7b Device [HID 17ef:6067] on usb-dummy_hcd.3-1/input0 [ 505.364188][ T5728] usb 4-1: USB disconnect, device number 21 [ 505.507933][ T10] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 505.672106][T12238] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.672986][T12238] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.684739][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 505.694334][T12239] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.696310][T12239] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.708863][ T10] usb 2-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 505.732500][T12238] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.733183][T12238] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.749948][ T10] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 505.750008][ T10] usb 2-1: config 0 has no interface number 0 [ 505.772799][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.772900][ T10] usb 2-1: Product: syz [ 505.772938][ T10] usb 2-1: Manufacturer: syz [ 505.772967][ T10] usb 2-1: SerialNumber: syz [ 505.797823][ T10] usb 2-1: config 0 descriptor?? [ 505.808399][ T10] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 505.986882][T12242] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2174'. [ 506.964757][ T32] audit: type=1326 audit(1787308762.812:162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12246 comm="syz.0.2175" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=228 compat=0 ip=0x7f5df7b1a0f3 code=0x0 [ 507.090840][ T32] audit: type=1326 audit(1787308762.932:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12246 comm="syz.0.2175" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=228 compat=0 ip=0x7f5df7b1a0f3 code=0x0 [ 507.280750][T12253] FAULT_INJECTION: forcing a failure. [ 507.280750][T12253] name failslab, interval 1, probability 0, space 0, times 0 [ 507.280823][T12253] CPU: 1 UID: 0 PID: 12253 Comm: syz.2.2178 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 507.280905][T12253] Tainted: [L]=SOFTLOCKUP [ 507.280915][T12253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 507.280930][T12253] Call Trace: [ 507.280950][T12253] [ 507.280993][T12253] dump_stack_lvl+0xe8/0x150 [ 507.281086][T12253] should_fail_ex+0x410/0x560 [ 507.281203][T12253] should_failslab+0xa8/0x100 [ 507.281268][T12253] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 507.281367][T12253] kmem_cache_alloc_noprof+0xa1/0x600 [ 507.281443][T12253] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 507.281520][T12253] ? kmem_cache_alloc_noprof+0x156/0x600 [ 507.281597][T12253] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 507.281711][T12253] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 507.281837][T12253] mmu_topup_memory_caches+0x21/0x170 [ 507.281933][T12253] kvm_mmu_load+0x9d/0x21e0 [ 507.282030][T12253] ? kvm_msr_allowed+0x9a/0x490 [ 507.282117][T12253] ? kvm_msr_allowed+0x9a/0x490 [ 507.282203][T12253] ? kvm_msr_allowed+0x9a/0x490 [ 507.282290][T12253] ? kvm_msr_allowed+0x3f4/0x490 [ 507.282373][T12253] ? kvm_msr_allowed+0x9a/0x490 [ 507.282467][T12253] ? kvm_apic_has_interrupt+0x740/0x770 [ 507.282589][T12253] vcpu_run+0x4f68/0x79b0 [ 507.282762][T12253] ? update_se+0x90/0x1020 [ 507.282945][T12253] ? __pfx_vcpu_run+0x10/0x10 [ 507.283030][T12253] ? lock_acquire+0x115/0x350 [ 507.283165][T12253] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 507.283261][T12253] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 507.283336][T12253] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 507.283394][T12253] kvm_vcpu_ioctl+0xa61/0xfd0 [ 507.283501][T12253] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 507.283593][T12253] ? hook_file_ioctl+0x1f2/0x600 [ 507.283732][T12253] ? __fget_files+0x2a/0x420 [ 507.283817][T12253] ? __fget_files+0x2a/0x420 [ 507.283907][T12253] ? __fget_files+0x3a2/0x420 [ 507.283979][T12253] ? __fget_files+0x2a/0x420 [ 507.284063][T12253] ? bpf_lsm_file_ioctl+0x9/0x20 [ 507.284137][T12253] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 507.284225][T12253] __se_sys_ioctl+0xfc/0x170 [ 507.284320][T12253] do_syscall_64+0x166/0x520 [ 507.284387][T12253] ? trace_irq_disable+0x3b/0x140 [ 507.284472][T12253] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.284547][T12253] ? clear_bhb_loop+0x70/0xc0 [ 507.284622][T12253] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.284686][T12253] RIP: 0033:0x7fe690f9e0d9 [ 507.284748][T12253] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 507.284801][T12253] RSP: 002b:00007fe691dcb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 507.284873][T12253] RAX: ffffffffffffffda RBX: 00007fe691225fa0 RCX: 00007fe690f9e0d9 [ 507.284919][T12253] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000f [ 507.284959][T12253] RBP: 00007fe691dcb090 R08: 0000000000000000 R09: 0000000000000000 [ 507.284994][T12253] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 507.285035][T12253] R13: 00007fe691226038 R14: 00007fe691225fa0 R15: 00007fffe5c208e8 [ 507.285131][T12253] [ 507.294307][ T5700] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 507.506875][ T5700] usb 4-1: Using ep0 maxpacket: 16 [ 507.533577][ T5700] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 507.574910][ T10] gspca_spca1528: reg_w err -110 [ 507.575050][ T10] spca1528 2-1:0.1: probe with driver spca1528 failed with error -110 [ 507.620516][ T5700] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 507.670297][ T5700] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.670349][ T5700] usb 4-1: Product: syz [ 507.670387][ T5700] usb 4-1: Manufacturer: syz [ 507.670409][ T5700] usb 4-1: SerialNumber: syz [ 507.698557][ T5700] usb 4-1: config 0 descriptor?? [ 507.729597][ T5700] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 507.729657][ T5700] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 507.992662][T12262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.007811][T12262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.096182][ T5350] Process accounting resumed [ 508.300699][ T5767] usb 2-1: USB disconnect, device number 31 [ 508.508008][ T5700] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 508.579354][ T5700] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 508.581727][ T5700] em28xx 4-1:0.0: board has no eeprom [ 508.658853][ T5700] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 508.658936][ T5700] em28xx 4-1:0.0: dvb set to bulk mode. [ 508.659986][ T10] em28xx 4-1:0.0: Binding DVB extension [ 508.695043][ T5700] usb 4-1: USB disconnect, device number 22 [ 508.703208][ T5700] em28xx 4-1:0.0: Disconnecting em28xx [ 508.723527][T12262] Process accounting resumed [ 508.769555][ T5767] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 508.839518][T12277] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2188'. [ 508.851376][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 508.851436][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 508.890378][ T10] em28xx 4-1:0.0: Registering input extension [ 508.909319][ T5700] em28xx 4-1:0.0: Closing input extension [ 508.937902][ T5767] usb 2-1: Using ep0 maxpacket: 16 [ 508.941986][ T5767] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 508.949152][ T5767] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 509.016326][ T5767] usb 2-1: config 0 descriptor?? [ 509.051185][ T5767] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 509.153669][ T5700] em28xx: Freeing device [ 509.346000][T12269] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 509.346720][T12269] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 509.372479][T12269] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 509.373199][T12269] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 509.830210][ T5767] usb 2-1: Detected FT232A [ 509.836506][ T5767] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 509.869053][ T5767] usb 2-1: USB disconnect, device number 32 [ 509.885785][ T5767] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 509.886495][ T5767] ftdi_sio 2-1:0.0: device disconnected [ 510.471268][T12323] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 510.580619][ T5728] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 510.730762][ T5728] usb 2-1: New USB device found, idVendor=04b3, idProduct=3103, bcdDevice= 0.40 [ 510.734971][ T5728] usb 2-1: config 1 interface 0 altsetting 2 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 510.735078][ T5728] usb 2-1: config 1 interface 0 has no altsetting 0 [ 510.749392][ T5728] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.749478][ T5728] usb 2-1: Product: syz [ 510.749529][ T5728] usb 2-1: Manufacturer: syz [ 510.749573][ T5728] usb 2-1: SerialNumber: syz [ 510.769914][T12322] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 511.308324][ T5700] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 511.478233][ T5700] usb 4-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 511.499124][ T5700] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 511.499173][ T5700] usb 4-1: Product: syz [ 511.499223][ T5700] usb 4-1: Manufacturer: syz [ 511.499266][ T5700] usb 4-1: SerialNumber: syz [ 511.529676][ T5700] usb 4-1: config 0 descriptor?? [ 511.556711][ T5700] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 511.578443][ T5700] dvb-usb: bulk message failed: -22 (2/0) [ 511.602430][ T5700] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 511.615051][ T5700] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 511.615131][ T5700] usb 4-1: media controller created [ 511.655108][ T5700] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 511.802061][T12328] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 511.803640][T12328] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.350135][ T5700] cxusb: set interface failed [ 512.350174][ T5700] dvb-usb: bulk message failed: -22 (1/0) [ 512.375535][T12340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.376264][T12340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.480719][ T5700] DVB: Unable to find symbol mt352_attach() [ 512.480951][ T5700] dvb-usb: bulk message failed: -22 (5/0) [ 512.480998][ T5700] zl10353_read_register: readreg error (reg=127, ret==-121) [ 512.481052][ T5700] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 512.808802][ T5700] rc_core: IR keymap rc-dvico-mce not found [ 512.808865][ T5700] Registered IR keymap rc-empty [ 512.824990][ T5700] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 512.850296][ T5700] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input68 [ 512.889742][ T5700] dvb-usb: schedule remote query interval to 100 msecs. [ 512.889800][ T5700] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 512.911321][ T5700] usb 4-1: USB disconnect, device number 23 [ 513.047345][ T5700] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 513.122426][ T5617] udevd[5617]: setting owner of /dev/bus/usb/004/023 to uid=0, gid=0 failed: No such file or directory [ 513.363713][T12347] netlink: 'syz.3.2206': attribute type 1 has an invalid length. [ 513.363869][T12347] netlink: 'syz.3.2206': attribute type 1 has an invalid length. [ 513.544696][ T5728] usbhid 2-1:1.0: can't add hid device: -71 [ 513.544889][ T5728] usbhid 2-1:1.0: probe with driver usbhid failed with error -71 [ 513.568366][ T5728] usb 2-1: USB disconnect, device number 33 [ 513.730645][T12345] syz.2.2207 (12345) used greatest stack depth: 18088 bytes left [ 513.786041][T12356] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2211'. [ 513.977935][T12361] netlink: 260 bytes leftover after parsing attributes in process `syz.3.2212'. [ 514.838827][T12376] raw_sendmsg: syz.2.2217 forgot to set AF_INET. Fix it! [ 514.855440][T12376] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2217'. [ 515.512819][T12389] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2224'. [ 515.520149][T12389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.521492][T12389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.527841][T12389] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.529182][T12389] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.121725][T12395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 516.133872][T12395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.167014][T12395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 516.167767][T12395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.410687][T12400] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 516.423686][T12400] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 516.872241][T12409] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2231'. [ 517.496543][ T5728] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 517.568911][T12424] netlink: 'syz.1.2236': attribute type 1 has an invalid length. [ 517.568956][T12424] netlink: 248 bytes leftover after parsing attributes in process `syz.1.2236'. [ 517.658161][ T5728] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 517.662650][ T5728] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 517.662740][ T5728] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 517.662816][ T5728] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 517.671087][ T5728] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.671186][ T5728] usb 4-1: Product: syz [ 517.671231][ T5728] usb 4-1: Manufacturer: syz [ 517.671280][ T5728] usb 4-1: SerialNumber: syz [ 517.679216][ T5728] usb 4-1: config 0 descriptor?? [ 517.683306][T12417] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 517.683930][T12417] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 517.690259][ T5728] usb 4-1: ucan: probing device on interface #0 [ 517.876524][ T5700] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 517.965386][ T5728] usb 4-1: ucan: could not read protocol version, ret=-71 [ 517.965438][ T5728] usb 4-1: ucan: probe failed; try to update the device firmware [ 517.990972][ T5728] usb 4-1: USB disconnect, device number 24 [ 518.027460][ T5700] usb 2-1: Using ep0 maxpacket: 32 [ 518.036377][ T5700] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 518.053576][ T5700] usb 2-1: config 0 has an invalid interface number: 12 but max is 0 [ 518.053638][ T5700] usb 2-1: config 0 has no interface number 0 [ 518.053700][ T5700] usb 2-1: config 0 interface 12 has no altsetting 0 [ 518.082269][ T5700] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.082318][ T5700] usb 2-1: Product: syz [ 518.082353][ T5700] usb 2-1: Manufacturer: syz [ 518.082375][ T5700] usb 2-1: SerialNumber: syz [ 518.109328][ T5700] usb 2-1: config 0 descriptor?? [ 518.538197][T12424] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.539197][T12424] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.636805][ T9] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 518.797453][ T9] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 518.802374][ T9] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 518.802429][ T9] usb 4-1: config 1 has no interface number 0 [ 518.802681][ T9] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0xA has invalid maxpacket 8 [ 518.802857][ T9] usb 4-1: config 1 interface 7 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 518.833056][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.833283][ T9] usb 4-1: Product: syz [ 518.833334][ T9] usb 4-1: Manufacturer: syz [ 518.833481][ T9] usb 4-1: SerialNumber: syz [ 518.873316][T12443] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 518.873593][T12443] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 518.890240][ T9] usb 4-1: Expected 3 endpoints, found: 2 [ 519.090171][ T5767] usb 4-1: USB disconnect, device number 25 [ 519.757436][T12466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 519.767047][T12466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 519.927100][T12467] sctp: [Deprecated]: syz.3.2251 (pid 12467) Use of int in max_burst socket option. [ 519.927100][T12467] Use struct sctp_assoc_value instead [ 520.485803][T12469] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 520.703038][ T5700] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 520.703211][ T5700] f81534 2-1:0.12: f81534_find_config_idx: read failed: -71 [ 520.703298][ T5700] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 520.703525][ T5700] f81534 2-1:0.12: probe with driver f81534 failed with error -71 [ 520.803853][ T5700] usb 2-1: USB disconnect, device number 34 [ 521.719166][T12482] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 522.227069][T12493] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2257'. [ 523.400191][T12503] faux_driver vgem: [drm] Unknown color mode 181; guessing buffer size. [ 524.077377][ T5728] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 524.293705][ T5728] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 524.304904][ T5728] usb 2-1: config index 0 descriptor too short (expected 39, got 27) [ 524.304957][ T5728] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 524.304983][ T5728] usb 2-1: config 0 interface 0 has no altsetting 0 [ 524.330486][ T5728] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 524.330572][ T5728] usb 2-1: Product: syz [ 524.330617][ T5728] usb 2-1: Manufacturer: syz [ 524.330658][ T5728] usb 2-1: SerialNumber: syz [ 524.343060][ T5728] usb 2-1: config 0 descriptor?? [ 524.364728][ T5728] hub 2-1:0.0: bad descriptor, ignoring hub [ 524.365546][ T5728] hub 2-1:0.0: probe with driver hub failed with error -5 [ 524.369941][ T5728] usb 2-1: selecting invalid altsetting 0 [ 524.577578][T12510] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.591260][T12510] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 524.843605][ T5728] usb 2-1: USB disconnect, device number 35 [ 525.466969][ T9] usb 4-1: new full-speed USB device number 26 using dummy_hcd [ 525.631974][T12523] tipc: Started in network mode [ 525.632112][T12523] tipc: Node identity 000000002e0000000040000000000001, cluster identity 4711 [ 525.632340][T12523] tipc: Enabling of bearer rejected, failed to enable media [ 525.661264][ T9] usb 4-1: not running at top speed; connect to a high speed hub [ 525.661451][ T9] usb 4-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=b7.1d [ 525.700521][ T9] usb 4-1: config 252 has an invalid interface number: 209 but max is 0 [ 525.700571][ T9] usb 4-1: config 252 has no interface number 0 [ 525.700617][ T9] usb 4-1: config 252 interface 209 has no altsetting 0 [ 525.730545][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.730658][ T9] usb 4-1: Product: syz [ 525.730737][ T9] usb 4-1: Manufacturer: syz [ 525.730789][ T9] usb 4-1: SerialNumber: syz [ 526.044388][T12524] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.071486][T12524] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.420439][ T9] usb_8dev 4-1:252.209 can0: sending command message failed [ 526.468444][ T9] usb_8dev 4-1:252.209 can0: can't get firmware version [ 526.545568][T12528] netlink: 'syz.1.2270': attribute type 1 has an invalid length. [ 526.546608][T12528] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2270'. [ 526.577987][ T9] usb_8dev 4-1:252.209: probe with driver usb_8dev failed with error -22 [ 526.602164][ T9] usb 4-1: USB disconnect, device number 26 [ 527.517063][ T5728] usb 4-1: new low-speed USB device number 27 using dummy_hcd [ 527.667391][ T5728] usb 4-1: device descriptor read/64, error -71 [ 527.948067][ T5728] usb 4-1: new low-speed USB device number 28 using dummy_hcd [ 528.151559][ T5728] usb 4-1: device descriptor read/64, error -71 [ 528.261467][ T5728] usb usb4-port1: attempt power cycle [ 528.620804][ T5728] usb 4-1: new low-speed USB device number 29 using dummy_hcd [ 528.658648][ T5728] usb 4-1: device descriptor read/8, error -71 [ 528.736694][T12556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 528.760943][T12556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.937684][ T5728] usb 4-1: new low-speed USB device number 30 using dummy_hcd [ 528.962434][ T5728] usb 4-1: device descriptor read/8, error -71 [ 529.069704][ T5728] usb usb4-port1: unable to enumerate USB device [ 529.660149][T12562] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2284'. [ 531.162624][T12583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 531.163162][T12583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 531.477999][ T5626] Bluetooth: hci3: unexpected event for opcode 0x1005 [ 531.601093][T12587] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2292'. [ 531.693594][T12592] binder: 12591:12592 ioctl c0306201 200000000080 returned -14 [ 531.705231][ T9] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 531.714781][T12592] binder: 12591:12592 ioctl c0306201 2000000003c0 returned -14 [ 531.857254][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 531.874592][ T9] usb 4-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=8f.67 [ 531.891086][ T9] usb 4-1: config 8 has an invalid interface number: 188 but max is 0 [ 531.891162][ T9] usb 4-1: config 8 has no interface number 0 [ 531.891304][ T9] usb 4-1: config 8 interface 188 altsetting 0 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 531.891379][ T9] usb 4-1: config 8 interface 188 altsetting 0 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 531.891447][ T9] usb 4-1: config 8 interface 188 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 532.040698][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 532.040810][ T9] usb 4-1: Product: syz [ 532.040893][ T9] usb 4-1: Manufacturer: syz [ 532.040944][ T9] usb 4-1: SerialNumber: syz [ 532.373576][T12589] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 532.375367][T12589] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 532.439050][ T9] vmk80xx 4-1:8.188: driver 'vmk80xx' failed to auto-configure device. [ 532.467700][ T9] vmk80xx 4-1:8.188: probe with driver vmk80xx failed with error -22 [ 532.486393][ T9] usb 4-1: USB disconnect, device number 31 [ 533.175836][T12604] cgroup: No subsys list or none specified [ 533.527932][T12608] tipc: Enabling of bearer rejected, failed to enable media [ 534.856798][T12603] lo speed is unknown, defaulting to 1000 [ 534.870039][T12603] vcan0 speed is unknown, defaulting to 1000 [ 535.248790][ T9] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 535.388238][ T9] usb 2-1: device descriptor read/64, error -71 [ 535.628471][ T9] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 535.764870][ T9] usb 2-1: device descriptor read/64, error -71 [ 535.880973][ T9] usb usb2-port1: attempt power cycle [ 536.226011][ T9] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 536.254255][ T9] usb 2-1: device descriptor read/8, error -71 [ 536.504878][ T9] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 536.526227][ T9] usb 2-1: device descriptor read/8, error -71 [ 536.636775][ T9] usb usb2-port1: unable to enumerate USB device [ 537.079824][T12630] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2310'. [ 539.866567][ T31] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 540.042357][ T31] usb 2-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 540.050793][ T31] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 540.051596][ T31] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x4 has invalid wMaxPacketSize 0 [ 540.052422][ T31] usb 2-1: config 0 interface 0 has no altsetting 0 [ 540.133730][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 540.134255][ T31] usb 2-1: Product: syz [ 540.135107][ T31] usb 2-1: Manufacturer: syz [ 540.135795][ T31] usb 2-1: SerialNumber: syz [ 540.140648][ T31] usb 2-1: config 0 descriptor?? [ 540.686182][ T31] usb 2-1: USB disconnect, device number 40 [ 541.178780][T12669] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 541.179838][T12669] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 541.634405][ T9] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 541.784628][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 541.786414][ T9] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 541.790843][ T9] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 541.790920][ T9] usb 2-1: config 0 has no interface number 0 [ 541.791065][ T9] usb 2-1: config 0 interface 184 has no altsetting 0 [ 541.847617][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.847765][ T9] usb 2-1: Product: syz [ 541.847830][ T9] usb 2-1: Manufacturer: syz [ 541.847881][ T9] usb 2-1: SerialNumber: syz [ 541.878473][ T9] usb 2-1: config 0 descriptor?? [ 542.580658][ T9] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 542.580722][ T9] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 542.794684][ T9] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 542.794810][ T9] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 542.794891][ T9] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 542.795589][ T9] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -61 [ 544.238762][T12688] sctp: [Deprecated]: syz.3.2328 (pid 12688) Use of int in max_burst socket option. [ 544.238762][T12688] Use struct sctp_assoc_value instead [ 544.988991][T12697] MTDSB: Device #1 doesn't appear to exist [ 544.988991][T12697] [ 545.369797][ T9] usb 2-1: USB disconnect, device number 41 [ 545.689080][T12702] netlink: 'syz.1.2333': attribute type 10 has an invalid length. [ 546.267356][T12702] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 546.280113][T12702] team0: Port device netdevsim1 added [ 546.765908][ T5628] Bluetooth: hci0: command 0x0405 tx timeout [ 546.781517][T12714] binder: BINDER_SET_CONTEXT_MGR bad uid 0 != 60929 [ 546.781622][T12714] binder: 12713:12714 ioctl 4018620d 200000003280 returned -1 [ 546.806964][T12714] netlink: 'syz.2.2339': attribute type 4 has an invalid length. [ 546.807011][T12714] netlink: 17 bytes leftover after parsing attributes in process `syz.2.2339'. [ 546.816813][T12714] binder: 12713:12714 ioctl c0306201 200000000080 returned -14 [ 546.843222][T12714] binder: BINDER_SET_CONTEXT_MGR bad uid 0 != 60929 [ 546.843326][T12714] binder: 12713:12714 ioctl 4018620d 200000000480 returned -1 [ 546.859292][T12714] binder: 12713:12714 ioctl c0306201 2000000003c0 returned -14 [ 547.217992][T12715] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2338'. [ 547.284643][ T32] audit: type=1800 audit(1787308803.142:164): pid=12723 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2341" name="midi1_num_groups" dev="configfs" ino=50060 res=0 errno=0 [ 547.876688][T12730] 9p: Bad value for 'rfdno' [ 548.268306][ T5767] usb 4-1: new full-speed USB device number 32 using dummy_hcd [ 548.431193][ T5767] usb 4-1: unable to get BOS descriptor or descriptor too short [ 548.434931][ T5767] usb 4-1: not running at top speed; connect to a high speed hub [ 548.435485][ T5767] usb 4-1: New USB device found, idVendor=0403, idProduct=e80e, bcdDevice=92.a4 [ 548.449774][ T5767] usb 4-1: config 160 has an invalid interface number: 156 but max is 0 [ 548.449899][ T5767] usb 4-1: config 160 has no interface number 0 [ 548.449991][ T5767] usb 4-1: config 160 interface 156 altsetting 8 has an endpoint descriptor with address 0xF4, changing to 0x84 [ 548.450061][ T5767] usb 4-1: config 160 interface 156 altsetting 8 endpoint 0x84 has invalid maxpacket 49717, setting to 64 [ 548.450137][ T5767] usb 4-1: config 160 interface 156 altsetting 8 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 548.450201][ T5767] usb 4-1: config 160 interface 156 altsetting 8 has an invalid descriptor for endpoint zero, skipping [ 548.450244][ T5767] usb 4-1: config 160 interface 156 altsetting 8 has a duplicate endpoint with address 0x7, skipping [ 548.450341][ T5767] usb 4-1: config 160 interface 156 altsetting 8 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 548.450443][ T5767] usb 4-1: config 160 interface 156 altsetting 8 has 7 endpoint descriptors, different from the interface descriptor's value: 6 [ 548.450520][ T5767] usb 4-1: config 160 interface 156 has no altsetting 0 [ 548.498831][ T5767] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 548.498871][ T5767] usb 4-1: Product: syz [ 548.498895][ T5767] usb 4-1: Manufacturer: syz [ 548.498926][ T5767] usb 4-1: SerialNumber: syz [ 548.607764][T12732] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 548.618287][T12732] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 549.647783][ T5767] ftdi_sio 4-1:160.156: FTDI USB Serial Device converter detected [ 549.669492][ T5767] ftdi_sio ttyUSB0: unknown device type: 0x92a4 [ 549.729368][ T5767] usb 4-1: USB disconnect, device number 32 [ 549.772910][T12744] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -11 0 [ 549.791936][T12744] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 549.826365][ T5638] udevd[5638]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 549.846414][ T5767] ftdi_sio 4-1:160.156: device disconnected [ 549.965571][ T8426] udevd[8426]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 552.657209][T12776] FAULT_INJECTION: forcing a failure. [ 552.657209][T12776] name failslab, interval 1, probability 0, space 0, times 0 [ 552.657348][T12776] CPU: 0 UID: 0 PID: 12776 Comm: syz.2.2358 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 552.657435][T12776] Tainted: [L]=SOFTLOCKUP [ 552.657452][T12776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 552.657481][T12776] Call Trace: [ 552.657514][T12776] [ 552.657538][T12776] dump_stack_lvl+0xe8/0x150 [ 552.657617][T12776] should_fail_ex+0x410/0x560 [ 552.657698][T12776] should_failslab+0xa8/0x100 [ 552.657754][T12776] __kmalloc_noprof+0xfe/0x720 [ 552.657829][T12776] ? tomoyo_encode+0x2ad/0x570 [ 552.657907][T12776] ? tomoyo_encode+0x2ad/0x570 [ 552.658004][T12776] tomoyo_encode+0x2ad/0x570 [ 552.658094][T12776] tomoyo_realpath_from_path+0x5fa/0x640 [ 552.658221][T12776] ? tomoyo_path_number_perm+0x219/0x5f0 [ 552.658295][T12776] tomoyo_path_number_perm+0x246/0x5f0 [ 552.658370][T12776] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 552.658436][T12776] ? __lock_acquire+0x6df/0x2e50 [ 552.658539][T12776] ? hook_file_ioctl+0x1f2/0x600 [ 552.658657][T12776] ? __fget_files+0x2a/0x420 [ 552.658723][T12776] ? __fget_files+0x2a/0x420 [ 552.658783][T12776] ? __fget_files+0x3a2/0x420 [ 552.658837][T12776] ? __fget_files+0x2a/0x420 [ 552.658909][T12776] security_file_ioctl+0xc3/0x2a0 [ 552.658976][T12776] __se_sys_ioctl+0x47/0x170 [ 552.659055][T12776] do_syscall_64+0x166/0x520 [ 552.659105][T12776] ? trace_irq_disable+0x3b/0x140 [ 552.659180][T12776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.659232][T12776] ? clear_bhb_loop+0x70/0xc0 [ 552.659295][T12776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.659339][T12776] RIP: 0033:0x7fe690f9e0d9 [ 552.659389][T12776] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 552.659437][T12776] RSP: 002b:00007fe691dcb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 552.659490][T12776] RAX: ffffffffffffffda RBX: 00007fe691225fa0 RCX: 00007fe690f9e0d9 [ 552.659528][T12776] RDX: 0000200000000040 RSI: 0000000000008b2c RDI: 0000000000000004 [ 552.659558][T12776] RBP: 00007fe691dcb090 R08: 0000000000000000 R09: 0000000000000000 [ 552.659594][T12776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 552.659628][T12776] R13: 00007fe691226038 R14: 00007fe691225fa0 R15: 00007fffe5c208e8 [ 552.659700][T12776] [ 552.963320][ T5767] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 552.963743][ C0] raw-gadget.2 gadget.3: ignoring, device is not running [ 552.984638][T12776] ERROR: Out of memory at tomoyo_realpath_from_path. [ 553.109260][ T5767] usb 4-1: device descriptor read/64, error -32 [ 553.344089][ T5767] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 553.483945][ T5767] usb 4-1: device descriptor read/64, error -71 [ 553.595568][ T5767] usb usb4-port1: attempt power cycle [ 553.953338][ T5767] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 553.974896][ T5767] usb 4-1: device descriptor read/8, error -71 [ 554.214228][ T5767] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 554.249948][ T5767] usb 4-1: device descriptor read/8, error -71 [ 554.359513][ T5767] usb usb4-port1: unable to enumerate USB device [ 556.146404][T12816] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 556.160486][T12816] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 556.184696][T12818] Bluetooth: MGMT ver 1.23 [ 556.334488][T12817] oom_control is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 556.573188][T12824] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2374'. [ 557.148424][T12828] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 557.154766][T12828] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 557.311962][ T5626] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 557.324610][T12829] FAULT_INJECTION: forcing a failure. [ 557.324610][T12829] name failslab, interval 1, probability 0, space 0, times 0 [ 557.324669][T12829] CPU: 0 UID: 0 PID: 12829 Comm: syz.0.2377 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 557.324697][T12829] Tainted: [L]=SOFTLOCKUP [ 557.324705][T12829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 557.324717][T12829] Call Trace: [ 557.324727][T12829] [ 557.324735][T12829] dump_stack_lvl+0xe8/0x150 [ 557.324765][T12829] should_fail_ex+0x410/0x560 [ 557.324797][T12829] should_failslab+0xa8/0x100 [ 557.324818][T12829] __kvmalloc_node_noprof+0x176/0x820 [ 557.324847][T12829] ? __kmalloc_cache_noprof+0x321/0x600 [ 557.324874][T12829] ? alloc_fdtable+0x101/0x2c0 [ 557.324892][T12829] ? alloc_fdtable+0x101/0x2c0 [ 557.324916][T12829] alloc_fdtable+0x101/0x2c0 [ 557.324934][T12829] ? dup_fd+0x7f5/0xaf0 [ 557.324954][T12829] dup_fd+0x7fe/0xaf0 [ 557.324982][T12829] copy_files+0xaf/0x120 [ 557.325004][T12829] ? copy_process+0xd3c/0x43e0 [ 557.325023][T12829] copy_process+0x1cca/0x43e0 [ 557.325043][T12829] ? _parse_integer_limit+0x18f/0x1e0 [ 557.325148][T12829] ? copy_process+0xd3c/0x43e0 [ 557.325182][T12829] ? __pfx_copy_process+0x10/0x10 [ 557.325204][T12829] ? get_pid_task+0x20/0x1f0 [ 557.325236][T12829] ? get_pid_task+0x20/0x1f0 [ 557.325268][T12829] kernel_clone+0x2d7/0x940 [ 557.325295][T12829] ? __pfx_kernel_clone+0x10/0x10 [ 557.325333][T12829] __x64_sys_clone+0x1b6/0x230 [ 557.325359][T12829] ? __pfx___x64_sys_clone+0x10/0x10 [ 557.325394][T12829] ? __pfx_ksys_write+0x10/0x10 [ 557.325427][T12829] do_syscall_64+0x166/0x520 [ 557.325446][T12829] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.325466][T12829] ? clear_bhb_loop+0x70/0xc0 [ 557.325489][T12829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.325508][T12829] RIP: 0033:0x7f5df6b9e0d9 [ 557.325525][T12829] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 557.325541][T12829] RSP: 002b:00007f5df7b11fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 557.325562][T12829] RAX: ffffffffffffffda RBX: 00007f5df6e25fa0 RCX: 00007f5df6b9e0d9 [ 557.325576][T12829] RDX: 0000000000000000 RSI: fffffffffffffea0 RDI: 0000000000000000 [ 557.325589][T12829] RBP: 00007f5df7b12090 R08: 0000000000000000 R09: 0000000000000000 [ 557.325601][T12829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 557.325612][T12829] R13: 00007f5df6e26038 R14: 00007f5df6e25fa0 R15: 00007ffcfb3bc958 [ 557.325640][T12829] [ 557.471171][ T5626] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 557.524048][ T5626] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 557.636503][ T5626] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 557.708782][ T5626] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 557.872425][T12817] debugfs: out of free dentries, can not create file 'pf_fixed' [ 557.936256][T12817] debugfs: out of free dentries, can not create file 'pf_guest' [ 559.076123][T12843] netlink: 165 bytes leftover after parsing attributes in process `syz.1.2380'. [ 559.268342][T12847] FAULT_INJECTION: forcing a failure. [ 559.268342][T12847] name failslab, interval 1, probability 0, space 0, times 0 [ 559.268568][T12847] CPU: 0 UID: 0 PID: 12847 Comm: syz.0.2381 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 559.268648][T12847] Tainted: [L]=SOFTLOCKUP [ 559.268665][T12847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 559.268702][T12847] Call Trace: [ 559.268726][T12847] [ 559.268750][T12847] dump_stack_lvl+0xe8/0x150 [ 559.268828][T12847] should_fail_ex+0x410/0x560 [ 559.268915][T12847] should_failslab+0xa8/0x100 [ 559.268969][T12847] __kmalloc_noprof+0xfe/0x720 [ 559.269044][T12847] ? tomoyo_encode+0x2ad/0x570 [ 559.269130][T12847] ? tomoyo_encode+0x2ad/0x570 [ 559.269226][T12847] tomoyo_encode+0x2ad/0x570 [ 559.269316][T12847] tomoyo_realpath_from_path+0x5fa/0x640 [ 559.269417][T12847] ? tomoyo_path_number_perm+0x219/0x5f0 [ 559.269494][T12847] tomoyo_path_number_perm+0x246/0x5f0 [ 559.269575][T12847] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 559.269640][T12847] ? __lock_acquire+0x6df/0x2e50 [ 559.269752][T12847] ? hook_file_ioctl+0x1f2/0x600 [ 559.269867][T12847] ? __fget_files+0x2a/0x420 [ 559.269931][T12847] ? __fget_files+0x2a/0x420 [ 559.269991][T12847] ? __fget_files+0x3a2/0x420 [ 559.270061][T12847] ? __fget_files+0x2a/0x420 [ 559.270127][T12847] security_file_ioctl+0xc3/0x2a0 [ 559.270194][T12847] __se_sys_ioctl+0x47/0x170 [ 559.270274][T12847] do_syscall_64+0x166/0x520 [ 559.270323][T12847] ? trace_irq_disable+0x3b/0x140 [ 559.270402][T12847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.270455][T12847] ? clear_bhb_loop+0x70/0xc0 [ 559.270518][T12847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.270573][T12847] RIP: 0033:0x7f5df6b9e0d9 [ 559.270625][T12847] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 559.270666][T12847] RSP: 002b:00007f5df7af1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 559.270727][T12847] RAX: ffffffffffffffda RBX: 00007f5df6e26090 RCX: 00007f5df6b9e0d9 [ 559.270766][T12847] RDX: 0000200000000340 RSI: 00000000400448c8 RDI: 0000000000000004 [ 559.270803][T12847] RBP: 00007f5df7af1090 R08: 0000000000000000 R09: 0000000000000000 [ 559.270840][T12847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 559.270867][T12847] R13: 00007f5df6e26128 R14: 00007f5df6e26090 R15: 00007ffcfb3bc958 [ 559.270951][T12847] [ 559.636095][T12847] ERROR: Out of memory at tomoyo_realpath_from_path. [ 559.882977][ T5626] Bluetooth: hci4: command tx timeout [ 560.077110][ T5350] hid-generic 0005:10CF:3737.0045: item fetching failed at offset 0/1 [ 560.175340][ T5350] hid-generic 0005:10CF:3737.0045: probe with driver hid-generic failed with error -22 [ 560.447407][T12854] FAULT_INJECTION: forcing a failure. [ 560.447407][T12854] name failslab, interval 1, probability 0, space 0, times 0 [ 560.447485][T12854] CPU: 0 UID: 0 PID: 12854 Comm: syz.0.2384 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 560.447522][T12854] Tainted: [L]=SOFTLOCKUP [ 560.447533][T12854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 560.447550][T12854] Call Trace: [ 560.447561][T12854] [ 560.447572][T12854] dump_stack_lvl+0xe8/0x150 [ 560.447616][T12854] should_fail_ex+0x410/0x560 [ 560.447660][T12854] should_failslab+0xa8/0x100 [ 560.447689][T12854] __kmalloc_node_noprof+0x100/0x720 [ 560.447725][T12854] ? __get_vm_area_node+0x200/0x2f0 [ 560.447755][T12854] ? __get_vm_area_node+0x283/0x2f0 [ 560.447784][T12854] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 560.447816][T12854] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 560.447859][T12854] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 560.447926][T12854] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 560.447961][T12854] ? __kasan_kmalloc+0x93/0xb0 [ 560.448004][T12854] ? __kmalloc_cache_noprof+0x321/0x600 [ 560.448046][T12854] vmalloc_user_noprof+0xad/0xe0 [ 560.448079][T12854] ? vb2_vmalloc_alloc+0xef/0x360 [ 560.448255][T12854] vb2_vmalloc_alloc+0xef/0x360 [ 560.448295][T12854] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 560.448336][T12854] __vb2_queue_alloc+0xa0b/0x1660 [ 560.448404][T12854] vb2_core_reqbufs+0xc3f/0x1470 [ 560.448458][T12854] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 560.448502][T12854] ? __kasan_kmalloc+0x93/0xb0 [ 560.448545][T12854] ? __kmalloc_cache_noprof+0x14d/0x600 [ 560.448580][T12854] ? __vb2_init_fileio+0x1e2/0x1040 [ 560.448618][T12854] ? __vb2_init_fileio+0x1e2/0x1040 [ 560.448665][T12854] __vb2_init_fileio+0x310/0x1040 [ 560.448722][T12854] __vb2_perform_fileio+0x287/0x1660 [ 560.448774][T12854] ? __asan_memset+0x22/0x50 [ 560.448813][T12854] vb2_fop_read+0x282/0x360 [ 560.448858][T12854] v4l2_read+0x19c/0x2c0 [ 560.448981][T12854] vfs_readv+0x57c/0x850 [ 560.449008][T12854] ? __pfx_v4l2_read+0x10/0x10 [ 560.449049][T12854] ? __pfx_vfs_readv+0x10/0x10 [ 560.449092][T12854] ? __fget_files+0x2a/0x420 [ 560.449129][T12854] ? __fget_files+0x3a2/0x420 [ 560.449158][T12854] ? __fget_files+0x2a/0x420 [ 560.449199][T12854] __x64_sys_preadv+0x19c/0x2b0 [ 560.449238][T12854] ? __pfx___x64_sys_preadv+0x10/0x10 [ 560.449288][T12854] do_syscall_64+0x166/0x520 [ 560.449312][T12854] ? trace_irq_disable+0x3b/0x140 [ 560.449390][T12854] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.449449][T12854] ? clear_bhb_loop+0x70/0xc0 [ 560.449532][T12854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.449591][T12854] RIP: 0033:0x7f5df6b9e0d9 [ 560.449640][T12854] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 560.449696][T12854] RSP: 002b:00007f5df7b12028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 560.449765][T12854] RAX: ffffffffffffffda RBX: 00007f5df6e25fa0 RCX: 00007f5df6b9e0d9 [ 560.449808][T12854] RDX: 0000000000000001 RSI: 0000200000000640 RDI: 0000000000000003 [ 560.449848][T12854] RBP: 00007f5df7b12090 R08: 0000000000000003 R09: 0000000000000000 [ 560.449882][T12854] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000002 [ 560.449950][T12854] R13: 00007f5df6e26038 R14: 00007f5df6e25fa0 R15: 00007ffcfb3bc958 [ 560.450029][T12854] [ 560.797228][T12854] syz.0.2384: vmalloc error: size 233472, failed to allocated page array size 456, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 560.797423][T12854] CPU: 0 UID: 0 PID: 12854 Comm: syz.0.2384 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 560.797455][T12854] Tainted: [L]=SOFTLOCKUP [ 560.797465][T12854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 560.797529][T12854] Call Trace: [ 560.797546][T12854] [ 560.797564][T12854] dump_stack_lvl+0xe8/0x150 [ 560.797642][T12854] warn_alloc+0x24d/0x270 [ 560.797680][T12854] ? __pfx_warn_alloc+0x10/0x10 [ 560.797719][T12854] ? __kmalloc_node_noprof+0x4d7/0x720 [ 560.797749][T12854] ? __get_vm_area_node+0x200/0x2f0 [ 560.797776][T12854] ? __get_vm_area_node+0x283/0x2f0 [ 560.797801][T12854] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 560.797830][T12854] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 560.797874][T12854] __vmalloc_node_range_noprof+0x969/0x1540 [ 560.797990][T12854] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 560.798023][T12854] ? __kasan_kmalloc+0x93/0xb0 [ 560.798060][T12854] ? __kmalloc_cache_noprof+0x321/0x600 [ 560.798105][T12854] vmalloc_user_noprof+0xad/0xe0 [ 560.798136][T12854] ? vb2_vmalloc_alloc+0xef/0x360 [ 560.798173][T12854] vb2_vmalloc_alloc+0xef/0x360 [ 560.798207][T12854] ? __pfx_vb2_vmalloc_alloc+0x10/0x10 [ 560.798241][T12854] __vb2_queue_alloc+0xa0b/0x1660 [ 560.798301][T12854] vb2_core_reqbufs+0xc3f/0x1470 [ 560.798349][T12854] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 560.798380][T12854] ? __kasan_kmalloc+0x93/0xb0 [ 560.798488][T12854] ? __kmalloc_cache_noprof+0x14d/0x600 [ 560.798524][T12854] ? __vb2_init_fileio+0x1e2/0x1040 [ 560.798556][T12854] ? __vb2_init_fileio+0x1e2/0x1040 [ 560.798597][T12854] __vb2_init_fileio+0x310/0x1040 [ 560.798652][T12854] __vb2_perform_fileio+0x287/0x1660 [ 560.798699][T12854] ? __asan_memset+0x22/0x50 [ 560.798734][T12854] vb2_fop_read+0x282/0x360 [ 560.798776][T12854] v4l2_read+0x19c/0x2c0 [ 560.798815][T12854] vfs_readv+0x57c/0x850 [ 560.798840][T12854] ? __pfx_v4l2_read+0x10/0x10 [ 560.798876][T12854] ? __pfx_vfs_readv+0x10/0x10 [ 560.798913][T12854] ? __fget_files+0x2a/0x420 [ 560.798945][T12854] ? __fget_files+0x3a2/0x420 [ 560.798971][T12854] ? __fget_files+0x2a/0x420 [ 560.799006][T12854] __x64_sys_preadv+0x19c/0x2b0 [ 560.799090][T12854] ? __pfx___x64_sys_preadv+0x10/0x10 [ 560.799138][T12854] do_syscall_64+0x166/0x520 [ 560.799160][T12854] ? trace_irq_disable+0x3b/0x140 [ 560.799194][T12854] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.799219][T12854] ? clear_bhb_loop+0x70/0xc0 [ 560.799247][T12854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.799272][T12854] RIP: 0033:0x7f5df6b9e0d9 [ 560.799295][T12854] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 560.799315][T12854] RSP: 002b:00007f5df7b12028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 560.799341][T12854] RAX: ffffffffffffffda RBX: 00007f5df6e25fa0 RCX: 00007f5df6b9e0d9 [ 560.799359][T12854] RDX: 0000000000000001 RSI: 0000200000000640 RDI: 0000000000000003 [ 560.799375][T12854] RBP: 00007f5df7b12090 R08: 0000000000000003 R09: 0000000000000000 [ 560.799391][T12854] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000002 [ 560.799405][T12854] R13: 00007f5df6e26038 R14: 00007f5df6e25fa0 R15: 00007ffcfb3bc958 [ 560.799439][T12854] [ 560.996998][T12854] Mem-Info: [ 560.997049][T12854] active_anon:6781 inactive_anon:1656 isolated_anon:0 [ 560.997049][T12854] active_file:9863 inactive_file:44507 isolated_file:0 [ 560.997049][T12854] unevictable:0 dirty:59 writeback:0 [ 560.997049][T12854] slab_reclaimable:10915 slab_unreclaimable:99221 [ 560.997049][T12854] mapped:25463 shmem:3188 pagetables:1478 [ 560.997049][T12854] sec_pagetables:0 bounce:0 [ 560.997049][T12854] kernel_misc_reclaimable:0 [ 560.997049][T12854] free:1306968 free_pcp:8677 free_cma:0 [ 560.997212][T12854] Node 0 active_anon:27124kB inactive_anon:6624kB active_file:39452kB inactive_file:177776kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:101836kB dirty:236kB writeback:0kB shmem:12752kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12420kB pagetables:5752kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 560.997378][T12854] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:252kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:16kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:96kB pagetables:160kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 560.997527][T12854] Node 0 DMA free:15340kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 560.997708][T12854] lowmem_reserve[]: 0 2482 2484 2484 2484 [ 560.997823][T12854] Node 0 DMA32 free:1264196kB boost:0kB min:34096kB low:42620kB high:51144kB reserved_highatomic:0kB free_highatomic:0kB active_anon:27124kB inactive_anon:6624kB active_file:39452kB inactive_file:177776kB unevictable:0kB writepending:236kB zspages:4308kB present:3129332kB managed:2542440kB mlocked:0kB bounce:0kB free_pcp:34704kB local_pcp:20612kB free_cma:0kB [ 560.998979][T12854] lowmem_reserve[]: 0 0 1 1 1 [ 560.999094][T12854] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1712kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 560.999259][T12854] lowmem_reserve[]: 0 0 0 0 0 [ 560.999363][T12854] Node 1 Normal free:3948336kB boost:0kB min:55780kB low:69724kB high:83668kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:252kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 560.999547][T12854] lowmem_reserve[]: 0 0 0 0 0 [ 560.999665][T12854] Node 0 DMA: 1*4kB (U) 1*8kB (U) 0*16kB 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15340kB [ 561.000102][T12854] Node 0 DMA32: 997*4kB (UM) 216*8kB (UM) 245*16kB (UME) 233*32kB (UME) 230*64kB (UME) 74*128kB (UM) 65*256kB (UME) 48*512kB (UME) 40*1024kB (UME) 21*2048kB (UM) 268*4096kB (UM) = 1264196kB [ 561.000577][T12854] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 561.000891][T12854] Node 1 Normal: 0*4kB 2*8kB (U) 10*16kB (UM) 6*32kB (UM) 9*64kB (UM) 9*128kB (UM) 5*256kB (UM) 3*512kB (UM) 1*1024kB (M) 1*2048kB (U) 962*4096kB (M) = 3948336kB [ 561.001353][T12854] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 561.001398][T12854] Node 0 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 561.001449][T12854] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 561.186337][T12854] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 561.186427][T12854] 57586 total pagecache pages [ 561.186469][T12854] 34 pages in swap cache [ 561.186491][T12854] Free swap = 64492kB [ 561.186513][T12854] Total swap = 124996kB [ 561.186557][T12854] 2097051 pages RAM [ 561.186579][T12854] 0 pages HighMem/MovableOnly [ 561.186601][T12854] 429397 pages reserved [ 561.186629][T12854] 0 pages cma reserved [ 561.962435][ T5626] Bluetooth: hci4: command tx timeout [ 562.292702][ T9] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 562.456513][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 562.476429][ T9] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 562.497350][ T9] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 562.497505][ T9] usb 2-1: config 0 has no interface number 0 [ 562.528803][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.528879][ T9] usb 2-1: Product: syz [ 562.528965][ T9] usb 2-1: Manufacturer: syz [ 562.529016][ T9] usb 2-1: SerialNumber: syz [ 562.601248][ T9] usb 2-1: config 0 descriptor?? [ 562.623352][ T9] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 562.839440][ T9] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 562.997735][ T9] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 564.044915][ T5626] Bluetooth: hci4: command tx timeout [ 566.129449][ T5626] Bluetooth: hci4: command tx timeout [ 566.840381][T12831] lo speed is unknown, defaulting to 1000 [ 566.868865][ C0] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 566.904891][T12831] vcan0 speed is unknown, defaulting to 1000 [ 567.008785][ T31] usb 2-1: USB disconnect, device number 42 [ 567.065184][ T31] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 567.103830][ T31] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 567.130147][ T31] quatech2 2-1:0.51: device disconnected [ 567.971465][T12910] FAULT_INJECTION: forcing a failure. [ 567.971465][T12910] name failslab, interval 1, probability 0, space 0, times 0 [ 567.971757][T12910] CPU: 1 UID: 0 PID: 12910 Comm: syz.2.2401 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 567.971789][T12910] Tainted: [L]=SOFTLOCKUP [ 567.971799][T12910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 567.971837][T12910] Call Trace: [ 567.971872][T12910] [ 567.971911][T12910] dump_stack_lvl+0xe8/0x150 [ 567.972072][T12910] should_fail_ex+0x410/0x560 [ 567.972168][T12910] ? __alloc_skb+0x1db/0x7a0 [ 567.972235][T12910] should_failslab+0xa8/0x100 [ 567.972300][T12910] ? __alloc_skb+0x1db/0x7a0 [ 567.972361][T12910] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 567.972438][T12910] ? __alloc_skb+0x18d/0x7a0 [ 567.972514][T12910] ? __alloc_skb+0x1db/0x7a0 [ 567.972590][T12910] __alloc_skb+0x1db/0x7a0 [ 567.972665][T12910] netlink_sendmsg+0x5d4/0xb40 [ 567.972899][T12910] ? __pfx_netlink_sendmsg+0x10/0x10 [ 567.973006][T12910] ? apparmor_socket_sendmsg+0x98/0x360 [ 567.973109][T12910] ? __pfx_netlink_sendmsg+0x10/0x10 [ 567.973185][T12910] sock_sendmsg_nosec+0x13a/0x180 [ 567.973286][T12910] ____sys_sendmsg+0x54e/0x850 [ 567.973394][T12910] ? __pfx_____sys_sendmsg+0x10/0x10 [ 567.973486][T12910] ? import_iovec+0x73/0xa0 [ 567.973560][T12910] ___sys_sendmsg+0x2a5/0x360 [ 567.973635][T12910] ? __lock_acquire+0x6df/0x2e50 [ 567.973732][T12910] ? __pfx____sys_sendmsg+0x10/0x10 [ 567.973893][T12910] ? __fget_files+0x2a/0x420 [ 567.973977][T12910] ? __fget_files+0x3a2/0x420 [ 567.974065][T12910] __x64_sys_sendmsg+0x1b1/0x290 [ 567.974150][T12910] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 567.974279][T12910] do_syscall_64+0x166/0x520 [ 567.974334][T12910] ? trace_irq_disable+0x3b/0x140 [ 567.974422][T12910] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.974484][T12910] ? clear_bhb_loop+0x70/0xc0 [ 567.974557][T12910] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.974621][T12910] RIP: 0033:0x7fe690f9e0d9 [ 567.974679][T12910] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 567.974740][T12910] RSP: 002b:00007fe691dcb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 567.974819][T12910] RAX: ffffffffffffffda RBX: 00007fe691225fa0 RCX: 00007fe690f9e0d9 [ 567.974864][T12910] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 567.974905][T12910] RBP: 00007fe691dcb090 R08: 0000000000000000 R09: 0000000000000000 [ 567.974946][T12910] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 567.975020][T12910] R13: 00007fe691226038 R14: 00007fe691225fa0 R15: 00007fffe5c208e8 [ 567.975106][T12910] [ 570.295898][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 570.296805][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 570.414450][T12831] bridge0: port 1(bridge_slave_0) entered blocking state [ 570.414734][T12831] bridge0: port 1(bridge_slave_0) entered disabled state [ 570.432381][T12831] bridge_slave_0: entered allmulticast mode [ 570.447935][T12831] bridge_slave_0: entered promiscuous mode [ 570.470756][T12831] bridge0: port 2(bridge_slave_1) entered blocking state [ 570.471035][T12831] bridge0: port 2(bridge_slave_1) entered disabled state [ 570.552659][T12831] bridge_slave_1: entered allmulticast mode [ 570.563226][T12831] bridge_slave_1: entered promiscuous mode [ 570.769058][T12831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 570.806188][T12831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 570.892014][ T5700] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 570.940586][T12831] team0: Port device team_slave_0 added [ 570.951168][T12831] team0: Port device team_slave_1 added [ 571.034882][T12831] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 571.034964][T12831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 571.035047][T12831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 571.083905][ T5700] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 571.101895][ T5700] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 571.102020][ T5700] usb 2-1: config 0 has no interface number 0 [ 571.102133][ T5700] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 571.102204][ T5700] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 571.144575][T12831] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 571.144614][T12831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 571.144760][T12831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 571.145311][ T5700] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.145384][ T5700] usb 2-1: Product: syz [ 571.145428][ T5700] usb 2-1: Manufacturer: syz [ 571.145478][ T5700] usb 2-1: SerialNumber: syz [ 571.219352][ T5700] usb 2-1: config 0 descriptor?? [ 571.253807][ T5700] yurex 2-1:0.50: Could not submitting URB [ 571.254118][ T5700] yurex 2-1:0.50: probe with driver yurex failed with error -5 [ 571.527015][ T5350] usb 2-1: USB disconnect, device number 43 [ 571.755860][T12831] hsr_slave_0: entered promiscuous mode [ 571.771510][T12831] hsr_slave_1: entered promiscuous mode [ 571.794564][T12831] debugfs: 'hsr0' already exists in 'hsr' [ 571.795559][T12831] Cannot create hsr debugfs directory [ 573.621781][T12954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 573.637486][T12954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 573.669290][T12831] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.039288][T12831] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.235595][T12831] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.335088][ T5626] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 574.672464][T12831] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.876098][T12967] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 574.877363][T12967] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 576.660605][T12831] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 576.688662][T12831] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 576.707223][T12831] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 576.725751][T12831] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 576.740599][T12831] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 576.776914][T12831] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 576.817748][T12831] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 576.848974][T12831] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 577.138817][T12831] 8021q: adding VLAN 0 to HW filter on device bond0 [ 577.218269][T12831] 8021q: adding VLAN 0 to HW filter on device team0 [ 577.258974][ T1418] bridge0: port 1(bridge_slave_0) entered blocking state [ 577.259113][ T1418] bridge0: port 1(bridge_slave_0) entered forwarding state [ 577.298651][T11113] bridge0: port 2(bridge_slave_1) entered blocking state [ 577.298937][T11113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 578.906223][T12831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 579.136833][T12831] veth0_vlan: entered promiscuous mode [ 579.177684][T12831] veth1_vlan: entered promiscuous mode [ 579.293083][T12831] veth0_macvtap: entered promiscuous mode [ 579.318367][T12831] veth1_macvtap: entered promiscuous mode [ 579.380878][T12831] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 579.403470][T12831] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 579.463927][T11113] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 579.477945][T11113] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 579.493777][T11113] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 579.512560][T11113] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.774645][T11118] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 580.774744][T11118] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 580.879828][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 580.880754][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 581.425646][T13010] netlink: 'syz.2.2432': attribute type 16 has an invalid length. [ 582.137444][T13022] netlink: 'syz.1.2434': attribute type 10 has an invalid length. [ 582.479008][T13025] netlink: 'syz.3.2427': attribute type 64 has an invalid length. [ 582.512175][T13026] FAULT_INJECTION: forcing a failure. [ 582.512175][T13026] name failslab, interval 1, probability 0, space 0, times 0 [ 582.513015][T13026] CPU: 1 UID: 0 PID: 13026 Comm: syz.2.2425 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 582.513050][T13026] Tainted: [L]=SOFTLOCKUP [ 582.513060][T13026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 582.513082][T13026] Call Trace: [ 582.513099][T13026] [ 582.513118][T13026] dump_stack_lvl+0xe8/0x150 [ 582.513265][T13026] should_fail_ex+0x410/0x560 [ 582.513438][T13026] ? __alloc_skb+0x1db/0x7a0 [ 582.513514][T13026] should_failslab+0xa8/0x100 [ 582.513581][T13026] ? __alloc_skb+0x1db/0x7a0 [ 582.513645][T13026] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 582.513734][T13026] ? __alloc_skb+0x18d/0x7a0 [ 582.513808][T13026] ? __alloc_skb+0x1db/0x7a0 [ 582.513878][T13026] __alloc_skb+0x1db/0x7a0 [ 582.513963][T13026] netlink_sendmsg+0x5d4/0xb40 [ 582.514073][T13026] ? __pfx_netlink_sendmsg+0x10/0x10 [ 582.514179][T13026] ? apparmor_socket_sendmsg+0x98/0x360 [ 582.514274][T13026] ? __pfx_netlink_sendmsg+0x10/0x10 [ 582.514351][T13026] sock_sendmsg_nosec+0x13a/0x180 [ 582.514452][T13026] ____sys_sendmsg+0x54e/0x850 [ 582.514556][T13026] ? __pfx_____sys_sendmsg+0x10/0x10 [ 582.514660][T13026] ? import_iovec+0x73/0xa0 [ 582.514735][T13026] ___sys_sendmsg+0x2a5/0x360 [ 582.514824][T13026] ? __lock_acquire+0x6df/0x2e50 [ 582.514929][T13026] ? __pfx____sys_sendmsg+0x10/0x10 [ 582.515099][T13026] ? __fget_files+0x2a/0x420 [ 582.515173][T13026] ? __fget_files+0x3a2/0x420 [ 582.515270][T13026] __x64_sys_sendmsg+0x1b1/0x290 [ 582.515355][T13026] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 582.515496][T13026] do_syscall_64+0x166/0x520 [ 582.515583][T13026] ? trace_irq_disable+0x3b/0x140 [ 582.515664][T13026] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 582.515730][T13026] ? clear_bhb_loop+0x70/0xc0 [ 582.515805][T13026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 582.515871][T13026] RIP: 0033:0x7fe690f9e0d9 [ 582.515934][T13026] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 582.515987][T13026] RSP: 002b:00007fe691dcb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 582.516059][T13026] RAX: ffffffffffffffda RBX: 00007fe691225fa0 RCX: 00007fe690f9e0d9 [ 582.516119][T13026] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 582.516168][T13026] RBP: 00007fe691dcb090 R08: 0000000000000000 R09: 0000000000000000 [ 582.516218][T13026] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 582.516252][T13026] R13: 00007fe691226038 R14: 00007fe691225fa0 R15: 00007fffe5c208e8 [ 582.516340][T13026] [ 583.197987][T13035] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2428'. [ 583.198269][T13035] bridge_slave_1: left allmulticast mode [ 583.198366][T13035] bridge_slave_1: left promiscuous mode [ 583.207113][T13035] bridge0: port 2(bridge_slave_1) entered disabled state [ 583.249269][T13036] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 583.284915][T13035] bridge_slave_0: left allmulticast mode [ 583.284966][T13035] bridge_slave_0: left promiscuous mode [ 583.312057][T13035] bridge0: port 1(bridge_slave_0) entered disabled state [ 583.511044][ T6476] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 583.683901][ T6476] usb 4-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.00 [ 583.697345][ T6476] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 583.697510][ T6476] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 583.697600][ T6476] usb 4-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 583.735066][ T6476] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.735231][ T6476] usb 4-1: Product: syz [ 583.735268][ T6476] usb 4-1: Manufacturer: syz [ 583.735297][ T6476] usb 4-1: SerialNumber: syz [ 584.033831][ T6476] speedtch 4-1:1.0: speedtch_bind: data interface not found! [ 584.034055][ T6476] speedtch 4-1:1.0: usbatm_usb_probe: bind failed: -19! [ 584.064033][ T6476] usb 4-1: USB disconnect, device number 37 [ 584.627238][T13040] FAULT_INJECTION: forcing a failure. [ 584.627238][T13040] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 584.627397][T13040] CPU: 0 UID: 0 PID: 13040 Comm: syz.1.2433 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 584.627466][T13040] Tainted: [L]=SOFTLOCKUP [ 584.627489][T13040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 584.627525][T13040] Call Trace: [ 584.627542][T13040] [ 584.627565][T13040] dump_stack_lvl+0xe8/0x150 [ 584.627643][T13040] should_fail_ex+0x410/0x560 [ 584.627711][T13040] _copy_from_user+0x2d/0xb0 [ 584.627758][T13040] ___sys_sendmsg+0x1c6/0x360 [ 584.627786][T13040] ? __lock_acquire+0x6df/0x2e50 [ 584.627823][T13040] ? __pfx____sys_sendmsg+0x10/0x10 [ 584.627885][T13040] ? __fget_files+0x2a/0x420 [ 584.627911][T13040] ? __fget_files+0x3a2/0x420 [ 584.627948][T13040] __x64_sys_sendmsg+0x1b1/0x290 [ 584.627981][T13040] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 584.628031][T13040] do_syscall_64+0x166/0x520 [ 584.628054][T13040] ? trace_irq_disable+0x3b/0x140 [ 584.628087][T13040] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.628112][T13040] ? clear_bhb_loop+0x70/0xc0 [ 584.628140][T13040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.628164][T13040] RIP: 0033:0x7f323019e0d9 [ 584.628185][T13040] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 584.628206][T13040] RSP: 002b:00007f3231060028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 584.628232][T13040] RAX: ffffffffffffffda RBX: 00007f3230425fa0 RCX: 00007f323019e0d9 [ 584.628250][T13040] RDX: 0000000000000004 RSI: 0000200000000040 RDI: 0000000000000010 [ 584.628266][T13040] RBP: 00007f3231060090 R08: 0000000000000000 R09: 0000000000000000 [ 584.628282][T13040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 584.628297][T13040] R13: 00007f3230426038 R14: 00007f3230425fa0 R15: 00007ffe9ec8c488 [ 584.628332][T13040] [ 585.067545][T13041] netlink: 'syz.2.2435': attribute type 16 has an invalid length. [ 585.453281][ T9] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 585.563062][T13052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 585.573742][T13052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 585.621525][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 585.636213][ T9] usb 4-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 585.660334][ T9] usb 4-1: config 0 has an invalid interface number: 107 but max is 0 [ 585.660440][ T9] usb 4-1: config 0 has no interface number 0 [ 585.660564][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 585.695753][ T9] usb 4-1: config 0 descriptor?? [ 585.716100][ T9] gspca_main: sunplus-2.14.0 probing 041e:400b [ 586.623415][ T9] gspca_sunplus: reg_w_riv err -110 [ 586.623748][ T9] sunplus 4-1:0.107: probe with driver sunplus failed with error -110 [ 586.977855][ T9] usb 4-1: USB disconnect, device number 38 [ 588.959370][T13072] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 588.966063][T13072] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 589.079549][ T5626] Bluetooth: hci3: unexpected event for opcode 0x0c1b [ 589.212298][T13072] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 589.213588][T13072] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 589.380285][ T9] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 589.557489][ T9] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 589.575973][ T9] usb 4-1: config 0 has an invalid interface number: 50 but max is 0 [ 589.576084][ T9] usb 4-1: config 0 has no interface number 0 [ 589.576205][ T9] usb 4-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 589.576280][ T9] usb 4-1: config 0 interface 50 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 589.659234][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 589.659339][ T9] usb 4-1: Product: syz [ 589.659414][ T9] usb 4-1: Manufacturer: syz [ 589.659468][ T9] usb 4-1: SerialNumber: syz [ 589.721790][ T9] usb 4-1: config 0 descriptor?? [ 589.763147][ T9] yurex 4-1:0.50: Could not submitting URB [ 589.776477][ T9] yurex 4-1:0.50: probe with driver yurex failed with error -5 [ 590.218394][ T6476] usb 4-1: USB disconnect, device number 39 [ 591.514846][T13100] syzkaller1: entered promiscuous mode [ 591.514960][T13100] syzkaller1: entered allmulticast mode [ 593.479594][T13108] syzkaller1: entered promiscuous mode [ 593.491596][T13108] syzkaller1: entered allmulticast mode [ 593.586215][T13113] FAULT_INJECTION: forcing a failure. [ 593.586215][T13113] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 593.586316][T13113] CPU: 0 UID: 0 PID: 13113 Comm: syz.2.2455 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 593.586384][T13113] Tainted: [L]=SOFTLOCKUP [ 593.586406][T13113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 593.586434][T13113] Call Trace: [ 593.586458][T13113] [ 593.586483][T13113] dump_stack_lvl+0xe8/0x150 [ 593.586552][T13113] should_fail_ex+0x410/0x560 [ 593.586639][T13113] _copy_from_iter+0x1d3/0x1660 [ 593.586730][T13113] ? __lock_acquire+0x6df/0x2e50 [ 593.586804][T13113] ? __pfx__copy_from_iter+0x10/0x10 [ 593.586905][T13113] tun_get_user+0x52f/0x44d0 [ 593.587070][T13113] ? aa_file_perm+0x18b/0x15f0 [ 593.587145][T13113] ? aa_file_perm+0x4ed/0x15f0 [ 593.587196][T13113] ? __pfx_tun_get_user+0x10/0x10 [ 593.587236][T13113] ? __lock_acquire+0x6df/0x2e50 [ 593.587293][T13113] ? kstrtoull+0x137/0x1d0 [ 593.587352][T13113] ? ref_tracker_alloc+0x341/0x4b0 [ 593.587457][T13113] ? lock_acquire+0x115/0x350 [ 593.587541][T13113] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 593.587618][T13113] ? lock_acquire+0x115/0x350 [ 593.587692][T13113] ? tun_get+0x1c/0x2f0 [ 593.587754][T13113] ? tun_get+0x1c/0x2f0 [ 593.587804][T13113] ? tun_get+0x1c/0x2f0 [ 593.587878][T13113] tun_chr_write_iter+0x113/0x200 [ 593.587944][T13113] vfs_write+0x612/0xba0 [ 593.588022][T13113] ? __pfx_vfs_write+0x10/0x10 [ 593.588102][T13113] ? __fget_files+0x2a/0x420 [ 593.588158][T13113] ksys_write+0x150/0x270 [ 593.588211][T13113] ? __pfx_ksys_write+0x10/0x10 [ 593.588297][T13113] do_syscall_64+0x166/0x520 [ 593.588353][T13113] ? trace_irq_disable+0x3b/0x140 [ 593.588419][T13113] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.588471][T13113] ? clear_bhb_loop+0x70/0xc0 [ 593.588544][T13113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 593.588596][T13113] RIP: 0033:0x7fe690f9e0d9 [ 593.588645][T13113] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 593.588691][T13113] RSP: 002b:00007fe691daa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 593.588743][T13113] RAX: ffffffffffffffda RBX: 00007fe691226090 RCX: 00007fe690f9e0d9 [ 593.588781][T13113] RDX: 000000000000fdef RSI: 0000200000000240 RDI: 0000000000000003 [ 593.588816][T13113] RBP: 00007fe691daa090 R08: 0000000000000000 R09: 0000000000000000 [ 593.588846][T13113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 593.588880][T13113] R13: 00007fe691226128 R14: 00007fe691226090 R15: 00007fffe5c208e8 [ 593.588936][T13113] [ 594.007836][T13117] syzkaller1: entered promiscuous mode [ 594.007915][T13117] syzkaller1: entered allmulticast mode [ 594.221811][ T31] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 594.269774][ T6476] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 594.372480][T13121] tipc: Enabled bearer , priority 10 [ 594.430073][ T6476] usb 2-1: Using ep0 maxpacket: 16 [ 594.447513][ T6476] usb 2-1: unable to get BOS descriptor or descriptor too short [ 594.447689][ T6476] usb 2-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 0.01 [ 594.483518][ T6476] usb 2-1: config index 0 descriptor too short (expected 22, got 18) [ 594.483674][ T6476] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 594.521943][T13121] tipc: Disabling bearer [ 594.650270][ T31] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 594.666662][ T31] usb 4-1: config 0 has an invalid interface number: 50 but max is 0 [ 594.690751][ T31] usb 4-1: config 0 has no interface number 0 [ 594.691774][ T31] usb 4-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 594.692711][ T31] usb 4-1: config 0 interface 50 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 594.718623][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 594.718707][ T31] usb 4-1: Product: syz [ 594.718758][ T31] usb 4-1: Manufacturer: syz [ 594.718802][ T31] usb 4-1: SerialNumber: syz [ 594.780707][ T31] usb 4-1: config 0 descriptor?? [ 594.873313][ T31] yurex 4-1:0.50: Could not submitting URB [ 594.874479][ T31] yurex 4-1:0.50: probe with driver yurex failed with error -5 [ 595.070244][ T31] usb 4-1: USB disconnect, device number 40 [ 595.192573][T13129] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 595.210562][T13129] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 595.536279][ T6476] usb 2-1: string descriptor 0 read error: -71 [ 595.595343][ T6476] usb 2-1: USB disconnect, device number 44 [ 597.376612][T13150] FAULT_INJECTION: forcing a failure. [ 597.376612][T13150] name failslab, interval 1, probability 0, space 0, times 0 [ 597.376750][T13150] CPU: 0 UID: 0 PID: 13150 Comm: syz.3.2467 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 597.376830][T13150] Tainted: [L]=SOFTLOCKUP [ 597.376848][T13150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 597.376877][T13150] Call Trace: [ 597.376900][T13150] [ 597.376925][T13150] dump_stack_lvl+0xe8/0x150 [ 597.377006][T13150] should_fail_ex+0x410/0x560 [ 597.377093][T13150] should_failslab+0xa8/0x100 [ 597.377153][T13150] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 597.377229][T13150] kmem_cache_alloc_noprof+0xa1/0x600 [ 597.377297][T13150] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 597.377364][T13150] ? kmem_cache_alloc_noprof+0x156/0x600 [ 597.377430][T13150] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 597.377510][T13150] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 597.377610][T13150] mmu_topup_memory_caches+0x21/0x170 [ 597.377691][T13150] kvm_mmu_load+0x9d/0x21e0 [ 597.377779][T13150] ? kvm_msr_allowed+0x9a/0x490 [ 597.377848][T13150] ? kvm_msr_allowed+0x9a/0x490 [ 597.377923][T13150] ? kvm_msr_allowed+0x9a/0x490 [ 597.377997][T13150] ? kvm_msr_allowed+0x3f4/0x490 [ 597.378064][T13150] ? kvm_msr_allowed+0x9a/0x490 [ 597.378137][T13150] ? kvm_apic_has_interrupt+0x740/0x770 [ 597.378251][T13150] vcpu_run+0x4f68/0x79b0 [ 597.378403][T13150] ? update_se+0x90/0x1020 [ 597.378550][T13150] ? __pfx_vcpu_run+0x10/0x10 [ 597.378617][T13150] ? lock_acquire+0x115/0x350 [ 597.378701][T13150] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 597.378738][T13150] ? preempt_schedule_thunk+0x16/0x40 [ 597.378803][T13150] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 597.378849][T13150] ? preempt_schedule_thunk+0x16/0x40 [ 597.378891][T13150] kvm_vcpu_ioctl+0xa61/0xfd0 [ 597.378931][T13150] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 597.378977][T13150] ? hook_file_ioctl+0x1f2/0x600 [ 597.379065][T13150] ? __fget_files+0x2a/0x420 [ 597.379111][T13150] ? __fget_files+0x2a/0x420 [ 597.379143][T13150] ? __fget_files+0x3a2/0x420 [ 597.379168][T13150] ? __fget_files+0x2a/0x420 [ 597.379206][T13150] ? bpf_lsm_file_ioctl+0x9/0x20 [ 597.379233][T13150] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 597.379268][T13150] __se_sys_ioctl+0xfc/0x170 [ 597.379311][T13150] do_syscall_64+0x166/0x520 [ 597.379332][T13150] ? trace_irq_disable+0x3b/0x140 [ 597.379365][T13150] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.379390][T13150] ? clear_bhb_loop+0x70/0xc0 [ 597.379420][T13150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 597.379443][T13150] RIP: 0033:0x7f60f9d9e0d9 [ 597.379465][T13150] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 597.379486][T13150] RSP: 002b:00007f60fac79028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 597.379512][T13150] RAX: ffffffffffffffda RBX: 00007f60fa026090 RCX: 00007f60f9d9e0d9 [ 597.379531][T13150] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 597.379546][T13150] RBP: 00007f60fac79090 R08: 0000000000000000 R09: 0000000000000000 [ 597.379561][T13150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 597.379575][T13150] R13: 00007f60fa026128 R14: 00007f60fa026090 R15: 00007ffd1851df68 [ 597.379612][T13150] [ 597.774404][T13155] jffs2: notice: (13155) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 599.881882][ T31] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 600.093191][ T31] usb 2-1: Using ep0 maxpacket: 16 [ 600.102779][ T31] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 600.118996][ T31] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 600.120979][ T31] usb 2-1: config 0 has no interface number 0 [ 600.121115][ T31] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 600.121198][ T31] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 600.279505][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.280449][ T31] usb 2-1: Product: syz [ 600.281326][ T31] usb 2-1: Manufacturer: syz [ 600.281384][ T31] usb 2-1: SerialNumber: syz [ 600.354567][ T31] usb 2-1: config 0 descriptor?? [ 600.362092][T13178] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 600.362278][T13178] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 600.600225][T13178] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 600.611326][T13178] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 600.970508][T13178] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 600.986885][T13178] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 601.206656][T13178] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 601.229692][T13178] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 601.828860][ T31] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 601.831314][ T31] asix 2-1:0.34: probe with driver asix failed with error -71 [ 601.909949][ T31] usb 2-1: USB disconnect, device number 45 [ 604.080888][ T9] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 604.247606][ T9] usb 2-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.0a [ 604.302589][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 604.324291][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.324403][ T9] usb 2-1: Product: syz [ 604.324490][ T9] usb 2-1: Manufacturer: syz [ 604.324533][ T9] usb 2-1: SerialNumber: syz [ 604.434984][ T9] gspca_main: xirlink-cit-2.14.0 probing 0545:8080 [ 604.534422][ T9] input: xirlink-cit as /devices/platform/dummy_hcd.1/usb2/2-1/input/input70 [ 604.959918][ T9] usb 2-1: USB disconnect, device number 46 [ 605.539229][ T6476] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 605.704950][ T6476] usb 4-1: Using ep0 maxpacket: 16 [ 605.721435][ T6476] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice=4f.14 [ 605.738106][ T6476] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 605.738230][ T6476] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 605.760549][ T6476] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 605.796040][ T6476] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.796152][ T6476] usb 4-1: Product: syz [ 605.796237][ T6476] usb 4-1: Manufacturer: syz [ 605.796287][ T6476] usb 4-1: SerialNumber: syz [ 605.850114][ T6476] usb 4-1: config 0 descriptor?? [ 605.944365][T13203] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 606.023732][ T6476] mceusb 4-1:0.0: mceusb_dev_probe: device setup failed! [ 606.023813][ T6476] mceusb 4-1:0.0: probe with driver mceusb failed with error -12 [ 606.425079][ T5700] usb 4-1: USB disconnect, device number 41 [ 608.184565][T13248] FAULT_INJECTION: forcing a failure. [ 608.184565][T13248] name failslab, interval 1, probability 0, space 0, times 0 [ 608.184675][T13248] CPU: 0 UID: 0 PID: 13248 Comm: syz.3.2505 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 608.184754][T13248] Tainted: [L]=SOFTLOCKUP [ 608.184771][T13248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 608.184806][T13248] Call Trace: [ 608.184830][T13248] [ 608.184847][T13248] dump_stack_lvl+0xe8/0x150 [ 608.184933][T13248] should_fail_ex+0x410/0x560 [ 608.185013][T13248] should_failslab+0xa8/0x100 [ 608.185072][T13248] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 608.185146][T13248] kmem_cache_alloc_noprof+0xa1/0x600 [ 608.185205][T13248] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 608.185272][T13248] ? kmem_cache_alloc_noprof+0x156/0x600 [ 608.185343][T13248] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 608.185431][T13248] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 608.185523][T13248] mmu_topup_memory_caches+0x21/0x170 [ 608.185608][T13248] kvm_mmu_load+0x9d/0x21e0 [ 608.185685][T13248] ? kvm_msr_allowed+0x9a/0x490 [ 608.185761][T13248] ? kvm_msr_allowed+0x3f4/0x490 [ 608.185839][T13248] ? kvm_msr_allowed+0x9a/0x490 [ 608.185912][T13248] ? kvm_msr_allowed+0x9a/0x490 [ 608.185996][T13248] ? kvm_apic_has_interrupt+0x740/0x770 [ 608.186086][T13248] vcpu_run+0x4f68/0x79b0 [ 608.186226][T13248] ? update_se+0x90/0x1020 [ 608.186375][T13248] ? __pfx_vcpu_run+0x10/0x10 [ 608.186451][T13248] ? lock_acquire+0x115/0x350 [ 608.186536][T13248] ? vmx_set_nmi_mask+0x120/0x280 [ 608.186625][T13248] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 608.186712][T13248] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 608.186811][T13248] kvm_vcpu_ioctl+0xa61/0xfd0 [ 608.186901][T13248] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 608.186962][T13248] ? hook_file_ioctl+0x1f2/0x600 [ 608.187058][T13248] ? __fget_files+0x2a/0x420 [ 608.187119][T13248] ? __fget_files+0x2a/0x420 [ 608.187182][T13248] ? __fget_files+0x3a2/0x420 [ 608.187241][T13248] ? __fget_files+0x2a/0x420 [ 608.187306][T13248] ? bpf_lsm_file_ioctl+0x9/0x20 [ 608.187376][T13248] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 608.187451][T13248] __se_sys_ioctl+0xfc/0x170 [ 608.187528][T13248] do_syscall_64+0x166/0x520 [ 608.187585][T13248] ? trace_irq_disable+0x3b/0x140 [ 608.187652][T13248] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.187713][T13248] ? clear_bhb_loop+0x70/0xc0 [ 608.187776][T13248] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.187827][T13248] RIP: 0033:0x7f60f9d9e0d9 [ 608.187877][T13248] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 608.187925][T13248] RSP: 002b:00007f60fac9a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 608.187978][T13248] RAX: ffffffffffffffda RBX: 00007f60fa025fa0 RCX: 00007f60f9d9e0d9 [ 608.188017][T13248] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 608.188051][T13248] RBP: 00007f60fac9a090 R08: 0000000000000000 R09: 0000000000000000 [ 608.188072][T13248] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 608.188086][T13248] R13: 00007f60fa026038 R14: 00007f60fa025fa0 R15: 00007ffd1851df68 [ 608.188134][T13248] [ 609.804367][T13261] FAULT_INJECTION: forcing a failure. [ 609.804367][T13261] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 609.820880][T13261] CPU: 0 UID: 0 PID: 13261 Comm: syz.2.2509 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 609.820969][T13261] Tainted: [L]=SOFTLOCKUP [ 609.820993][T13261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 609.821027][T13261] Call Trace: [ 609.821052][T13261] [ 609.821077][T13261] dump_stack_lvl+0xe8/0x150 [ 609.821161][T13261] should_fail_ex+0x410/0x560 [ 609.821249][T13261] _copy_to_user+0x31/0xb0 [ 609.821305][T13261] simple_read_from_buffer+0xe1/0x170 [ 609.821381][T13261] proc_fail_nth_read+0x1bb/0x230 [ 609.821456][T13261] ? common_file_perm+0x20e/0x2b0 [ 609.821543][T13261] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 609.821632][T13261] ? rw_verify_area+0x24a/0x4c0 [ 609.821713][T13261] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 609.821782][T13261] vfs_read+0x213/0xa80 [ 609.821858][T13261] ? __pfx___mutex_lock+0x10/0x10 [ 609.821920][T13261] ? __pfx_vfs_read+0x10/0x10 [ 609.821986][T13261] ? __fget_files+0x2a/0x420 [ 609.822048][T13261] ? __fget_files+0x3a2/0x420 [ 609.822102][T13261] ? __fget_files+0x2a/0x420 [ 609.822180][T13261] ksys_read+0x150/0x270 [ 609.822255][T13261] ? __pfx_ksys_read+0x10/0x10 [ 609.822312][T13261] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 609.822414][T13261] do_syscall_64+0x166/0x520 [ 609.822456][T13261] ? trace_irq_disable+0x3b/0x140 [ 609.822580][T13261] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.822635][T13261] ? clear_bhb_loop+0x70/0xc0 [ 609.822701][T13261] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.822755][T13261] RIP: 0033:0x7fe690f5e90e [ 609.822808][T13261] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 609.822859][T13261] RSP: 002b:00007fe691dcafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 609.822913][T13261] RAX: ffffffffffffffda RBX: 00007fe691dcb6c0 RCX: 00007fe690f5e90e [ 609.822953][T13261] RDX: 000000000000000f RSI: 00007fe691dcb0a0 RDI: 0000000000000008 [ 609.822989][T13261] RBP: 00007fe691dcb090 R08: 0000000000000000 R09: 0000000000000000 [ 609.823023][T13261] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 609.823062][T13261] R13: 00007fe691226038 R14: 00007fe691225fa0 R15: 00007fffe5c208e8 [ 609.823134][T13261] [ 612.578772][T13295] syzkaller0: entered allmulticast mode [ 613.499114][T13305] netlink: 'syz.2.2519': attribute type 1 has an invalid length. [ 614.122482][ T5626] Bluetooth: hci3: unexpected event for opcode 0xd7cb [ 615.082899][T13317] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 615.411225][ T6476] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 615.572749][ T6476] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice= 1.08 [ 615.615982][ T6476] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 615.616166][ T6476] usb 2-1: config 1 interface 0 altsetting 0 has 6 endpoint descriptors, different from the interface descriptor's value: 8 [ 615.732108][ T6476] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.732199][ T6476] usb 2-1: Product: syz [ 615.732287][ T6476] usb 2-1: Manufacturer: syz [ 615.732308][ T6476] usb 2-1: SerialNumber: syz [ 617.331341][ T6476] ath6kl: Failed to submit usb control message: -110 [ 617.331644][ T6476] ath6kl: unable to send the bmi data to the device: -110 [ 617.331862][ T6476] ath6kl: Unable to send get target info: -110 [ 617.704439][ T6476] ath6kl: Failed to init ath6kl core: -110 [ 617.787997][ T6476] ath6kl_usb 2-1:1.0: probe with driver ath6kl_usb failed with error -110 [ 618.737330][ T6476] usb 2-1: USB disconnect, device number 47 [ 619.374573][T13341] tmpfs: Invalid uid '0x00000000ffffffff' [ 620.948026][T13359] FAULT_INJECTION: forcing a failure. [ 620.948026][T13359] name failslab, interval 1, probability 0, space 0, times 0 [ 620.948167][T13359] CPU: 0 UID: 0 PID: 13359 Comm: syz.1.2531 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 620.948237][T13359] Tainted: [L]=SOFTLOCKUP [ 620.948261][T13359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 620.948290][T13359] Call Trace: [ 620.948314][T13359] [ 620.948343][T13359] dump_stack_lvl+0xe8/0x150 [ 620.948421][T13359] should_fail_ex+0x410/0x560 [ 620.948510][T13359] should_failslab+0xa8/0x100 [ 620.948562][T13359] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 620.948630][T13359] kmem_cache_alloc_noprof+0xa1/0x600 [ 620.948716][T13359] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 620.948782][T13359] ? kmem_cache_alloc_noprof+0x156/0x600 [ 620.948848][T13359] ? __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 620.948944][T13359] __kvm_mmu_topup_memory_cache+0x1b2/0x600 [ 620.949045][T13359] mmu_topup_memory_caches+0x21/0x170 [ 620.949126][T13359] kvm_mmu_load+0x9d/0x21e0 [ 620.949206][T13359] ? kvm_msr_allowed+0x9a/0x490 [ 620.949269][T13359] ? kvm_msr_allowed+0x9a/0x490 [ 620.949338][T13359] ? kvm_msr_allowed+0x9a/0x490 [ 620.949413][T13359] ? kvm_msr_allowed+0x3f4/0x490 [ 620.949467][T13359] ? kvm_msr_allowed+0x9a/0x490 [ 620.949542][T13359] ? kvm_apic_has_interrupt+0x740/0x770 [ 620.949632][T13359] vcpu_run+0x4f68/0x79b0 [ 620.949775][T13359] ? update_se+0x90/0x1020 [ 620.949927][T13359] ? __pfx_vcpu_run+0x10/0x10 [ 620.949994][T13359] ? lock_acquire+0x115/0x350 [ 620.950108][T13359] kvm_arch_vcpu_ioctl_run+0xe87/0x19c0 [ 620.950188][T13359] ? kvm_arch_vcpu_ioctl_run+0x1f8/0x19c0 [ 620.950231][T13359] ? kvm_vcpu_ioctl+0xe8f/0xfd0 [ 620.950315][T13359] kvm_vcpu_ioctl+0xa61/0xfd0 [ 620.950405][T13359] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 620.950473][T13359] ? hook_file_ioctl+0x1f2/0x600 [ 620.950590][T13359] ? __fget_files+0x2a/0x420 [ 620.950663][T13359] ? __fget_files+0x2a/0x420 [ 620.950727][T13359] ? __fget_files+0x3a2/0x420 [ 620.950781][T13359] ? __fget_files+0x2a/0x420 [ 620.950847][T13359] ? bpf_lsm_file_ioctl+0x9/0x20 [ 620.950911][T13359] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 620.950989][T13359] __se_sys_ioctl+0xfc/0x170 [ 620.951052][T13359] do_syscall_64+0x166/0x520 [ 620.951104][T13359] ? trace_irq_disable+0x3b/0x140 [ 620.951174][T13359] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.951226][T13359] ? clear_bhb_loop+0x70/0xc0 [ 620.951291][T13359] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 620.951345][T13359] RIP: 0033:0x7f323019e0d9 [ 620.951390][T13359] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 620.951438][T13359] RSP: 002b:00007f3231060028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 620.951501][T13359] RAX: ffffffffffffffda RBX: 00007f3230425fa0 RCX: 00007f323019e0d9 [ 620.951539][T13359] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 620.951575][T13359] RBP: 00007f3231060090 R08: 0000000000000000 R09: 0000000000000000 [ 620.951606][T13359] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 620.951635][T13359] R13: 00007f3230426038 R14: 00007f3230425fa0 R15: 00007ffe9ec8c488 [ 620.951721][T13359] [ 622.487489][ T5700] usb 2-1: new low-speed USB device number 48 using dummy_hcd [ 622.627254][ T5700] usb 2-1: device descriptor read/64, error -71 [ 622.694894][T13386] FAULT_INJECTION: forcing a failure. [ 622.694894][T13386] name failslab, interval 1, probability 0, space 0, times 0 [ 622.695052][T13386] CPU: 0 UID: 0 PID: 13386 Comm: syz.3.2536 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 622.695123][T13386] Tainted: [L]=SOFTLOCKUP [ 622.695146][T13386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 622.695181][T13386] Call Trace: [ 622.695199][T13386] [ 622.695226][T13386] dump_stack_lvl+0xe8/0x150 [ 622.695304][T13386] should_fail_ex+0x410/0x560 [ 622.695385][T13386] ? __alloc_skb+0x1db/0x7a0 [ 622.695445][T13386] should_failslab+0xa8/0x100 [ 622.695506][T13386] ? __alloc_skb+0x1db/0x7a0 [ 622.695544][T13386] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 622.695617][T13386] ? __alloc_skb+0x18d/0x7a0 [ 622.695657][T13386] ? __alloc_skb+0x1db/0x7a0 [ 622.695702][T13386] __alloc_skb+0x1db/0x7a0 [ 622.695776][T13386] netlink_sendmsg+0x5d4/0xb40 [ 622.695870][T13386] ? __pfx_netlink_sendmsg+0x10/0x10 [ 622.695960][T13386] ? apparmor_socket_sendmsg+0x98/0x360 [ 622.696051][T13386] ? __pfx_netlink_sendmsg+0x10/0x10 [ 622.696125][T13386] sock_sendmsg_nosec+0x13a/0x180 [ 622.696206][T13386] ____sys_sendmsg+0x54e/0x850 [ 622.696290][T13386] ? __pfx_____sys_sendmsg+0x10/0x10 [ 622.696372][T13386] ? import_iovec+0x73/0xa0 [ 622.696436][T13386] ___sys_sendmsg+0x2a5/0x360 [ 622.696486][T13386] ? __lock_acquire+0x6df/0x2e50 [ 622.696522][T13386] ? __pfx____sys_sendmsg+0x10/0x10 [ 622.696610][T13386] ? __fget_files+0x2a/0x420 [ 622.696636][T13386] ? __fget_files+0x3a2/0x420 [ 622.696673][T13386] __x64_sys_sendmsg+0x1b1/0x290 [ 622.696705][T13386] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 622.696777][T13386] do_syscall_64+0x166/0x520 [ 622.696798][T13386] ? trace_irq_disable+0x3b/0x140 [ 622.696845][T13386] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 622.696889][T13386] ? clear_bhb_loop+0x70/0xc0 [ 622.696945][T13386] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 622.696968][T13386] RIP: 0033:0x7f60f9d9e0d9 [ 622.696990][T13386] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 622.697011][T13386] RSP: 002b:00007f60fac9a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 622.697044][T13386] RAX: ffffffffffffffda RBX: 00007f60fa025fa0 RCX: 00007f60f9d9e0d9 [ 622.697062][T13386] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 622.697077][T13386] RBP: 00007f60fac9a090 R08: 0000000000000000 R09: 0000000000000000 [ 622.697092][T13386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 622.697106][T13386] R13: 00007f60fa026038 R14: 00007f60fa025fa0 R15: 00007ffd1851df68 [ 622.697140][T13386] [ 623.047963][ T5700] usb 2-1: new low-speed USB device number 49 using dummy_hcd [ 623.217563][ T5700] usb 2-1: device descriptor read/64, error -71 [ 623.329169][ T5700] usb usb2-port1: attempt power cycle [ 623.717619][ T5700] usb 2-1: new low-speed USB device number 50 using dummy_hcd [ 623.749383][ T5700] usb 2-1: device descriptor read/8, error -71 [ 623.989550][ T5700] usb 2-1: new low-speed USB device number 51 using dummy_hcd [ 624.018932][ T5700] usb 2-1: device descriptor read/8, error -71 [ 624.132479][ T5700] usb usb2-port1: unable to enumerate USB device [ 628.140409][T13441] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2550'. [ 628.742106][T13446] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2551'. [ 628.826729][T13446] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2551'. [ 628.826843][T13446] netlink: 'syz.3.2551': attribute type 3 has an invalid length. [ 628.826953][T13446] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2551'. [ 631.052213][T13472] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 631.080815][T13472] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 631.726023][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 631.726967][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 633.447330][ T5700] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 633.620404][ T5700] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 633.713724][ T5700] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.766690][ T5700] usb 4-1: config 0 descriptor?? [ 633.876452][ T5700] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 634.271287][T13504] tipc: Cannot configure node identity twice [ 635.712269][ T5700] usb 4-1: USB disconnect, device number 42 [ 638.109775][T13531] IPv6: Can't replace route, no match found [ 638.159578][T13529] sctp: [Deprecated]: syz.1.2571 (pid 13529) Use of struct sctp_assoc_value in delayed_ack socket option. [ 638.159578][T13529] Use struct sctp_sack_info instead [ 638.177316][T13529] hugetlbfs: Unknown parameter 'data' [ 638.683698][T13537] gadgetfs: bound to dummy_udc driver [ 639.235808][T13545] sg_write: data in/out 408028/56 bytes for SCSI command 0x0-- guessing data in; [ 639.235808][T13545] program syz.1.2577 not setting count and/or reply_len properly [ 639.319327][T13544] sg_write: data in/out 713604351/1 bytes for SCSI command 0xc5-- guessing data in; [ 639.319327][T13544] program syz.1.2577 not setting count and/or reply_len properly [ 643.731674][T13569] kvm: pic: non byte write [ 646.267044][T13581] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 646.388477][T13581] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 646.575184][ T6476] kernel write not supported for file /uinput (pid: 6476 comm: kworker/0:6) [ 648.134265][T13592] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2593'. [ 649.654125][T13605] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 649.669413][T13605] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 649.682667][T13605] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 649.712087][T13605] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 649.732142][T13605] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 650.330084][T13610] ublk_ctrl_add_dev: invalid recovery flags 10 [ 651.792880][ T5626] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 651.878033][ T5626] Bluetooth: hci2: command tx timeout [ 653.028251][T13626] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2601'. [ 653.028486][T13626] openvswitch: netlink: EtherType 300 is less than min 600 [ 653.954631][ T5626] Bluetooth: hci2: command tx timeout [ 654.529560][T13603] lo speed is unknown, defaulting to 1000 [ 654.547817][T13603] vcan0 speed is unknown, defaulting to 1000 [ 655.525711][T13605] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 655.594132][T13605] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 655.638239][T13605] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 655.712967][T13605] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 655.717358][T13605] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 656.082903][T13605] Bluetooth: hci2: command tx timeout [ 657.798640][ T5626] Bluetooth: hci1: command tx timeout [ 658.114490][ T5626] Bluetooth: hci2: command tx timeout [ 659.874491][ T5626] Bluetooth: hci1: command tx timeout [ 661.313238][T13603] bridge0: port 1(bridge_slave_0) entered blocking state [ 661.321214][T13603] bridge0: port 1(bridge_slave_0) entered disabled state [ 661.321472][T13603] bridge_slave_0: entered allmulticast mode [ 661.359124][T13603] bridge_slave_0: entered promiscuous mode [ 661.401002][T13603] bridge0: port 2(bridge_slave_1) entered blocking state [ 661.431856][T13603] bridge0: port 2(bridge_slave_1) entered disabled state [ 661.433826][T13603] bridge_slave_1: entered allmulticast mode [ 661.545267][T13603] bridge_slave_1: entered promiscuous mode [ 661.954487][ T5626] Bluetooth: hci1: command tx timeout [ 662.685751][T13603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 662.735295][T13603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 663.392877][T13633] lo speed is unknown, defaulting to 1000 [ 663.397868][T13633] vcan0 speed is unknown, defaulting to 1000 [ 663.445223][T13603] team0: Port device team_slave_0 added [ 663.452471][T13603] team0: Port device team_slave_1 added [ 664.034187][ T5626] Bluetooth: hci1: command tx timeout [ 664.163569][T13603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 664.163650][T13603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 664.170684][T13603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 664.221410][T13603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 664.221498][T13603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 664.221622][T13603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 665.157513][T13603] hsr_slave_0: entered promiscuous mode [ 665.172720][T13603] hsr_slave_1: entered promiscuous mode [ 665.185403][T13603] debugfs: 'hsr0' already exists in 'hsr' [ 665.185473][T13603] Cannot create hsr debugfs directory [ 666.018290][ T6073] IPVS: starting estimator thread 0... [ 666.484019][T13672] IPVS: using max 7 ests per chain, 16800 per kthread [ 669.785857][T13603] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 671.082965][T13603] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 671.825323][T13693] ------------[ cut here ]------------ [ 671.825391][T13693] failed to allocate ring buffer on CPU 0 [ 671.825479][T13693] WARNING: kernel/trace/ring_buffer.c:8029 at trace_rb_cpu_prepare+0x330/0x3c0, CPU#0: syz.2.2616/13693 [ 671.851972][T13693] Modules linked in: [ 671.856151][T13693] CPU: 0 UID: 0 PID: 13693 Comm: syz.2.2616 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 671.867268][T13693] Tainted: [L]=SOFTLOCKUP [ 671.871630][T13693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 671.882512][T13693] RIP: 0010:trace_rb_cpu_prepare+0x332/0x3c0 [ 671.888647][T13693] Code: 08 f0 48 0f ab 03 31 c0 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d e9 cd 1e 25 0a cc e8 97 32 fc ff 48 8d 3d c0 c8 d3 0e 89 ee <67> 48 0f b9 3a b8 f4 ff ff ff eb d2 e8 7d 32 fc ff e9 ef fe ff ff [ 671.911190][T13693] RSP: 0018:ffffc900036877e0 EFLAGS: 00010283 [ 671.918165][T13693] RAX: ffffffff81cbacd9 RBX: dffffc0000000000 RCX: 0000000000080000 [ 671.926773][T13693] RDX: ffffc9001a419000 RSI: 0000000000000000 RDI: ffffffff909f75a0 [ 671.934948][T13693] RBP: 0000000000000000 R08: ffffffff909ba57f R09: 1ffffffff21374af [ 671.943232][T13693] R10: dffffc0000000000 R11: fffffbfff21374b0 R12: 0000000000000000 [ 671.951406][T13693] R13: ffff888059fb6e80 R14: ffff88807c0970a8 R15: 0000000000000000 [ 671.960172][T13693] FS: 00007fe691daa6c0(0000) GS:ffff88812488b000(0000) knlGS:0000000000000000 [ 671.969529][T13693] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 671.976298][T13693] CR2: 00007f5df6df14b8 CR3: 000000002bea6000 CR4: 00000000003526f0 [ 671.984525][T13693] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000001800 [ 671.992755][T13693] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 672.000879][T13693] Call Trace: [ 672.004295][T13693] [ 672.007294][T13693] ? __pfx_trace_rb_cpu_prepare+0x10/0x10 [ 672.013242][T13693] cpuhp_invoke_callback+0x498/0x810 [ 672.018978][T13693] ? __pfx___mutex_lock+0x10/0x10 [ 672.024333][T13693] ? __pfx_trace_rb_cpu_prepare+0x10/0x10 [ 672.030155][T13693] cpuhp_issue_call+0x3f0/0x750 [ 672.035751][T13693] __cpuhp_state_add_instance_cpuslocked+0x225/0x560 [ 672.042752][T13693] __cpuhp_state_add_instance+0x25/0x40 [ 672.048422][T13693] alloc_buffer+0x197a/0x1e70 [ 672.053371][T13693] __ring_buffer_alloc+0x2c/0x40 [ 672.058461][T13693] allocate_trace_buffer+0x1d2/0x950 [ 672.064028][T13693] ? __kmalloc_node_track_caller_noprof+0x2eb/0x720 [ 672.070681][T13693] ? trace_array_create_systems+0x75/0xe60 [ 672.076766][T13693] ? __pfx_allocate_trace_buffer+0x10/0x10 [ 672.082816][T13693] ? __raw_spin_lock_init+0x45/0x100 [ 672.088171][T13693] trace_array_create_systems+0x590/0xe60 [ 672.094098][T13693] ? tracefs_syscall_mkdir+0x108/0x190 [ 672.099727][T13693] instance_mkdir+0xd5/0x140 [ 672.104526][T13693] tracefs_syscall_mkdir+0x11a/0x190 [ 672.109954][T13693] ? __pfx_tracefs_syscall_mkdir+0x10/0x10 [ 672.116106][T13693] ? generic_permission+0x2bf/0x670 [ 672.122018][T13693] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 672.127711][T13693] vfs_mkdir+0x40c/0x620 [ 672.132186][T13693] filename_mkdirat+0x285/0x510 [ 672.137224][T13693] ? __pfx_filename_mkdirat+0x10/0x10 [ 672.142790][T13693] ? do_getname+0x151/0x250 [ 672.147373][T13693] __se_sys_mkdirat+0x35/0x150 [ 672.152239][T13693] do_syscall_64+0x166/0x520 [ 672.157068][T13693] ? trace_irq_disable+0x3b/0x140 [ 672.162155][T13693] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.168380][T13693] ? clear_bhb_loop+0x70/0xc0 [ 672.173402][T13693] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.179483][T13693] RIP: 0033:0x7fe690f9e0d9 [ 672.184075][T13693] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 672.204150][T13693] RSP: 002b:00007fe691daa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 672.212742][T13693] RAX: ffffffffffffffda RBX: 00007fe691226090 RCX: 00007fe690f9e0d9 [ 672.220767][T13693] RDX: 00000000000001ff RSI: 0000200000000100 RDI: ffffffffffffff9c [ 672.229300][T13693] RBP: 00007fe691035024 R08: 0000000000000000 R09: 0000000000000000 [ 672.237695][T13693] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 672.246007][T13693] R13: 00007fe691226128 R14: 00007fe691226090 R15: 00007fffe5c208e8 [ 672.254285][T13693] [ 672.257435][T13693] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 672.264815][T13693] CPU: 0 UID: 0 PID: 13693 Comm: syz.2.2616 Tainted: G L syzkaller #0 PREEMPT(lazy) [ 672.275892][T13693] Tainted: [L]=SOFTLOCKUP [ 672.280275][T13693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 672.290397][T13693] Call Trace: [ 672.293801][T13693] [ 672.296794][T13693] vpanic+0x56d/0xa60 [ 672.300934][T13693] ? __pfx__printk+0x10/0x10 [ 672.305613][T13693] ? __pfx_vpanic+0x10/0x10 [ 672.310179][T13693] ? is_bpf_text_address+0x292/0x2b0 [ 672.315620][T13693] ? is_bpf_text_address+0x26/0x2b0 [ 672.320961][T13693] panic+0xc5/0xd0 [ 672.324804][T13693] ? __pfx_panic+0x10/0x10 [ 672.329326][T13693] __warn+0x315/0x4c0 [ 672.333447][T13693] ? trace_rb_cpu_prepare+0x330/0x3c0 [ 672.338978][T13693] ? trace_rb_cpu_prepare+0x330/0x3c0 [ 672.344488][T13693] __report_bug+0x276/0x570 [ 672.349251][T13693] ? trace_rb_cpu_prepare+0x330/0x3c0 [ 672.354730][T13693] ? __pfx___report_bug+0x10/0x10 [ 672.359917][T13693] ? rb_allocate_cpu_buffer+0x5cc/0x2fc0 [ 672.365735][T13693] ? rb_allocate_cpu_buffer+0x5cc/0x2fc0 [ 672.371534][T13693] report_bug_entry+0x19b/0x290 [ 672.376488][T13693] ? trace_rb_cpu_prepare+0x332/0x3c0 [ 672.381992][T13693] ? trace_rb_cpu_prepare+0x337/0x3c0 [ 672.387471][T13693] handle_bug+0xce/0x200 [ 672.391839][T13693] exc_invalid_op+0x1a/0x50 [ 672.396530][T13693] asm_exc_invalid_op+0x1a/0x20 [ 672.401549][T13693] RIP: 0010:trace_rb_cpu_prepare+0x332/0x3c0 [ 672.407680][T13693] Code: 08 f0 48 0f ab 03 31 c0 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d e9 cd 1e 25 0a cc e8 97 32 fc ff 48 8d 3d c0 c8 d3 0e 89 ee <67> 48 0f b9 3a b8 f4 ff ff ff eb d2 e8 7d 32 fc ff e9 ef fe ff ff [ 672.427483][T13693] RSP: 0018:ffffc900036877e0 EFLAGS: 00010283 [ 672.433656][T13693] RAX: ffffffff81cbacd9 RBX: dffffc0000000000 RCX: 0000000000080000 [ 672.441732][T13693] RDX: ffffc9001a419000 RSI: 0000000000000000 RDI: ffffffff909f75a0 [ 672.449883][T13693] RBP: 0000000000000000 R08: ffffffff909ba57f R09: 1ffffffff21374af [ 672.457914][T13693] R10: dffffc0000000000 R11: fffffbfff21374b0 R12: 0000000000000000 [ 672.465949][T13693] R13: ffff888059fb6e80 R14: ffff88807c0970a8 R15: 0000000000000000 [ 672.474215][T13693] ? trace_rb_cpu_prepare+0x329/0x3c0 [ 672.479778][T13693] ? __pfx_trace_rb_cpu_prepare+0x10/0x10 [ 672.485725][T13693] cpuhp_invoke_callback+0x498/0x810 [ 672.491174][T13693] ? __pfx___mutex_lock+0x10/0x10 [ 672.496326][T13693] ? __pfx_trace_rb_cpu_prepare+0x10/0x10 [ 672.502200][T13693] cpuhp_issue_call+0x3f0/0x750 [ 672.507182][T13693] __cpuhp_state_add_instance_cpuslocked+0x225/0x560 [ 672.514010][T13693] __cpuhp_state_add_instance+0x25/0x40 [ 672.519665][T13693] alloc_buffer+0x197a/0x1e70 [ 672.524507][T13693] __ring_buffer_alloc+0x2c/0x40 [ 672.529627][T13693] allocate_trace_buffer+0x1d2/0x950 [ 672.535060][T13693] ? __kmalloc_node_track_caller_noprof+0x2eb/0x720 [ 672.541816][T13693] ? trace_array_create_systems+0x75/0xe60 [ 672.547701][T13693] ? __pfx_allocate_trace_buffer+0x10/0x10 [ 672.553632][T13693] ? __raw_spin_lock_init+0x45/0x100 [ 672.559028][T13693] trace_array_create_systems+0x590/0xe60 [ 672.564862][T13693] ? tracefs_syscall_mkdir+0x108/0x190 [ 672.570488][T13693] instance_mkdir+0xd5/0x140 [ 672.575219][T13693] tracefs_syscall_mkdir+0x11a/0x190 [ 672.580621][T13693] ? __pfx_tracefs_syscall_mkdir+0x10/0x10 [ 672.586474][T13693] ? generic_permission+0x2bf/0x670 [ 672.591827][T13693] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 672.596934][T13693] vfs_mkdir+0x40c/0x620 [ 672.601294][T13693] filename_mkdirat+0x285/0x510 [ 672.606268][T13693] ? __pfx_filename_mkdirat+0x10/0x10 [ 672.611761][T13693] ? do_getname+0x151/0x250 [ 672.616384][T13693] __se_sys_mkdirat+0x35/0x150 [ 672.621225][T13693] do_syscall_64+0x166/0x520 [ 672.625927][T13693] ? trace_irq_disable+0x3b/0x140 [ 672.631066][T13693] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.637187][T13693] ? clear_bhb_loop+0x70/0xc0 [ 672.641946][T13693] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.647953][T13693] RIP: 0033:0x7fe690f9e0d9 [ 672.652454][T13693] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 672.672385][T13693] RSP: 002b:00007fe691daa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 672.680856][T13693] RAX: ffffffffffffffda RBX: 00007fe691226090 RCX: 00007fe690f9e0d9 [ 672.688876][T13693] RDX: 00000000000001ff RSI: 0000200000000100 RDI: ffffffffffffff9c [ 672.696901][T13693] RBP: 00007fe691035024 R08: 0000000000000000 R09: 0000000000000000 [ 672.704951][T13693] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 672.712973][T13693] R13: 00007fe691226128 R14: 00007fe691226090 R15: 00007fffe5c208e8 [ 672.721099][T13693] [ 672.724865][T13693] Kernel Offset: disabled [ 672.729205][T13693] Rebooting in 86400 seconds..