last executing test programs: 2m39.44385075s ago: executing program 1 (id=118): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040980c401100010000000109021900010100803209040000010300000007058103"], 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) 2m36.393007022s ago: executing program 1 (id=125): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000100)=0x4) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000600)="878b7cdfd4455cf49da7ba6f280ae012ce80389a2aefe4fd04084554d7015aba5330d1b817d6c08af29938b8a9bc2b83462ddadaad3a3a5c0181a0203e49b12c99ac8757fc317fe672938a06f89c133d"}) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000000240)="00214500002c00000000400600000a0000010a00000200500050000000010000f801601003000000000001010101", 0x2e}], 0x1, 0x0, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000003c0)="002145000014000b0000400600000a0000010a000002005000500000000200000002601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x55, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r4, 0x4080aebf, &(0x7f0000005700)=@vmx={0x5, 0x0, 0x2080, {0x0, 0x40000, {}, 0x0, 0x8000}, {'\x00', "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c955000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000"}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 2m36.039306291s ago: executing program 1 (id=127): mkdir(&(0x7f0000000440)='./file1\x00', 0x0) (async) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000800)={0x0, 0x0, 0x1, 0x2, 0x1e5}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_WRITEV={0x2, 0x0, 0x6000, @fd=r0, 0x6, 0x0, 0x0, 0x0, 0x0, {0x2}}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, &(0x7f0000000440)) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r4 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x718bb647156ec3b7) creat(&(0x7f0000000200)='./file0/file1\x00', 0x80) chdir(&(0x7f0000000240)='./file0/file1\x00') (async) chdir(&(0x7f0000000240)='./file0/file1\x00') r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) (async) connect$vsock_stream(r5, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) setsockopt$sock_int(r5, 0x1, 0x12, &(0x7f00000000c0), 0x4) open$dir(&(0x7f0000000040)='./file1\x00', 0x200, 0x2) (async) open$dir(&(0x7f0000000040)='./file1\x00', 0x200, 0x2) linkat(r4, &(0x7f0000000100)='./file1\x00', r4, &(0x7f0000000180)='./file0\x00', 0x1000) (async) linkat(r4, &(0x7f0000000100)='./file1\x00', r4, &(0x7f0000000180)='./file0\x00', 0x1000) open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x190) unlink(&(0x7f0000000180)='./file1\x00') 2m35.136725625s ago: executing program 1 (id=129): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/filehandle\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000009, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = userfaultfd(0x801) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) mount$bind(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x80000, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00') ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x700}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) write(r0, &(0x7f00000000c0)='mydomain \\ 64\n', 0xe) 2m35.076071128s ago: executing program 1 (id=130): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d083911000000000000a1180015000600142603600e1209002100ff000401a80016000400144006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000040)={{0x0, 0x5, 0x0, 0x25}, 'syz0\x00', 0x53}) r2 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) ioctl$FE_GET_PROPERTY(r2, 0x80106f53, &(0x7f0000000400)={0x4, &(0x7f0000000480)=[{0x32, '\x00', @st={0x4, [{0x1, @uvalue=0x80000001}, {0x1, @uvalue=0xd093}, {0x1, @svalue=0x1}, {0x1, @uvalue=0x8}]}, 0x87}, {0x15, '\x00', @data=0x2, 0x86}, {0x38, '\x00', @data, 0x6}, {0x3, '\x00', @buffer={"072c0a1d5b3c89009675c3051f43214507732bfc10320a14580ace71f07eda63", 0x20}, 0x2}]}) ioctl$UI_SET_SNDBIT(r1, 0x4004556a, 0x2) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x12) ioctl$UI_DEV_CREATE(r1, 0x5501) 2m34.768038982s ago: executing program 1 (id=133): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040980c401100010000000109021900010100803209040000010300000007058103"], 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) 2m34.477927806s ago: executing program 32 (id=133): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040980c401100010000000109021900010100803209040000010300000007058103"], 0x0) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) 1m42.031124578s ago: executing program 3 (id=357): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1b9) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x40000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'erspan0\x00', &(0x7f00000001c0)={'sit0\x00', 0x0, 0x700, 0x8000, 0x0, 0x368b, {{0x6, 0x4, 0x1, 0x2, 0x18, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @loopback, {[@noop]}}}}}) sendmsg$nl_route_sched_retired(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)=@delchain={0x50, 0x65, 0x400, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {0x3, 0xe}, {0xffff, 0x9}, {0xd, 0x10}}, [@f_rsvp6={{0xa}, {0x20, 0x2, [@TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0x3}}, @TCA_RSVP_SRC={0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x50}, 0x40400c5) syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000000)=ANY=[], 0x0) 1m38.74202716s ago: executing program 3 (id=374): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='pagemap\x00') r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) setsockopt$sock_int(r3, 0x1, 0x22, &(0x7f00000001c0)=0x40, 0x4) pread64(r2, &(0x7f0000000200)=""/102400, 0x19020, 0x1000000300) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_START_UNIT(r4, 0x5) sendmsg$AUDIT_ADD_RULE(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000019200)=ANY=[@ANYRESDEC=r0, @ANYBLOB="bed4e785e66cd25d8e9cfbe5823a1e332428c8d04a1f0f2ab5ee84f051675bef339e83057f52b2560b35d36051801bc0860331f3308fc907a06d14b5b66a3a3410c5ecc008fcbadd651784a03b5fc6357804b3f6d05c28f81e0fe20f35eb15474da73bda2fb3a222a1eec4386012289a52a6b518bc41b37398d618d9ec9ab87b818f36e3a4bcd4f1fc6887ce32b1d650343472746be001be17364c4e17318e63f9126afc3a39f86661d8a5eebaec69474dc247933fd502c9256e2203732f6b9c166908a3fed4e7b0ff5f742be33cc352247ba52fc16d06ac7929155fbfb8147b32928a794af039cc6a362ddd4bcc6e38bfd3423a5f64f52302b1309953cbc526eed2e2159177641aa1e8180cda33e4778881ebe719b8a4efedba02b25c4c21369c2eee799c1c4b96c67adb9566f6b9aac242a0f24f353c04a26be7a5a3d139372ae28216956f953170ea49edd305e993415e3e702ac8cf3de57200a4ee881329155ea833b3eca91f6fa3ff5c207979085d2316f96f916a40a83c7d803bbadf02f62515cc9cba669c42eff908e446477525ef596cfa660be472662f35028cac2acba6002ba00965cccd231b2ec37079edea7ea97c6e98e848cef34c31e153ac1194b75109d974e054bbd9945719099c2d78460d306482af0a9ec2ecd6946c2386ee82183f1bbe445ea2d42a37c8298a5a486f0014e683219e4630e65d2fc1001ef7309c950be80ae25a7d1e95154eade307b0449ee43dca7642178e28c5b52482ece2c325802f6d72236fd31ee148477cc5e6cbc6f41a736109bf78da3ec1705cd4cdd870d4b671cd30564f0a091ac2495f59855fc0bd71181a350b5d6689dea86728e324ddfd255ed9e05783de0cbc3851de2ef253c3165e0ef39351c37b69aca6e028954b21e875767c9dce00577b66062818465c66c2070956a5b0721f7a573a11af6268b44471fbf6076a94c9c2252e7e9cd187c80184dbaf32501ad9b7c7952658d92f11bb8936932bad430aeeffb749d00d4b8de7792bd4b280f2d2841ebcaf29b1ed3974ac7326901f886abc57ba61f7841f1d7d5b95ef234269568d846cb36b3a4ddeea8376eb1fa14999084ee13ec4dc6b0db12f507c8092c580eac34c10544372ccedc9d6b6427265890848fd9111859286dce69b38cf93d7f6c4790f4f5f16b62de7de97379cc4a7adfa2f30160738d4cad9737f60f0a2d6ce40b01b426e16d724d812003242e6904a01662a5310fddc82ed1218dc93b4cf004358674057ca0f9e5adcd8e988fa477c252cee47d278cb87268be05e2141a03a8fa649883eaeb5f19732f1534478b55cb2bbb67882da2a38f22ae3fc9bf5f3a8f2d783d7b250bd30e87127db0c52ca93e114ebab1fc86a995264c6b4136768230de524cd166cc8b2292a6824dc96c73947a90e161b2418f81de613a25b93ab349488febb8c978d85e94b7eb01de7b2e2447702152fdad33627b976c31c01f4f6aa9d0632489e514c626c08e5d49a9b62ad63095a40b8c522d68b8bc38cd6de880ff7cb15d02c44d7e57fbbc57098bd62500de90f63469ad8cc2d0e7e95cc85a7cbf15fcdac1320dfad34f09df605f183b1486160e05353a19b1a298f5b079cb4cced48ed79902c49f41082ecfb74fd177c083e32074ce58200639c51c4c6bcb7d9f9f9c7b8a72e3c5557e130692a5b6283eeffcee8fe6c270ab168fcb0aa0293041ae49a9d5fd85096cc0b3a7f7902afe144b6b2ca0514d48ff664bb2ccfce334088f514406aea530fc9e0648314bee48a130d3d1372d38ab933800dd44fb5419181bbbd7883d95d6919dd1a0df05c6e59c3069a8c13608f0ac5fbb10137c069aad99e5aef5fec8ebf5d4ca271600be3f662e6d640942b38c58d41bb66c66c20816a12330b2ef139cf4ab11ce314409bdfca58c399f04ac1327a6ede08d9ee4ae7bdc1554ab125845c43182e1fde668ef5ad3024a91721d10efeb17130bb85dc46fd58b6a3531f416b71d06b01c091a4fdca7f5a730c1709308f495280d26bc1918c589e49be79cc60989b39156b73b6e60a1001008d7208b0d4b7d1d33ff99c139f316de5bf2344390ae4abe340f503fa2e6df49779e1c662afa89eef4f7a450848850d7dd9a46eb067e0ecb5734cf35f2fd0c88c0cf210def02702a5234e4d8ad39b4becc9636bbdaa87c4868aab68fd47fa3d98a3bbcb874c15781000984f45dd9ab8eb4943480031a00704cbcba17e9584bd2259f93ff286126009d98318c81b2ffc43084655632db11d522d00b4c98f802d5723260f20e2ec0caf8f49d523dd85e45a2776330cb02a8bc5babc33c2e9d3f12f1de74c3dd207353014d5102bfbdf78c2fa63833e17e3850bcb1d323f5058996f6975f6ccf7345d42e049a19bc9e05087b7e3fc88ec55b9ea3d35bccf7a9bbce5e39646f96f1630069b133fa846d8bc15206c203ca072add6c4c2aae474ff11c13861be5f639a40b380f5c2f1431ce685c4c3d5d6e59ca313ec66f74e477b8c59625ba4d24db9a4b3712a26ed59f78870ba484867c021912d0085d23c8aa2834a58f06d1c26a7376f881eaf82e2e1979c71f45297928795f212b07994fc8f64bdff1dd23e65eccdd6d2ff0b2a73a9c5280cad0908d3ea9574c7be0e2cd559426f1692ff89e33b866c086f9136854df9b131819028fdfdf9fd0bfda298297812f7bab780f807622cc28624660c6044c2501caca7aa8a7478953bf7cb7212d21f0ced3328107fd24a4c78eb9e9d518463c761a245407e131872837b286bf38c7940d1781577f7ca5d92d9881c7a90cfe56d0a68f389129e360f6c2a08ecd86b81d436f27a1eed12a2685ca109a83d2ba365e07acc3030ce9c014424f38c709d8ff39ccdf3651f371c767eadf783a6e6c44ad32fbc3c6d86cf1027281130fe5bf715e3c2f81c1f92f4d0269d98716df887436e9c2a7801d18a78648c19deefd778117e375701403076e46c58b9c219090d3d626dce3a1e51a24023c65f3bfa3c35d21b1d8cf930d590b8c31548e1c721450cd3814fa910a8c11118706dd830c3e59d6dfc08dd3e760dfa955b438033e2645c3b02b7b2990e66f88e28a2fc911e661c4a5b9f2dbcea7e521954bfe7a20f152853439656c29d25784c2cb52d1e7fdc87ee70c2272d8bc2a7bb589f06f1d7e7a1b70585c6a28390174f0c4a054e81ff035456a5c59047ce4ae47c5504cc512d7c37b9319102731e6e868fe05a00d79a0cdbd746c4658d107c4ae5c0bd6cc02446d69956dfbad92259ab3b7c721e63cba8e11a282c529e8d6a2367d05808bb71188103ff998ecc69b992d0820d717fb9c0a42dfb8d1241840a6e267d5cfad65c3cd4530e3c9de343624a64a6003da6636f99063f1cf4c305136b49b4b93282acf01a63854c1bc102913e9652d2844b6c9dfc409e765048174a2fc7f250b9c8605791bf949a64d3681fab0fef3f0f97a0637a0d411c9e66e538f7995216a5574673c953647218525e451027819540e57e2cba52cc7a92480a2de8dd623b7a17300d087e98c0242688cea45ef1c97f04cfa15837fe8d29ce46163cb619ab4910d11caffb002f3a09dc0a42b0ef68d7ec5e1bb060c9b1644cc09659242c32de639efbaf2017c5d77d0093f87351b349e601f5bfec104daa186cfbe2c7b60c4104d0d511d4a33bca88adf9942c54a9c38a8fa70bfc21edab3135c55b9c78bf3914e4993a715d2b5bae43c82f62b3eef989c9f80ac8b92d74ba59c21042e74de602f0379e5642ada2c3d32c3c7c7ab2152a988fb2137fa4df1091282ed707bfca0b8eda3a26b99f47dbc17cd748a5e22732d9de8ee8c1d4cadbb8d57864d209481dd502d148485f6e40a709fe57d54d52db296290564d9547a80a225b590948b786f151ad0afcdd225459229e55b593fe60b59d09105bd73632211e2ae7de24abe3600aa410e9979c8fc6d43edeb2aac9b02d1b774f29bc1ab85bf65f02989177ec15b15e47b78b4f89c50cc30f524ab2baeb8d6b724744509a24bbec9779438b3087b8fb44b3b2d13b2fbb082ccd048d4107252bb69a348298d39276ea3120faf007c7603c8e2360c99fbc543bf67997d321bf708136c2b96c2b8daeef1f20af1ed0a09261a77307961404fd8db405b0b1abd251c782954b302df7930cd5836d86421a92b1ad0e7148ca24f8b0e5783f83cb330836b4cce1cbe630a254a4a0b9836fae329c255eb70e3d02391e640fafac8c6e0811643c2373541252b21007cfffcb44c515a26856493a49b8ad2b8d942324ed924c804c253a9e89ea90a56f5b5eb7465d9eabc0aa9f51cc2e1a26eebc4b47da17e52c88fe81c7be6e91f558011023f76fdcc1410e78fe6b1ee097d876f618cf032bc149d459b7ade9264acd62e3c7f40b04326c6bd969c81add61f9475bd2e0f0f9d1dc8017516b7121d817155f5db7212ce6d43d5fa315436652080d580cb7282aeef2702060f8e0816ed4dd36cfd0df88460d3fb900240000a36906b0148f8ca2af528b7391f6ccb49af60a8186bca7f5024d1ef929c223e7b6980efc2d4d16b39e593fa70e25c171701e8d231d06a565620f7b2494159256439e2a827c7a76ebca991911d04e45206c4a12a0e32bc54bbe07fff7a0908fcd652532688e7e5744ba8178e8716820bf6df69822fe5f144becc828e6b675d29073cda2353d462f1e72769b6275ca3000236f0b914e182360459bc9a58ac61543de48342a72b44dbc7108ea199a59c427284e5f6847c6daff08e49e2e7b55029fb9482d1780d10467db699e8cf793b0f9020cdca76577f0da916d6b47eb904a24cca2c7427bd5064be9008c98550218dbf7caf5220a6affe0b53d7c352d240833cb208fc8c33b4227cd97a86375ecbc7a432f9a8e690fd34055808dbb2f992399b8283711a7b273412984e6f18ba0ad5508b08915c48e8aa4d7ff23de636261b7ea07f2aee38e87db271c7ca6b24305b176f2bcfa230edb1e5fd22f2d16cedbf9261dfcbd7334f347e00a372dee349d6451d2ac7482213005532bca430d6a180638ac7a64560695c818cd930e1759ca77302c5011e36fe2547d2a84d965afe89410d31c98005629879c690f1eb8dd79264bae48006e37caf025c85224635307f0b4bc728356da135b4c2e1e3cb766e6a80f15a7e55ede6fb0278609f05825add7e7be5823827d5c1c628fef33055921407cceb2eb3aeab1c88df8798b0473e2afb46ec00ef20d96c1298a9633e2174a52002d0357bccf3f75943871122c8fca1d738b8a6c6e5908a51dd597de27a1bbfbb0cd8795c9c8df5a1566e38907cf06005d160995cdecb87897482083d744e3cf8cc73dc17ec216cee967d57dcbb243a91b7da3d089afb18a70eb46c123e28275f0309e837a1a29f595fe0361f0121c53fd5fcfd9c298d5cf5e92d2d868cedc8824c6cf986bfb6bf8d893f22824a9af0d155aafcd8b595baded963b5427aad054df2273ffc4c5a1e88f9c60afaf47abde4b7d16d67ec67c84719eb1c48d831374e74ddf70e26a26ff237515d5b289f65975b14be42b8dfce226c2e87fba8826d147f34fa63ba5dda2b82c357afa1b9cff89b0f8259f87a723d0771214e4c99a0afe14d608d5cd0d9ea5c8b81289e5b6039b2d458428c1361bdf32c468a6dd88cd2a4f33efe35e349913881d826f72c5879d7710036acf13c85ba2ff398b1fabfecb52391300cdcc6eb6147d4da7df77afef1b9001fcc1eae36591cb4b6a872d87d8b50b0cdf5df0060afda7755b477b3a9d27424636ed5b537a7bf08f029d6725048675", @ANYRES32, @ANYRES64=r0, @ANYRESHEX=r1, @ANYRES64, @ANYRES32=r0], 0x420}, 0x1, 0x0, 0x0, 0x40}, 0x8a0) mount$binderfs(0x0, 0x0, 0x0, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1m38.412648724s ago: executing program 3 (id=375): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xd1012000) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r0, 0x7, &(0x7f0000000100)={0x1, 0x1, 0x201, 0xfffffffffffffffe}) fcntl$lock(r0, 0x26, &(0x7f00000031c0)={0x0, 0x0, 0x0, 0x2}) (async, rerun: 64) fcntl$lock(r0, 0x26, &(0x7f0000000080)={0x0, 0x2}) (async, rerun: 64) fcntl$lock(r0, 0x7, &(0x7f0000000040)={0x1, 0x1, 0x0, 0xb97}) (async, rerun: 32) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) (async, rerun: 32) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x109040, 0x0) ioctl$COMEDI_CMD(r1, 0x80506409, &(0x7f0000000180)={0x1, 0x80, 0x80, 0xd, 0x10, 0x3e8, 0x2, 0x0, 0x20, 0x1, 0x21, 0xffffffff, &(0x7f0000000600)=[0x7], 0x1, 0x0}) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2f) r3 = pidfd_getfd(r1, r1, 0x0) (async) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000240), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB='8\x00', @ANYRES64, @ANYBLOB="010000000000000000003f"], 0x38}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0xfffffffa, 0x25dfdbfd, {{@in=@multicast2, @in=@empty, 0x0, 0xfd, 0x2, 0x7f, 0xa, 0x20, 0x10}, {0x8, 0x14, 0x100001002, 0x81, 0xfff, 0xffffffffffffb473, 0xfffffffffffffffb}, {0x1000000000, 0x2000000000000001, 0x2, 0xffffffffffffffff}, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000001}, 0x4004) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r3, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, r4, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8040) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x4, 0x8001, 0x0, 0x7, 0x200000000002, 0x7, 0x8, 0x3}, 0x0) (async) r7 = syz_open_procfs(0x0, &(0x7f00000020c0)='net/sockstat\x00') read$FUSE(r7, 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000080)={0xb4, r1, 0x1}) setsockopt$inet_udp_encap(r8, 0x11, 0x64, &(0x7f00000000c0)=0x2, 0x4) (async, rerun: 64) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x10003, 0x4, 0xc000, 0x1000, &(0x7f00002e0000/0x1000)=nil}) (async, rerun: 64) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r9) sendmsg$TIPC_CMD_GET_NODES(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)={0x1c, r10, 0x1, 0x1f, 0x0, {{}, {0x0, 0x6}}}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4004000) (async, rerun: 64) ioctl$SW_SYNC_IOC_CREATE_FENCE(r8, 0xc0285700, &(0x7f0000000140)={0x2, "4f6fb3491f60530d92ab4a34b7008bfa6fd231d00172ed2198497219dda6472d"}) (async, rerun: 64) madvise(&(0x7f00002f9000/0x3000)=nil, 0x3000, 0x16) (async) timer_create(0x5, &(0x7f0000001740)={0x0, 0x2, 0x3, @thr={&(0x7f0000000640)="118e8edb55a7fbd8aeb0dd457b78d3ccb7ece7bcc09d7d87cbb23f58079695848587811aed87a05c69df89511f6c28785f789ff758286607c20b43e64bd62e1338ee8eb1bc2f4665783002f04aa3eb77a43cb396a8339a76fea6574666622fd4f8187b51505febbd55d4ac548be6b1dcb5a61816989f9b0494487fd522eaaa6ba169efbfba8d4114144727430b8ca40723fd7d747b58dafd89939a82b4c0d8bf7ffd6204bb849607178538d961483dcd191bdb66b2120e65a412038eb07764fe6c44e92a9b38db2319b84f9edb83798dfde037c409bcba09829fa38c1147ca74d40601382bc0d4c0dc8a343cece3962a112c9b906cd28ea615f1292c188f73b6ece3dc542647c3bd15c879419d3a207130e2331cabffa9eec34864362c0f5872e077fd81945f36832151d991680899d023c481575afef19d74ac9ce10271c0f30077d1b4295be39c9f7247be63377ef5997120b01964f38588dfd2e7fa4e2c37da5020ca5cc4552ce8b78c59a939dba5ffe98ed4ba76649100d355449562ca6a5c0dcf11339ecced5325ca5628ad4c74af8847c5a11d92c88c82b025471ddcef66cb65eec8699ec445a75c4d9133f37a386cddccfe91ada540fa3f5438ec9e00208fe0d238ce01a8b8bfafc8dcf5bca46a74015b76d708030035f8300099538f08c267c0812c90943327974f8dcfe07d9fe214ab39f0b52a219cad3b5ce7c9eb9c65cfd8e3f41b435e101431a153a2a88c2b5736eadad272927a393de6f72d334f4fa5ae8b949f8eb88f3e83c7c61b7f6aa7af50b39425442d5932389ada78379f1b3cf614e070535e982d2404db3bc74fbc9c02468f1d2e4337ed77831fee8f83284d7657153da13566254d5fce1be423c20de168da4c21de270f93f03fbd602d80047b5c5ad2cd708a2474b0bddb2ae2fb0427399aa58ef8960b162c57c184633d3903f4e8830af98f72fac93394812c1a610d2262e09d6a9cedc2b0c107ec92b3bd2e2cea4e037aed4fcb3be9c954a639a67972d3d395f03794d1b387615e0e5a34bce8b7ec1c4a287804bca5a1778c8537e3185b2a1927cdaa4b0f668f5f7b01e7cf2fcff7ccb05a760e8499b4e30677cb82ebf259bf56619ec4a905510fec7555f26ec6fdec2ae11815c060852a148713af6a459d212e5c1b50cb923af0856ce0db10875501ce61951e1c31048a643baca9c9a387854588c445b3779128aa2c10c24a0a4d33f7bd788bb1a3901e71b644f975010301ea999d515cb840fb5b2143a1409e5d6d73b8b9779c8910e125aed85f7a4df7477a0c6b27e570b1dca1b4b02e831d36450140546f4dab4c5af683ee5368e86e0beacb766c49f56a6fd14de4bed2788ec854f7f697fc8b6607d6218878a4907b4fd7cf31e42e05542662754ad9183ec026bbbb8dbd7f00fb10e6551fd5d97b80799efa4dc02199950742f174ff4db71f6fc1831b3c7f03e0c7cb58cee661dd7538c7efaeaefb239ad572e74a0450ec9a117e052a7bba65aabc84eed1cbca76c9fe22231119ae14ef8ded7c4795dbfbdad049c5aba81fab0fdad3991719cbc6b1769e7c9cf206e51ca0ef33138f9ee4e7e59659ba6698561f1d530262fa9d1d7ce0ad30fa5f83dfd7e06e1765cf8d158fbb90291d64187837aaa30b71f63566e38ac7a5f1545214c0affc61a5ed3feaa156e0a7317003203800993eb7f7bea14c797cefb7d88e3c3ad08244fa4568a58aa3721018d63b64d98d31de2f4d981e996df0638ae6d6b9ec9387da9de4d2775eebdafb43e2a1092f3722669d8473becdb9bdc7d2ba1440855e4e1f5814be5c86790811f516f3b61ac121a3ff96612d558a0cae46cbfd87f0737b8987fad0b0e0f02516baea97c577410e1861bcd723828b4913d7dd021bc3b816b8aaba83b79314269a27cebe4f8b7b12245f60f00614029ef410bb0fae0b8bdbba6947e9c39261d0148b218bbac82318bbb6fe82f7a43d47341e636bea660c93a9f4d1c09b09a7c1c645babf0809eb6782c6cf152a37bd17ab79e8f65269bd1783e7827e8a67b1eb5cc40d85569f25eaa90b6f91c770e6dfa5ede5e79548e22ca90101010cd44336f57a697c1f5bab87c73d70476ba6743d0f61758e7b6035af757f70ecf58c0d25a9db266fe69a114260391731cabfd9f84623295253e6d1ecd39521a2aa03cffa12361f65609a7ce23c73c0fd2c6871447f7e3e0c5d25ec0f0662d10ef0f6a98202464257648ec69503022b8b4c00b8bf57fae9efecebd9b759f279fb984a3d47d7d056ddfd2baa0d358e84360330320f735a49685357ce6c8624ad181076d686b93090bff076d7e4aaa0cb245efc5a517fc28644268f3b0a63bf07eb1c09234271b0d8c916a6ebfb6575bf488a992bcad3e0f4cfae95f767af17a2caf0fb8182c3549993062c3c572e9db3483001052d884fcbf3a1f78f59fe38a95378ac063f990b863c07b39ce48fa49e1e7eec82733154fd4853ffc9c3ec97ca85d626369d5a7479edc6260341216bb5d6cf7f53b317fe2d3b30969772e84d7902d3209f812ab626498b537f0fa3ca54c2ee237fbeb2eac55ca0311dc0dd82db6587d0da815d56b9a3e5eb57ca3e54faf0a85ee60d0ce91cfc43f816a032e7d4a3ea38dab403399cf21f230e4054dd6537c95107051992e496635c7aca664a4de1bc7c394305894e00821579716b1d86da6d9b8285cd852e17af64f2616ba4707b054e21700c695a4cbc679e546c20972a6da853361a4eb2f38dcebda4a620f976db9ebfc6f2a29e435b29a81bc71008a9dff29975937e63489e9208f6c0758677db91d21ab8a9db85bbc40f4a0ffdbba0f7b6f33b5efd7770a3144746d960643a2825ad48b9ec1406523f674c8abcadf5bd943ee117436acc57843d8729a3ea403e806bb078248384db5580407e57de4073b900446e109dbb926e802811a4cc6097315a74381b66e4b74cb8e5fe4dc9460cfc0deae3d2e535041b9acc4aaf40f07db58490e933580397543a76da4a199f62c33120d72c8cefd8f00fe1d676800f3a984c193b39f84531df3eb63d27477a492dc1b8c24496ab256e247fd43d2b76d0171e85cb10dc92a575f9f6639730bd7bbd0e786bf5594637961ef846e61b2f75aaf02a07702cb01f37dcf2332a56fca60ead33213b0af29b29952f3f7429191fb57953a6243d54be7576b2978c9ae57335e352dc3fee0115f7cf730a16e8d7aa1af964eb36c78d178e0facbc98a8eed354f08128aebbc29b49a617642d879df03e170136b0d671f993db6c24ddeb1a4143aef4ff4317257b6aae7f7927ab57ec79f9994ff54ca56e2f520fccb0c34a4c1aa58bc93664bae4810fa57dc9d3a06d4299685e5dc0ac5c085dbc3800850f70d0689b8e176f89992ec723c4534dedbf02445bd6fd7617435700b3ab2a396e33ba56fe04019598774f9f1b38188cce4a24af1f0f7be77c967d3963d3cf2ed3d5b7252b6fe70c1f8abb162cde383a1af5567112b207e8786a46d773d6ac1ee5817caf0abdeb078f0c9901433c800b1279e052b2bd6f3b8d07149b014cc54f97b5a23a46d8d53becb8b1d6e25708079f3495a5f0bc378baa68b44c3c93a1415580fd5113b39e2a545cd432b6ccb50f848d921be324c7f116ec44656e286cd667908ab4ab8099f87503028a9ce1aa54c6ac145e679ddac9d3ea8bb5be7c34c8a30de0b45797c665efbab5752c6f31eaeb70fa625f77dd3cb7f94bcd9a612abe9035ab24b0abc82a1830998f875f2240c390db80e0c0119b4adf196f457ba393c0a6c046b36c74b90985c3801157778bd0a08e2f8f196ae64de42f349e69025e99ca580e92f2f4b0ec973149841313bfab8959470e5ec8eaa373c532f076f8d79dde2677493f3ef7c1697a27ade956bc597dcd96eb43b631386e4b503e6a83fb55403a9814f6531b61fc2c936f3e783c20aed3280656b567e162b2a73a7987c5835d420e11e5157dc34086ac9322afd1b60071285883df4e498b38c766e023b1b5923bc53c1e2fb98c408273a5e35186f51d09de5bcfbdeeb7eb7ab521297b8fc7fc8f663aa78bdbdecbbafec0d5650c72be0645a08e5e547d7eca6231c51720bd40617c8b0d33a0d801a06331c7e8c8afcf4dad5a61823a23ab0c06b4644b3c82073fcf7f23d73616b58e99e86c26fa803aa05a96a8b81a2738d8d24dc21bc2d7ea461af8c57e24cacff4d4b2673ca2ccdc64c16cefb3a10cf4f5ed81849823307bf1f5d625ce5183d23ae8f643c3e5979f23814d46b5553a186a2ed3d823c4f013d4cb9aedd94ea8870e668956f6524579f05aa88fdecfb1de3590673e6c4c12d8d4fe97ee62d4f19c78de8572b4a2bad9ce55c018ce8ee80917fa833f41945333b07be6448a6f5be38d7c04e6ec362b95e4ee82ac5abcc1a1db83c06b33e83b975850b7300baaa668c25c0c29301bc35da28022713336439317f6916217ba8d700f1af83eb8b3b052b1802fe6d49cad505b44a053ff4a8c1c660e8b9e9d50583a84f82df459f83e2636a9e75eb812e99665a66d5aedab20a26a4c151c34ca0860eef8f15c0ea8d4ddad04417fac0732d24da592d601351e169d8f36dc26cdd87800156d3519cbd1a6847c4da4c45cb30cfcd2b5e8c119309d41806499d7848b57e6d6edc200bedafd997c854a63f4657e4263e505d32733d8bcadd08bb5901c9e87824c9d3fca67e328b9a37bfe18d56b20e25d5fd90648b7ce69547d495280e0511794fe108ff76331c5e3d9fc9a1120ca9cbe9c75c3dea633cbe687e14177662ef8e5d6c7bcb8ee354ac238a753970fc05ea66c98ec0c590ffcd694eeb478066bb36637eff676ca40aa194133cebbfe99689dd88d023fe919176152988a2ee9169763cf0d8c8a0e900cf1dc24936d6218dfc8eae310e3b9db58d263ee800e79fca04ef935cb76daa02a227b29a7880fa58f8650b18c279e3fdfc9599f6947934ed9b3c576d937be79cf561fa4d59d25255b76f06f3d77deac38e099e04764f2dc7cf68d1fd8cfbe3629ec8b9457be2cb17c7fa6dd27f7b3cfe73ea10c3bdfab983b28642a9df628ad6e140c2e816c8160f372ff3e4cbf5cd1a93d3c9e2e93c760f6082cb15cd883a0c5ac1862e0f2a3629e5e4a544aa86291049d079eecaee6ec658a98eb1e4aed0dbd22ddda27ba67c0d788c3a5799bee7f9c892f84b92c6b0d574c09408a898537956e8a37a98e475b2ccc34c6d8008ec4c3ea5ad586016c797fac2848e8e6cc651dfe4d88c32013d79944be8ccf2d6692517724c4602bc5b2cf10d3958a78a516e881037eb2ddb0f91f12812f795e8ed1328c3935b61798299ecd3f0361ded81f6ec59ef54db9a2d7ee2db21003f69dcc046df36ffd10211d5250cfe8ae63ad88949799abcaddca9949d6e338407a3a0b4c4621559cb7ad24a3d98e4fb105a4b71066eaa83f0d2c502a122a9a48b393b7e34b3bda06fa6c96cd288cca10f243d81f4d0299523a909915deca45e2fa1a03045e849cee37d87a50615e092e4741de174f01fb036bf149d26a5dbf1ef6079add48d86df7c642ea0c74c88e0c5cc3a7231887475a254c4d6bb72510884157ee8b13b7ddb889df5fef2adcc3be3b3153a89de7f5e7a7cc09371b22eb268f1a984ba5e08eff294e0cbc6f0b7a44bd62b154891f785b6feb23593ba8c0a2e388a1ec7d70b7f7b949645f570178a6449f39eb73c007f1b4b000c7765a41424bf8f080c05e282436cf3a3bbe3a3f9a1187a9bee09287dd5f2801e63d34e0cc673f055af88519ba43da6ae7430cafaf1b1b652d", &(0x7f0000001640)="deac5d3cabf38a1b76504483816a0653efd35b0604f08804d1062d620e03ef11772b1fc80dbd98ca41ef9f7bb9b82e49fd44160c90a2fda215a03143ef90f2db5a1be954faf73e8600e216281cb85b3cdaaf032d713694fbb647a476afea775ad97826355c0bb3144d682e6ce55fb7b5db21864256976982e80ce11d9ba47698cf5cec7ebd3a7f266b20cd36f1af3cd3a3cd943193d0074136139dd7bb287f084966e9269480148415323cff3a840ed8a4c77d4370627c3249271a1e1077b419453e147630931dda"}}, &(0x7f0000001780)) 1m37.374703776s ago: executing program 3 (id=380): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="120100001ca37b10720c1300bebaaf0203010902120001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000040)={0x34, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) (async) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) (async, rerun: 32) mount$bind(&(0x7f0000000380)='./file0/file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x185093, 0x0) (async, rerun: 32) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x29) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'gre0\x00'}) setsockopt$packet_int(r3, 0x107, 0x10, &(0x7f0000000140)=0x8, 0x4) sendto$packet(r3, &(0x7f0000000340)="05030006e8fe091c6202a0ffffffff006003000000007f141434e3177f43055762", 0x21, 0x0, 0x0, 0x0) (async) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) (async) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003680), 0x0, 0x8840) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xb6, '\x00', 0x3}) (async, rerun: 32) socketpair$unix(0x1, 0x1, 0x0, 0x0) (async, rerun: 32) r5 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040109710780001010200010902270001010080320904000003ff000000070581020002000705010200020007058203"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) (async) syz_usb_control_io(r5, 0x0, &(0x7f0000000140)={0x84, &(0x7f0000000740)=ANY=[@ANYBLOB="ca0acc69480000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) mkdir(0x0, 0x1ff) (rerun: 64) mount(0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_usb_control_io$sierra_net(r5, 0x0, 0x0) syz_usb_control_io$uac2(r5, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async, rerun: 64) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x40000070, 0x0, 0x400006}]}) (rerun: 64) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) (async) umount2(&(0x7f00000002c0)='./file0/file0\x00', 0x7) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 1m35.248855109s ago: executing program 3 (id=385): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_connect(0x6, 0x518, &(0x7f0000000b40)={{0x12, 0x1, 0x250, 0x80, 0xed, 0x9e, 0x10, 0x4a5, 0x3008, 0x6e03, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x506, 0x3, 0x5, 0x2, 0x90, 0x5, "", [{{0x9, 0x4, 0xed, 0xc0, 0xe, 0x8f, 0xbc, 0x7b, 0x2, [@uac_as={[@as_header={0x7, 0x24, 0x1, 0x4, 0xe, 0x2}]}, @cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "58fc9ed15499"}, {0x5, 0x24, 0x0, 0xf6c}, {0xd, 0x24, 0xf, 0x1, 0x6, 0x38c, 0x3, 0x9}, [@dmm={0x7, 0x24, 0x14, 0x1eaf}, @ncm={0x6, 0x24, 0x1a, 0xe, 0x9}, @dmm={0x7, 0x24, 0x14, 0x7, 0x2}]}], [{{0x9, 0x5, 0x3, 0x0, 0x400, 0x2, 0x1, 0xb, [@generic={0xa2, 0x1, "25ed58d41477b00128d94fc36dad6d594ba5e34ff2fcf12c0d661eeb1bbc1728c77d11cc787179099cb21dc10cdc6e23badac04d746836ed62a4292b58f2b0506c193e91f2e45dc4e355f08ef6e4229033424b04b3ffd5993e4531108b76fc1f4f9fbc7d082dfe1b563bcf27a0824be29ab747495cc7914738080d1861bfd3270fe193b02b0296c46c8c7671d683fdb0d36299e92e40e2f1454c1be984b6a914"}, @generic={0x55, 0xb, "c1624ab17d2f5e5be9dee94a4c94e4ecec5bf27dfe9801a374841aef2d70e22f908b4c41f5e963d092a298e337ccaaf049a5923a22aeb009f96e487747a01b6cfd28b324c38ff965c1c91cf5d1490a2a7fc927"}]}}, {{0x9, 0x5, 0x0, 0x1, 0x8, 0x0, 0x9, 0x5}}, {{0x9, 0x5, 0xa, 0x0, 0x10, 0xff, 0xa8, 0xd}}, {{0x9, 0x5, 0x7, 0x0, 0x8, 0x5, 0x8c, 0x1}}, {{0x9, 0x5, 0x3, 0x10, 0x10, 0xe0, 0x0, 0x9, [@generic={0x8c, 0x8, "7a22927995f54d21c26d6dd0fbc4394eece4f3de62d19179160af4cd62ff7e79f136c44bd9efdafb863bc53f260fff17f460b52be69bae78c6560341b2a80ce6fe686c118308865ad079fccf4bd0a8cb4d7d8852924cabdb8a19ca06aca7cac3e2032e5dcfb93796176ea35bf325f011b9aadf3d532ae825b2b926a0cff1dd2e603900c2b9f6f434abe8"}, @generic={0x5c, 0x23, "7b412a3878451ca4fb32b5026df1eca193868f560813d870ad888a75c41e37f41d743a88e4966118987be547984b927a25de680a65dda2ec4b047d230bcda2be36a40754852e886765afb77c97dd0d80b5f3fa971399fdb06171"}]}}, {{0x9, 0x5, 0xa, 0x10, 0x200, 0x4, 0x2f, 0x4}}, {{0x9, 0x5, 0xd, 0x4, 0x10, 0x6, 0x6, 0x3}}, {{0x9, 0x5, 0x4, 0x0, 0x3ff, 0x5, 0x4, 0x2, [@generic={0x8d, 0x21, "292a51933bbd1200ff307d107ff7315377aca2ad6992f98d5f7a97de67955f40c3dfdb37448aa29a30141e3204e81346cdff45d20e3b5d4e8fcc2aaf1d65234abaca14540bcd5cd01b2f524442352a944b19c8afd834b95a6d6c8bcfcbb368ca54052b244be5388dbcff84b8092cd6676a124a5391b9f080fe48f404b0b858b7c4002c7e6e17e98e17a90d"}]}}, {{0x9, 0x5, 0x4, 0x1b, 0x3ff, 0x5, 0x9, 0x1, [@generic={0x3b, 0x1, "1d89ecabb2c3e8ae4a3038ee466a628745a53592f3d384a749eb4a6ed3e2a9e9d13efa8cc805a0d36d1367b1925a9302c8d8ea81cc8af6eb4d"}, @uac_iso={0x7, 0x25, 0x1, 0x10, 0x5, 0x4}]}}, {{0x9, 0x5, 0x2, 0x0, 0x200, 0x9, 0x5, 0x0, [@generic={0x2d, 0x10, "de59b036c067e50904f82d8a24d985f30e44ea039c137a7668d827e3bc268c6c73213b0a35c8e29f38d89f"}]}}, {{0x9, 0x5, 0xd, 0x0, 0x8, 0x1, 0x6, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x9e, 0x226}, @generic={0x8f, 0x2, "51ea51d19f020c5ec2694bcaaadbc685491cf0005b3438f75d08f65b9448d1f9ef30a1dee20f6b0013af2663cc8413fa9d7e92c3758f49240147c6157f8791fcdcad240d3ff7d17570f24e686d79a185671f76454f11f68e07381dcae3496f6714b8bbd282946588a74dbf7ae620ccab9e397afadcd3632dd6eaaaa17c385433fe1a5602db9e0073dc4001cfb9"}]}}, {{0x9, 0x5, 0xd, 0x2, 0x10, 0xe5, 0x7, 0xff}}, {{0x9, 0x5, 0xb, 0x10, 0x20, 0xa2, 0x81, 0x3}}, {{0x9, 0x5, 0x1, 0x4ab231decdfd3a46, 0x40, 0x5, 0x7, 0x6}}]}}, {{0x9, 0x4, 0xed, 0x2f, 0x0, 0x6, 0x6e, 0x2e, 0x1, [@uac_control={{0xa, 0x24, 0x1, 0x3, 0x31}, [@mixer_unit={0xb, 0x24, 0x4, 0x4, 0xfc, "e8a1c2b20d22"}, @input_terminal={0xc, 0x24, 0x2, 0x5, 0x401, 0x3, 0x48, 0x401, 0x0, 0x54}, @processing_unit={0x7, 0x24, 0x7, 0x2, 0x0, 0x6}, @processing_unit={0x9, 0x24, 0x7, 0x3, 0x6, 0xe4, "2ec9"}]}]}}, {{0x9, 0x4, 0xa3, 0x10, 0x5, 0xd, 0x67, 0xf6, 0x6, [], [{{0x9, 0x5, 0xc, 0x3, 0x200, 0x7, 0xf8, 0x6, [@generic={0x2c, 0x6, "ab5e7a39c28fb3ab932512a93a20b9d98cc011cf1edb24cded24487beb5bca485d4b9e01cf65bff384c9"}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x0, 0x4}]}}, {{0x9, 0x5, 0x9, 0x3, 0x10, 0x5, 0x0, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x7ff}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0x3, 0x2c}]}}, {{0x9, 0x5, 0xd, 0x10, 0x3ff, 0x25, 0xff, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x5, 0x41b}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x0, 0x1}]}}, {{0x9, 0x5, 0xd, 0x1, 0x20, 0x5, 0x9, 0x81, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x0, 0x3ff}]}}, {{0x9, 0x5, 0x0, 0x0, 0x400, 0x4, 0x2, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0xb, 0x4a56}]}}]}}]}}]}}, &(0x7f0000001580)={0xa, &(0x7f0000001080)={0xa, 0x6, 0x110, 0x8, 0x0, 0xe, 0x0, 0xff}, 0x182, &(0x7f00000011c0)={0x5, 0xf, 0x182, 0x6, [@ssp_cap={0xc, 0x10, 0xa, 0xfa, 0x0, 0xfc0e, 0xf000, 0x2}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xa, 0x8, 0x9, 0x6cb3}, @ext_cap={0x7, 0x10, 0x2, 0x14, 0x9, 0x4, 0xd98}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "35350b4023e043967022f0caa53d35e7"}, @generic={0xf4, 0x10, 0x2, "7f80dbd96c2843a1ddea728ac2f4cc01e8a10ec54f12e4db196b8a3e6d846f336e4ad9120ed913c7d8be9cce40861f0374e3b3c1ff98a182a030af91bef56e6be0ce9680b1b8b0c2f7e3de5eea8657fdd478d1d5669965627ccd712f2f39f58d17441848c723a26ea8e895ef64343755144d3aa2a21fdffcc61d1523e401cb7c8d0ce5ae0a231b0095bacfa1a4fb9ecd7979facdd94be2e1835b7055d9180202c6d800309fee3d54714208a11c0ec6105c4add7b65b58d6935cd1b4bc7ff46f6c62d6fbb722b733b2f621869d12c64960aea0d9c0481f4e7a67241286501cd7ca68740ccfeebe6b7fbd845d5d3dae48350"}, @generic={0x58, 0x10, 0x4, "bc82268a36b6570075e4193ea3b06f80282f633de01be069d1fd91ce53859b46486f673384b65ab82954894204e7778ed383f24c83f5e06b582cbe1fe5963fa3d26ab977e35a59f1ae46a44abab9d5dbd92df04faf"}]}, 0x3, [{0x3, &(0x7f0000001380)=@string={0x3, 0x3, "d1"}}, {0xaa, &(0x7f00000013c0)=@string={0xaa, 0x3, "97534934e57d3c73df42f78fa4af6cdb0dec18b67719cf3d16b0f2113aef5219eb1894cbe29340b00330675f781d18683d8f065b8b682d1cecacd39ebe26318da413c3648ce467241490e18dfdb7a8c2f49cc902ec82ef6568bcac8df1a67ab7dd0e0f4afced9d5e30eae35b5812977217409da13e6ae6c514ea1aab36bd6834afa2374b4b54f15317dfc7e8aa019cf1363d654eacaa27e3e1785fa7feae86da65a0f050111cb792"}}, {0xd3, &(0x7f0000001480)=@string={0xd3, 0x3, "3facc7a95e9f93d89b4bd18b46451c8774861a959cd44f21e6c224db4b172a61b4f92e06f6d28f56342c4e8ad4105549ceb77b7e1de523b2e25a61ffb2069325cb74af128e99ba7aca7ce278ece180a225761b0f013aad0cdbcc0db06eb115e6f0722d895a471635ce1e4a392f55dc6abd1af61a7b7188eae563a94f258a06d912adefe82c9fb3ce5676f37203c809e2194ec8fafc8575c76c36c49c9e658460b5090feb8e991b62615d38f97b2947f0798419f224d5be8f04c708ad2fe04efc998e0fa64143479f103ad800d20ac2581e"}}]}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000029c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000002640)={0x44, &(0x7f0000000500)={0x20, 0x10, 0x2, '!k'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x5, 0x1, 0x4, 0x0, 0x87}) ioctl$vim2m_VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000200)={0x9, 0xd75, 0x1, {0x1, @vbi={0x8, 0x8000, 0x3, 0x41416770, [0x82, 0x7], [0xc153], 0x1}}, 0xd3}) syz_usb_connect(0x0, 0x51, &(0x7f0000000500)=ANY=[@ANYBLOB="12010102d21df4406708129882b00102030109023f0001050030040904"], &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x40, 0xb, 0x2, "31fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_RW(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48, 0x8, 0xffffffffffffffff, 0x0, 0x3ff, 0x0, 0x0, 0x5}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r2, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x29}, './file0\x00'}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000580)={0x0, 0x16, 0x2, "f610"}, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r4, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000100)={0x9b, 0x4, 0x8, 0x201, 0x0, 0x0, {0x3, 0x0, 0x1}, [@CTA_TIMEOUT_DATA={0x0, 0x4, 0x0, 0x1, @sctp=[@CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED={0x0, 0x9, 0x1, 0x0, 0xb752}, @CTA_TIMEOUT_SCTP_SHUTDOWN_SENT={0x0, 0x5, 0x1, 0x0, 0xfffffffc}, @CTA_TIMEOUT_SCTP_COOKIE_WAIT={0x0, 0x2, 0x1, 0x0, 0x7d92}, @CTA_TIMEOUT_SCTP_COOKIE_ECHOED={0x0, 0x3, 0x1, 0x0, 0x1e805702}]}, @CTA_TIMEOUT_L4PROTO={0x0, 0x3, 0x6}, @CTA_TIMEOUT_L3PROTO={0x0, 0x2, 0x1, 0x0, 0x16}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x2004c004) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="00becb6c"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) ioctl$INCFS_IOC_PERMIT_FILL(r3, 0x40046721, &(0x7f0000000040)={r3}) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 1m34.937951172s ago: executing program 3 (id=387): syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f0000000180)={0x14, &(0x7f0000000040)={0x20, 0xd, 0x9e, {0x9e, 0x4f, "678dad4ea2ca379cd722417159004e81cdbcd936fb0cb697869cc59785dfa16fbbeaf4faec3055943a32b6326ee9d78e19424c2bbe90bae483b3c86d1e74c643f8a6b89b9eaf652bfc09b6f5af7a6846b18b94450b9ad91dc596f0877dbdbc85883c2634a8a6f112b1bf9c27a24587a20709fbd7a00f28f04d2d9c416cb35a5ded9201f0e786de8e6d46351b04cf7eaf22786bad945728ffabea1fcd"}}, &(0x7f0000000100)={0x0, 0x3, 0x6e, @string={0x6e, 0x3, "2bc0efe37abb8f82d8823b73293d6286201b28aaa978b9c3aa638e6b2e9997d280f5348dc414c905230d1f9006721b8b679d228568e966b9122f7cca7d42d4c9dac0be1165818c230a0176c974ca1ec25d44fa821d2f50a6170ccbe0ce4791e90f29b6676637013e8048266d"}}}, &(0x7f00000003c0)={0x44, &(0x7f00000001c0)={0x40, 0xd, 0x29, "43a87ed1f2b11ed07d241eaaf459fb237e196e4ad47afd10b5e85829c70a28564fb583f1fb6949a9b9"}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000240)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000002340)=ANY=[@ANYBLOB="208101000000fe5350660f281f976b3cc80a0d4450e77b35036fa947ed9711449e0d90d9f29cc066d55c1a1c42275487ad8c8300"/66], &(0x7f00000002c0)={0x20, 0x82, 0x3, "5540aa"}, &(0x7f0000000300)={0x20, 0x83, 0x3, "b3ce86"}, &(0x7f0000000340)={0x20, 0x84, 0x3, "5e9b48"}, &(0x7f0000000380)={0x20, 0x85, 0x3, "2137fb"}}) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x44}, 'bridge_slave_1\x00'}}, 0x1e) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x12) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{0xfffc, 0x100, 0xee}, 'syz0\x00', 0x4b}) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11) ioctl$UI_DEV_CREATE(r1, 0x5501) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000000300)={0x2020}, 0x2020) socket$pppoe(0x18, 0x1, 0x0) 1m34.457363796s ago: executing program 33 (id=387): syz_usb_control_io$uac2(0xffffffffffffffff, &(0x7f0000000180)={0x14, &(0x7f0000000040)={0x20, 0xd, 0x9e, {0x9e, 0x4f, "678dad4ea2ca379cd722417159004e81cdbcd936fb0cb697869cc59785dfa16fbbeaf4faec3055943a32b6326ee9d78e19424c2bbe90bae483b3c86d1e74c643f8a6b89b9eaf652bfc09b6f5af7a6846b18b94450b9ad91dc596f0877dbdbc85883c2634a8a6f112b1bf9c27a24587a20709fbd7a00f28f04d2d9c416cb35a5ded9201f0e786de8e6d46351b04cf7eaf22786bad945728ffabea1fcd"}}, &(0x7f0000000100)={0x0, 0x3, 0x6e, @string={0x6e, 0x3, "2bc0efe37abb8f82d8823b73293d6286201b28aaa978b9c3aa638e6b2e9997d280f5348dc414c905230d1f9006721b8b679d228568e966b9122f7cca7d42d4c9dac0be1165818c230a0176c974ca1ec25d44fa821d2f50a6170ccbe0ce4791e90f29b6676637013e8048266d"}}}, &(0x7f00000003c0)={0x44, &(0x7f00000001c0)={0x40, 0xd, 0x29, "43a87ed1f2b11ed07d241eaaf459fb237e196e4ad47afd10b5e85829c70a28564fb583f1fb6949a9b9"}, &(0x7f0000000200)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000240)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000002340)=ANY=[@ANYBLOB="208101000000fe5350660f281f976b3cc80a0d4450e77b35036fa947ed9711449e0d90d9f29cc066d55c1a1c42275487ad8c8300"/66], &(0x7f00000002c0)={0x20, 0x82, 0x3, "5540aa"}, &(0x7f0000000300)={0x20, 0x83, 0x3, "b3ce86"}, &(0x7f0000000340)={0x20, 0x84, 0x3, "5e9b48"}, &(0x7f0000000380)={0x20, 0x85, 0x3, "2137fb"}}) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x44}, 'bridge_slave_1\x00'}}, 0x1e) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x12) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{0xfffc, 0x100, 0xee}, 'syz0\x00', 0x4b}) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x11) ioctl$UI_DEV_CREATE(r1, 0x5501) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000000300)={0x2020}, 0x2020) socket$pppoe(0x18, 0x1, 0x0) 36.540483016s ago: executing program 0 (id=571): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3100) 36.037224965s ago: executing program 0 (id=573): r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)="580000fe1400192340834b80040d8c560a06e7bc45ff810500000000000058000b480000945f64009400050028925a01000000000000008000f0fffeffa809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) 35.988708721s ago: executing program 0 (id=574): socket$nl_generic(0x10, 0x3, 0x10) gettid() fcntl$lock(0xffffffffffffffff, 0x24, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x40000) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001100), 0xb4dac462410aaf85, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r1, &(0x7f0000004800)=[{&(0x7f0000000400)="a3b04b9acce921f59d8fa797d344f099deffd03c64a0c5a6a79b8d5b484bdc8418a637384080c8590ccc7853f2494db3c254768d19bc8aa76c660bcb58696aadba1fdb3ba11ad5f03a111e051c2ad98f2041b820f6185c56", 0x58}, {&(0x7f0000000580)="8726ffcc6a786d1b544e55207be96da62ef0dc2a09216d661b579fafecb518c3e93fb2596fee3d0fc7e1e2044fdf0615e514e9ba89cfcfb6bee41106f3f2d405d9980c184e89e68cf85fdd064a22eba75bebb8d9f95dc71d0cf70f31a258589fba92fe0abbad712eaf7f29b25c87ac5cff25ae370ce25720f2cceed4c20e871d2c5cc09e3bfdd22e8e6c51c918fbdd0b77d964e16dfb078553b8d98762a3211eb884d98f76cf5003db7fa3dcd68018b1516549500c6df03e98", 0xb9}], 0x2) socket$alg(0x26, 0x5, 0x0) 35.862271636s ago: executing program 0 (id=575): syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r0 = syz_usb_connect(0x1, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x310, 0xa, 0x43, 0x8, 0x8, 0x6737, 0x1, 0x9180, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x8e, 0x5, 0x10, 0x7, "", [{{0x9, 0x4, 0xfb, 0xb, 0x2, 0x82, 0xd2, 0xd2, 0x0, [], [{{0x9, 0x5, 0x9f, 0x2, 0x40, 0x7, 0x0, 0x7}}, {{0x9, 0x5, 0x1, 0x2, 0x40, 0x7, 0x5, 0x8}}]}}]}}]}}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0) (fail_nth: 9) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000340)={0x1c, 0x0, 0x0, 0x0}) syz_open_dev$tty1(0xc, 0x4, 0x1) 32.70879593s ago: executing program 0 (id=586): syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) syz_open_dev$sndctrl(&(0x7f0000000040), 0x1400000000000000, 0x90700) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x6004, 0x1) r0 = open(&(0x7f0000000280)='.\x00', 0x80, 0x28) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000100)=0x10) link(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file1\x00') mount(0x0, &(0x7f0000004080)='./mnt\x00', &(0x7f00000040c0)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004200)='./mnt/trace_marker\x00', 0x1, 0x1a) write(r1, 0x0, 0x0) 32.548263678s ago: executing program 0 (id=588): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) r0 = syz_usb_connect(0x5, 0x3f, &(0x7f00000009c0)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b339175db55a829339a69cb65f05dc22e623df7626d9ba6364d919d83d18008bb322096a6665f58e39f804d433f57ae67a19100f20ad0b4790cafad0cb890c5573be69d93c588a0845d0d1d28bf0d82e6b314e378fe660f"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000a80)={0x1c, &(0x7f0000000980)={0x60, 0x14, 0x3, "be53c8"}, 0x0, 0x0}) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r1) removexattr(0x0, 0x0) r2 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$apparmor_exec(r2, &(0x7f0000002280)=ANY=[@ANYBLOB='exec :'], 0x8) syz_usb_control_io(r0, 0x0, &(0x7f0000000bc0)={0x84, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17.46598835s ago: executing program 34 (id=588): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) r0 = syz_usb_connect(0x5, 0x3f, &(0x7f00000009c0)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b339175db55a829339a69cb65f05dc22e623df7626d9ba6364d919d83d18008bb322096a6665f58e39f804d433f57ae67a19100f20ad0b4790cafad0cb890c5573be69d93c588a0845d0d1d28bf0d82e6b314e378fe660f"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000a80)={0x1c, &(0x7f0000000980)={0x60, 0x14, 0x3, "be53c8"}, 0x0, 0x0}) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) fchdir(r1) removexattr(0x0, 0x0) r2 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$apparmor_exec(r2, &(0x7f0000002280)=ANY=[@ANYBLOB='exec :'], 0x8) syz_usb_control_io(r0, 0x0, &(0x7f0000000bc0)={0x84, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15.79669537s ago: executing program 4 (id=632): syz_open_procfs(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000140)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000002, 0x204031, 0xffffffffffffffff, 0xe60d3000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0x39000, 0x1100000000000000) write$binfmt_elf64(r2, &(0x7f0000000000)=ANY=[], 0xfffffe3e) 14.796936045s ago: executing program 4 (id=636): capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) r0 = syz_open_dev$dri(&(0x7f0000000ac0), 0x239, 0x7e1780) ioctl$DRM_IOCTL_MODE_ADDFB(r0, 0xc01c64ae, &(0x7f0000000700)={0x0, 0xffffffc2, 0x3, 0xb301, 0x80, 0x800, 0x6}) setpriority(0x2, 0x0, 0xb842) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100000000004026093333400000000001090224080000000000000000000921003fc92300000122010009058103080000000000"], 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000004c0)={&(0x7f0000000180)=[0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0], 0x2, 0xa, 0x9, 0x1}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000640)={&(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000580)=[0x0], &(0x7f00000005c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0], 0x9, 0x1, 0x5, 0x4}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f00000006c0)={0x2, 0x0, &(0x7f0000000680)=[0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000008c0)={&(0x7f0000000740)=[0x0], &(0x7f0000000800)=[0x0], &(0x7f0000000840)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000880)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1, 0x1, 0x5, 0x6}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000980)={&(0x7f0000000940)=[0x0, 0x0], 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000a00)={&(0x7f0000000900)=[r3, r4, r5, r6], 0x4, 0x0, r7, 0x7ff, 0x4, 0x7, 0x7, {0x5, 0x40, 0x8c, 0x625, 0x3, 0xfff, 0x8, 0x8001, 0x31b1, 0x6, 0x29d, 0xd593, 0x8, 0x7e397028, "3929c73007fa6c72d57448e44593dc7a3e051585779f7ae7c802c52ccf3622df"}}) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r8, 0x6, 0x1d, &(0x7f0000000100)={0x35, 0xc, 0xfffffffb, 0x100, 0x6}, 0x14) syz_usb_control_io$hid(r1, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETGAMMA(r0, 0xc02064a4, &(0x7f0000000b80)={r2, 0x7, &(0x7f0000000a80)=[0x3, 0x1, 0x89b, 0xbc, 0x3, 0x7, 0xc9d], &(0x7f0000000b00)=[0x4, 0x40, 0x8, 0x9, 0x8000], &(0x7f0000000b40)=[0xfff, 0x1, 0x7]}) r9 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000d0327408ca0768a8d4c4000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r9, 0x0, 0x0) syz_usb_connect$printer(0x6, 0x0, 0x0, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x5, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0xe8, &(0x7f0000000540)=ANY=[@ANYRES8=r1]}]}) r10 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt(r10, 0x0, 0x82, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x1, {[@local=@item_012={0x0, 0x2, 0x7}]}}, 0x0}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000040)='./my_configfs\x00', 0x176) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r12 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/dbroot\x00', 0x1, 0x0) write$proc_mixer(r12, &(0x7f0000000080)=[{'IMIX', @val={' \'', 'CD'}}], 0x1f) sendmsg$nl_generic(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="dc000000260001031dbd7002f4dbdf25200000009bd44ae44d1705244246c0d8cb4bc093cfb30db8426e147d7d96813bb4437ae5701d395d3afc5c23e7d464ecab281fe1a4e74bf77da5a947d63e39b488e09bc48749dead4aa45a7198d0b21441d1888370fceefaccf1ffe7a04f1dfac5a78bfbecf38f1d2984dddecea1ba95e093f189f2293a2adc35c8e1afe1d7e62575ee5bd20672097393dd4bd95064d4bf25fb6d87cf7f3485e1a5a95e9df5b9747ebef4bdb29521230852944846bee777890875699181b6dc5958922ed51adda3623e8a0722a1f12755611d"], 0xdc}, 0x1, 0x0, 0x0, 0x40040}, 0x0) syz_usb_ep_write(r1, 0x81, 0xffffff75, &(0x7f00000002c0)="b9425b44651dd23241963599000000110000004a16941ff5f4b4f1f0add7fcf2b877fceafffffffffff1ffdf4cd9f5d3969890522c77157d88010000003a5bd5531d459dffff03000000000091ff000000e8f5b3371da3635b8b4fa637135800001f65e4b436aa9e50bc0f19b7d3372ff9ebcede1fb5e9428f54d5d1f0cc752cf246a5d2da34a5aa97dc14a469c3dd3e26b41c356484e46fd66e3f2c7807e8773eed7b94fa099ab84feadec2ea95f65bba452eae5b0900f98a979a88c517a2dc360a00237723e2f467af706ea17226296b3a10a351cb47aba2c6b836c90679b4dd859ddc9e4800448aab0000000000000d75f34bb50d8d7084") syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) 11.281127034s ago: executing program 4 (id=641): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000500)={0x0, 0x0, 0x3, 'Yf\''}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)={0x20, 0x1, 0x34, "712bab"}, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001300)={0x84, &(0x7f0000000e40)={0x0, 0x0, 0x3, "0b3b81"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000000)={0x40, 0x12, 0x3, '\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000f40)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="400a03000000fbc85fc8dcf0a36d9d5ed6038c3698d56c629afc513f43138835a39771d4076c1a0b66bea717c862db4a786cb35fd84bed60a420908e56ad0ffce415658f6c19338e17a312863a4b71e71398ab11305923a0aa646a18212917ffb6a5f8fe"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 8.900746921s ago: executing program 6 (id=648): r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="2000000014000504010000000000000023000000010000000500020008000000", 0x20) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) arch_prctl$ARCH_SET_GS(0x1001, 0xfffffffffffffffe) bind$phonet(r1, &(0x7f0000000100)={0x23, 0x0, 0x8, 0x2b}, 0x10) listen(r1, 0x5) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) fcntl$setstatus(r2, 0x4, 0x800) connect$phonet_pipe(r2, &(0x7f0000000200)={0x23, 0x0, 0x8, 0x2b}, 0x10) r3 = socket(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x3a, 0x1, 0x0, 0xc) r4 = accept$phonet_pipe(r1, 0x0, 0x0) setsockopt$PNPIPE_ENCAP(r4, 0x113, 0x1, &(0x7f0000000300)=0x1, 0x4) close(r2) close(r4) close(r1) close(r0) r5 = socket$nl_generic(0x10, 0x3, 0x10) write(r1, &(0x7f0000000340)="483fd94838f1ddecead49a4dc8a9a09215c7957812e1248e", 0x18) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002ebd700e000600001400000018000180140002006e657464657673696d30000000000000050019000000000308001500f1ffff01050018"], 0x44}}, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0xc0686611, &(0x7f0000000080)={0x67, 0x0, 0x2, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x4, 0x2, 0x5, 0x7f37b986, 0x40, @private2={0xfc, 0x2, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x40, 0x8000, 0x5, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f00000002c0)={'syztnl0\x00', &(0x7f0000000240)={'ip6_vti0\x00', r8, 0x2f, 0x9, 0x5, 0x7ff, 0x43, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x700, 0x8, 0x8, 0xffff9399}}) sendmsg$ETHTOOL_MSG_FEATURES_GET(r3, &(0x7f00000004c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000840)=ANY=[@ANYBLOB="2b06fa0094886112af1a191b", @ANYBLOB="3c42bbd4f9f77ee2a3eee84c1ed2ec53360804765725ff141a8db8163773b8a22873d2aa7d5bbe276b23ae9b99a2388685498b23be4aeb8f4dacee1536ec68ae20b994326030c19b31bcb69d94474297815b35cc67431e0514f9763e9554ba3cd117d0db4183fcb9a27b8615bb524b8543", @ANYBLOB="100025bd7000fddbdf250b0000004c000180140002006d6163736563300000000000000000000800030001000000080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="1400020064766d72703100000000000000000000080003000000000034000180140002006873723000000000000000000000000008000100", @ANYRES32=r8, @ANYBLOB="1400020064766d72703000000000000000010000700001800800030003000000080003000200000008000100efc32451245ae44230e34a0d57f5a9863e3a9a8d957e118a21c7c006260d76ec4778e1290c0d21d9a31c8ef313ebeacc00000000000000", @ANYRES32=r9, @ANYBLOB="080003000100000014000200636169663000000000000000000000000800030000000000080003000000000014000200776731000000000000000000000000001400020073797a6b616c6c657230000000000000"], 0x104}}, 0x20008084) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000340)='erofs\x00', 0x0, &(0x7f0000000240)='acl') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x4000, 0x0) open(&(0x7f00000000c0)='./tracefs/dynamic_events\x00', 0x202, 0x40) 7.989499389s ago: executing program 6 (id=650): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r1, @ANYBLOB="08002600901500000800570080"], 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0xc044) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) mount(0x0, 0x0, &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) ftruncate(r5, 0x7fffffffffffffff) syz_usb_control_io$cdc_ecm(r4, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000380)=ANY=[@ANYBLOB="400c00001c00"], 0x0, 0x0}) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000001100)={{r0, &(0x7f0000000140)='@\x00', 0xf100e7962f507d03, &(0x7f00000001c0)={@_ha_fsid={[0x2, 0x1]}, {0x101, 0x9311, 0x7fffffff, 0x8001}}, 0x1, &(0x7f0000000580), &(0x7f00000005c0)=0x5}, 0x4, &(0x7f0000001080)=[{0x2, 0xfffffffd, &(0x7f0000000600)='wlan0\x00', &(0x7f0000000a00)="affc830583e2cb3f09b3ee1948fabf8bd2010270b394da1c635459d17119f4065eb69e66f7c46fde70c37af8b506af54e7e30b256acfdf029fe086e14ab4b4883c3d5e84e1bf2f13d0177c8b28f8b36f782263adc0d9357972fad93a068355e7c76797e3306d90ac53c8e297c5817da3", 0x70, 0x18}, {0x3, 0xe2a, &(0x7f0000000d00)='TIPCv2\x00', &(0x7f0000000d40)="9953da575796040e1b4fdc915c10b67298d00da1a8846faeea4b0ebbe6eea62e2ff2a9dfd1b69d988b72eee0bfe693b8fb2beb03ea5c926ae026f989c7aa008a4c262f2c8abb19cebb2a3917afaa7695ff1834b2ae8674ee8de879413f04a291cb667261c28eeb1cb5372295da3d9ade8a105fe10d3d16f640c23b4a1846ded115d23ea0c6d0c748ed233357131ea727d4a543a31de02decca93820b1dd2f86401e3c3d4d9b7", 0xa6, 0x2c}, {0x1, 0xc0000000, &(0x7f0000000e00)='#:-\'-\x00', &(0x7f0000000e40)="d62bc8b0e872a8f12de54aec5e7bd3a1e2e215fd735b89141bb0044731918d2e70f05265b077cf4d346296d0fc249994dc6ef80c65e99dda3d4a9655c5748b9f1f31e192c2d87dd8c42f16a83f55447a8d7d43d0c67a7c4393940622ed9b3b01cd6205500acc4ba210571b9a1def38ee6793e02cd25128c7d627fbd25b53c8ea4e640078ce8d5edbd752c2922ba8f1cdd3865b61e8eb0fce66a7e1d248a1d59cbabbaa0cea7d98589da0847d45da03a6181f22211002f1624cdceffa8db4a7610129dc1214a419607fd0e422bc890f96a16f1f9be3e5ff353436278793d646e2fa33", 0xe2, 0x8}, {0x1, 0x8, &(0x7f0000000f40)='TIPCv2\x00', &(0x7f0000000f80)="c1116cb4609d8017ea9ace7f495cd99a9ba721abeda0a733949ed44186f90bb1c1179d53e16b5ed0648c836eef120f30206635c8f35b752c1606491e884754b5a3727e5fc2d7e1c0a07e1c2c0b6fd08cc28de58bbb159e46adba8b22e20107dbc76807a61674b566ddb799ed6aab0c2295d08a7c663aea0136c13371ca8f45fe98ee48212eba24e7dd6e6a2c606a93d2d4af631a9c1ac2c6f9f0c21d51d09e8a24f4ec5bd9ef8e4c3b9ace748cd987174e15ed1177222047a00fc96b0a2f30d439f0dd3a3b0911f65384f9a6e85a0f889eca9ffd1d5b9f847275ed22", 0xdc}]}) 7.885199353s ago: executing program 2 (id=651): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000001, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x1, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e21, 0x80000, @dev={0xfe, 0x80, '\x00', 0x13}, 0xfffffffe}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000002900000037000000d4c6"], 0x18}, 0x40c0) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x40000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='net\x00') lseek(r2, 0x517b, 0x2) getdents64(r2, 0xffffffffffffffff, 0x43) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r1, &(0x7f0000000c40)=[{&(0x7f0000000340)="2e1221b23bb601c494d3df173e7596", 0xf}, {&(0x7f00000002c0)="0400200002e877", 0x7}], 0x2) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) 7.709893617s ago: executing program 2 (id=652): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1b9) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x40000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'erspan0\x00', 0x0}) sendmsg$nl_route_sched_retired(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)=@delchain={0x50, 0x65, 0x400, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x3, 0xe}, {0xffff, 0x9}, {0xd, 0x10}}, [@f_rsvp6={{0xa}, {0x20, 0x2, [@TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0x3}}, @TCA_RSVP_SRC={0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x50}, 0x40400c5) syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000000)=ANY=[], 0x0) 6.81909242s ago: executing program 4 (id=656): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x42, 0x1ff) write(r0, &(0x7f00000001c0)="cf", 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r1, &(0x7f0000000100)='p:p1 ./file0:0', 0xe) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/events/uprobes/p1/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='1', 0x1) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, &(0x7f0000001800)=[{0x0}, {&(0x7f0000000680)="02", 0x1}], 0x2, 0x0) mmap(&(0x7f0000fee000/0x12000)=nil, 0x12000, 0x5, 0x2012, r0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x40000004c0902, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) (async) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x42, 0x1ff) (async) write(r0, &(0x7f00000001c0)="cf", 0x1) (async) openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x1, 0x0) (async) write(r1, &(0x7f0000000100)='p:p1 ./file0:0', 0xe) (async) openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/events/uprobes/p1/enable\x00', 0x1, 0x0) (async) write(r2, &(0x7f0000000240)='1', 0x1) (async) pipe(&(0x7f00000045c0)) (async) vmsplice(r3, &(0x7f0000001800)=[{0x0}, {&(0x7f0000000680)="02", 0x1}], 0x2, 0x0) (async) mmap(&(0x7f0000fee000/0x12000)=nil, 0x12000, 0x5, 0x2012, r0, 0x0) (async) openat$nullb(0xffffffffffffff9c, 0x0, 0x40000004c0902, 0x0) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) (async) 6.664980832s ago: executing program 4 (id=657): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000080)={0x0, 0x4000}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000140)={0x1d, r2, 0x1, {0x0, 0xff, 0x4}, 0x83}, 0x18) (async) bind$can_j1939(r0, &(0x7f0000000140)={0x1d, r2, 0x1, {0x0, 0xff, 0x4}, 0x83}, 0x18) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000340)={0x1d, r4, 0x2000200, {0x2, 0xff, 0x4}}, 0x18) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r5, 0x29, 0x1c, &(0x7f0000000040)={@mcast1, r4}, 0x14) r6 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r6, &(0x7f00000001c0), 0x10) (async) bind$can_raw(r6, &(0x7f00000001c0), 0x10) socket$phonet(0x23, 0x2, 0x1) (async) socket$phonet(0x23, 0x2, 0x1) socket(0x10, 0x3, 0x0) (async) r7 = socket(0x10, 0x3, 0x0) write(r7, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e0000000000000008000f0001000000", 0x24) 6.472740991s ago: executing program 4 (id=658): timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x77359400}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0xc00, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000000900010073797a30000000006c000000160a01040000000000000000010000000900010073797a30000000000900020073797a300000000040000380080001400000000008000240000000002c000380140001006c6f00000000000000000000000000001400010064756d6d79300000000000000000000054000000030a01040000930000000000010000000900010073797a30000000000900030073797a300000000014000480080001400000000208000240000000000b00070066696c746572000008000a400000000158000000060a01040000000000000000010000000900010073797a30000000000900020073797a30000000002c0004802800018011000100666c6f775f6f66666c6f6164"], 0x160}}, 0x0) 6.167711428s ago: executing program 35 (id=658): timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x77359400}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0xc00, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000000900010073797a30000000006c000000160a01040000000000000000010000000900010073797a30000000000900020073797a300000000040000380080001400000000008000240000000002c000380140001006c6f00000000000000000000000000001400010064756d6d79300000000000000000000054000000030a01040000930000000000010000000900010073797a30000000000900030073797a300000000014000480080001400000000208000240000000000b00070066696c746572000008000a400000000158000000060a01040000000000000000010000000900010073797a30000000000900020073797a30000000002c0004802800018011000100666c6f775f6f66666c6f6164"], 0x160}}, 0x0) 4.866664658s ago: executing program 6 (id=663): prctl$PR_SCHED_CORE(0x3a, 0x0, 0x0, 0x0, &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/mapper/control\x00', 0x0, 0x0) ioctl(r2, 0xc138fd03, &(0x7f0000000100)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141") ioctl(r2, 0xc138fd09, &(0x7f0000000300)="0400000032000000000000008a0100003801000001000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141000000000000000008000000000000000000000000000000726169640000000000000000000000007261696431203120382032202d202e2f6465762f6c6f6f7030202d202e2f6465762f6c6f6f703100") ioctl(r2, 0xc138fd0c, &(0x7f0000000500)="040000003200000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f72616964004141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141") syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) sendmsg$IPVS_CMD_DEL_DAEMON(r0, 0x0, 0x24000001) r3 = socket(0x10, 0x803, 0x0) r4 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'ip6_vti0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f00000005c0)={@mcast1, @remote, @remote, 0x1, 0x2, 0x5, 0x400, 0xb7, 0xd30048, r5}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', r6, 0x4, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3a}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x80, 0x0, 0x1, 0x1}}) 4.499680182s ago: executing program 2 (id=665): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000500)={0x0, 0x0, 0x3, 'Yf\''}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)={0x20, 0x1, 0x34, "712bab"}, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001300)={0x84, &(0x7f0000000e40)={0x0, 0x0, 0x3, "0b3b81"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000000)={0x40, 0x12, 0x3, '\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000f40)={0x84, &(0x7f0000000200)=ANY=[@ANYBLOB="400a03000000fbc85fc8dcf0a36d9d5ed6038c3698d56c629afc513f43138835a39771d4076c1a0b66bea717c862db4a786cb35fd84bed60a420908e56ad0ffce415658f6c19338e17a312863a4b71e71398ab11305923a0aa646a18212917ffb6a5f8fe"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.463031197s ago: executing program 6 (id=666): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="5c000000020601030000000000000000000000000900020073797a30000000000500010006000000050005000a0000000500040000000000140007800800114000"], 0x5c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={0x68, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_LABELS={0x4}]}, 0x68}}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x88020, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x1) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x40000095, 0x0, 0xfffffffffffffffd}]}) r5 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r5, 0x0, 0x0) listen(r5, 0x1) sendmsg(r5, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r6, &(0x7f0000000040)="550000001100290404850698fae99e0002000000000000", 0x17) r7 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r7, 0x0, 0x0) r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_GET(r8, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x18, 0x1406, 0x10, 0x70bd29, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x4004000}, 0x20000000) recvmsg(r5, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x2) syz_open_dev$usbmon(&(0x7f0000000200), 0x0, 0x60040) r9 = syz_clone(0x20000000, 0x0, 0xf, 0x0, 0x0, 0x0) ptrace(0x10, r9) close(0xffffffffffffffff) r10 = syz_open_dev$loop(0x0, 0x7, 0x180062) r11 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/mem_sleep', 0x20001, 0x18b) ioctl$LOOP_CONFIGURE(r10, 0x4c0a, &(0x7f0000000080)={r11, 0x0, {0x0, 0x0, 0x0, 0x7, 0x4010000000000ffd, 0x0, 0x0, 0x19, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0x6]}}) socket$nl_generic(0x10, 0x3, 0x10) r12 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r12, 0x89f1, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000240)=@ethtool_rxfh={0x46, 0x1, 0x247a, 0x4, 0x0, "baef9a", 0x7, [0x9, 0xcb8, 0x6, 0x8, 0x8]}}) 3.961035793s ago: executing program 6 (id=667): syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040980c4011000100000001090219000101008032090400"], 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x0, 0x0) 3.715846101s ago: executing program 5 (id=669): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x12, &(0x7f0000001200)=0xd0, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000440)={@val={0x8, 0x800}, @val={0x0, 0x0, 0x6, 0x0, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x2, 0x14, 0x66, 0x0, 0x3, 0x73, 0x0, @rand_addr=0x64010120, @broadcast}}}, 0x22) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r3) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_SHORT_ADDR={0x6}]}, 0x50}, 0x4, 0x700000000000000}, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/22, 0xff04, 0x585761205da19404, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) 2.717193352s ago: executing program 5 (id=670): pipe2(&(0x7f0000000440), 0x80000) (async) pipe2(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) read$FUSE(r1, &(0x7f0000007680)={0x2020}, 0x2020) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) (async) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) sendfile(r0, r1, 0x0, 0x10ffff) (async) sendfile(r0, r1, 0x0, 0x10ffff) write$apparmor_exec(r0, &(0x7f0000000080)={'exec ', '{<\x00'}, 0x8) 2.643773453s ago: executing program 5 (id=671): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x1c1842, 0x0) syz_usb_connect(0x0, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5500010102030109025100010100c0320904000002080650000705"], 0x0) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="043ef502"], 0xf8) 2.388060453s ago: executing program 6 (id=672): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1b9) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x40000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000200)={'erspan0\x00', &(0x7f00000001c0)={'sit0\x00', 0x0, 0x700, 0x8000, 0x0, 0x368b, {{0x5, 0x4, 0x1, 0x2, 0x14, 0x64, 0x0, 0x4, 0x4, 0x0, @multicast2, @loopback}}}}) sendmsg$nl_route_sched_retired(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)=@delchain={0x50, 0x65, 0x400, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {0x3, 0xe}, {0xffff, 0x9}, {0xd, 0x10}}, [@f_rsvp6={{0xa}, {0x20, 0x2, [@TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0x3}}, @TCA_RSVP_SRC={0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x50}, 0x40400c5) syz_usb_connect$cdc_ncm(0x5, 0x6e, &(0x7f0000000000)=ANY=[], 0x0) 1.860914608s ago: executing program 5 (id=673): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r1, 0x8982, &(0x7f0000000280)={0x0, 'veth0_macvtap\x00', {0x2}, 0x6}) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000500)={0x0, 0x0, 0x3, 'Yf\''}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000001e40)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001dc0)={0x20, 0x1, 0x34, "712bab"}, 0x0}) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000001300)={0x84, &(0x7f0000000e40)={0x0, 0x0, 0x3, "0b3b81"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) syz_usb_control_io$uac2(r2, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000000)={0x40, 0x12, 0x3, '\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.277548639s ago: executing program 2 (id=674): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000480)='/dev/comedi2\x00', 0x1, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r3, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x800}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000000)={0x28, 0x4, r3, 0x0, &(0x7f00004f9000/0x3000)=nil, 0x3000}) ioctl$IOMMU_IOAS_COPY(r2, 0x3b83, &(0x7f0000000040)={0x28, 0x5, r3, r3, 0x3, 0xfffffffffffffffa, 0x3fff}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000200)={0x28, 0x4, r3, 0x0, &(0x7f00004f9000/0x4000)=nil, 0x4000, 0xf3}) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000000c0)={'das16m1\x00', [0x140, 0x9, 0x7, 0x2, 0x1000000a, 0x7, 0x8002, 0x208000, 0x7, 0xc72d, 0x0, 0x7, 0x3, 0xa, 0x29, 0x72ef, 0x101, 0x50, 0x6, 0x9, 0x3, 0x6, 0x4004, 0x9, 0x1000, 0x8, 0x471, 0xffffff7f, 0x5, 0x8003, 0x4]}) write$tun(r1, 0x0, 0x0) write$tun(r0, &(0x7f0000000080)={@void, @val={0x2, 0x8d, 0xf9, 0x1, 0x8, 0x6}, @ipv4=@tipc={{0x21, 0x4, 0x3, 0x7, 0xae, 0x67, 0x0, 0x9, 0x6, 0x0, @dev={0xac, 0x14, 0x14, 0xb}, @local, {[@noop, @timestamp_prespec={0x44, 0x4c, 0xbc, 0x3, 0x6, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xef}, {@multicast1, 0x6}, {@local, 0x6}, {@remote, 0x80}, {@dev={0xac, 0x14, 0x14, 0x1d}, 0x59}, {@loopback}, {@loopback, 0x49}, {@loopback, 0x8}]}, @rr={0x7, 0x3, 0x3a}, @end, @timestamp_prespec={0x44, 0x1c, 0xbf, 0x3, 0x2, [{@remote, 0x6}, {@rand_addr=0x64010100, 0x7c0}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7db8}]}]}}, @payload_named={{{{{0x2a, 0x0, 0x1, 0x0, 0x0, 0xa, 0x2, 0x2, 0x1000, 0x0, 0x2, 0x0, 0x0, 0x2, 0x7f, 0xd, 0x4, 0x4e24, 0x4e20}, 0x0, 0x1}, 0x3}}, [0x0, 0x0]}}}, 0xb8) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x2, 0x1a8) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0x4}}, 0x20) ioctl$DVB_DVR_DMX_DQBUF(0xffffffffffffffff, 0xc0186f40, &(0x7f0000000180)={0x4, 0x5, 0xadd1, 0xfd82, 0xa, 0x4}) 1.067487394s ago: executing program 5 (id=675): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000d507df08c410448200dc01020301090212000100000000090400000003"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) unlink(&(0x7f0000000000)='./file0\x00') syz_usb_connect$uac1(0xde1645505043d779, 0x101, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xef, 0x3, 0x1, 0x6, 0x70, 0x5, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x0, 0x4d}, [@processing_unit={0xd, 0x24, 0x7, 0x2, 0x3, 0x4, "afadb525cc37"}, @selector_unit={0x5, 0x24, 0x5, 0x4, 0x40}, @feature_unit={0x11, 0x24, 0x6, 0x2, 0x6, 0x5, [0x6, 0xa, 0x8, 0x5, 0x3], 0x49}, @processing_unit={0xb, 0x24, 0x7, 0x1, 0x1, 0x0, "94d33cae"}, @selector_unit={0xb, 0x24, 0x5, 0x2, 0x7, "363a41d0e923"}, @selector_unit={0xa, 0x24, 0x5, 0x1, 0xd3, "14dd335f14"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xc, 0x1, 0x7, 0xd, 0x2}, @format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0xe9, 0x4, 0x8, 0x2, "3fee58"}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0xc1, 0x2, 0xf1, 0x9, 'S'}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x2, 0x0, 0x8, 0x3}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x8000, 0xed, 0xaa}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x7, 0x2, 0xcb, 0x80, 'fG'}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x3, 0x9, 0xa0, {0x7, 0x25, 0x1, 0x0, 0x7, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x2, 0x2, 0x0, 0x3b, "c9", "d6"}, @as_header={0x7, 0x24, 0x1, 0x6, 0x7, 0x1001}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x6, 0x2, 0x8, {0x7, 0x25, 0x1, 0xc, 0x5, 0x6}}}}}}}}]}}, &(0x7f00000004c0)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x110, 0x3, 0x7d, 0x2, 0x20, 0xab}, 0xb9, &(0x7f0000000280)={0x5, 0xf, 0xb9, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x7, "33db90a9aa5af6d5d1bc008e077c8b97"}, @generic={0x89, 0x10, 0x5, "11d5332dc1a751f16384a1dc3b8890a3666ababfa8777f05f520581f0ba6171dd474fc237b3c4409722b8278c5547d4314a5b20f24b1833304456d14d9a27e89bf9c4982aa2cdcc826a6f15f9eee3657bfd96bd3e1992b5b1209f2f9d47477da34114e0864cbb7b5e9121f9e6eff7ee6c018ec061880ac0125c20626b4421db470816303b691"}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "807e24451df1803c8cc509b394121ed8"}]}, 0x5, [{0x6, &(0x7f0000000340)=@string={0x6, 0x3, "fe946418"}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x813}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x4c0a}}, {0x4b, &(0x7f0000000400)=@string={0x4b, 0x3, "d7d0dcb9d365f441614abc72288652f5ad6ebfe3a69cff31f2b656581c1e6385c216b35df12d7069c2eaf0d187d5023330ff947fe4fe69a5bfa7c968f29cd00159a16c96cddf3b1b8f"}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x44e}}]}) syz_usb_control_io(r0, 0x0, 0x0) 1.004802676s ago: executing program 2 (id=676): socket$unix(0x1, 0x1, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000000)=""/196, 0xc4}], 0x1, 0xa3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setxattr$security_ima(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340), &(0x7f0000000380)=@sha1={0x1, "9a11cd0bf1180ce9ee9e125d3ddd699514abea81"}, 0x15, 0x3) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000f, 0x204031, 0xffffffffffffffff, 0xb320a000) r1 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) io_setup(0x222, &(0x7f0000000180)=0x0) r4 = eventfd2(0x1, 0x800) io_submit(r3, 0x3, &(0x7f0000000200)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x5, r2, 0x0, 0x0, 0x5, 0x0, 0x0, r4}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x7, 0x2, r2, &(0x7f00000000c0)="dbaeab51b0c0", 0x6, 0x400}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2, 0x6, r1, &(0x7f0000000100)="65914bafba7b46f1d0ca10657d9424a91d330704bc0f8f61e6a89f728b885ede19a8ca7ba167a9c867ec0b22585f135b0b894a1f82e44fc288b4371d6c97da3eb8aab80f3a2586b1a3227397eb39f6fa53e1131c866f9d277dfff1423c26fff5b4539aa4fe2b59e614b3b5", 0x6b, 0x8, 0x0, 0x1, r4}]) ioctl$DVB_DEMUX_DMX_SET_FILTER(r1, 0x403c6f2b, &(0x7f0000000040)={0x4, {"0dbad96fff01000008ff00200800", "3dfab043e15fad27a639f905b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x40010, 0x6}) preadv(r1, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) ioctl$DVB_DEMUX_DMX_SET_BUFFER_SIZE(r1, 0x6f2d, 0x5) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_int(r5, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) r7 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r7, &(0x7f0000000680)=[{{&(0x7f0000000000)={0xa, 0x0, 0x4000000, @rand_addr=' \x01\x00'}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)="18", 0x1}], 0x1}}], 0x1, 0x0) shutdown(r7, 0x1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r7, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x3ff}, &(0x7f0000000180)=0x8) write$cgroup_subtree(r6, &(0x7f00000000c0)=ANY=[], 0x6a) 369.58798ms ago: executing program 5 (id=677): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x12, &(0x7f0000001200)=0xd0, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000440)={@val={0x8, 0x800}, @val={0x0, 0x0, 0x6, 0x0, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x2, 0x14, 0x66, 0x0, 0x3, 0x73, 0x0, @rand_addr=0x64010120, @broadcast}}}, 0x22) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x50, 0x0, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_SHORT_ADDR={0x6}]}, 0x50}, 0x4, 0x700000000000000}, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/22, 0xff04, 0x585761205da19404, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) 0s ago: executing program 2 (id=678): bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0xfffffff6, @loopback, 0x101}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1f3) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) kernel console output (not intermixed with test programs): T7660] ? __asan_memcpy+0x40/0x70 [ 223.423373][ T7660] ? __skb_clone+0x5c/0x6c0 [ 223.423391][ T7660] netlink_rcv_skb+0x226/0x4a0 [ 223.423408][ T7660] ? __pfx_genl_rcv_msg+0x10/0x10 [ 223.423427][ T7660] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 223.423452][ T7660] ? down_read+0x2b9/0x320 [ 223.423469][ T7660] genl_rcv+0x28/0x40 [ 223.423487][ T7660] netlink_unicast+0x7bd/0x940 [ 223.423508][ T7660] netlink_sendmsg+0x7c3/0xae0 [ 223.423528][ T7660] ? __pfx_netlink_sendmsg+0x10/0x10 [ 223.423549][ T7660] ? apparmor_socket_sendmsg+0x98/0x360 [ 223.423564][ T7660] ? __pfx_netlink_sendmsg+0x10/0x10 [ 223.423580][ T7660] sock_sendmsg_nosec+0x13a/0x180 [ 223.423599][ T7660] ____sys_sendmsg+0x54e/0x850 [ 223.423617][ T7660] ? __pfx_____sys_sendmsg+0x10/0x10 [ 223.423637][ T7660] ? import_iovec+0x73/0xa0 [ 223.423655][ T7660] ___sys_sendmsg+0x2a5/0x360 [ 223.423669][ T7660] ? __lock_acquire+0x747/0x2de0 [ 223.423689][ T7660] ? __pfx____sys_sendmsg+0x10/0x10 [ 223.423725][ T7660] ? __fget_files+0x2a/0x420 [ 223.423740][ T7660] ? __fget_files+0x3a2/0x420 [ 223.423762][ T7660] __x64_sys_sendmsg+0x1b1/0x290 [ 223.423778][ T7660] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 223.423806][ T7660] do_syscall_64+0x166/0x520 [ 223.423817][ T7660] ? trace_irq_disable+0x3b/0x140 [ 223.423835][ T7660] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.423848][ T7660] ? clear_bhb_loop+0x70/0xc0 [ 223.423864][ T7660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.423877][ T7660] RIP: 0033:0x7f415239e159 [ 223.423889][ T7660] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 223.423901][ T7660] RSP: 002b:00007f4153277028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 223.423916][ T7660] RAX: ffffffffffffffda RBX: 00007f4152626090 RCX: 00007f415239e159 [ 223.423926][ T7660] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000006 [ 223.423935][ T7660] RBP: 00007f4153277090 R08: 0000000000000000 R09: 0000000000000000 [ 223.423944][ T7660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 223.423952][ T7660] R13: 00007f4152626128 R14: 00007f4152626090 R15: 00007ffd39a0a508 [ 223.423972][ T7660] [ 223.441599][ T9] usb 3-1: Using ep0 maxpacket: 8 [ 223.452901][ T9] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 223.514164][ T9] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 223.514201][ T9] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 223.514215][ T9] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 223.514230][ T9] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 223.514244][ T9] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 223.514271][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.546903][ T5696] usb 5-1: device descriptor read/64, error -71 [ 223.862662][ T5696] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 223.916257][ T9] usb 3-1: usb_control_msg returned -32 [ 223.916293][ T9] usbtmc 3-1:16.0: can't read capabilities [ 224.038307][ T5696] usb 5-1: device descriptor read/64, error -71 [ 224.141908][ T7666] FAULT_INJECTION: forcing a failure. [ 224.141908][ T7666] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 224.141930][ T7666] CPU: 0 UID: 0 PID: 7666 Comm: syz.0.505 Not tainted syzkaller #0 PREEMPT(full) [ 224.141946][ T7666] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 224.141954][ T7666] Call Trace: [ 224.141959][ T7666] [ 224.141965][ T7666] dump_stack_lvl+0xe8/0x150 [ 224.141987][ T7666] should_fail_ex+0x3eb/0x540 [ 224.142004][ T7666] _copy_to_user+0x31/0xb0 [ 224.142022][ T7666] dvb_frontend_do_ioctl+0x21a4/0x4290 [ 224.142041][ T7666] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 224.142060][ T7666] ? __pfx_dvb_frontend_do_ioctl+0x10/0x10 [ 224.142088][ T7666] ? stack_trace_save+0xa9/0x100 [ 224.142105][ T7666] ? __pfx_stack_trace_save+0x10/0x10 [ 224.142121][ T7666] ? kasan_save_track+0x4f/0x80 [ 224.142149][ T7666] ? stack_depot_save_flags+0x33/0x7f0 [ 224.142164][ T7666] ? __lock_acquire+0x747/0x2de0 [ 224.142185][ T7666] ? kasan_save_track+0x4f/0x80 [ 224.142203][ T7666] ? kasan_save_track+0x3e/0x80 [ 224.142220][ T7666] ? kasan_save_free_info+0x40/0x50 [ 224.142235][ T7666] ? __kasan_slab_free+0x5c/0x80 [ 224.142247][ T7666] ? kfree+0x1c5/0x650 [ 224.142261][ T7666] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 224.142274][ T7666] ? security_file_ioctl+0xc3/0x2a0 [ 224.142292][ T7666] ? __se_sys_ioctl+0x47/0x170 [ 224.142309][ T7666] ? do_syscall_64+0x166/0x520 [ 224.142320][ T7666] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 224.142381][ T7666] ? __might_fault+0xaf/0x130 [ 224.142402][ T7666] dvb_usercopy+0x199/0x2e0 [ 224.142417][ T7666] ? __pfx_dvb_frontend_do_ioctl+0x10/0x10 [ 224.142430][ T7666] ? __pfx_dvb_usercopy+0x10/0x10 [ 224.142452][ T7666] ? __fget_files+0x2a/0x420 [ 224.142467][ T7666] ? __fget_files+0x3a2/0x420 [ 224.142482][ T7666] ? __fget_files+0x2a/0x420 [ 224.142499][ T7666] ? __pfx_dvb_frontend_ioctl+0x10/0x10 [ 224.142512][ T7666] dvb_frontend_ioctl+0x59/0x80 [ 224.142527][ T7666] __se_sys_ioctl+0xfc/0x170 [ 224.142547][ T7666] do_syscall_64+0x166/0x520 [ 224.142558][ T7666] ? trace_irq_disable+0x3b/0x140 [ 224.142576][ T7666] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 224.142588][ T7666] ? clear_bhb_loop+0x70/0xc0 [ 224.142604][ T7666] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 224.142616][ T7666] RIP: 0033:0x7f745a59e159 [ 224.142629][ T7666] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 224.142640][ T7666] RSP: 002b:00007f745b510028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 224.142656][ T7666] RAX: ffffffffffffffda RBX: 00007f745a825fa0 RCX: 00007f745a59e159 [ 224.142666][ T7666] RDX: 0000200000000080 RSI: 0000000080106f53 RDI: 0000000000000003 [ 224.142675][ T7666] RBP: 00007f745b510090 R08: 0000000000000000 R09: 0000000000000000 [ 224.142683][ T7666] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 224.142691][ T7666] R13: 00007f745a826038 R14: 00007f745a825fa0 R15: 00007ffd5ef3f4e8 [ 224.142710][ T7666] [ 224.147625][ T5696] usb usb5-port1: attempt power cycle [ 224.541934][ T5696] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 224.558760][ T5696] usb 5-1: device descriptor read/8, error -71 [ 224.617455][ T7671] ieee802154 phy0 wpan0: encryption failed: -22 [ 224.797533][ T5696] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 224.817578][ T7674] usbtmc 3-1:16.0: usb_control_msg returned -32 [ 224.824432][ T5696] usb 5-1: device descriptor read/8, error -71 [ 224.927892][ T5696] usb usb5-port1: unable to enumerate USB device [ 224.977912][ T9] usb 6-1: new low-speed USB device number 14 using dummy_hcd [ 225.130501][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 225.130721][ T9] usb 6-1: New USB device found, idVendor=077d, idProduct=627a, bcdDevice= 0.10 [ 225.131715][ T9] usb 6-1: config 23 has an invalid interface number: 37 but max is 0 [ 225.131733][ T9] usb 6-1: config 23 has no interface number 0 [ 225.131751][ T9] usb 6-1: config 23 interface 37 has no altsetting 0 [ 225.134449][ T9] usb 6-1: string descriptor 0 read error: -22 [ 225.134534][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.204600][ T9] radioshark2 6-1:23.37: Invalid radioSHARK2 device [ 225.204622][ T9] radioshark2 6-1:23.37: probe with driver radioshark2 failed with error -22 [ 225.204828][ T9] usbhid 6-1:23.37: couldn't find an input interrupt endpoint [ 225.412559][ T9] usb 6-1: USB disconnect, device number 14 [ 225.962367][ T7678] CIFS: Attempting to mount //::1/share [ 226.281980][ T5696] usb 3-1: USB disconnect, device number 37 [ 226.697532][ T9] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 226.800652][ T7678] CIFS: VFS: Error connecting to socket. Aborting operation. [ 226.800689][ T7678] CIFS: VFS: cifs_mount failed w/return code = -4 [ 226.848863][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 226.850976][ T9] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 226.853250][ T9] usb 5-1: config 0 has an invalid descriptor of length 168, skipping remainder of the config [ 226.853281][ T9] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 226.853305][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 117, changing to 10 [ 226.853322][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 33075, setting to 1024 [ 226.853338][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 226.856525][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 226.856543][ T9] usb 5-1: Product: syz [ 226.856553][ T9] usb 5-1: Manufacturer: syz [ 226.856562][ T9] usb 5-1: SerialNumber: syz [ 226.980915][ T9] usb 5-1: config 0 descriptor?? [ 227.198377][ T9] radio-si470x 5-1:0.0: DeviceID=0x53c8 ChipID=0x0000 [ 227.198397][ T9] radio-si470x 5-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 227.235279][ T7687] overlay: Unknown parameter 'appraise' [ 227.625361][ T9] radio-si470x 5-1:0.0: si470x_get_report: usb_control_msg returned -71 [ 227.625382][ T9] radio-si470x 5-1:0.0: si470x_get_scratch: si470x_get_report returned -71 [ 227.625576][ T9] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -5 [ 227.670484][ T9] usb 5-1: USB disconnect, device number 44 [ 227.750059][ T1219] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 227.908039][ T1219] usb 3-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice=29.00 [ 227.910479][ T1219] usb 3-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 227.910499][ T1219] usb 3-1: Product: syz [ 227.943693][ T7689] overlayfs: statfs failed on './file0' [ 227.945890][ T1219] ftdi_sio 3-1:5.0: FTDI USB Serial Device converter detected [ 227.946821][ T1219] usb 3-1: Detected FT4233HP [ 228.149582][ T7694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 228.149898][ T7694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.175738][ T1219] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 228.184945][ T1219] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 228.200459][ T1219] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 228.219038][ T1219] usb 3-1: USB disconnect, device number 38 [ 228.241132][ T1219] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 228.241500][ T1219] ftdi_sio 3-1:5.0: device disconnected [ 228.317125][ T7708] tipc: MTU too low for tipc bearer [ 228.837897][ T1219] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 228.997611][ T1219] usb 5-1: Using ep0 maxpacket: 8 [ 228.998419][ T1219] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 228.999554][ T1219] usb 5-1: config 0 has an invalid descriptor of length 168, skipping remainder of the config [ 228.999585][ T1219] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 228.999601][ T1219] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 117, changing to 10 [ 228.999617][ T1219] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 33075, setting to 1024 [ 228.999633][ T1219] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 229.001290][ T1219] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 229.001306][ T1219] usb 5-1: Product: syz [ 229.001315][ T1219] usb 5-1: Manufacturer: syz [ 229.001324][ T1219] usb 5-1: SerialNumber: syz [ 229.007031][ T1219] usb 5-1: config 0 descriptor?? [ 229.053485][ T9] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 229.170709][ T7726] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 229.170730][ T7726] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 229.174290][ T7726] vhci_hcd vhci_hcd.0: Device attached [ 229.230063][ T9] usb 6-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00 [ 229.230920][ T9] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32 [ 229.230940][ T9] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 98 [ 229.230964][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 229.240027][ T7721] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 229.240121][ T7721] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 229.292016][ T9] cyberjack 6-1:1.0: Reiner SCT Cyberjack USB card reader converter detected [ 229.328521][ T1219] radio-si470x 5-1:0.0: DeviceID=0x53c8 ChipID=0x0000 [ 229.328542][ T1219] radio-si470x 5-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 229.364525][ T9] usb 6-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 229.378993][ T5768] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 229.439429][ T5768] usb 37-1: new full-speed USB device number 2 using vhci_hcd [ 229.460494][ T7727] vhci_hcd: connection reset by peer [ 229.464178][ T12] vhci_hcd vhci_hcd.2: stop threads [ 229.464599][ T12] vhci_hcd vhci_hcd.2: release socket [ 229.489661][ T12] vhci_hcd vhci_hcd.2: disconnect device [ 229.530249][ T1219] radio-si470x 5-1:0.0: software version 83, hardware version 200 [ 229.530291][ T1219] radio-si470x 5-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 229.535742][ T9] usb 6-1: USB disconnect, device number 15 [ 229.582758][ T9] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 229.590163][ T9] cyberjack 6-1:1.0: device disconnected [ 229.732422][ T1219] radio-si470x 5-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 229.732711][ C0] radio-si470x 5-1:0.0: non-zero urb status (-71) [ 229.732834][ T1219] radio-si470x 5-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 229.733155][ T1219] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -22 [ 229.776320][ T1219] usb 5-1: USB disconnect, device number 45 [ 230.299626][ T6896] cxacru 1-1:251.202: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 230.378492][ T9] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 230.497562][ T1219] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 230.529361][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 230.530232][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.607700][ T30] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 230.647677][ T1219] usb 6-1: Using ep0 maxpacket: 16 [ 230.649475][ T1219] usb 6-1: unable to get BOS descriptor or descriptor too short [ 230.649526][ T1219] usb 6-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 230.650455][ T1219] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 230.650517][ T1219] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 230.650541][ T1219] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 230.653987][ T1219] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.654005][ T1219] usb 6-1: Product: syz [ 230.654014][ T1219] usb 6-1: Manufacturer: syz [ 230.654023][ T1219] usb 6-1: SerialNumber: syz [ 230.763547][ T9] cdc_acm 3-1:1.0: ttyACM0: USB ACM device [ 230.779919][ T30] usb 1-1: device descriptor read/64, error -71 [ 230.928300][ T7753] FAULT_INJECTION: forcing a failure. [ 230.928300][ T7753] name fail_futex, interval 1, probability 0, space 0, times 0 [ 230.928322][ T7753] CPU: 0 UID: 0 PID: 7753 Comm: syz.0.536 Not tainted syzkaller #0 PREEMPT(full) [ 230.928338][ T7753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 230.928346][ T7753] Call Trace: [ 230.928352][ T7753] [ 230.928358][ T7753] dump_stack_lvl+0xe8/0x150 [ 230.928447][ T7753] should_fail_ex+0x3eb/0x540 [ 230.928520][ T7753] get_futex_key+0x1b4/0x1580 [ 230.928564][ T7753] ? __pfx_get_futex_key+0x10/0x10 [ 230.928586][ T7753] ? __rtnl_unlock+0xc3/0xe0 [ 230.928667][ T7753] futex_wake+0x119/0x5f0 [ 230.928684][ T7753] ? __pfx_netdev_run_todo+0x10/0x10 [ 230.928732][ T7753] ? __pfx_futex_wake+0x10/0x10 [ 230.928750][ T7753] ? sock_ioctl+0x636/0x7e0 [ 230.928804][ T7753] ? __mutex_unlock_slowpath+0x731/0x900 [ 230.928870][ T7753] do_futex+0x458/0x4e0 [ 230.928888][ T7753] ? __pfx_do_futex+0x10/0x10 [ 230.928901][ T7753] ? irqentry_exit+0x218/0x910 [ 230.928933][ T7753] ? trace_irq_disable+0x3b/0x140 [ 230.928969][ T7753] __se_sys_futex+0x3a8/0x450 [ 230.928985][ T7753] ? security_file_ioctl+0x250/0x2a0 [ 230.929052][ T7753] ? __pfx___se_sys_futex+0x10/0x10 [ 230.929066][ T7753] ? __sanitizer_cov_trace_pc+0x4/0x80 [ 230.929097][ T7753] ? __x64_sys_futex+0x21/0xf0 [ 230.929113][ T7753] do_syscall_64+0x166/0x520 [ 230.929124][ T7753] ? trace_irq_disable+0x3b/0x140 [ 230.929141][ T7753] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.929169][ T7753] ? clear_bhb_loop+0x70/0xc0 [ 230.929186][ T7753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.929199][ T7753] RIP: 0033:0x7f745a59e159 [ 230.929213][ T7753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 230.929225][ T7753] RSP: 002b:00007f745b5100e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 230.929242][ T7753] RAX: ffffffffffffffda RBX: 00007f745a825fa8 RCX: 00007f745a59e159 [ 230.929252][ T7753] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f745a825fac [ 230.929261][ T7753] RBP: 00007f745a825fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 230.929270][ T7753] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 230.929279][ T7753] R13: 00007f745a826038 R14: 00007ffd5ef3f400 R15: 00007ffd5ef3f4e8 [ 230.929299][ T7753] [ 231.035035][ T5724] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 231.259373][ T5724] usb 5-1: Using ep0 maxpacket: 8 [ 231.260832][ T5724] usb 5-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 231.283456][ T30] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 231.284472][ T5724] usb 5-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 231.284488][ T5724] usb 5-1: Product: syz [ 231.284497][ T5724] usb 5-1: Manufacturer: syz [ 231.284507][ T5724] usb 5-1: SerialNumber: syz [ 231.323498][ T5724] usb 5-1: config 0 descriptor?? [ 231.336929][ T5724] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 231.366206][ T1219] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 231.381304][ T1219] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 231.386196][ T1219] usb 6-1: 2:1 : no cluster descriptor [ 231.436767][ T1219] usb 6-1: USB disconnect, device number 16 [ 231.446497][ T30] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 231.458267][ T30] usb 1-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 231.458291][ T30] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 231.458307][ T30] usb 1-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 231.458358][ T30] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 231.528475][ T7753] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 231.590019][ T7323] udevd[7323]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 231.619106][ T7751] rnbd_client L127: Can't parse path hp:127.0.0.1\ß?:…b”EzñîÜ[‡þ¶ÖßùÍÛµ¬°>,: -22 [ 231.662951][ T7751] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 231.663322][ T7751] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 231.692035][ T5724] gspca_zc3xx: reg_w_i err -71 [ 231.692114][ T5724] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 231.696776][ T5724] usb 5-1: USB disconnect, device number 46 [ 231.999513][ T7757] CIFS: bad ip= option (1:7.0.0.1) [ 232.300328][ T5724] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 232.345971][ T7761] afs: Unknown parameter 'dynv/kvm' [ 232.448624][ T5724] usb 6-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 232.452029][ T5724] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 232.452052][ T5724] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 232.454170][ T5724] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 232.454186][ T5724] usb 6-1: Product: syz [ 232.454195][ T5724] usb 6-1: Manufacturer: syz [ 232.454211][ T5724] usb 6-1: SerialNumber: syz [ 232.457056][ T5724] usb 6-1: config 0 descriptor?? [ 232.522363][ T7759] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 232.522462][ T7759] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 232.727508][ T7759] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 232.727581][ T7759] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 233.132205][ T5724] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 233.657897][ T5724] dm9601 6-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 233.689426][ T5724] usb 6-1: USB disconnect, device number 17 [ 234.299140][ T7766] syz.4.540 (7766): drop_caches: 2 [ 234.577346][ T5768] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 234.604572][ T30] aiptek 1-1:17.0: Aiptek tried all speeds, no sane response [ 234.604726][ T30] aiptek 1-1:17.0: probe with driver aiptek failed with error -22 [ 234.614991][ T9] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 234.643423][ T30] usb 1-1: USB disconnect, device number 45 [ 234.778522][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 234.779114][ T9] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 234.780160][ T9] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 234.780176][ T9] usb 5-1: config 0 has no interface number 0 [ 234.780201][ T9] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 234.780217][ T9] usb 5-1: config 0 interface 85 has no altsetting 0 [ 234.782241][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.782256][ T9] usb 5-1: Product: syz [ 234.782265][ T9] usb 5-1: Manufacturer: syz [ 234.782274][ T9] usb 5-1: SerialNumber: syz [ 234.787048][ T9] usb 5-1: config 0 descriptor?? [ 235.075536][ T9] appletouch 5-1:0.85: Failed to read mode from device. [ 235.075710][ T9] appletouch 5-1:0.85: probe with driver appletouch failed with error -5 [ 235.160610][ T7774] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.160961][ T7774] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.341371][ T9] usb 5-1: USB disconnect, device number 47 [ 235.400910][ T1219] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 235.550494][ T1219] usb 6-1: device descriptor read/64, error -71 [ 235.632192][ T7785] FAULT_INJECTION: forcing a failure. [ 235.632192][ T7785] name failslab, interval 1, probability 0, space 0, times 0 [ 235.632236][ T7785] CPU: 0 UID: 0 PID: 7785 Comm: syz.0.544 Not tainted syzkaller #0 PREEMPT(full) [ 235.632252][ T7785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 235.632261][ T7785] Call Trace: [ 235.632266][ T7785] [ 235.632273][ T7785] dump_stack_lvl+0xe8/0x150 [ 235.632296][ T7785] should_fail_ex+0x3eb/0x540 [ 235.632314][ T7785] should_failslab+0xa8/0x100 [ 235.632376][ T7785] __kmalloc_cache_noprof+0x9e/0x600 [ 235.632405][ T7785] ? bus_add_driver+0x162/0x670 [ 235.632479][ T7785] ? bus_add_driver+0x162/0x670 [ 235.632496][ T7785] bus_add_driver+0x162/0x670 [ 235.632511][ T7785] ? driver_find+0x192/0x1a0 [ 235.632527][ T7785] driver_register+0x23a/0x320 [ 235.632547][ T7785] usb_gadget_register_driver_owner+0xf9/0x270 [ 235.632610][ T7785] raw_ioctl+0x1541/0x41c0 [ 235.632656][ T7785] ? tomoyo_path_number_perm+0x219/0x5f0 [ 235.632691][ T7785] ? do_vfs_ioctl+0x116f/0x1530 [ 235.632718][ T7785] ? __pfx_raw_ioctl+0x10/0x10 [ 235.632739][ T7785] ? hook_file_ioctl+0x1f2/0x600 [ 235.632784][ T7785] ? __fget_files+0x2a/0x420 [ 235.632821][ T7785] ? __fget_files+0x2a/0x420 [ 235.632836][ T7785] ? __fget_files+0x3a2/0x420 [ 235.632850][ T7785] ? __fget_files+0x2a/0x420 [ 235.632868][ T7785] ? bpf_lsm_file_ioctl+0x9/0x20 [ 235.632899][ T7785] ? __pfx_raw_ioctl+0x10/0x10 [ 235.632911][ T7785] __se_sys_ioctl+0xfc/0x170 [ 235.632932][ T7785] do_syscall_64+0x166/0x520 [ 235.632945][ T7785] ? trace_irq_disable+0x3b/0x140 [ 235.632962][ T7785] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.632975][ T7785] ? clear_bhb_loop+0x70/0xc0 [ 235.632991][ T7785] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.633003][ T7785] RIP: 0033:0x7f745a59ddeb [ 235.633017][ T7785] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 235.633029][ T7785] RSP: 002b:00007f745b50df00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 235.633045][ T7785] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f745a59ddeb [ 235.633054][ T7785] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 [ 235.633070][ T7785] RBP: 00007f745b50efd0 R08: 0000000000000001 R09: 00000000ffffffff [ 235.633079][ T7785] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 235.633088][ T7785] R13: 0000200000000000 R14: 0000000000000005 R15: 0000000000000000 [ 235.633106][ T7785] [ 235.634291][ T7785] UDC core: USB Raw Gadget: driver registration failed: -12 [ 235.634306][ T7785] misc raw-gadget: fail, usb_gadget_register_driver returned -12 [ 235.917775][ T1219] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 236.057327][ T1219] usb 6-1: device descriptor read/64, error -71 [ 236.168040][ T1219] usb usb6-port1: attempt power cycle [ 236.247503][ T5768] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 236.389264][ T7791] netlink: 'syz.0.547': attribute type 58 has an invalid length. [ 236.393713][ T7791] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.547'. [ 236.394183][ T7791] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.547'. [ 236.406632][ T5768] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 236.441022][ T5768] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 236.441079][ T5768] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.470154][ T5768] usb 5-1: config 0 descriptor?? [ 236.476854][ T5768] pwc: Askey VC010 type 2 USB webcam detected. [ 236.529498][ T1219] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 236.548043][ T1219] usb 6-1: device descriptor read/8, error -71 [ 236.607463][ T9] usb 3-1: USB disconnect, device number 39 [ 236.787902][ T1219] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 236.808544][ T1219] usb 6-1: device descriptor read/8, error -71 [ 236.823532][ T5724] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 236.890541][ T5768] pwc: recv_control_msg error -32 req 02 val 2b00 [ 236.891285][ T5768] pwc: recv_control_msg error -32 req 02 val 2700 [ 236.891796][ T5768] pwc: recv_control_msg error -32 req 02 val 2c00 [ 236.892334][ T5768] pwc: recv_control_msg error -32 req 04 val 1000 [ 236.892969][ T5768] pwc: recv_control_msg error -32 req 04 val 1300 [ 236.893502][ T5768] pwc: recv_control_msg error -32 req 04 val 1400 [ 236.894027][ T5768] pwc: recv_control_msg error -32 req 02 val 2000 [ 236.894540][ T5768] pwc: recv_control_msg error -32 req 02 val 2100 [ 236.895085][ T5768] pwc: recv_control_msg error -32 req 04 val 1500 [ 236.938671][ T1219] usb usb6-port1: unable to enumerate USB device [ 237.017293][ T5724] usb 1-1: Using ep0 maxpacket: 32 [ 237.017850][ T5724] usb 1-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 237.018937][ T5724] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 189, changing to 11 [ 237.018957][ T5724] usb 1-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 237.018974][ T5724] usb 1-1: config 0 interface 0 has no altsetting 0 [ 237.019016][ T5724] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.022913][ T5724] usb 1-1: config 0 descriptor?? [ 237.120136][ T5768] pwc: recv_control_msg error -71 req 02 val 2400 [ 237.121479][ T5768] pwc: recv_control_msg error -71 req 02 val 2600 [ 237.122504][ T5768] pwc: recv_control_msg error -71 req 02 val 2900 [ 237.122888][ T5768] pwc: recv_control_msg error -71 req 02 val 2800 [ 237.123339][ T5768] pwc: recv_control_msg error -71 req 04 val 1100 [ 237.123656][ T5768] pwc: recv_control_msg error -71 req 04 val 1200 [ 237.133954][ T9] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 237.193354][ T5768] pwc: Registered as video103. [ 237.205254][ T5768] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input32 [ 237.253369][ T5768] usb 5-1: USB disconnect, device number 48 [ 237.328853][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 237.328890][ T9] usb 3-1: New USB device found, idVendor=10b8, idProduct=1f90, bcdDevice=a5.ec [ 237.336051][ T9] usb 3-1: config 6 has an invalid interface number: 226 but max is 0 [ 237.336072][ T9] usb 3-1: config 6 has an invalid descriptor of length 202, skipping remainder of the config [ 237.336084][ T9] usb 3-1: config 6 has no interface number 0 [ 237.336128][ T9] usb 3-1: config 6 interface 226 altsetting 129 endpoint 0x9 has an invalid bInterval 153, changing to 11 [ 237.336146][ T9] usb 3-1: config 6 interface 226 altsetting 129 endpoint 0x9 has invalid maxpacket 25829, setting to 1024 [ 237.336171][ T9] usb 3-1: config 6 interface 226 altsetting 129 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 237.336187][ T9] usb 3-1: config 6 interface 226 has no altsetting 0 [ 237.436775][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.436797][ T9] usb 3-1: Product: syz [ 237.436807][ T9] usb 3-1: Manufacturer: syz [ 237.436836][ T9] usb 3-1: SerialNumber: syz [ 237.475423][ T7795] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 237.496535][ T5724] usbhid 1-1:0.0: can't add hid device: -71 [ 237.496607][ T5724] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 237.535787][ T5724] usb 1-1: USB disconnect, device number 46 [ 237.710341][ T7795] omfs: Invalid superblock (0) [ 237.724971][ T9] dvb-usb: found a 'DiBcom STK807xP reference design' in cold state, will try to load a firmware [ 237.784749][ T9] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 237.784863][ T9] dib0700: firmware download failed at 7 with -22 [ 238.027766][ T5768] usb 5-1: new full-speed USB device number 49 using dummy_hcd [ 238.186066][ T5768] usb 5-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 238.187174][ T5768] usb 5-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 238.187195][ T5768] usb 5-1: config 36 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 238.187211][ T5768] usb 5-1: config 36 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 238.241580][ T5768] usb 5-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 238.241601][ T5768] usb 5-1: Manufacturer: syz [ 238.241610][ T5768] usb 5-1: SerialNumber: syz [ 238.362523][ T7804] sit0: entered promiscuous mode [ 238.379742][ T7804] netlink: 'syz.5.553': attribute type 1 has an invalid length. [ 238.379761][ T7804] netlink: 1 bytes leftover after parsing attributes in process `syz.5.553'. [ 238.471118][ T7806] FAULT_INJECTION: forcing a failure. [ 238.471118][ T7806] name failslab, interval 1, probability 0, space 0, times 0 [ 238.471462][ T7806] CPU: 0 UID: 0 PID: 7806 Comm: syz.0.554 Not tainted syzkaller #0 PREEMPT(full) [ 238.471481][ T7806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 238.471489][ T7806] Call Trace: [ 238.471494][ T7806] [ 238.471501][ T7806] dump_stack_lvl+0xe8/0x150 [ 238.471524][ T7806] should_fail_ex+0x3eb/0x540 [ 238.471542][ T7806] should_failslab+0xa8/0x100 [ 238.471558][ T7806] __kmalloc_noprof+0xf9/0x710 [ 238.471580][ T7806] ? tomoyo_encode+0x2ad/0x570 [ 238.471596][ T7806] ? tomoyo_encode+0x2ad/0x570 [ 238.471616][ T7806] tomoyo_encode+0x2ad/0x570 [ 238.471634][ T7806] tomoyo_realpath_from_path+0x5fa/0x640 [ 238.471656][ T7806] ? tomoyo_path_number_perm+0x219/0x5f0 [ 238.471670][ T7806] tomoyo_path_number_perm+0x246/0x5f0 [ 238.471685][ T7806] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 238.471697][ T7806] ? __lock_acquire+0x747/0x2de0 [ 238.471748][ T7806] ? hook_file_ioctl+0x1f2/0x600 [ 238.471774][ T7806] ? __fget_files+0x2a/0x420 [ 238.471792][ T7806] ? __fget_files+0x2a/0x420 [ 238.471806][ T7806] ? __fget_files+0x3a2/0x420 [ 238.471821][ T7806] ? __fget_files+0x2a/0x420 [ 238.471839][ T7806] security_file_ioctl+0xc3/0x2a0 [ 238.471860][ T7806] __se_sys_ioctl+0x47/0x170 [ 238.471881][ T7806] do_syscall_64+0x166/0x520 [ 238.471894][ T7806] ? trace_irq_disable+0x3b/0x140 [ 238.471912][ T7806] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.471925][ T7806] ? clear_bhb_loop+0x70/0xc0 [ 238.471941][ T7806] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.471953][ T7806] RIP: 0033:0x7f745a59ddeb [ 238.471966][ T7806] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 238.471977][ T7806] RSP: 002b:00007f745b50df00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 238.471993][ T7806] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f745a59ddeb [ 238.472003][ T7806] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 [ 238.472011][ T7806] RBP: 00007f745b50efd0 R08: 0000000000000001 R09: 00000000ffffffff [ 238.472020][ T7806] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 238.472029][ T7806] R13: 0000200000000000 R14: 0000000000000005 R15: 0000000000000000 [ 238.472048][ T7806] [ 238.474438][ T7806] ERROR: Out of memory at tomoyo_realpath_from_path. [ 238.776584][ T5768] yealink 5-1:36.0: invalid payload size 0, expected 16 [ 238.793495][ T5768] input: Yealink usb-p1k as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:36.0/input/input33 [ 238.821450][ T5724] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 238.863776][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 238.863983][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 238.864175][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 238.864370][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 238.864559][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 238.864743][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 238.864926][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 238.865102][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 238.865115][ C0] yealink 5-1:36.0: urb_ctl_callback - usb_submit_urb failed -90 [ 238.947436][ T5724] usb 1-1: device descriptor read/64, error -71 [ 238.948667][ T5768] usb 5-1: USB disconnect, device number 49 [ 239.187372][ T5724] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 239.257388][ T1219] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 239.297981][ T5768] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 239.327364][ T5724] usb 1-1: device descriptor read/64, error -71 [ 239.408355][ T1219] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 239.409566][ T1219] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 239.409582][ T1219] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 239.409609][ T1219] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 239.409634][ T1219] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.416691][ T1219] cdc_acm 6-1:1.0: Control and data interfaces are not separated! [ 239.416708][ T1219] cdc_acm 6-1:1.0: This needs exactly 3 endpoints [ 239.416726][ T1219] cdc_acm 6-1:1.0: probe with driver cdc_acm failed with error -22 [ 239.438164][ T5724] usb usb1-port1: attempt power cycle [ 239.487840][ T5768] usb 5-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 239.517509][ T5768] usb 5-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 239.517534][ T5768] usb 5-1: config 36 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 239.517550][ T5768] usb 5-1: config 36 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 239.521398][ T5768] usb 5-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 239.521420][ T5768] usb 5-1: Manufacturer: syz [ 239.521430][ T5768] usb 5-1: SerialNumber: syz [ 239.621677][ T1219] usb 6-1: USB disconnect, device number 22 [ 239.770295][ T7293] usb 3-1: USB disconnect, device number 40 [ 239.816961][ T5768] yealink 5-1:36.0: invalid payload size 0, expected 16 [ 239.829367][ T5768] input: Yealink usb-p1k as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:36.0/input/input34 [ 239.832489][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 239.832694][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 239.832886][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 239.833082][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 239.833275][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 239.833457][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 239.833633][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 239.833810][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 239.833823][ C0] yealink 5-1:36.0: urb_ctl_callback - usb_submit_urb failed -90 [ 239.849937][ T5724] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 239.926080][ T5724] usb 1-1: device descriptor read/8, error -71 [ 239.951694][ T5768] usb 5-1: USB disconnect, device number 50 [ 240.150099][ T7817] FAULT_INJECTION: forcing a failure. [ 240.150099][ T7817] name failslab, interval 1, probability 0, space 0, times 0 [ 240.150122][ T7817] CPU: 0 UID: 0 PID: 7817 Comm: syz.2.557 Not tainted syzkaller #0 PREEMPT(full) [ 240.150145][ T7817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 240.150153][ T7817] Call Trace: [ 240.150159][ T7817] [ 240.150165][ T7817] dump_stack_lvl+0xe8/0x150 [ 240.150188][ T7817] should_fail_ex+0x3eb/0x540 [ 240.150208][ T7817] should_failslab+0xa8/0x100 [ 240.150224][ T7817] __kmalloc_noprof+0xf9/0x710 [ 240.150242][ T7817] ? tomoyo_encode+0x2ad/0x570 [ 240.150259][ T7817] ? tomoyo_encode+0x2ad/0x570 [ 240.150277][ T7817] tomoyo_encode+0x2ad/0x570 [ 240.150296][ T7817] tomoyo_realpath_from_path+0x5fa/0x640 [ 240.150319][ T7817] ? tomoyo_path_number_perm+0x219/0x5f0 [ 240.150333][ T7817] tomoyo_path_number_perm+0x246/0x5f0 [ 240.150348][ T7817] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 240.150362][ T7817] ? __lock_acquire+0x747/0x2de0 [ 240.150390][ T7817] ? hook_file_ioctl+0x1f2/0x600 [ 240.150415][ T7817] ? __fget_files+0x2a/0x420 [ 240.150433][ T7817] ? __fget_files+0x2a/0x420 [ 240.150447][ T7817] ? __fget_files+0x3a2/0x420 [ 240.150462][ T7817] ? __fget_files+0x2a/0x420 [ 240.150479][ T7817] security_file_ioctl+0xc3/0x2a0 [ 240.150499][ T7817] __se_sys_ioctl+0x47/0x170 [ 240.150520][ T7817] do_syscall_64+0x166/0x520 [ 240.150535][ T7817] ? trace_irq_disable+0x3b/0x140 [ 240.150553][ T7817] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.150566][ T7817] ? clear_bhb_loop+0x70/0xc0 [ 240.150582][ T7817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.150594][ T7817] RIP: 0033:0x7fc1cb99ddeb [ 240.150607][ T7817] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 240.150618][ T7817] RSP: 002b:00007fc1cc82cf00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 240.150634][ T7817] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fc1cb99ddeb [ 240.150644][ T7817] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000005 [ 240.150653][ T7817] RBP: 00007fc1cc82dfd0 R08: 0000000000000001 R09: 00000000ffffffff [ 240.150661][ T7817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 240.150669][ T7817] R13: 00002000000000c0 R14: 0000000000000000 R15: 0000000000000000 [ 240.150689][ T7817] [ 240.150702][ T7817] ERROR: Out of memory at tomoyo_realpath_from_path. [ 240.170606][ T5724] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 240.246287][ T5724] usb 1-1: device descriptor read/8, error -71 [ 240.383614][ T5724] usb usb1-port1: unable to enumerate USB device [ 240.443245][ T7293] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 240.583157][ T7821] ./mnt: Can't lookup blockdev [ 240.607935][ T7293] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 240.611230][ T7293] usb 3-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 240.611252][ T7293] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 240.611268][ T7293] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 240.611295][ T7293] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 240.682116][ T7817] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 241.007459][ T5768] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 241.025369][ T5724] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 241.158256][ T5768] usb 6-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 241.159391][ T5768] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 241.159413][ T5768] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 241.159438][ T5768] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.161261][ T5768] usb 6-1: config 0 descriptor?? [ 241.198818][ T5724] usb 5-1: Using ep0 maxpacket: 8 [ 241.221443][ T5724] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 241.224195][ T5724] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 241.224230][ T5724] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 241.224244][ T5724] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 241.224279][ T5724] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 241.224294][ T5724] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 241.224320][ T5724] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.518123][ T5724] usb 5-1: usb_control_msg returned -32 [ 241.518165][ T5724] usbtmc 5-1:16.0: can't read capabilities [ 241.612833][ T5768] playstation 0003:054C:0DF2.000D: unknown main item tag 0x0 [ 241.612860][ T5768] playstation 0003:054C:0DF2.000D: unknown main item tag 0x0 [ 241.612876][ T5768] playstation 0003:054C:0DF2.000D: unknown main item tag 0x0 [ 241.612891][ T5768] playstation 0003:054C:0DF2.000D: unknown main item tag 0x0 [ 241.612906][ T5768] playstation 0003:054C:0DF2.000D: unknown main item tag 0x0 [ 241.648608][ T5768] playstation 0003:054C:0DF2.000D: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.5-1/input0 [ 241.803545][ T5768] playstation 0003:054C:0DF2.000D: Invalid byte count transferred, expected 20 got 0 [ 241.803566][ T5768] playstation 0003:054C:0DF2.000D: Failed to retrieve DualSense pairing info: -22 [ 241.803599][ T5768] playstation 0003:054C:0DF2.000D: Failed to get MAC address from DualSense [ 241.803608][ T5768] playstation 0003:054C:0DF2.000D: Failed to create dualsense. [ 241.805420][ T5768] playstation 0003:054C:0DF2.000D: probe with driver playstation failed with error -22 [ 242.418546][ T5768] usb 5-1: USB disconnect, device number 51 [ 243.169215][ T5768] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 243.318540][ T5768] usb 1-1: Using ep0 maxpacket: 8 [ 243.319142][ T5768] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 243.320133][ T5768] usb 1-1: config 0 has an invalid descriptor of length 168, skipping remainder of the config [ 243.320163][ T5768] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 243.320179][ T5768] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 117, changing to 10 [ 243.320195][ T5768] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid maxpacket 33075, setting to 1024 [ 243.320211][ T5768] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 243.322149][ T5768] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 243.322165][ T5768] usb 1-1: Product: syz [ 243.322179][ T5768] usb 1-1: Manufacturer: syz [ 243.322187][ T5768] usb 1-1: SerialNumber: syz [ 243.326115][ T5768] usb 1-1: config 0 descriptor?? [ 243.469069][ T5724] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 243.617270][ T5724] usb 5-1: Using ep0 maxpacket: 32 [ 243.623727][ T5724] usb 5-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 243.624761][ T5724] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.652621][ T5768] radio-si470x 1-1:0.0: DeviceID=0x53c8 ChipID=0x0000 [ 243.652641][ T5768] radio-si470x 1-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 243.653241][ T5724] usb 5-1: config 0 descriptor?? [ 243.689944][ T5724] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 243.783152][ T5696] usb 6-1: USB disconnect, device number 23 [ 243.859428][ T5768] radio-si470x 1-1:0.0: software version 83, hardware version 200 [ 243.859469][ T5768] radio-si470x 1-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 243.899271][ T5724] gspca_vc032x: reg_r err -32 [ 243.899362][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899371][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899377][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899383][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899389][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899394][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899400][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899406][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899412][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899418][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899423][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899429][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899435][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899440][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899446][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899451][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899458][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899463][ T5724] gspca_vc032x: I2c Bus Busy Wait 00 [ 243.899484][ T5724] gspca_vc032x: Unknown sensor... [ 243.899532][ T5724] vc032x 5-1:0.0: probe with driver vc032x failed with error -22 [ 244.070899][ T5768] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 244.071117][ C0] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 244.071301][ C0] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 244.071484][ C0] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 244.071665][ C0] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 244.071850][ C0] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 244.072033][ C0] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 244.072214][ C0] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 244.072393][ C0] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 244.072573][ C0] radio-si470x 1-1:0.0: non-zero urb status (-71) [ 244.072676][ T5768] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 244.073825][ T5768] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -22 [ 244.174702][ T5768] usb 1-1: USB disconnect, device number 51 [ 244.334721][ T7865] FAULT_INJECTION: forcing a failure. [ 244.334721][ T7865] name failslab, interval 1, probability 0, space 0, times 0 [ 244.334767][ T7865] CPU: 0 UID: 0 PID: 7865 Comm: syz.5.567 Not tainted syzkaller #0 PREEMPT(full) [ 244.334783][ T7865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 244.334792][ T7865] Call Trace: [ 244.334798][ T7865] [ 244.334804][ T7865] dump_stack_lvl+0xe8/0x150 [ 244.334827][ T7865] should_fail_ex+0x3eb/0x540 [ 244.334846][ T7865] should_failslab+0xa8/0x100 [ 244.334862][ T7865] __kmalloc_noprof+0xf9/0x710 [ 244.334883][ T7865] ? rcu_is_watching+0x16/0xb0 [ 244.334919][ T7865] ? tomoyo_realpath_from_path+0xef/0x640 [ 244.334936][ T7865] ? tomoyo_realpath_from_path+0xef/0x640 [ 244.334956][ T7865] tomoyo_realpath_from_path+0xef/0x640 [ 244.334979][ T7865] ? tomoyo_path_number_perm+0x219/0x5f0 [ 244.334993][ T7865] tomoyo_path_number_perm+0x246/0x5f0 [ 244.335008][ T7865] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 244.335067][ T7865] ? __lock_acquire+0x747/0x2de0 [ 244.335095][ T7865] ? hook_file_ioctl+0x1f2/0x600 [ 244.335121][ T7865] ? __fget_files+0x2a/0x420 [ 244.335139][ T7865] ? __fget_files+0x2a/0x420 [ 244.335154][ T7865] ? __fget_files+0x3a2/0x420 [ 244.335169][ T7865] ? __fget_files+0x2a/0x420 [ 244.335188][ T7865] security_file_ioctl+0xc3/0x2a0 [ 244.335209][ T7865] __se_sys_ioctl+0x47/0x170 [ 244.335230][ T7865] do_syscall_64+0x166/0x520 [ 244.335243][ T7865] ? trace_irq_disable+0x3b/0x140 [ 244.335261][ T7865] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 244.335275][ T7865] ? clear_bhb_loop+0x70/0xc0 [ 244.335291][ T7865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 244.335303][ T7865] RIP: 0033:0x7f415239e159 [ 244.335317][ T7865] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 244.335328][ T7865] RSP: 002b:00007f4153298028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 244.335344][ T7865] RAX: ffffffffffffffda RBX: 00007f4152625fa0 RCX: 00007f415239e159 [ 244.335354][ T7865] RDX: 0000200000000380 RSI: 000000000000890b RDI: 0000000000000003 [ 244.335363][ T7865] RBP: 00007f4153298090 R08: 0000000000000000 R09: 0000000000000000 [ 244.335372][ T7865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 244.335380][ T7865] R13: 00007f4152626038 R14: 00007f4152625fa0 R15: 00007ffd39a0a508 [ 244.335400][ T7865] [ 244.335428][ T7865] ERROR: Out of memory at tomoyo_realpath_from_path. [ 244.628171][ T7293] aiptek 3-1:17.0: Aiptek tried all speeds, no sane response [ 244.628309][ T7293] aiptek 3-1:17.0: probe with driver aiptek failed with error -22 [ 244.654242][ T7293] usb 3-1: USB disconnect, device number 41 [ 244.916705][ T7872] FAULT_INJECTION: forcing a failure. [ 244.916705][ T7872] name failslab, interval 1, probability 0, space 0, times 0 [ 244.916728][ T7872] CPU: 0 UID: 0 PID: 7872 Comm: syz.5.570 Not tainted syzkaller #0 PREEMPT(full) [ 244.916743][ T7872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 244.916751][ T7872] Call Trace: [ 244.916757][ T7872] [ 244.916763][ T7872] dump_stack_lvl+0xe8/0x150 [ 244.916786][ T7872] should_fail_ex+0x3eb/0x540 [ 244.916804][ T7872] should_failslab+0xa8/0x100 [ 244.916821][ T7872] __kmalloc_noprof+0xf9/0x710 [ 244.916839][ T7872] ? tomoyo_encode+0x2ad/0x570 [ 244.916855][ T7872] ? tomoyo_encode+0x2ad/0x570 [ 244.916873][ T7872] tomoyo_encode+0x2ad/0x570 [ 244.916893][ T7872] tomoyo_realpath_from_path+0x5fa/0x640 [ 244.916914][ T7872] ? tomoyo_path_number_perm+0x219/0x5f0 [ 244.916928][ T7872] tomoyo_path_number_perm+0x246/0x5f0 [ 244.916943][ T7872] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 244.916956][ T7872] ? __lock_acquire+0x747/0x2de0 [ 244.916983][ T7872] ? hook_file_ioctl+0x1f2/0x600 [ 244.917008][ T7872] ? __fget_files+0x2a/0x420 [ 244.917025][ T7872] ? __fget_files+0x2a/0x420 [ 244.917040][ T7872] ? __fget_files+0x3a2/0x420 [ 244.917054][ T7872] ? __fget_files+0x2a/0x420 [ 244.917071][ T7872] security_file_ioctl+0xc3/0x2a0 [ 244.917092][ T7872] __se_sys_ioctl+0x47/0x170 [ 244.917113][ T7872] do_syscall_64+0x166/0x520 [ 244.917125][ T7872] ? trace_irq_disable+0x3b/0x140 [ 244.917143][ T7872] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 244.917156][ T7872] ? clear_bhb_loop+0x70/0xc0 [ 244.917181][ T7872] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 244.917194][ T7872] RIP: 0033:0x7f415239ddeb [ 244.917207][ T7872] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 244.917218][ T7872] RSP: 002b:00007f4153295f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 244.917238][ T7872] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f415239ddeb [ 244.917248][ T7872] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 [ 244.917256][ T7872] RBP: 00007f4153296fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 244.917265][ T7872] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 244.917274][ T7872] R13: 0000200000000000 R14: 0000000000000005 R15: 0000000000000000 [ 244.917294][ T7872] [ 245.033880][ T7872] ERROR: Out of memory at tomoyo_realpath_from_path. [ 245.427967][ T5768] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 245.567353][ T5768] usb 6-1: device descriptor read/64, error -71 [ 245.808704][ T5768] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 245.868501][ T7293] usb 1-1: new low-speed USB device number 52 using dummy_hcd [ 245.938306][ T5768] usb 6-1: device descriptor read/64, error -71 [ 246.019507][ T7293] usb 1-1: unable to get BOS descriptor or descriptor too short [ 246.019553][ T7293] usb 1-1: New USB device found, idVendor=6737, idProduct=0001, bcdDevice=91.80 [ 246.020489][ T7293] usb 1-1: config 142 has an invalid interface number: 251 but max is 0 [ 246.020505][ T7293] usb 1-1: config 142 has no interface number 0 [ 246.020540][ T7293] usb 1-1: config 142 interface 251 altsetting 11 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 246.020556][ T7293] usb 1-1: config 142 interface 251 altsetting 11 endpoint 0x8F is Bulk; changing to Interrupt [ 246.020571][ T7293] usb 1-1: config 142 interface 251 altsetting 11 endpoint 0x1 is Bulk; changing to Interrupt [ 246.020585][ T7293] usb 1-1: config 142 interface 251 has no altsetting 0 [ 246.023412][ T7293] usb 1-1: string descriptor 0 read error: -22 [ 246.023644][ T7293] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.027104][ T7890] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 246.027196][ T7890] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 246.088342][ T5768] usb usb6-port1: attempt power cycle [ 246.089963][ T7293] cypress_m8 1-1:142.251: HID->COM RS232 Adapter converter detected [ 246.160583][ T7293] usb 1-1: HID->COM RS232 Adapter converter now attached to ttyUSB0 [ 246.265006][ T7293] usb 5-1: USB disconnect, device number 52 [ 246.372667][ T7890] FAULT_INJECTION: forcing a failure. [ 246.372667][ T7890] name failslab, interval 1, probability 0, space 0, times 0 [ 246.372691][ T7890] CPU: 0 UID: 0 PID: 7890 Comm: syz.0.575 Not tainted syzkaller #0 PREEMPT(full) [ 246.372711][ T7890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 246.372719][ T7890] Call Trace: [ 246.372725][ T7890] [ 246.372732][ T7890] dump_stack_lvl+0xe8/0x150 [ 246.372755][ T7890] should_fail_ex+0x3eb/0x540 [ 246.372773][ T7890] should_failslab+0xa8/0x100 [ 246.372789][ T7890] __kmalloc_cache_node_noprof+0xa5/0x620 [ 246.372810][ T7890] ? __get_vm_area_node+0x155/0x2f0 [ 246.372825][ T7890] ? __get_vm_area_node+0x155/0x2f0 [ 246.372845][ T7890] __get_vm_area_node+0x155/0x2f0 [ 246.372860][ T7890] ? look_up_lock_class+0x57/0x110 [ 246.372884][ T7890] __vmalloc_node_range_noprof+0x340/0x1690 [ 246.372902][ T7890] ? n_tty_open+0x1d/0x150 [ 246.372985][ T7890] ? __lock_acquire+0x747/0x2de0 [ 246.373007][ T7890] ? lock_acquire+0x115/0x350 [ 246.373037][ T7890] ? do_raw_spin_lock+0x12b/0x2f0 [ 246.373053][ T7890] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 246.373082][ T7890] ? n_tty_open+0x1d/0x150 [ 246.373097][ T7890] vzalloc_noprof+0xb2/0xe0 [ 246.373114][ T7890] ? n_tty_open+0x1d/0x150 [ 246.373130][ T7890] n_tty_open+0x1d/0x150 [ 246.373147][ T7890] tty_ldisc_setup+0xcc/0x270 [ 246.373177][ T7890] tty_init_dev+0x279/0x4d0 [ 246.373212][ T7890] tty_open+0x7de/0xd80 [ 246.373235][ T7890] ? __pfx_tty_open+0x10/0x10 [ 246.373251][ T7890] ? do_raw_spin_unlock+0xf5/0x200 [ 246.373269][ T7890] chrdev_open+0x4d9/0x600 [ 246.373285][ T7890] ? __pfx_chrdev_open+0x10/0x10 [ 246.373299][ T7890] ? devcgroup_check_permission+0x31/0x8f0 [ 246.373341][ T7890] ? __pfx_chrdev_open+0x10/0x10 [ 246.373354][ T7890] do_dentry_open+0x80e/0x1360 [ 246.373374][ T7890] vfs_open_consume+0x4a/0x350 [ 246.373387][ T7890] ? path_openat+0x14bb/0x1e40 [ 246.373408][ T7890] path_openat+0x14d7/0x1e40 [ 246.373438][ T7890] do_file_open+0x23e/0x4a0 [ 246.373460][ T7890] ? __pfx_do_file_open+0x10/0x10 [ 246.373493][ T7890] ? _raw_spin_unlock+0x28/0x50 [ 246.373528][ T7890] ? alloc_fd+0x651/0x6c0 [ 246.373551][ T7890] do_sys_openat2+0x115/0x200 [ 246.373567][ T7890] ? __pfx_do_sys_openat2+0x10/0x10 [ 246.373583][ T7890] ? ksys_write+0x242/0x270 [ 246.373601][ T7890] ? __pfx_ksys_write+0x10/0x10 [ 246.373621][ T7890] __x64_sys_openat+0x138/0x170 [ 246.373639][ T7890] do_syscall_64+0x166/0x520 [ 246.373651][ T7890] ? trace_irq_disable+0x3b/0x140 [ 246.373669][ T7890] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.373682][ T7890] ? clear_bhb_loop+0x70/0xc0 [ 246.373698][ T7890] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.373711][ T7890] RIP: 0033:0x7f745a59e159 [ 246.373725][ T7890] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 246.373736][ T7890] RSP: 002b:00007f745b510028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 246.373751][ T7890] RAX: ffffffffffffffda RBX: 00007f745a825fa0 RCX: 00007f745a59e159 [ 246.373762][ T7890] RDX: 0000000000000000 RSI: 0000200000000700 RDI: ffffffffffffff9c [ 246.373771][ T7890] RBP: 00007f745b510090 R08: 0000000000000000 R09: 0000000000000000 [ 246.373779][ T7890] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 246.373787][ T7890] R13: 00007f745a826038 R14: 00007f745a825fa0 R15: 00007ffd5ef3f4e8 [ 246.373808][ T7890] [ 246.456117][ T5768] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 246.529176][ T5768] usb 6-1: device descriptor read/8, error -71 [ 246.623630][ T7890] syz.0.575: vmalloc error: size 9112, align 0x1, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 246.623714][ T7890] CPU: 0 UID: 0 PID: 7890 Comm: syz.0.575 Not tainted syzkaller #0 PREEMPT(full) [ 246.623729][ T7890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 246.623738][ T7890] Call Trace: [ 246.623743][ T7890] [ 246.623749][ T7890] dump_stack_lvl+0xe8/0x150 [ 246.623771][ T7890] warn_alloc+0x24d/0x270 [ 246.623791][ T7890] ? __kasan_kmalloc+0x22/0xb0 [ 246.623807][ T7890] ? __pfx_warn_alloc+0x10/0x10 [ 246.623823][ T7890] ? __get_vm_area_node+0x155/0x2f0 [ 246.623843][ T7890] ? __get_vm_area_node+0x2a9/0x2f0 [ 246.623863][ T7890] __vmalloc_node_range_noprof+0x368/0x1690 [ 246.623881][ T7890] ? __lock_acquire+0x747/0x2de0 [ 246.623902][ T7890] ? lock_acquire+0x115/0x350 [ 246.623930][ T7890] ? do_raw_spin_lock+0x12b/0x2f0 [ 246.623947][ T7890] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 246.623968][ T7890] ? n_tty_open+0x1d/0x150 [ 246.623985][ T7890] vzalloc_noprof+0xb2/0xe0 [ 246.624002][ T7890] ? n_tty_open+0x1d/0x150 [ 246.624018][ T7890] n_tty_open+0x1d/0x150 [ 246.624033][ T7890] tty_ldisc_setup+0xcc/0x270 [ 246.624048][ T7890] tty_init_dev+0x279/0x4d0 [ 246.624085][ T7890] tty_open+0x7de/0xd80 [ 246.624107][ T7890] ? __pfx_tty_open+0x10/0x10 [ 246.624124][ T7890] ? do_raw_spin_unlock+0xf5/0x200 [ 246.624142][ T7890] chrdev_open+0x4d9/0x600 [ 246.624157][ T7890] ? __pfx_chrdev_open+0x10/0x10 [ 246.624172][ T7890] ? devcgroup_check_permission+0x31/0x8f0 [ 246.624193][ T7890] ? __pfx_chrdev_open+0x10/0x10 [ 246.624205][ T7890] do_dentry_open+0x80e/0x1360 [ 246.624225][ T7890] vfs_open_consume+0x4a/0x350 [ 246.624238][ T7890] ? path_openat+0x14bb/0x1e40 [ 246.624258][ T7890] path_openat+0x14d7/0x1e40 [ 246.624288][ T7890] do_file_open+0x23e/0x4a0 [ 246.624310][ T7890] ? __pfx_do_file_open+0x10/0x10 [ 246.624342][ T7890] ? _raw_spin_unlock+0x28/0x50 [ 246.624360][ T7890] ? alloc_fd+0x651/0x6c0 [ 246.624381][ T7890] do_sys_openat2+0x115/0x200 [ 246.624398][ T7890] ? __pfx_do_sys_openat2+0x10/0x10 [ 246.624413][ T7890] ? ksys_write+0x242/0x270 [ 246.624431][ T7890] ? __pfx_ksys_write+0x10/0x10 [ 246.624451][ T7890] __x64_sys_openat+0x138/0x170 [ 246.624469][ T7890] do_syscall_64+0x166/0x520 [ 246.624480][ T7890] ? trace_irq_disable+0x3b/0x140 [ 246.624497][ T7890] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.624511][ T7890] ? clear_bhb_loop+0x70/0xc0 [ 246.624526][ T7890] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 246.624539][ T7890] RIP: 0033:0x7f745a59e159 [ 246.624553][ T7890] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 246.624565][ T7890] RSP: 002b:00007f745b510028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 246.624579][ T7890] RAX: ffffffffffffffda RBX: 00007f745a825fa0 RCX: 00007f745a59e159 [ 246.624588][ T7890] RDX: 0000000000000000 RSI: 0000200000000700 RDI: ffffffffffffff9c [ 246.624597][ T7890] RBP: 00007f745b510090 R08: 0000000000000000 R09: 0000000000000000 [ 246.624606][ T7890] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 246.624614][ T7890] R13: 00007f745a826038 R14: 00007f745a825fa0 R15: 00007ffd5ef3f4e8 [ 246.624634][ T7890] [ 246.624640][ T7890] Mem-Info: [ 246.624646][ T7890] active_anon:6709 inactive_anon:12427 isolated_anon:0 [ 246.624646][ T7890] active_file:17 inactive_file:55272 isolated_file:0 [ 246.624646][ T7890] unevictable:0 dirty:41 writeback:0 [ 246.624646][ T7890] slab_reclaimable:10554 slab_unreclaimable:90372 [ 246.624646][ T7890] mapped:25527 shmem:12990 pagetables:1430 [ 246.624646][ T7890] sec_pagetables:3 bounce:0 [ 246.624646][ T7890] kernel_misc_reclaimable:0 [ 246.624646][ T7890] free:1306529 free_pcp:9606 free_cma:0 [ 246.624694][ T7890] Node 0 active_anon:26836kB inactive_anon:49708kB active_file:68kB inactive_file:220892kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:102108kB dirty:164kB writeback:0kB shmem:51960kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12896kB pagetables:5604kB sec_pagetables:12kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 246.624729][ T7890] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:116kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 246.624761][ T7890] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 246.624797][ T7890] lowmem_reserve[]: 0 2482 2483 2483 2483 [ 246.624821][ T7890] Node 0 DMA32 free:1280640kB boost:0kB min:34092kB low:42612kB high:51132kB reserved_highatomic:0kB free_highatomic:0kB active_anon:26836kB inactive_anon:49708kB active_file:68kB inactive_file:220892kB unevictable:0kB writepending:164kB zspages:2036kB present:3129332kB managed:2541832kB mlocked:0kB bounce:0kB free_pcp:38420kB local_pcp:38420kB free_cma:0kB [ 246.624860][ T7890] lowmem_reserve[]: 0 0 1 1 1 [ 246.624882][ T7890] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1692kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 246.624917][ T7890] lowmem_reserve[]: 0 0 0 0 0 [ 246.624939][ T7890] Node 1 Normal free:3930116kB boost:0kB min:55784kB low:69728kB high:83672kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 246.624975][ T7890] lowmem_reserve[]: 0 0 0 0 0 [ 246.624998][ T7890] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 246.724685][ T7890] Node 0 DMA32: 434*4kB (UM) 379*8kB (UME) 440*16kB (UME) 651*32kB (UME) 186*64kB (UM) 55*128kB (UM) 19*256kB (M) 9*512kB (M) 3*1024kB (M) 2*2048kB (ME) 296*4096kB (UM) = 1280640kB [ 246.724790][ T7890] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 246.724852][ T7890] Node 1 Normal: 3*4kB (UM) 1*8kB (M) 5*16kB (UM) 9*32kB (UM) 10*64kB (UM) 2*128kB (UM) 3*256kB (UM) 2*512kB (M) 1*1024kB (M) 3*2048kB (UM) 957*4096kB (M) = 3930116kB [ 246.724956][ T7890] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 246.724967][ T7890] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 246.724978][ T7890] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 246.724988][ T7890] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 246.724998][ T7890] 68275 total pagecache pages [ 246.725003][ T7890] 0 pages in swap cache [ 246.725008][ T7890] Free swap = 112796kB [ 246.725020][ T7890] Total swap = 124996kB [ 246.725026][ T7890] 2097051 pages RAM [ 246.725030][ T7890] 0 pages HighMem/MovableOnly [ 246.725035][ T7890] 429554 pages reserved [ 246.725040][ T7890] 0 pages cma reserved [ 246.725180][ T7890] ttyUSB ttyUSB0: ldisc open failed (-12), clearing slot 0 [ 246.790872][ T5768] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 246.877962][ T5768] usb 6-1: device descriptor read/8, error -71 [ 247.002581][ T5768] usb usb6-port1: unable to enumerate USB device [ 247.828590][ T5768] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 247.978416][ T5768] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 247.979286][ T5768] usb 3-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 247.979354][ T5768] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 247.979372][ T5768] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 247.979400][ T5768] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.986611][ T7899] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 248.665771][ T5724] usb 1-1: USB disconnect, device number 52 [ 248.701724][ T5724] cyphidcom ttyUSB0: HID->COM RS232 Adapter converter now disconnected from ttyUSB0 [ 248.702102][ T5724] cypress_m8 1-1:142.251: device disconnected [ 248.877362][ T7293] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 248.910303][ T7924] FAULT_INJECTION: forcing a failure. [ 248.910303][ T7924] name failslab, interval 1, probability 0, space 0, times 0 [ 248.910347][ T7924] CPU: 0 UID: 0 PID: 7924 Comm: syz.4.587 Not tainted syzkaller #0 PREEMPT(full) [ 248.910363][ T7924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 248.910372][ T7924] Call Trace: [ 248.910377][ T7924] [ 248.910384][ T7924] dump_stack_lvl+0xe8/0x150 [ 248.910406][ T7924] should_fail_ex+0x3eb/0x540 [ 248.910424][ T7924] should_failslab+0xa8/0x100 [ 248.910440][ T7924] __kmalloc_noprof+0xf9/0x710 [ 248.910457][ T7924] ? rcu_is_watching+0x16/0xb0 [ 248.910474][ T7924] ? tomoyo_realpath_from_path+0xef/0x640 [ 248.910491][ T7924] ? tomoyo_realpath_from_path+0xef/0x640 [ 248.910511][ T7924] tomoyo_realpath_from_path+0xef/0x640 [ 248.910532][ T7924] ? tomoyo_path_number_perm+0x219/0x5f0 [ 248.910546][ T7924] tomoyo_path_number_perm+0x246/0x5f0 [ 248.910561][ T7924] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 248.910574][ T7924] ? __lock_acquire+0x747/0x2de0 [ 248.910601][ T7924] ? hook_file_ioctl+0x1f2/0x600 [ 248.910627][ T7924] ? __fget_files+0x2a/0x420 [ 248.910645][ T7924] ? __fget_files+0x2a/0x420 [ 248.910660][ T7924] ? __fget_files+0x3a2/0x420 [ 248.910674][ T7924] ? __fget_files+0x2a/0x420 [ 248.910693][ T7924] security_file_ioctl+0xc3/0x2a0 [ 248.910713][ T7924] __se_sys_ioctl+0x47/0x170 [ 248.910734][ T7924] do_syscall_64+0x166/0x520 [ 248.910746][ T7924] ? trace_irq_disable+0x3b/0x140 [ 248.910764][ T7924] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.910777][ T7924] ? clear_bhb_loop+0x70/0xc0 [ 248.910792][ T7924] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 248.910805][ T7924] RIP: 0033:0x7ffa5e79ddeb [ 248.910819][ T7924] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 248.910830][ T7924] RSP: 002b:00007ffa5c9f3f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 248.910845][ T7924] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007ffa5e79ddeb [ 248.910855][ T7924] RDX: 00007ffa5c9f4fd0 RSI: 0000000041015500 RDI: 0000000000000005 [ 248.910864][ T7924] RBP: 00007ffa5c9f4fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 248.910872][ T7924] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffa5c9f3fa0 [ 248.910881][ T7924] R13: 0000200000000000 R14: 0000000000000005 R15: 0000000000000000 [ 248.910900][ T7924] [ 248.910922][ T7924] ERROR: Out of memory at tomoyo_realpath_from_path. [ 249.066940][ T7293] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 249.164821][ T5724] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 249.164978][ T7293] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 249.164993][ T7293] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 249.165014][ T7293] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 249.165043][ T7293] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 249.256784][ T7293] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 249.256804][ T7293] usb 6-1: Product: syz [ 249.256814][ T7293] usb 6-1: Manufacturer: syz [ 249.284410][ T7293] cdc_wdm 6-1:1.0: skipping garbage [ 249.284426][ T7293] cdc_wdm 6-1:1.0: skipping garbage [ 249.303031][ T7293] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 249.303048][ T7293] cdc_wdm 6-1:1.0: Unknown control protocol [ 249.397911][ T5724] usb 5-1: device descriptor read/64, error -71 [ 249.484567][ T5696] usb 6-1: USB disconnect, device number 28 [ 249.638784][ T5724] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 249.767905][ T5724] usb 5-1: device descriptor read/64, error -71 [ 249.878008][ T5724] usb usb5-port1: attempt power cycle [ 249.937929][ T5696] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 250.089140][ T5696] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 250.090093][ T5696] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 250.090112][ T5696] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 250.090124][ T5696] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 250.090150][ T5696] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 250.091497][ T5696] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 250.091513][ T5696] usb 6-1: Product: syz [ 250.091522][ T5696] usb 6-1: Manufacturer: syz [ 250.154295][ T5696] cdc_wdm 6-1:1.0: skipping garbage [ 250.154311][ T5696] cdc_wdm 6-1:1.0: skipping garbage [ 250.191093][ T5696] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 250.191110][ T5696] cdc_wdm 6-1:1.0: Unknown control protocol [ 250.247793][ T5724] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 250.268608][ T5724] usb 5-1: device descriptor read/8, error -71 [ 250.507446][ T5724] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 250.529904][ T5724] usb 5-1: device descriptor read/8, error -71 [ 250.637644][ T5724] usb usb5-port1: unable to enumerate USB device [ 251.188871][ T5768] aiptek 3-1:17.0: Aiptek tried all speeds, no sane response [ 251.189005][ T5768] aiptek 3-1:17.0: probe with driver aiptek failed with error -22 [ 251.214438][ T5768] usb 3-1: USB disconnect, device number 42 [ 251.252894][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 251.252972][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 251.253186][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 251.253198][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 251.253373][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 251.253385][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 251.253461][ T5696] usb 6-1: USB disconnect, device number 29 [ 251.253562][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 251.253572][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 251.253581][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 252.397179][ T7953] FAULT_INJECTION: forcing a failure. [ 252.397179][ T7953] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 252.397203][ T7953] CPU: 0 UID: 0 PID: 7953 Comm: syz.4.596 Not tainted syzkaller #0 PREEMPT(full) [ 252.397222][ T7953] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 252.397230][ T7953] Call Trace: [ 252.397235][ T7953] [ 252.397242][ T7953] dump_stack_lvl+0xe8/0x150 [ 252.397264][ T7953] should_fail_ex+0x3eb/0x540 [ 252.397283][ T7953] prepare_alloc_pages+0x21e/0x5f0 [ 252.397307][ T7953] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 252.397329][ T7953] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 252.397352][ T7953] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 252.397371][ T7953] ? policy_nodemask+0x2cc/0x8e0 [ 252.397386][ T7953] ? __lock_acquire+0x747/0x2de0 [ 252.397406][ T7953] alloc_pages_mpol+0x21e/0x390 [ 252.397428][ T7953] folio_alloc_mpol_noprof+0x39/0x160 [ 252.397445][ T7953] vma_alloc_folio_noprof+0xe1/0x1e0 [ 252.397461][ T7953] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 252.397477][ T7953] ? lock_acquire+0x115/0x350 [ 252.397499][ T7953] do_pte_missing+0x173a/0x34b0 [ 252.397557][ T7953] handle_mm_fault+0x1a53/0x3750 [ 252.397580][ T7953] ? handle_mm_fault+0xf1/0x3750 [ 252.397601][ T7953] ? __pfx_handle_mm_fault+0x10/0x10 [ 252.397625][ T7953] ? __lock_acquire+0x747/0x2de0 [ 252.397645][ T7953] ? lock_mm_and_find_vma+0xa7/0x340 [ 252.397664][ T7953] do_user_addr_fault+0x7f6/0x1480 [ 252.397707][ T7953] exc_page_fault+0x6a/0xc0 [ 252.397728][ T7953] asm_exc_page_fault+0x26/0x30 [ 252.397740][ T7953] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 252.397800][ T7953] Code: 71 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 252.397811][ T7953] RSP: 0018:ffffc9000560fa18 EFLAGS: 00050206 [ 252.397825][ T7953] RAX: ffffffff84e6d801 RBX: ffff88807dd38000 RCX: 00000000000000cd [ 252.397835][ T7953] RDX: 0000000000000000 RSI: ffff88807dd38000 RDI: 0000200000001640 [ 252.397845][ T7953] RBP: ffffc9000560fba0 R08: ffff88807dd380cc R09: 1ffff1100fba7019 [ 252.397854][ T7953] R10: dffffc0000000000 R11: ffffed100fba701a R12: 1ffff92000ac1faf [ 252.397864][ T7953] R13: 0000200000001640 R14: ffffc9000560fd88 R15: 00000000000000cd [ 252.397878][ T7953] ? _copy_to_iter+0x221/0x1810 [ 252.397935][ T7953] _copy_to_iter+0x255/0x1810 [ 252.397950][ T7953] ? __pfx_from_kuid_munged+0x10/0x10 [ 252.397976][ T7953] ? __pfx__copy_to_iter+0x10/0x10 [ 252.397990][ T7953] ? llc_seq_stop+0xd2/0xf0 [ 252.398035][ T7953] ? llc_seq_stop+0xd2/0xf0 [ 252.398053][ T7953] ? __local_bh_enable_ip+0xd6/0x140 [ 252.398076][ T7953] seq_read_iter+0xaae/0xca0 [ 252.398127][ T7953] proc_reg_read_iter+0x1b7/0x280 [ 252.398166][ T7953] vfs_read+0x595/0xa80 [ 252.398189][ T7953] ? __pfx_vfs_read+0x10/0x10 [ 252.398213][ T7953] ? __fget_files+0x2a/0x420 [ 252.398234][ T7953] ksys_read+0x150/0x270 [ 252.398253][ T7953] ? __pfx_ksys_read+0x10/0x10 [ 252.398277][ T7953] do_syscall_64+0x166/0x520 [ 252.398289][ T7953] ? trace_irq_disable+0x3b/0x140 [ 252.398306][ T7953] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.398319][ T7953] ? clear_bhb_loop+0x70/0xc0 [ 252.398335][ T7953] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 252.398348][ T7953] RIP: 0033:0x7ffa5e79e159 [ 252.398360][ T7953] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.398370][ T7953] RSP: 002b:00007ffa5c9d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 252.398384][ T7953] RAX: ffffffffffffffda RBX: 00007ffa5ea26090 RCX: 00007ffa5e79e159 [ 252.398393][ T7953] RDX: 00000000000000cd RSI: 0000200000001640 RDI: 0000000000000003 [ 252.398402][ T7953] RBP: 00007ffa5c9d5090 R08: 0000000000000000 R09: 0000000000000000 [ 252.398410][ T7953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 252.398418][ T7953] R13: 00007ffa5ea26128 R14: 00007ffa5ea26090 R15: 00007fffd52e5738 [ 252.398439][ T7953] [ 252.438358][ T5696] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 252.477629][ T5768] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 252.618200][ T5696] usb 3-1: device descriptor read/64, error -71 [ 252.785487][ T5768] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 252.859613][ T5768] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 252.859648][ T5768] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 252.859664][ T5768] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 252.859679][ T5768] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 252.859693][ T5768] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 252.859707][ T5768] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 252.859721][ T5768] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 252.859736][ T5768] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 252.859750][ T5768] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 252.859764][ T5768] usb 6-1: config 1 interface 0 altsetting 0 has 8 endpoint descriptors, different from the interface descriptor's value: 14 [ 252.891547][ T5696] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 253.003071][ T5768] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.003092][ T5768] usb 6-1: Product: syz [ 253.003101][ T5768] usb 6-1: Manufacturer: syz [ 253.003110][ T5768] usb 6-1: SerialNumber: syz [ 253.035758][ T7950] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 253.035852][ T7950] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 253.035915][ T7950] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 253.035999][ T7950] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 253.036064][ T7950] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 253.036327][ T7950] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 253.036426][ T7950] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 253.036493][ T7950] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 253.085875][ T5768] keyspan 6-1:1.0: Keyspan 2 port adapter converter detected [ 253.086719][ T5768] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 7 [ 253.087377][ T5696] usb 3-1: device descriptor read/64, error -71 [ 253.133846][ T5768] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 253.133926][ T5768] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 5 [ 253.155925][ T5768] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 253.167685][ T5768] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 3 [ 253.167747][ T5768] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 4 [ 253.167814][ T5768] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 6 [ 253.201451][ T5696] usb usb3-port1: attempt power cycle [ 253.209941][ T5768] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 253.547766][ T5696] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 253.568252][ T5696] usb 3-1: device descriptor read/8, error -71 [ 253.587972][ T5768] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 253.738781][ T5768] usb 5-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 253.739773][ T5768] usb 5-1: config 1 has an invalid interface number: 7 but max is 0 [ 253.739791][ T5768] usb 5-1: config 1 has no interface number 0 [ 253.739814][ T5768] usb 5-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 253.739831][ T5768] usb 5-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 253.739847][ T5768] usb 5-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 253.741977][ T5768] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.741993][ T5768] usb 5-1: Product: syz [ 253.742002][ T5768] usb 5-1: Manufacturer: syz [ 253.742011][ T5768] usb 5-1: SerialNumber: syz [ 253.774187][ T7956] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 253.837071][ T5696] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 253.868731][ T5696] usb 3-1: device descriptor read/8, error -71 [ 253.978181][ T5696] usb usb3-port1: unable to enumerate USB device [ 254.059912][ T7956] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 254.303866][ T5768] usb 5-1: Incompatible driver and firmware versions [ 254.324954][ T5768] usb 5-1: USB disconnect, device number 57 [ 255.138479][ T5724] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 255.172007][ T5768] usb 6-1: USB disconnect, device number 30 [ 255.291803][ T5724] usb 5-1: Using ep0 maxpacket: 32 [ 255.292695][ T5724] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 255.293527][ T5724] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 255.293544][ T5724] usb 5-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 255.293559][ T5724] usb 5-1: config 0 interface 0 has no altsetting 0 [ 255.338226][ T5724] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.338247][ T5724] usb 5-1: Product: syz [ 255.338257][ T5724] usb 5-1: Manufacturer: syz [ 255.338267][ T5724] usb 5-1: SerialNumber: syz [ 255.379921][ T5724] usb 5-1: config 0 descriptor?? [ 255.582630][ T5768] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 255.615686][ T5768] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 255.632190][ T5768] keyspan 6-1:1.0: device disconnected [ 255.788221][ T7972] FAULT_INJECTION: forcing a failure. [ 255.788221][ T7972] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 255.788245][ T7972] CPU: 0 UID: 0 PID: 7972 Comm: syz.5.601 Not tainted syzkaller #0 PREEMPT(full) [ 255.788260][ T7972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 255.788272][ T7972] Call Trace: [ 255.788277][ T7972] [ 255.788284][ T7972] dump_stack_lvl+0xe8/0x150 [ 255.788307][ T7972] should_fail_ex+0x3eb/0x540 [ 255.788326][ T7972] prepare_alloc_pages+0x21e/0x5f0 [ 255.788351][ T7972] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 255.788372][ T7972] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 255.788395][ T7972] ? __kernel_text_address+0xd/0x30 [ 255.788433][ T7972] ? policy_nodemask+0x2cc/0x8e0 [ 255.788447][ T7972] ? __lock_acquire+0x747/0x2de0 [ 255.788467][ T7972] alloc_pages_mpol+0x21e/0x390 [ 255.788485][ T7972] folio_alloc_mpol_noprof+0x39/0x160 [ 255.788502][ T7972] vma_alloc_folio_noprof+0xe1/0x1e0 [ 255.788518][ T7972] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 255.788534][ T7972] ? lock_acquire+0x115/0x350 [ 255.788556][ T7972] do_pte_missing+0x173a/0x34b0 [ 255.788586][ T7972] handle_mm_fault+0x1a53/0x3750 [ 255.788608][ T7972] ? handle_mm_fault+0xf1/0x3750 [ 255.788629][ T7972] ? __pfx_handle_mm_fault+0x10/0x10 [ 255.788643][ T7972] ? lock_vma_under_rcu+0x45a/0x500 [ 255.788660][ T7972] ? do_sys_openat2+0x14e/0x200 [ 255.788687][ T7972] do_user_addr_fault+0xb35/0x1480 [ 255.788713][ T7972] ? trace_page_fault_user+0x84/0x1e0 [ 255.788732][ T7972] exc_page_fault+0x6a/0xc0 [ 255.788752][ T7972] asm_exc_page_fault+0x26/0x30 [ 255.788765][ T7972] RIP: 0033:0x7f4152265a50 [ 255.788778][ T7972] Code: 76 13 00 89 c3 85 c0 0f 88 ad 07 00 00 83 f8 1d 0f 8f 9d 09 00 00 48 8d 3d ad 5f 1a 00 31 c0 41 bf 01 00 00 00 e8 70 ca fe ff 44 0f c1 3d a7 a8 4e 00 41 83 ff 05 7f 06 49 83 fc 1a 77 1b 48 [ 255.788789][ T7972] RSP: 002b:00007f4153295f60 EFLAGS: 00010202 [ 255.788802][ T7972] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000000000 [ 255.788811][ T7972] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f415240b9f0 [ 255.788819][ T7972] RBP: 00007f415243506b R08: 0000000000000000 R09: 0000000000000000 [ 255.788828][ T7972] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000006e [ 255.788836][ T7972] R13: 0000200000000000 R14: 0000000000000005 R15: 0000000000000001 [ 255.788855][ T7972] [ 255.789023][ T7972] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 255.873422][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.873460][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.133650][ T7970] syzkaller0: entered promiscuous mode [ 256.133668][ T7970] syzkaller0: entered allmulticast mode [ 256.157762][ T5768] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 256.287811][ T5768] usb 6-1: device descriptor read/64, error -71 [ 256.463492][ T5724] gs_usb 5-1:0.0: Couldn't get device config: (err=-71) [ 256.463517][ T5724] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -71 [ 256.493693][ T5724] usb 5-1: USB disconnect, device number 58 [ 256.518362][ T7037] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 256.538196][ T5768] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 256.667853][ T5768] usb 6-1: device descriptor read/64, error -71 [ 256.669392][ T7037] usb 3-1: New USB device found, idVendor=2040, idProduct=2400, bcdDevice= 0.00 [ 256.670333][ T7037] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 256.670365][ T7037] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 256.727830][ T7037] pvrusb2: Hardware description: WinTV PVR USB2 Model 24xxx [ 256.778052][ T5768] usb usb6-port1: attempt power cycle [ 256.890899][ T2360] usb 3-1: Direct firmware load for v4l-pvrusb2-24xxx-01.fw failed with error -2 [ 256.890921][ T2360] usb 3-1: Falling back to sysfs fallback for: v4l-pvrusb2-24xxx-01.fw [ 256.936884][ T7037] usb 3-1: USB disconnect, device number 47 [ 257.118589][ T5768] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 257.138504][ T5768] usb 6-1: device descriptor read/8, error -71 [ 257.347710][ T5724] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 257.377401][ T5768] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 257.397776][ T5768] usb 6-1: device descriptor read/8, error -71 [ 257.507751][ T5768] usb usb6-port1: unable to enumerate USB device [ 258.060688][ T7990] netlink: 8 bytes leftover after parsing attributes in process `syz.4.605'. [ 259.246756][ T31] audit: type=1326 audit(1790274985.259:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8007 comm="syz.4.612" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ffa5e79e159 code=0x0 [ 259.327617][ T5724] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 259.477918][ T5724] usb 6-1: Using ep0 maxpacket: 32 [ 259.478437][ T5724] usb 6-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 259.479427][ T5724] usb 6-1: config index 0 descriptor too short (expected 164, got 36) [ 259.479459][ T5724] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 259.479475][ T5724] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 259.479498][ T5724] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 259.483860][ T5724] usb 6-1: config 0 descriptor?? [ 259.900790][ T5724] logitech 0003:046D:C29C.000E: unknown main item tag 0x0 [ 259.931546][ T5724] logitech 0003:046D:C29C.000E: hidraw0: USB HID v0.00 Device [HID 046d:c29c] on usb-dummy_hcd.5-1/input0 [ 260.212233][ T8015] netlink: 'syz.4.614': attribute type 4 has an invalid length. [ 260.212271][ T8015] netlink: 152 bytes leftover after parsing attributes in process `syz.4.614'. [ 260.241761][ T8015] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 260.314802][ T5724] logitech 0003:046D:C29C.000E: no inputs found [ 260.333059][ T5724] usb 6-1: USB disconnect, device number 35 [ 260.422020][ T8017] netlink: 'syz.4.615': attribute type 16 has an invalid length. [ 260.422041][ T8017] netlink: 'syz.4.615': attribute type 2 has an invalid length. [ 260.422049][ T8017] netlink: 64102 bytes leftover after parsing attributes in process `syz.4.615'. [ 260.912949][ T8021] FAULT_INJECTION: forcing a failure. [ 260.912949][ T8021] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 260.912974][ T8021] CPU: 0 UID: 0 PID: 8021 Comm: syz.5.617 Not tainted syzkaller #0 PREEMPT(full) [ 260.912990][ T8021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 260.912998][ T8021] Call Trace: [ 260.913004][ T8021] [ 260.913011][ T8021] dump_stack_lvl+0xe8/0x150 [ 260.913033][ T8021] should_fail_ex+0x3eb/0x540 [ 260.913052][ T8021] prepare_alloc_pages+0x21e/0x5f0 [ 260.913082][ T8021] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 260.913104][ T8021] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 260.913126][ T8021] ? rcu_is_watching+0x16/0xb0 [ 260.913141][ T8021] ? policy_nodemask+0x2cc/0x8e0 [ 260.913155][ T8021] ? __lock_acquire+0x747/0x2de0 [ 260.913174][ T8021] alloc_pages_mpol+0x21e/0x390 [ 260.913192][ T8021] folio_alloc_mpol_noprof+0x39/0x160 [ 260.913208][ T8021] vma_alloc_folio_noprof+0xe1/0x1e0 [ 260.913225][ T8021] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 260.913240][ T8021] ? lock_acquire+0x115/0x350 [ 260.913262][ T8021] do_pte_missing+0x173a/0x34b0 [ 260.913289][ T8021] handle_mm_fault+0x1a53/0x3750 [ 260.913311][ T8021] ? handle_mm_fault+0xf1/0x3750 [ 260.913332][ T8021] ? __pfx_handle_mm_fault+0x10/0x10 [ 260.913345][ T8021] ? lock_vma_under_rcu+0x45a/0x500 [ 260.913362][ T8021] ? do_sys_openat2+0x14e/0x200 [ 260.913388][ T8021] do_user_addr_fault+0xb35/0x1480 [ 260.913414][ T8021] ? trace_page_fault_user+0x84/0x1e0 [ 260.913432][ T8021] exc_page_fault+0x6a/0xc0 [ 260.913453][ T8021] asm_exc_page_fault+0x26/0x30 [ 260.913465][ T8021] RIP: 0033:0x7f4152265a50 [ 260.913478][ T8021] Code: 76 13 00 89 c3 85 c0 0f 88 ad 07 00 00 83 f8 1d 0f 8f 9d 09 00 00 48 8d 3d ad 5f 1a 00 31 c0 41 bf 01 00 00 00 e8 70 ca fe ff 44 0f c1 3d a7 a8 4e 00 41 83 ff 05 7f 06 49 83 fc 1a 77 1b 48 [ 260.913490][ T8021] RSP: 002b:00007f4153295f60 EFLAGS: 00010202 [ 260.913503][ T8021] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000000000 [ 260.913511][ T8021] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007f415240b9f0 [ 260.913520][ T8021] RBP: 00007f415243506b R08: 0000000000000000 R09: 0000000000000000 [ 260.913528][ T8021] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000006e [ 260.913537][ T8021] R13: 0000200000000000 R14: 0000000000000005 R15: 0000000000000001 [ 260.913556][ T8021] [ 260.913566][ T8021] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 261.237413][ T5696] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 261.368032][ T5696] usb 6-1: device descriptor read/64, error -71 [ 261.587942][ T5724] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 261.607873][ T5696] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 261.737970][ T5696] usb 6-1: device descriptor read/64, error -71 [ 261.738523][ T5724] usb 5-1: New USB device found, idVendor=104f, idProduct=0004, bcdDevice= 1.00 [ 261.739366][ T5724] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 261.739383][ T5724] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 261.740579][ T5724] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 261.740595][ T5724] usb 5-1: Product: syz [ 261.740605][ T5724] usb 5-1: Manufacturer: syz [ 261.746403][ T5724] iuu_phoenix 5-1:1.0: iuu_phoenix converter detected [ 261.825295][ T5724] usb 5-1: iuu_phoenix converter now attached to ttyUSB0 [ 261.847577][ T5696] usb usb6-port1: attempt power cycle [ 262.187835][ T5696] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 262.209140][ T5696] usb 6-1: device descriptor read/8, error -71 [ 262.447946][ T5696] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 262.468264][ T5696] usb 6-1: device descriptor read/8, error -71 [ 262.578199][ T5696] usb usb6-port1: unable to enumerate USB device [ 262.990365][ T8023] iuu_phoenix ttyUSB0: iuu_open - failed submitting read urb, error -90 [ 263.007950][ T5696] usb 5-1: USB disconnect, device number 60 [ 263.019985][ T5696] iuu_phoenix ttyUSB0: iuu_phoenix converter now disconnected from ttyUSB0 [ 263.039224][ T5696] iuu_phoenix 5-1:1.0: device disconnected [ 263.585204][ T8030] netlink: 12 bytes leftover after parsing attributes in process `syz.4.621'. [ 264.154481][ T8039] netlink: 60 bytes leftover after parsing attributes in process `syz.5.626'. [ 264.192988][ T8040] netlink: 60 bytes leftover after parsing attributes in process `syz.5.626'. [ 264.244874][ T4933] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 264.258915][ T4933] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 264.259740][ T4933] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 264.263181][ T4933] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 264.263588][ T4933] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 264.618928][ T8051] syzkaller1: entered promiscuous mode [ 264.618946][ T8051] syzkaller1: entered allmulticast mode [ 264.990209][ T8062] [U] ª [ 264.994651][ T1405] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.112779][ T1405] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.184406][ T1405] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.251677][ T1405] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.565868][ T1405] bridge_slave_1: left allmulticast mode [ 265.565890][ T1405] bridge_slave_1: left promiscuous mode [ 265.566033][ T1405] bridge0: port 2(bridge_slave_1) entered disabled state [ 265.605208][ T1405] bridge_slave_0: left allmulticast mode [ 265.605231][ T1405] bridge_slave_0: left promiscuous mode [ 265.605382][ T1405] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.786826][ T8074] FAULT_INJECTION: forcing a failure. [ 265.786826][ T8074] name failslab, interval 1, probability 0, space 0, times 0 [ 265.786850][ T8074] CPU: 0 UID: 0 PID: 8074 Comm: syz.5.633 Not tainted syzkaller #0 PREEMPT(full) [ 265.786866][ T8074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 265.786874][ T8074] Call Trace: [ 265.786880][ T8074] [ 265.786886][ T8074] dump_stack_lvl+0xe8/0x150 [ 265.786908][ T8074] should_fail_ex+0x3eb/0x540 [ 265.786927][ T8074] should_failslab+0xa8/0x100 [ 265.786943][ T8074] __kmalloc_noprof+0xf9/0x710 [ 265.786971][ T8074] ? tomoyo_encode+0x2ad/0x570 [ 265.786987][ T8074] ? tomoyo_encode+0x2ad/0x570 [ 265.787006][ T8074] tomoyo_encode+0x2ad/0x570 [ 265.787025][ T8074] tomoyo_realpath_from_path+0x5fa/0x640 [ 265.787047][ T8074] ? tomoyo_path_number_perm+0x219/0x5f0 [ 265.787062][ T8074] tomoyo_path_number_perm+0x246/0x5f0 [ 265.787077][ T8074] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 265.787090][ T8074] ? __lock_acquire+0x747/0x2de0 [ 265.787117][ T8074] ? hook_file_ioctl+0x1f2/0x600 [ 265.787141][ T8074] ? __fget_files+0x2a/0x420 [ 265.787161][ T8074] ? __fget_files+0x2a/0x420 [ 265.787175][ T8074] ? __fget_files+0x3a2/0x420 [ 265.787190][ T8074] ? __fget_files+0x2a/0x420 [ 265.787208][ T8074] security_file_ioctl+0xc3/0x2a0 [ 265.787232][ T8074] __se_sys_ioctl+0x47/0x170 [ 265.787253][ T8074] do_syscall_64+0x166/0x520 [ 265.787266][ T8074] ? trace_irq_disable+0x3b/0x140 [ 265.787283][ T8074] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.787297][ T8074] ? clear_bhb_loop+0x70/0xc0 [ 265.787313][ T8074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.787325][ T8074] RIP: 0033:0x7f415239ddeb [ 265.787339][ T8074] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 265.787350][ T8074] RSP: 002b:00007f4153295f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 265.787366][ T8074] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f415239ddeb [ 265.787376][ T8074] RDX: 00007f4153296fd0 RSI: 0000000041015500 RDI: 0000000000000005 [ 265.787384][ T8074] RBP: 00007f4153296fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 265.787393][ T8074] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4153295fa0 [ 265.787402][ T8074] R13: 0000200000000000 R14: 0000000000000005 R15: 0000000000000000 [ 265.787421][ T8074] [ 266.047460][ T8074] ERROR: Out of memory at tomoyo_realpath_from_path. [ 266.222869][ T8077] FAULT_INJECTION: forcing a failure. [ 266.222869][ T8077] name failslab, interval 1, probability 0, space 0, times 0 [ 266.222893][ T8077] CPU: 0 UID: 0 PID: 8077 Comm: syz.2.634 Not tainted syzkaller #0 PREEMPT(full) [ 266.222909][ T8077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 266.222917][ T8077] Call Trace: [ 266.222922][ T8077] [ 266.222928][ T8077] dump_stack_lvl+0xe8/0x150 [ 266.222951][ T8077] should_fail_ex+0x3eb/0x540 [ 266.222968][ T8077] ? __alloc_skb+0x1db/0x7a0 [ 266.223078][ T8077] should_failslab+0xa8/0x100 [ 266.223094][ T8077] ? __alloc_skb+0x1db/0x7a0 [ 266.223104][ T8077] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 266.223122][ T8077] ? __alloc_skb+0x18d/0x7a0 [ 266.223134][ T8077] ? __alloc_skb+0x1db/0x7a0 [ 266.223149][ T8077] __alloc_skb+0x1db/0x7a0 [ 266.223164][ T8077] netlink_sendmsg+0x577/0xae0 [ 266.223221][ T8077] ? __pfx_netlink_sendmsg+0x10/0x10 [ 266.223242][ T8077] ? apparmor_socket_sendmsg+0x18b/0x360 [ 266.223258][ T8077] ? __pfx_netlink_sendmsg+0x10/0x10 [ 266.223273][ T8077] sock_sendmsg_nosec+0x13a/0x180 [ 266.223293][ T8077] ____sys_sendmsg+0x54e/0x850 [ 266.223310][ T8077] ? __pfx_____sys_sendmsg+0x10/0x10 [ 266.223329][ T8077] ? import_iovec+0x73/0xa0 [ 266.223347][ T8077] ___sys_sendmsg+0x2a5/0x360 [ 266.223360][ T8077] ? __lock_acquire+0x747/0x2de0 [ 266.223380][ T8077] ? __pfx____sys_sendmsg+0x10/0x10 [ 266.223413][ T8077] ? __fget_files+0x2a/0x420 [ 266.223428][ T8077] ? __fget_files+0x3a2/0x420 [ 266.223449][ T8077] __x64_sys_sendmsg+0x1b1/0x290 [ 266.223465][ T8077] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 266.223490][ T8077] do_syscall_64+0x166/0x520 [ 266.223506][ T8077] ? trace_irq_disable+0x3b/0x140 [ 266.223524][ T8077] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 266.223538][ T8077] ? clear_bhb_loop+0x70/0xc0 [ 266.223553][ T8077] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 266.223566][ T8077] RIP: 0033:0x7fc1cb99e159 [ 266.223579][ T8077] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 266.223591][ T8077] RSP: 002b:00007fc1cc82f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 266.223607][ T8077] RAX: ffffffffffffffda RBX: 00007fc1cbc25fa0 RCX: 00007fc1cb99e159 [ 266.223617][ T8077] RDX: 000000002400c046 RSI: 0000200000000040 RDI: 0000000000000003 [ 266.223626][ T8077] RBP: 00007fc1cc82f090 R08: 0000000000000000 R09: 0000000000000000 [ 266.223634][ T8077] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 266.223642][ T8077] R13: 00007fc1cbc26038 R14: 00007fc1cbc25fa0 R15: 00007fff73a06078 [ 266.223661][ T8077] [ 266.308499][ T5768] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 266.352287][ T5624] Bluetooth: hci4: command tx timeout [ 266.458264][ T5768] usb 6-1: device descriptor read/64, error -71 [ 266.678916][ T1405] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 266.697821][ T5768] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 266.704303][ T1405] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 266.727610][ T1405] bond0 (unregistering): Released all slaves [ 266.827796][ T5768] usb 6-1: device descriptor read/64, error -71 [ 266.862919][ T1405] tipc: Left network mode [ 266.940684][ T5768] usb usb6-port1: attempt power cycle [ 267.208367][ T7293] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 267.277651][ T5768] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 267.300043][ T5768] usb 6-1: device descriptor read/8, error -71 [ 267.359264][ T7293] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 267.360125][ T7293] usb 5-1: config index 0 descriptor too short (expected 2084, got 36) [ 267.360144][ T7293] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 267.360156][ T7293] usb 5-1: config 0 has no interfaces? [ 267.360174][ T7293] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.362077][ T7293] usb 5-1: config 0 descriptor?? [ 267.436971][ T1405] hsr_slave_0: left promiscuous mode [ 267.450688][ T1405] hsr_slave_1: left promiscuous mode [ 267.451287][ T1405] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 267.451303][ T1405] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 267.451852][ T1405] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 267.451864][ T1405] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 267.504912][ T1405] veth1_macvtap: left promiscuous mode [ 267.504943][ T1405] veth0_macvtap: left promiscuous mode [ 267.505004][ T1405] veth1_vlan: left promiscuous mode [ 267.505044][ T1405] veth0_vlan: left promiscuous mode [ 267.537620][ T5768] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 267.560687][ T5768] usb 6-1: device descriptor read/8, error -71 [ 267.668286][ T5768] usb usb6-port1: unable to enumerate USB device [ 267.984834][ T1405] team0 (unregistering): Port device team_slave_1 removed [ 267.997182][ T8101] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.011262][ T8101] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 268.040092][ T1405] team0 (unregistering): Port device team_slave_0 removed [ 268.161091][ T8044] bridge0: port 1(bridge_slave_0) entered blocking state [ 268.161211][ T8044] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.161298][ T8044] bridge_slave_0: entered allmulticast mode [ 268.162507][ T8044] bridge_slave_0: entered promiscuous mode [ 268.202887][ T5278] 8021q: adding VLAN 0 to HW filter on device eth9 [ 268.205324][ T8044] bridge0: port 2(bridge_slave_1) entered blocking state [ 268.205390][ T8044] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.205473][ T8044] bridge_slave_1: entered allmulticast mode [ 268.241695][ T8044] bridge_slave_1: entered promiscuous mode [ 268.325012][ T8044] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 268.342979][ T8044] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 268.431267][ T5624] Bluetooth: hci4: command tx timeout [ 268.432560][ T8044] team0: Port device team_slave_0 added [ 268.433507][ T8103] db_root: cannot open: IMIX 'CD' 00000000000000000000 [ 268.462000][ T8103] netlink: 200 bytes leftover after parsing attributes in process `syz.4.636'. [ 268.493785][ T8044] team0: Port device team_slave_1 added [ 268.578650][ T8044] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 268.578665][ T8044] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 268.578682][ T8044] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 268.581149][ T8044] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 268.581161][ T8044] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 268.581178][ T8044] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 268.765741][ T8044] hsr_slave_0: entered promiscuous mode [ 268.767091][ T8044] hsr_slave_1: entered promiscuous mode [ 269.396709][ T8044] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 269.419213][ T8044] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 269.420021][ T5278] 8021q: adding VLAN 0 to HW filter on device eth10 [ 269.422973][ T8044] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 269.425667][ T8044] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 269.456665][ T8044] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 269.478452][ T8044] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 269.482907][ T8044] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 269.512845][ T8044] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 269.812283][ T8044] 8021q: adding VLAN 0 to HW filter on device bond0 [ 269.860137][ T8044] 8021q: adding VLAN 0 to HW filter on device team0 [ 269.885457][ T1405] bridge0: port 1(bridge_slave_0) entered blocking state [ 269.885525][ T1405] bridge0: port 1(bridge_slave_0) entered forwarding state [ 269.913299][ T1405] bridge0: port 2(bridge_slave_1) entered blocking state [ 269.913365][ T1405] bridge0: port 2(bridge_slave_1) entered forwarding state [ 270.104318][ T5696] usb 5-1: USB disconnect, device number 61 [ 270.224491][ T8139] syzkaller1: entered promiscuous mode [ 270.224510][ T8139] syzkaller1: entered allmulticast mode [ 270.507706][ T5624] Bluetooth: hci4: command tx timeout [ 270.567797][ T5696] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 270.719872][ T5696] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 270.722892][ T5696] usb 5-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 270.722915][ T5696] usb 5-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 270.722932][ T5696] usb 5-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 270.722967][ T5696] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.794356][ T8141] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 270.995471][ T5278] 8021q: adding VLAN 0 to HW filter on device eth11 [ 271.224291][ T8044] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 271.656806][ T8044] veth0_vlan: entered promiscuous mode [ 271.683659][ T8044] veth1_vlan: entered promiscuous mode [ 271.751592][ T8044] veth0_macvtap: entered promiscuous mode [ 271.775026][ T8044] veth1_macvtap: entered promiscuous mode [ 271.824004][ T8044] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 271.842679][ T8044] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 271.878299][ T7843] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 271.878332][ T7843] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 271.878353][ T7843] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 271.878374][ T7843] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 272.142828][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 272.142848][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 272.171907][ T5278] 8021q: adding VLAN 0 to HW filter on device eth12 [ 272.262705][ T7846] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 272.262722][ T7846] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 272.588453][ T5624] Bluetooth: hci4: command tx timeout [ 272.771414][ T8204] erofs: Unknown parameter 'acl_vti0' [ 273.771183][ T8228] FAULT_INJECTION: forcing a failure. [ 273.771183][ T8228] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 273.771207][ T8228] CPU: 0 UID: 0 PID: 8228 Comm: syz.2.652 Not tainted syzkaller #0 PREEMPT(full) [ 273.771223][ T8228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 273.771231][ T8228] Call Trace: [ 273.771236][ T8228] [ 273.771243][ T8228] dump_stack_lvl+0xe8/0x150 [ 273.771264][ T8228] should_fail_ex+0x3eb/0x540 [ 273.771283][ T8228] prepare_alloc_pages+0x21e/0x5f0 [ 273.771306][ T8228] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 273.771328][ T8228] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 273.771349][ T8228] ? __kernel_text_address+0xd/0x30 [ 273.771369][ T8228] ? policy_nodemask+0x2cc/0x8e0 [ 273.771384][ T8228] ? __lock_acquire+0x747/0x2de0 [ 273.771404][ T8228] alloc_pages_mpol+0x21e/0x390 [ 273.771422][ T8228] folio_alloc_mpol_noprof+0x39/0x160 [ 273.771437][ T8228] vma_alloc_folio_noprof+0xe1/0x1e0 [ 273.771454][ T8228] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 273.771469][ T8228] ? lock_acquire+0x115/0x350 [ 273.771490][ T8228] do_pte_missing+0x173a/0x34b0 [ 273.771518][ T8228] handle_mm_fault+0x1a53/0x3750 [ 273.771540][ T8228] ? handle_mm_fault+0xf1/0x3750 [ 273.771560][ T8228] ? __pfx_handle_mm_fault+0x10/0x10 [ 273.771574][ T8228] ? lock_vma_under_rcu+0x45a/0x500 [ 273.771590][ T8228] ? do_sys_openat2+0x14e/0x200 [ 273.771617][ T8228] do_user_addr_fault+0xb35/0x1480 [ 273.771642][ T8228] ? trace_page_fault_user+0x84/0x1e0 [ 273.771661][ T8228] exc_page_fault+0x6a/0xc0 [ 273.771681][ T8228] asm_exc_page_fault+0x26/0x30 [ 273.771693][ T8228] RIP: 0033:0x7fc1cb865a50 [ 273.771706][ T8228] Code: 76 13 00 89 c3 85 c0 0f 88 ad 07 00 00 83 f8 1d 0f 8f 9d 09 00 00 48 8d 3d ad 5f 1a 00 31 c0 41 bf 01 00 00 00 e8 70 ca fe ff 44 0f c1 3d a7 a8 4e 00 41 83 ff 05 7f 06 49 83 fc 1a 77 1b 48 [ 273.771717][ T8228] RSP: 002b:00007fc1cc82cf60 EFLAGS: 00010202 [ 273.771730][ T8228] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000000000 [ 273.771739][ T8228] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fc1cba0b9f0 [ 273.771747][ T8228] RBP: 00007fc1cba3506b R08: 0000000000000000 R09: 0000000000000000 [ 273.771756][ T8228] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000006e [ 273.771764][ T8228] R13: 0000200000000000 R14: 0000000000000005 R15: 0000000000000001 [ 273.771782][ T8228] [ 273.771791][ T8228] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 273.805083][ T9] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 274.050166][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 274.059510][ T9] usb 7-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 274.076415][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.094569][ T9] usb 7-1: config 0 descriptor?? [ 274.105375][ T5696] aiptek 5-1:17.0: Aiptek tried all speeds, no sane response [ 274.105528][ T5696] aiptek 5-1:17.0: probe with driver aiptek failed with error -22 [ 274.137189][ T9] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 274.148246][ T5696] usb 5-1: USB disconnect, device number 62 [ 274.266885][ T8233] jffs2: notice: (8233) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 274.339000][ T9] gspca_vc032x: reg_r err -32 [ 274.339015][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339023][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339028][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339035][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339040][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339045][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339052][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339057][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339063][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339068][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339074][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339080][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339085][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339091][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339096][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339102][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339108][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339113][ T9] gspca_vc032x: I2c Bus Busy Wait 00 [ 274.339119][ T9] gspca_vc032x: Unknown sensor... [ 274.339165][ T9] vc032x 7-1:0.0: probe with driver vc032x failed with error -22 [ 275.141605][ T7841] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 275.322496][ T7841] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 275.436924][ T7841] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 275.539547][ T4933] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 275.544253][ T4933] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 275.546524][ T4933] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 275.581259][ T4933] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 275.581801][ T4933] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 275.627151][ T7841] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 276.090507][ T7841] bridge_slave_1: left allmulticast mode [ 276.090531][ T7841] bridge_slave_1: left promiscuous mode [ 276.090676][ T7841] bridge0: port 2(bridge_slave_1) entered disabled state [ 276.122401][ T7841] bridge_slave_0: left allmulticast mode [ 276.122423][ T7841] bridge_slave_0: left promiscuous mode [ 276.122584][ T7841] bridge0: port 1(bridge_slave_0) entered disabled state [ 276.545185][ T7293] usb 7-1: USB disconnect, device number 2 [ 276.643283][ T7841] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 276.666779][ T7841] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 276.680725][ T7841] bond0 (unregistering): Released all slaves [ 276.768318][ T7841] tipc: Left network mode [ 276.977067][ T8284] netlink: 12 bytes leftover after parsing attributes in process `syz.5.664'. [ 276.977087][ T8284] netlink: 1 bytes leftover after parsing attributes in process `syz.5.664'. [ 277.167465][ T8290] netlink: 16 bytes leftover after parsing attributes in process `syz.6.666'. [ 277.394960][ T7841] hsr_slave_0: left promiscuous mode [ 277.395567][ T7841] hsr_slave_1: left promiscuous mode [ 277.396125][ T7841] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 277.396140][ T7841] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 277.426843][ T7841] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 277.426862][ T7841] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 277.471866][ T7841] veth1_macvtap: left promiscuous mode [ 277.471898][ T7841] veth0_macvtap: left promiscuous mode [ 277.471959][ T7841] veth1_vlan: left promiscuous mode [ 277.472041][ T7841] veth0_vlan: left promiscuous mode [ 277.631493][ T4933] Bluetooth: hci1: command tx timeout [ 277.951364][ T7841] team0 (unregistering): Port device team_slave_1 removed [ 277.972444][ T7841] team0 (unregistering): Port device team_slave_0 removed [ 278.029965][ T5768] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 278.112726][ T5278] 8021q: adding VLAN 0 to HW filter on device eth13 [ 278.179384][ T5768] usb 7-1: New USB device found, idVendor=0c98, idProduct=1140, bcdDevice= 1.00 [ 278.180242][ T5768] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 278.180274][ T5768] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.230685][ T5768] pcwd_usb: This driver only supports 1 device [ 278.456460][ T9] usb 7-1: USB disconnect, device number 3 [ 278.519894][ T7841] IPVS: stop unused estimator thread 0... [ 278.873483][ T4933] Bluetooth: hci3: unknown advertising packet type: 0x65 [ 278.873504][ T4933] Bluetooth: hci3: Dropping invalid advertising data [ 278.873515][ T4933] Bluetooth: hci3: Dropping invalid advertising data [ 278.873522][ T4933] Bluetooth: hci3: Malformed LE Event: 0x02 [ 278.934856][ T8255] bridge0: port 1(bridge_slave_0) entered blocking state [ 278.936485][ T8255] bridge0: port 1(bridge_slave_0) entered disabled state [ 278.936586][ T8255] bridge_slave_0: entered allmulticast mode [ 278.961699][ T8255] bridge_slave_0: entered promiscuous mode [ 278.974969][ T8255] bridge0: port 2(bridge_slave_1) entered blocking state [ 278.976676][ T8255] bridge0: port 2(bridge_slave_1) entered disabled state [ 278.976791][ T8255] bridge_slave_1: entered allmulticast mode [ 279.002761][ T8255] bridge_slave_1: entered promiscuous mode [ 279.115360][ T8255] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 279.143347][ T8255] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 279.196182][ T8331] FAULT_INJECTION: forcing a failure. [ 279.196182][ T8331] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 279.196207][ T8331] CPU: 0 UID: 0 PID: 8331 Comm: syz.6.672 Not tainted syzkaller #0 PREEMPT(full) [ 279.196223][ T8331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 279.196231][ T8331] Call Trace: [ 279.196237][ T8331] [ 279.196243][ T8331] dump_stack_lvl+0xe8/0x150 [ 279.196265][ T8331] should_fail_ex+0x3eb/0x540 [ 279.196284][ T8331] prepare_alloc_pages+0x21e/0x5f0 [ 279.196307][ T8331] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 279.196330][ T8331] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 279.196352][ T8331] ? __kernel_text_address+0xd/0x30 [ 279.196372][ T8331] ? policy_nodemask+0x2cc/0x8e0 [ 279.196386][ T8331] ? __lock_acquire+0x747/0x2de0 [ 279.196406][ T8331] alloc_pages_mpol+0x21e/0x390 [ 279.196425][ T8331] folio_alloc_mpol_noprof+0x39/0x160 [ 279.196440][ T8331] vma_alloc_folio_noprof+0xe1/0x1e0 [ 279.196457][ T8331] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 279.196472][ T8331] ? lock_acquire+0x115/0x350 [ 279.196494][ T8331] do_pte_missing+0x173a/0x34b0 [ 279.196522][ T8331] handle_mm_fault+0x1a53/0x3750 [ 279.196544][ T8331] ? handle_mm_fault+0xf1/0x3750 [ 279.196564][ T8331] ? __pfx_handle_mm_fault+0x10/0x10 [ 279.196582][ T8331] ? lock_vma_under_rcu+0x45a/0x500 [ 279.196598][ T8331] ? do_sys_openat2+0x14e/0x200 [ 279.196629][ T8331] do_user_addr_fault+0xb35/0x1480 [ 279.196654][ T8331] ? trace_page_fault_user+0x84/0x1e0 [ 279.196673][ T8331] exc_page_fault+0x6a/0xc0 [ 279.196693][ T8331] asm_exc_page_fault+0x26/0x30 [ 279.196706][ T8331] RIP: 0033:0x7fa81d665a50 [ 279.196718][ T8331] Code: 76 13 00 89 c3 85 c0 0f 88 ad 07 00 00 83 f8 1d 0f 8f 9d 09 00 00 48 8d 3d ad 5f 1a 00 31 c0 41 bf 01 00 00 00 e8 70 ca fe ff 44 0f c1 3d a7 a8 4e 00 41 83 ff 05 7f 06 49 83 fc 1a 77 1b 48 [ 279.196730][ T8331] RSP: 002b:00007fa81e6dbf60 EFLAGS: 00010202 [ 279.196744][ T8331] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000000000 [ 279.196752][ T8331] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fa81d80b9f0 [ 279.196761][ T8331] RBP: 00007fa81d83506b R08: 0000000000000000 R09: 0000000000000000 [ 279.196769][ T8331] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000006e [ 279.196777][ T8331] R13: 0000200000000000 R14: 0000000000000005 R15: 0000000000000001 [ 279.196796][ T8331] [ 279.196818][ T8331] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 279.484734][ T8255] team0: Port device team_slave_0 added [ 279.521540][ T8255] team0: Port device team_slave_1 added [ 279.596114][ T8255] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 279.596129][ T8255] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 279.596146][ T8255] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 279.651195][ T8255] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 279.651210][ T8255] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 279.651227][ T8255] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 279.708387][ T4933] Bluetooth: hci1: command tx timeout [ 279.710058][ T9] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 279.816272][ T8255] hsr_slave_0: entered promiscuous mode [ 279.824472][ T8255] hsr_slave_1: entered promiscuous mode [ 279.824928][ T8255] debugfs: 'hsr0' already exists in 'hsr' [ 279.824942][ T8255] Cannot create hsr debugfs directory [ 279.839400][ T9] usb 7-1: device descriptor read/64, error -71 [ 279.901402][ T5278] 8021q: adding VLAN 0 to HW filter on device eth14 [ 280.080687][ T9] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 280.208201][ T9] usb 7-1: device descriptor read/64, error -71 [ 280.318268][ T9] usb usb7-port1: attempt power cycle [ 280.575581][ T8255] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 280.597154][ T8255] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 280.606123][ T8255] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 280.622698][ T8255] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 280.626648][ T8255] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 280.651109][ T8255] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 280.651702][ T8255] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 280.657084][ T8255] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 280.673670][ T9] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 280.703320][ T9] usb 7-1: device descriptor read/8, error -71 [ 280.881563][ T8255] 8021q: adding VLAN 0 to HW filter on device bond0 [ 280.916088][ T8255] 8021q: adding VLAN 0 to HW filter on device team0 [ 280.935629][ T7843] bridge0: port 1(bridge_slave_0) entered blocking state [ 280.935696][ T7843] bridge0: port 1(bridge_slave_0) entered forwarding state [ 280.937635][ T9] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 280.966411][ T9] usb 7-1: device descriptor read/8, error -71 [ 280.990558][ T1405] bridge0: port 2(bridge_slave_1) entered blocking state [ 280.990627][ T1405] bridge0: port 2(bridge_slave_1) entered forwarding state [ 281.069572][ T9] usb usb7-port1: unable to enumerate USB device [ 281.264211][ T5278] 8021q: adding VLAN 0 to HW filter on device eth15 [ 281.531363][ T8383] ================================================================== [ 281.531376][ T8383] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irq+0x3d/0x50 [ 281.531400][ T8383] Read of size 1 at addr ffff888029b97018 by task syz.2.678/8383 [ 281.531412][ T8383] [ 281.531420][ T8383] CPU: 0 UID: 0 PID: 8383 Comm: syz.2.678 Not tainted syzkaller #0 PREEMPT(full) [ 281.531435][ T8383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 281.531443][ T8383] Call Trace: [ 281.531449][ T8383] [ 281.531456][ T8383] dump_stack_lvl+0xe8/0x150 [ 281.531472][ T8383] print_address_description+0x55/0x1e0 [ 281.531518][ T8383] ? _raw_spin_lock_irq+0x3d/0x50 [ 281.531534][ T8383] print_report+0x58/0x70 [ 281.531549][ T8383] kasan_report+0x117/0x150 [ 281.531564][ T8383] ? _raw_spin_lock_irq+0x3d/0x50 [ 281.531582][ T8383] __kasan_check_byte+0x2a/0x40 [ 281.531595][ T8383] lock_acquire+0x7d/0x350 [ 281.531612][ T8383] ? __pfx_apparmor_file_open+0x10/0x10 [ 281.531673][ T8383] ? rcu_is_watching+0x16/0xb0 [ 281.531687][ T8383] _raw_spin_lock_irq+0x3d/0x50 [ 281.531703][ T8383] ? gadget_dev_open+0x4b/0x1b0 [ 281.531751][ T8383] gadget_dev_open+0x4b/0x1b0 [ 281.531768][ T8383] ? __pfx_gadget_dev_open+0x10/0x10 [ 281.531786][ T8383] do_dentry_open+0x80e/0x1360 [ 281.531803][ T8383] vfs_open_consume+0x4a/0x350 [ 281.531816][ T8383] ? path_openat+0x14bb/0x1e40 [ 281.531835][ T8383] path_openat+0x14d7/0x1e40 [ 281.531856][ T8383] do_file_open+0x23e/0x4a0 [ 281.531875][ T8383] ? __pfx_do_file_open+0x10/0x10 [ 281.531896][ T8383] ? _raw_spin_unlock+0x28/0x50 [ 281.531921][ T8383] ? alloc_fd+0x651/0x6c0 [ 281.531937][ T8383] do_sys_openat2+0x115/0x200 [ 281.531950][ T8383] ? __se_sys_futex+0x3a8/0x450 [ 281.531964][ T8383] ? __pfx_do_sys_openat2+0x10/0x10 [ 281.531978][ T8383] ? rcu_is_watching+0x16/0xb0 [ 281.531991][ T8383] __x64_sys_openat+0x138/0x170 [ 281.532006][ T8383] do_syscall_64+0x166/0x520 [ 281.532018][ T8383] ? trace_irq_disable+0x3b/0x140 [ 281.532036][ T8383] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.532049][ T8383] ? clear_bhb_loop+0x70/0xc0 [ 281.532063][ T8383] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.532076][ T8383] RIP: 0033:0x7fc1cb99e159 [ 281.532088][ T8383] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 281.532099][ T8383] RSP: 002b:00007fc1cc82f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 281.532114][ T8383] RAX: ffffffffffffffda RBX: 00007fc1cbc25fa0 RCX: 00007fc1cb99e159 [ 281.532124][ T8383] RDX: 0000000000000802 RSI: 0000200000000300 RDI: ffffffffffffff9c [ 281.532133][ T8383] RBP: 00007fc1cba3506b R08: 0000000000000000 R09: 0000000000000000 [ 281.532142][ T8383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 281.532150][ T8383] R13: 00007fc1cbc26038 R14: 00007fc1cbc25fa0 R15: 00007fff73a06078 [ 281.532162][ T8383] [ 281.532167][ T8383] [ 281.532171][ T8383] Allocated by task 38: [ 281.532177][ T8383] kasan_save_track+0x3e/0x80 [ 281.532198][ T8383] __kasan_kmalloc+0x93/0xb0 [ 281.532208][ T8383] __kmalloc_noprof+0x366/0x710 [ 281.532224][ T8383] ieee802_11_parse_elems_full+0x14b/0x2de0 [ 281.532278][ T8383] ieee80211_inform_bss+0x163/0x10d0 [ 281.532319][ T8383] cfg80211_inform_single_bss_data+0xd9c/0x1be0 [ 281.532365][ T8383] cfg80211_inform_bss_data+0x263/0x3cc0 [ 281.532378][ T8383] cfg80211_inform_bss_frame_data+0x3c7/0x840 [ 281.532391][ T8383] ieee80211_bss_info_update+0x791/0xa50 [ 281.532403][ T8383] ieee80211_ibss_rx_queued_mgmt+0x1cde/0x2c40 [ 281.532434][ T8383] ieee80211_iface_work+0x78a/0x1010 [ 281.532446][ T8383] cfg80211_wiphy_work+0x29e/0x420 [ 281.532485][ T8383] process_scheduled_works+0xc3d/0x1630 [ 281.532498][ T8383] worker_thread+0xa47/0xfb0 [ 281.532510][ T8383] kthread+0x38b/0x480 [ 281.532530][ T8383] ret_from_fork+0x514/0xb70 [ 281.532555][ T8383] ret_from_fork_asm+0x1a/0x30 [ 281.532569][ T8383] [ 281.532573][ T8383] Freed by task 38: [ 281.532578][ T8383] kasan_save_track+0x3e/0x80 [ 281.532595][ T8383] kasan_save_free_info+0x40/0x50 [ 281.532609][ T8383] __kasan_slab_free+0x5c/0x80 [ 281.532619][ T8383] kfree+0x1c5/0x650 [ 281.532633][ T8383] ieee80211_inform_bss+0xbda/0x10d0 [ 281.532643][ T8383] cfg80211_inform_single_bss_data+0xd9c/0x1be0 [ 281.532656][ T8383] cfg80211_inform_bss_data+0x263/0x3cc0 [ 281.532668][ T8383] cfg80211_inform_bss_frame_data+0x3c7/0x840 [ 281.532681][ T8383] ieee80211_bss_info_update+0x791/0xa50 [ 281.532691][ T8383] ieee80211_ibss_rx_queued_mgmt+0x1cde/0x2c40 [ 281.532709][ T8383] ieee80211_iface_work+0x78a/0x1010 [ 281.532721][ T8383] cfg80211_wiphy_work+0x29e/0x420 [ 281.532735][ T8383] process_scheduled_works+0xc3d/0x1630 [ 281.532747][ T8383] worker_thread+0xa47/0xfb0 [ 281.532758][ T8383] kthread+0x38b/0x480 [ 281.532773][ T8383] ret_from_fork+0x514/0xb70 [ 281.532788][ T8383] ret_from_fork_asm+0x1a/0x30 [ 281.532802][ T8383] [ 281.532805][ T8383] The buggy address belongs to the object at ffff888029b97000 [ 281.532805][ T8383] which belongs to the cache kmalloc-1k of size 1024 [ 281.532815][ T8383] The buggy address is located 24 bytes inside of [ 281.532815][ T8383] freed 1024-byte region [ffff888029b97000, ffff888029b97400) [ 281.532829][ T8383] [ 281.532832][ T8383] The buggy address belongs to the physical page: [ 281.532840][ T8383] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888029b90000 pfn:0x29b90 [ 281.532853][ T8383] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 281.532863][ T8383] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 281.532876][ T8383] page_type: f5(slab) [ 281.532888][ T8383] raw: 00fff00000000240 ffff88813ff1adc0 ffff88813ff19888 ffffea000081ce10 [ 281.533092][ T8383] raw: ffff888029b90000 000000000010000c 00000000f5000000 0000000000000000 [ 281.533113][ T8383] head: 00fff00000000240 ffff88813ff1adc0 ffff88813ff19888 ffffea000081ce10 [ 281.533124][ T8383] head: ffff888029b90000 000000000010000c 00000000f5000000 0000000000000000 [ 281.533135][ T8383] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 281.533146][ T8383] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 281.533153][ T8383] page dumped because: kasan: bad access detected [ 281.533204][ T8383] page_owner tracks the page as allocated [ 281.533211][ T8383] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5617, tgid 5617 (syz-executor), ts 88050771358 [ 281.533234][ T8383] post_alloc_hook+0x1f9/0x250 [ 281.533254][ T8383] get_page_from_freelist+0x2209/0x2280 [ 281.533272][ T8383] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 281.533290][ T8383] allocate_slab+0x7d/0x620 [ 281.533302][ T8383] refill_objects+0x2d5/0x350 [ 281.533315][ T8383] __pcs_replace_empty_main+0x2c8/0x6c0 [ 281.533327][ T8383] __kmalloc_node_noprof+0x548/0x720 [ 281.533344][ T8383] qdisc_alloc+0x92/0x9d0 [ 281.533378][ T8383] qdisc_create_dflt+0x8e/0x4e0 [ 281.533391][ T8383] dev_activate+0x37a/0x1150 [ 281.533403][ T8383] __dev_open+0x699/0x850 [ 281.533434][ T8383] __dev_change_flags+0x329/0x820 [ 281.533445][ T8383] netif_change_flags+0x7c/0x1b0 [ 281.533457][ T8383] do_setlink+0xdd6/0x4670 [ 281.533469][ T8383] rtnl_newlink+0x15a3/0x1c30 [ 281.533480][ T8383] rtnetlink_rcv_msg+0x802/0xc00 [ 281.533490][ T8383] page last free pid 5351 tgid 5351 ts 52032057469 stack trace: [ 281.533500][ T8383] __free_frozen_pages+0xc93/0xd90 [ 281.533515][ T8383] __slab_free+0x274/0x2c0 [ 281.533531][ T8383] qlist_free_all+0x99/0x100 [ 281.533558][ T8383] kasan_quarantine_reduce+0x148/0x160 [ 281.533574][ T8383] __kasan_slab_alloc+0x22/0x80 [ 281.533586][ T8383] __kmalloc_noprof+0x302/0x710 [ 281.533602][ T8383] tomoyo_supervisor+0xc4e/0x1550 [ 281.533635][ T8383] tomoyo_path_permission+0x262/0x3b0 [ 281.533647][ T8383] tomoyo_check_open_permission+0x2b2/0x470 [ 281.533659][ T8383] security_file_open+0xa9/0x240 [ 281.533670][ T8383] do_dentry_open+0x495/0x1360 [ 281.533681][ T8383] vfs_open_consume+0x4a/0x350 [ 281.533694][ T8383] path_openat+0x14d7/0x1e40 [ 281.533711][ T8383] do_file_open+0x23e/0x4a0 [ 281.533727][ T8383] do_sys_openat2+0x115/0x200 [ 281.533739][ T8383] __x64_sys_openat+0x138/0x170 [ 281.533752][ T8383] [ 281.533756][ T8383] Memory state around the buggy address: [ 281.533764][ T8383] ffff888029b96f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 281.533773][ T8383] ffff888029b96f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 281.533782][ T8383] >ffff888029b97000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 281.533788][ T8383] ^ [ 281.533795][ T8383] ffff888029b97080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 281.533803][ T8383] ffff888029b97100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 281.533809][ T8383] ================================================================== [ 281.533819][ T8383] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 282.391712][ T8383] CPU: 0 UID: 0 PID: 8383 Comm: syz.2.678 Not tainted syzkaller #0 PREEMPT(full) [ 282.400911][ T8383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 282.410963][ T8383] Call Trace: [ 282.414243][ T8383] [ 282.417261][ T8383] vpanic+0x56d/0xa70 [ 282.421253][ T8383] ? __pfx_vpanic+0x10/0x10 [ 282.425756][ T8383] panic+0xc5/0xd0 [ 282.429475][ T8383] ? __pfx_panic+0x10/0x10 [ 282.433889][ T8383] ? _raw_spin_lock_irq+0x3d/0x50 [ 282.438916][ T8383] ? rcu_is_watching+0x16/0xb0 [ 282.443684][ T8383] ? _raw_spin_lock_irq+0x3d/0x50 [ 282.448747][ T8383] ? _raw_spin_lock_irq+0x3d/0x50 [ 282.453781][ T8383] check_panic_on_warn+0x89/0xb0 [ 282.458730][ T8383] ? _raw_spin_lock_irq+0x3d/0x50 [ 282.463749][ T8383] end_report+0x73/0x170 [ 282.467985][ T8383] ? _raw_spin_lock_irq+0x3d/0x50 [ 282.473007][ T8383] kasan_report+0x128/0x150 [ 282.477503][ T8383] ? _raw_spin_lock_irq+0x3d/0x50 [ 282.482524][ T8383] __kasan_check_byte+0x2a/0x40 [ 282.487457][ T8383] lock_acquire+0x7d/0x350 [ 282.491871][ T8383] ? __pfx_apparmor_file_open+0x10/0x10 [ 282.497447][ T8383] ? rcu_is_watching+0x16/0xb0 [ 282.502221][ T8383] _raw_spin_lock_irq+0x3d/0x50 [ 282.507178][ T8383] ? gadget_dev_open+0x4b/0x1b0 [ 282.512045][ T8383] gadget_dev_open+0x4b/0x1b0 [ 282.516724][ T8383] ? __pfx_gadget_dev_open+0x10/0x10 [ 282.522014][ T8383] do_dentry_open+0x80e/0x1360 [ 282.526802][ T8383] vfs_open_consume+0x4a/0x350 [ 282.531562][ T8383] ? path_openat+0x14bb/0x1e40 [ 282.536326][ T8383] path_openat+0x14d7/0x1e40 [ 282.540917][ T8383] do_file_open+0x23e/0x4a0 [ 282.545430][ T8383] ? __pfx_do_file_open+0x10/0x10 [ 282.550469][ T8383] ? _raw_spin_unlock+0x28/0x50 [ 282.555321][ T8383] ? alloc_fd+0x651/0x6c0 [ 282.559646][ T8383] do_sys_openat2+0x115/0x200 [ 282.564333][ T8383] ? __se_sys_futex+0x3a8/0x450 [ 282.569178][ T8383] ? __pfx_do_sys_openat2+0x10/0x10 [ 282.574376][ T8383] ? rcu_is_watching+0x16/0xb0 [ 282.579146][ T8383] __x64_sys_openat+0x138/0x170 [ 282.583993][ T8383] do_syscall_64+0x166/0x520 [ 282.588592][ T8383] ? trace_irq_disable+0x3b/0x140 [ 282.593703][ T8383] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 282.599760][ T8383] ? clear_bhb_loop+0x70/0xc0 [ 282.604440][ T8383] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 282.610323][ T8383] RIP: 0033:0x7fc1cb99e159 [ 282.614735][ T8383] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 282.634359][ T8383] RSP: 002b:00007fc1cc82f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 282.642770][ T8383] RAX: ffffffffffffffda RBX: 00007fc1cbc25fa0 RCX: 00007fc1cb99e159 [ 282.650738][ T8383] RDX: 0000000000000802 RSI: 0000200000000300 RDI: ffffffffffffff9c [ 282.658716][ T8383] RBP: 00007fc1cba3506b R08: 0000000000000000 R09: 0000000000000000 [ 282.666688][ T8383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 282.674667][ T8383] R13: 00007fc1cbc26038 R14: 00007fc1cbc25fa0 R15: 00007fff73a06078 [ 282.682640][ T8383] [ 282.685709][ T8383] Kernel Offset: disabled [ 282.690127][ T8383] Rebooting in 86400 seconds..