last executing test programs: 8m54.939385124s ago: executing program 0 (id=1902): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x2, 0xe, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x7, 0xda, 0x0, 0x0, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x14}}}]}, 0x28}}, 0x0) (async) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xffde}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@getchain={0x64, 0x66, 0x10, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x10, 0xe}, {0xd, 0xc}, {0xd, 0x3}}, [{0x8, 0xb, 0x4}, {0x8, 0xb, 0x31}, {0x8, 0xb, 0x3}, {0x8, 0xb, 0x2ae}, {0x8, 0xb, 0x7fff}, {0x8, 0xb, 0xbf09}, {0x8, 0xb, 0x6}, {0x8, 0xb, 0x3}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x0) 8m54.398722632s ago: executing program 0 (id=1906): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x301442, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) migrate_pages(0x0, 0x3, &(0x7f00000002c0)=0x2d, &(0x7f0000000280)=0xa) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000300)={0xfffffffffffffffc, 0xaf9fff, 0x800, 0xbb, 0x1}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff274"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r3, 0x29, 0x37, &(0x7f0000000080)=ANY=[@ANYBLOB="02060000000000000401"], 0x40) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r3, &(0x7f0000001940)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 8m54.106984955s ago: executing program 0 (id=1910): r0 = socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r1, &(0x7f0000000100)=[{0x0}, {&(0x7f0000000300)="6bdffc", 0x3}], 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) r4 = syz_open_dev$vim2m(&(0x7f00000013c0), 0x8, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000040)={0x9, 0x2, 0x100, "9611ba5a0000000000000000e8f71313e9ffffffffeefff000", 0x56544943}) getsockname$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x96) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r6, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6, 0x5}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r6, 0x0) setsockopt$packet_fanout_data(r6, 0x107, 0x16, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x4, 0x7d, 0x3}]}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newlink={0x188, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_AF_SPEC={0x168, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @local}]}, @AF_INET={0x30, 0x2, 0x0, 0x1, {0x2c, 0x1, 0x0, 0x1, [{0x8, 0x16}, {0x8}, {0x8}, {0x8}, {0x8}]}}, @AF_INET={0x18, 0x2, 0x0, 0x1, {0x14, 0x1, 0x0, 0x1, [{0x8}, {0x8}]}}, @AF_INET6={0x40, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}]}, @AF_INET={0x28, 0x2, 0x0, 0x1, {0x24, 0x1, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}]}}, @AF_MPLS={0x4}, @AF_INET6={0x94, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00'}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_TOKEN={0x14, 0x7, @mcast2}, @IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00'}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x5}, @IFLA_INET6_ADDR_GEN_MODE={0x5}]}, @AF_MPLS={0x4}]}]}, 0x188}}, 0x4c0c0) 8m53.331089556s ago: executing program 0 (id=1913): r0 = epoll_create1(0x80000) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000700)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000100)={0x20000014}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x47, 0x5, 0x8, 0x5, 0x0, 0x9, 0x0, 0x57c73f3a, 0xfa11, 0xffffffff}, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) poll(&(0x7f0000000140)=[{0xffffffffffffffff, 0x2cfc08c20dafc34e}, {r0, 0xf102}], 0x2, 0x8000007) recvmmsg(0xffffffffffffffff, &(0x7f00000051c0)=[{{0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000240)=""/39, 0x27}], 0x1}, 0x40}], 0x1, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01010000000000000000020000000900020073797a320000000208000440000000000900010073797a30000000000800034000000008140000001100010000000000000000000000000ae6591b7edd10248f52f70320c0f7fa5bae98d903259d3131a3dcc63c59593a687bedb4626e202ea152d6fb9ddebb83a1107714bb840fe21b21ae8df58ba3baa67f26825b38e830270d263c9394b97730eab14f35663d8fba070129eebc8c"], 0x64}}, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r2, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) connect$l2tp6(r2, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r2, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) 8m52.489030968s ago: executing program 0 (id=1917): r0 = socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x40008001, 0x0, 0x6, 0x7, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$fb0(0xffffffffffffff9c, 0x0, 0x145cc2, 0x0) socket$kcm(0xa, 0x5, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002cbd7000fbdbdf2501000000100002800c000180080001944a0000000400018079"], 0x28}, 0x1, 0x0, 0x0, 0x20000080}, 0x2000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7ffffeff}]}) r5 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, 0xffffffffffffffff, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='net\x00') getdents64(r6, &(0x7f0000000380)=""/52, 0x34) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/power/disk', 0x141a82, 0x33) openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x200041, 0x0) write$vga_arbiter(r7, &(0x7f0000000000)=@unlock_all, 0xb) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x51f, 0x80, 0x7, 0x3ff}]}) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, 0x0, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001e61e410b1134200557b0102030109021b0001000000000904000001cf28fc000905822fe9"], 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x30, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x8}, [@IFLA_GROUP={0x8}, @IFLA_TXQLEN={0x8, 0xd, 0x1}]}, 0x30}}, 0x0) syz_emit_ethernet(0xcd, &(0x7f0000000440)={@random="5aea4f8cf78e", @broadcast, @val={@val={0x88a8, 0x7, 0x1}, {0x8100, 0x1, 0x1, 0x2}}, {@mpls_uc={0x8847, {[{0x2}, {0x101}, {0xfeb42}, {0xfff68}, {0x5}], @llc={@snap={0x1, 0x0, '/', "5048fb", 0x809b, "edea7dd559498ef2558ef7aa23ac7441f48fa7b474f3057c020d3b838559b32296f493ab8f591fb0f80dd590ddfe11a7564f18a1a2592fd06c414e9b3862770b032c214f2ceb67be42d638a4378b89fe89bbeabddd1869c264bb98dd1d591c42d3294f4f59de35d68348d8c4da808f734db878c735f0235b39203c2a52a1d411b714711ec3c50abe9559b22f5d32b02df23c5ab66b40f4988c93dc"}}}}}}, &(0x7f0000000180)={0x0, 0x4, [0x33f, 0x1cd, 0xe09, 0x27f]}) 8m49.74748212s ago: executing program 0 (id=1925): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x3, 0x3, @dev={0xfe, 0x80, '\x00', 0xd}, 0xf}, 0x1c) sendmmsg$unix(r1, &(0x7f0000007b80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2404c054}}], 0x1, 0x2000c080) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r3 = open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r4, 0x1, &(0x7f0000002380)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x6, r3, 0x0, 0x0, 0x67d0, 0x0, 0x0, r2}]) sendmsg$nl_xfrm(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)=@flushpolicy={0x1d0, 0x1d, 0x10, 0x70bd28, 0x25dfdbfe, "", [@replay_thresh={0x8, 0xb, 0x9}, @migrate={0x180, 0x11, [{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@private=0xa010101, @in=@remote, @in=@dev={0xac, 0x14, 0x14, 0x25}, 0xff, 0x2, 0x0, 0x3501, 0xa, 0xa}, {@in6=@dev={0xfe, 0x80, '\x00', 0xa}, @in6=@initdev={0xfe, 0x88, '\x00', 0x2, 0x0}, @in=@remote, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x32, 0x0, 0x0, 0x3507, 0xa, 0x2}, {@in=@local, @in=@multicast1, @in6=@local, @in6=@local, 0x81, 0x0, 0x0, 0x3502, 0x2, 0xa}, {@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@private=0xa010101, 0x2b, 0x2, 0x0, 0x34ff, 0x2, 0x2}, {@in=@local, @in6=@loopback, @in=@remote, @in=@broadcast, 0x32, 0x3, 0x0, 0x0, 0x2, 0x2}]}, @replay_val={0x10, 0xa, {0x70bd2c, 0x70bd2c, 0x80}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0xf7df}, @lastused={0xc, 0xf, 0x8}, @srcaddr={0x14, 0xd, @in=@remote}]}, 0x1d0}, 0x1, 0x0, 0x0, 0x20040000}, 0x40001) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x584}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 8m49.344242733s ago: executing program 32 (id=1925): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x3, 0x3, @dev={0xfe, 0x80, '\x00', 0xd}, 0xf}, 0x1c) sendmmsg$unix(r1, &(0x7f0000007b80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2404c054}}], 0x1, 0x2000c080) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r3 = open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r4, 0x1, &(0x7f0000002380)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x6, r3, 0x0, 0x0, 0x67d0, 0x0, 0x0, r2}]) sendmsg$nl_xfrm(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)=@flushpolicy={0x1d0, 0x1d, 0x10, 0x70bd28, 0x25dfdbfe, "", [@replay_thresh={0x8, 0xb, 0x9}, @migrate={0x180, 0x11, [{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@private=0xa010101, @in=@remote, @in=@dev={0xac, 0x14, 0x14, 0x25}, 0xff, 0x2, 0x0, 0x3501, 0xa, 0xa}, {@in6=@dev={0xfe, 0x80, '\x00', 0xa}, @in6=@initdev={0xfe, 0x88, '\x00', 0x2, 0x0}, @in=@remote, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x32, 0x0, 0x0, 0x3507, 0xa, 0x2}, {@in=@local, @in=@multicast1, @in6=@local, @in6=@local, 0x81, 0x0, 0x0, 0x3502, 0x2, 0xa}, {@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@private=0xa010101, 0x2b, 0x2, 0x0, 0x34ff, 0x2, 0x2}, {@in=@local, @in6=@loopback, @in=@remote, @in=@broadcast, 0x32, 0x3, 0x0, 0x0, 0x2, 0x2}]}, @replay_val={0x10, 0xa, {0x70bd2c, 0x70bd2c, 0x80}}, @XFRMA_SET_MARK_MASK={0x8, 0x1e, 0xf7df}, @lastused={0xc, 0xf, 0x8}, @srcaddr={0x14, 0xd, @in=@remote}]}, 0x1d0}, 0x1, 0x0, 0x0, 0x20040000}, 0x40001) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x584}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 16.844995314s ago: executing program 5 (id=3759): r0 = socket$packet(0x11, 0x2, 0x300) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000200)=[@acquire={0x40046305, 0xfffffffc}], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x4) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@handle={0x73682a85, 0x101}, @flat=@binder={0x73622a85, 0x100, 0x3, 0xf0}, @flat=@binder={0x73622a85, 0x0, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, 0x0, 0x40000) setsockopt$packet_rx_ring(r0, 0x107, 0x5, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x100e099, 0x0, 0x3, 0xb4}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xffffff73, 0x0, 0x4) ioctl$VIDIOC_QUERY_EXT_CTRL(0xffffffffffffffff, 0xc0445624, &(0x7f0000000300)={0xf0f000, 0x282, "9a555c14c966e134d198b9aaaa7da80f8e4fa888dece6ffdb507a3c83e58e128", 0x0, 0x100000000, 0xfffffffffdfff004, 0x0, 0x9, 0x5, 0x2, 0x2, [0x9, 0xf5, 0x0, 0xfffffffd]}) syz_io_uring_submit(r5, r6, &(0x7f0000000440)=@IORING_OP_SPLICE={0x1e, 0x1b, 0x0, @fd_index=0x5, 0x5, {}, 0xffff, 0xc, 0x1, {0x0, 0x0, r3}}) io_uring_enter(r4, 0x47f6, 0x0, 0x2, 0x0, 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000640)=@IORING_OP_ASYNC_CANCEL) 9.732328689s ago: executing program 5 (id=3780): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x118d7, 0x0, 0x0, &(0x7f00000002c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockname$inet(0xffffffffffffffff, 0x0, &(0x7f0000002280)) sched_setattr(0x0, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) unshare(0x62040200) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd0500070088000000060005"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) 9.593554301s ago: executing program 3 (id=3783): getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, &(0x7f0000000000), &(0x7f0000000040)=0x30) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = request_key(&(0x7f0000000340)='id_legacy\x00', &(0x7f0000000380)={'syz', 0x0}, 0x0, 0xfffffffffffffffe) request_key(&(0x7f00000001c0)='logon\x00', 0x0, 0x0, r2) r3 = socket(0x25, 0x3, 0x9a50) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8, 0x0, 0x6, 0xffffffffffffffff, 0xfffffe0001000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) fsetxattr$trusted_overlay_redirect(r3, &(0x7f0000000440), &(0x7f0000000480)='./file0\x00', 0x8, 0x1) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r5, 0x0, 0x0, 0x0, 0x0}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0xa0000, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x1cf2c2, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0100000007000013008000000100414bb0a6ca03a71fedb6000000100000feafe6915130499dfa06f9938e29ce46378b88bee3a3bca77780a38eadf440b9755ad663477722be2744182ae191559d9a7ee02a4e9d6640546a35717e37bdd7d4b1a09ac915e634be7cf67aa10fe7cb86f7ed2ac563ec4570ff0c0061f45da13c1ea85c46e7e8761b88d61420790ae47aa91a4771ba774866ce484133f8de6d3763b9e99458942cd7f6d6d1cbf8140647dd10a8e4ad92cddedf1cb43edece3813b146f4baeb6b6e59539d2566447a7bfdc5339bb9034966a26d83ec28f0094d149387cc4621b96d3632e9ca4f33f3ec3efa5ae1e0b884d7f97269906f0a1ee14e5b4287af2dfa52e523d69bbbbcbe7b9cfd8d1ab22c2406a1dbafadb7fe1be2aa4bb83f8ee8d2be6953d3c741e2d7511c754cc1063d04a1adbef069", @ANYRES32, @ANYBLOB="0200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r8, 0x0, 0x0}, 0x20) r9 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0xfffffffffff) ioctl$KVM_HYPERV_EVENTFD(r9, 0x400caed0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, 0x0) ioctl$IOMMU_HWPT_ALLOC$NONE(r4, 0x3b89, &(0x7f0000000000)={0x28, 0x2, r6, r5, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r4, 0x3b86, &(0x7f0000000040)={0x18, r5}) ioctl$FS_IOC_READ_VERITY_METADATA(r4, 0xc0286687, 0x0) socket$packet(0x11, 0x2, 0x300) 8.144863208s ago: executing program 4 (id=3786): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x82801, 0x0) write$sequencer(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="81040808f9ffffff94"], 0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, 0x0, 0x0) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r6, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010028bd70000000000008000000180001801400020073797a5f74756e0000000000000000001c00028018"], 0x48}}, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, &(0x7f0000000200)=0x3) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x2f, &(0x7f00000001c0)={&(0x7f0000000800)=ANY=[@ANYRES64=r8, @ANYRES16=r8, @ANYBLOB="ad03a2e9736dd3cc94299d6f60490aae6abeb9de7bd47c214821f724f720d2d4195c0401b6b66eda6675920609c284e544e26085aecde0424b61eae478a4041eb2f4302cbd8e2351101783f3e37f776c77fee42a5acdd4222dddb27b485835792af82a68eff98a0dbda834d1e947272aae0368f4e11c700e78f3292a5fd9f23ecb969203d6f0068fa15d6fe265f9e592025cfc24c328a8015033a12a66dd40545ddab188a060ccb76817f40d09ce84ab3e96ebc02f1ae4bb6fb379ff479c793e8037e48cb0f97c52e12b4975e2f4b02459928ad31d23fe970649d2451c5c684f54b3695d8e0d52e37baed533eb939f06a9ac2cb8fae0b8fd888fbfab63b2d95f3c23c8c2ef6bbcf4e24151c77679c122a686fa78d84921cbdbb089498e4e17fcf1a6c8838d01ce1159d6c99122f96a4504a8af35254cdbc0f7f6ebd1563d9f3ec120a701b92eb9d14ca7e895cccbcb1574c19f3e241d4e4ffab0afc6443e7418582c309090061a6aa0cdcf970433741b3594287d1b47c7d5020f7ed3704b944c6cec57f38382c4e2e99e06c6346823b9b39ef17bb4b8bf71ebca08f6e779d66715f87bb8613dced0f628b2d3a811edbd8dc0c4c0d62b6e6ac0821f81aa5d3ffc9f14b63ea5d29641918676327c092e5fd817b3d7580fce47644993cbc1a4c5be025986c8d38bfb03a28691f8e979786aa7ec26f9f7808b09e345c615b5295f124ba6962cda5769045da770cf4abdf8b8e0f1da40be80d06fb4dbf69315630a56490535ee4bc55a104242098d6ebe0f01b18bb1de7590bab96f6b42782f7f23b075236513f59ed9466e72d8607dd01560d629a31b49a8cba04a5f32a965a14a781817ab12abf8e9e278971f10104eecdfd7110bab640c27638c98f2c6b8d6088d783995de348a222d4b94158795f531d92fcd7105c164c40f44d3827e6b3887d5ade3cbaf0ad80acf896ebdeb765fe54d66f923d5863560fbada8a4fb2cdd8b17b5b728b4ba60382b13f45308c9d288ee000709975a16e10e34bbb1d60b6f48faf56a1b89c85f9e6fa4d32cf9c5a737c71aff7d49f17c8c4b3744b1f8d529ced6445874c65ac437f320d753d0e33ad59ea83766c647be12d8b7d7a7b86cc4fb79f0c57d8b3a3ad2b19afe51d988c68864e8d3d85312495d615a148825ead60e63b51ae93febc8733568459e2d0cce85cc5ca1db5ff4ad9b61d62d1e3c12573052849eeb9387059dade19c27a82327c4f1ff138f835ccdc4c59302e0ae5e274bde869f9598ad331e813a562914c0221c0d35286fba2a104a192336656cc43533f2f9d6ce2b347b3510b72c684f4a374dfb974d22f0cc5827047f38350229eb773d7a968ab4dca19f01c97c40a82fa0f9c1abde3544fb81363a3b91c8c4545e1ff4da57fb8d191ff9caad3a81e63e2f28fb99e7e5cf4287d08939acc913729c0e4cc096b8de87bf4d8373ea185a09c2e75b9608194bf1c82ef8763f58fd2d233674b25f750b99dd00a45f2d0924c19a23d391a39cd69b088236fb2ec9137e4d848abd6f9bacde0d4d00e8ec0d719f6240b550db14e0bf76d1567b2e5a54576ce1d172f3ceb6b65db1f80947fd69f90a1010435fdfaa1358745189d8303c0c2d7e0df63501da49b7dd06089c904f6c6d29fd6a377e0b2967ec8eed7dce5993e3d391309a3b64590357b88cfc96e33dda96091c9df218d4ff1b8070e9d6cef195b06612425fcee8b63ba09b9f48455016ca4f4f8642eec004042c99bb43f87e372d72fa41bc69ce1daf82cf51185db985374ec24c5dbcf1dd2e3d9e2fb9ed1ec504d6df6496efa74c5659f8f798407257e97546e36c3e14e8bbfa2b17e6443795d99d12bfbdd4ab2af441edc94722d0b611367bbcf6cf217aec355f110315930994193dad2d64353977270927278ebbb5159e8a3ab98d296b59854499e4e29b6d38850ec4a16ea5f76af12dceff3e8e2c0a8a08d8b91575c93669cfb0ff692df58400d6c1ea19e4e5090f4fdbb1b803949166e0cf881424a618381b91c27a257ad1de17537669d39c9d54d38babdb2719b02f330cf93012f4642ee6aa39a93a6d2d1aa80830791d71adfd1d9792f9f6b586b079a2c6bb9bac7ccea27c4da76c9cf451efe51fef21df853e82c3d0031a9b44639a6afce67a1937d3b934bddd93ed7830249077913726eee66a077e04246cc19c2301546348ce50d6922ef9c12cea95640bd09748dfb4e984776cbf15e43156857b4703b856e26530d3b58e9b80efabec8e774910ef1a449970e1f74244bb052d00237c6feb06c3b1d3d33a992bc902d5354219404d76eecc6f5cf3eea583c9ce8d280f9337d3efe03086cc2d61c5a1bde97de452f3756d9697d8d4c10451c816a472978522671b053d19ee3006871f4ed57c7c672271a70124280261dc663021ba2c3335e0a4f218832ee0024709ea222202c2b08dc3ec6e75e41433b34b7e717987b243d292c336d54ed49e2674c27de57b7d107279b3846b32ccb91495995e886df048570e6d72bb511c63e7ed2c75fdd6ce55ead1d2c3cf5018fab829f794ce16a94c9152a75fcf40d66f9ad5d3d3df83d03d1a846fec75db734ad8f739e5eb4ebf584ce4e08240ba643e4c12a351c737b1d2d605643481ec134821b73d6d39eb333aee1d58e2c929ce16084991e492971324bb4260bca86c13acf0153f49b9a1802d2908701ae456a02b837f20dc8e4bfcbbbe2c15dcaa78a99ce373fb1c79e04d06cde0aacca79bed67ca996a06c3d1d7cdbf9a8e242c64a8a9e51b26a9888e09a5d37bf6eb9a080b9ecf14eb3fe65c9ad82d4b9520e7826c6e2f5194f2fbdc183779c42dbb1e744d4228384b543264a19729dba212118706d733b7dba24d6e90a1b68bb1ce152dacf234e674b1b2fed7c3e4f56240fe662c447d971d6081f706e0494fffb86e09f95368e543a09dfe90c6bd3e4fc4f76139cc2520854d76a53e6ce996531169c282e0e6cc4828ca0a3de138d123624610be7fd991753ebbc31e2beb0dd81d693ec9a63599e862feb07c6b61dc03c3e9482ef382c9e5b4e6e7fa5bf30c19f2eaa12e409785794b1951e960e1128de886a36b855dda059b239203529d235ce9923814298c8e5f8993c3f03c21117a1aae9edd3223cfc76b2a3f40c3d3834b62f866fdd373e8f15beca2cf571cc14866488ef6b12198e37967f6efd2ac1c2cc6a7b3afce34d00e7d70e02e0cade65bc494f3355293f14eefc7caeac3fe45e0df2c00b70d5f5305b01fc9d6b2135d8cd5f7188f895865072edde534b867d70ee66fde69734d68ba3f6244a794a436bd749c823cad9ee656bd274f42625980742512cbff6041e79e6ac8f3b6b1e59c1bbe43357c9776802bd096bb5295efa544dfb46274a66d060772148a1909fdbdd0a86d813981d02d2eb678a7fc0dbd083bd303bfb8c8c8559dc538b62414e062f88ecd5eeb0637d06b6599d9aa3645c295cea2ebe2b897002bccd3d565da580157ddd5a58135e1cafb9875c7fdde5a79f443447db4e67bb5b459023d63fc06343ff3ce0c13eee8b231abfc6dd0f8608ddc2cbce9ba7a30427472c464b1adfec2f9d63f5050924130ed885ebde6fcec57b3025f825b00ebfef811c19f97a95d8c690d44d4a99d2985fd8e3f296fa92e0a4927de03b75f9e44a5ee8a77be6103fdf7f568dc4d98c4e15bb61c7a7b2059d2f2dce9eac465e5e93a8821c9e66c3efb9386ad19a333171c8aecd959956c3d966b30ecf027b17dea31ddcf6d7f378a52e64246e0a6f23d8a6788691b6b6358fd763fb266d4a26714cdcbb5096eba4c0dcd32343d8cdde94da2136b77220eaa33736151503ed2d380f9356fd6bae2086925dbdf616abc490c3fe790f20150e7301fc11c9e4cb6cfca2cf949f1325fbb5e3cde8b727037b0616a9a40fd9956081f262994fc4caa7462fd4bfce6ceb20bee7563cf276e175535de9804c8b74fd15bab8b0f537adc21a0ba814b4ff9070d667261a13db47ed0b26a235101626b2ca9ee617442a81d851ae1e9310f808b6b767092b6d5b4d9f781be0de47a4a6b7e2fc49fa818aa8168d35fcb964b862907b49686cf1f3c575733d902530b8de4b11fdbbf86642703861dcca9b6af0ba8caca6c63497c79801785190ec30425e60e99385521af54f45af8cacacd11af1099167213c1ee137288bdd1f51bf86cc73ac132e0fe349dcdc488b86b07212808aac6f2b797cee7b452fe5190f1c16ca9874c48d93d5407d8c3507f5371a9fbff0eb8d98c4256201ce4fd80a5a146fff068f731409e433b398d4e26a25165117ab800aef4878002847bdfc79624a71c1374a0bc174eb2e006188001b26e69a20f512838813190885ba61d392f48492e548102aab7de56232f34840b6c60b4fd699f6b9cbc6e873091d0b6c6de560108e11847a22d7b7150e41b6cf483719628482e780603eff8aaebb1555bbd887c477380bbb6f6082a1f27564f459aa1eab5eb711b2c1f943002508983ac0cd325593ab214f14b6600db17c5bc73a486826529e4068ea0316e4819d6b5aee644493209e28bf25bfd8554f85cc346f3bf0164aac3cd47dffaa267b5e94f7491c59c8e669f16f6dfa7be80659f84dc20fd70f9f7fb6e8f8fb9e44645632ad9e96fdd0d54fc85f78bf217f88730b2c935ae0f004bfd3529657e2a212487306291197473bcad2c62ff45c653d5047515366dde89247c997c9c79b96e2a12586892a46fba8a3f70ea54207d475725d21782217ba8e9b2bee035294f8dd4909e1f4c69fa0b0588c69531b8ba32a4f3ce01c2c424b313cf8daa7255ea89a519fa05f84c28e6f9a3d904165669d4cc8c6cd6a60d828454daf31c5833bca9efdac072969c0455e2945f7da0623d4e876b6a6ddd1b54b1c4b023a6a8201adad39984c9581ed0ede458a9a537b8dbf0b0ec35804432cb723abd7912c17a3addab2c35c599ff4ce615ca9f8dce4421a5eed3b6f92a41d14458300c79405c203f97eab9929f242357079034c3b03f0dd9a13d2ef4a7fa1feda76a6e98b97a0689804501a7e42e1bd73b0c301628991cf8e5ac409c69b2427c1d82a0e3face2c7ba5d4550506f8da881171c573baf18191317b92acd93ba06ec94319fd2cab40992c55a678b8c9206b10e0e3ff7e7965891b22b64070b17b74c40636ba1cb2bb3eae84ba65266ae13828b48ca5f92435f0a2261bac7362ef373722dc5b35a7dec57be9c59b1fef3bd6065684aafbae57ecdd74e52dd34a9a6df54e311ceb2892ce1f3e3148c3de2335c90c5250221970fff5408d083bef46191c5c5fac952f63c7a20648f309c1793ff3f5746f1aeb996234fb71d06784b4385730f6bf22ff46722f727fc2cc509a0bf76d2257df41383804545e5d19228a4c3b0e1ed5f51e8726af57ec1539f02d28cf325cc9963fceffe6448cf566e592c59a08540f10ca01d1e23521d2610540a81c3479808ab94e911a29b0760276f1d1847f00552c9e38c6f45c547b1bb649f46b4e3ba5ef43a3c8c9de1edc27c7c96c68460a487da99b89104b844859e4243722f1693600e20591432399f1d305f306b5c230281fb2935f03fa8ead51e31c7977a80c317bb2ef36eb4e0048bc9a982488c437bad44a3c2b7c7b933296ce56a0f6bbe362d4a55b37c1ed40f40de892370457b7c5a60ca31519ef46855463d53fbdf6607502ff0430540eddee008c45cd19e611cca3d795893cf46d076d6cda97ccb6ad97215f4ecedd9adf5cde20015fbb1b14cb77fa1b0cd1891db77bea0f6fa5e4b3558ed10f3813e5d83047", @ANYRESDEC=0x0, @ANYRESDEC=r1], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4000) readv(r8, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, 0x0, 0x0) sendmsg$nl_route(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="240000002100df4c2abd70c6270000220000e900104e88cb7634ce58ea220000"], 0x24}, 0x1, 0x0, 0x0, 0x24000014}, 0x0) r10 = syz_open_dev$vim2m(&(0x7f0000000100), 0xa7e, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r10, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r10, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x2000, 0x3, 0x4, 0x0, 0xd, {0x0, 0x2710}, {0x0, 0x0, 0x0, 0x3d, 0x0, 0x0, "a730ba01"}, 0x0, 0x1, {0x0}}) ioctl$vim2m_VIDIOC_STREAMOFF(r10, 0x40045612, &(0x7f0000000000)=0x1) 7.667766963s ago: executing program 3 (id=3787): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000340)='G', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000004c0)='illinois', 0x8) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="002205007a24a0f291df7a3ec383d9525b9a66be00ff9a04000000"], 0x0}, 0x0) shutdown(r0, 0x1) 7.538107384s ago: executing program 5 (id=3788): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000740)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300042e010203010902120001000000000904"], 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000000000)=ANY=[@ANYRESOCT=r1], 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = eventfd(0x0) ioctl$VHOST_SET_VRING_CALL(r2, 0x4008af21, &(0x7f0000000780)={0x1, r3}) close_range(r2, r3, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000840)={0x84, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r1, 0x0, &(0x7f00000004c0)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.856577554s ago: executing program 4 (id=3791): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000004102, 0x0) r1 = syz_io_uring_setup(0x43, &(0x7f0000000440)={0x0, 0x74c2, 0x1, 0x1, 0x1a4, 0x0, r0}, &(0x7f00000004c0)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0xc000000, &(0x7f00000002c0)=[{&(0x7f0000001600)=""/4096, 0x1000}, {0x0}], 0x2, 0x12}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) io_uring_enter(r1, 0x1d2d, 0x8890, 0x0, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000500)={0x2, 0x0, @pic={0xd, 0x1, 0x1, 0x3, 0xe, 0x1, 0x6d, 0xf2, 0x8, 0x7, 0x6d, 0xfe, 0x0, 0x6, 0x1, 0x9}}) r4 = syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000e09d7040460a2196324f01020301090224000100000000090400000206d3450009050102100000000009058b0240"], 0x0) syz_usb_control_io$printer(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000b00)={0x2c, &(0x7f0000000500)=ANY=[@ANYBLOB="400c15"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r4, 0x0, &(0x7f0000000340)={0x34, &(0x7f0000000140)=ANY=[@ANYBLOB="40144300000001"], 0x0, 0x0, 0x0, 0x0, 0x0}) 5.911585018s ago: executing program 1 (id=3792): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x64, r4, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @multicast2}}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x64}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r2, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x82000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x78, r4, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x4}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0xa5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2={0xfc, 0x2, '\x00', 0x1}}]}, 0x78}, 0x1, 0x0, 0x0, 0x1}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e00000000000000000008000a00", @ANYRES32=r5], 0x3c}}, 0x8000) 5.657455567s ago: executing program 1 (id=3793): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'vcan0\x00', 0x400}) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ptrace(0x10, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) syz_open_procfs$namespace(0x0, &(0x7f0000000400)='ns/net\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$netlink(0x10, 0x3, 0x0) socket$inet6(0xa, 0x3, 0x8) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r1], 0x38}}, 0x10) 5.57936997s ago: executing program 1 (id=3795): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) socket$pppoe(0x18, 0x1, 0x0) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010100000000000000002b00000008000300", @ANYRES32=r2, @ANYBLOB="050034006e00000004002a0009ffcbc822b7b1cfdcfcc4832b137422b6f5dc0265093385131fa32f48e2db32d8195ef363eb90887ee7de124ddb1ca0ca52ca9de7a31011a0a3b3ab434c3ca426bddf947f99c059ad7a25f0426390983435296d7ad464967496fc12f5a93980c745ec05bd780e7b1704df8f6b6aa83b7f14b6a42d5f473d95c66c19173857fdd3c867b0cb4931e6c133a3e97c5248d4f752e0ead7c17558f411afc9875408406f46a1819b68c350a1c3040ac1f5e7fff1e28e822f83c95f51f1b049a3dc06f99bc29ea1c959619824fa235c48fdd4a3b98594a90ec718dffdb46c39c85b9b5512953aff22ae238126a5a9a8af1abc21e121eee94852f2148df4e85e088c5cc741e5aa66e5569eb46d6ba601c27a87bb93832600fa40ae5c1b67305cdd58e4c3b5e7fe2938fc301c72e2fa7b13a60ad2"], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x20004800) sendmsg$NL80211_CMD_UPDATE_FT_IES(r0, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1804000a", @ANYRES16=r1, @ANYBLOB="10002cbd7000fcdbdf256000000033012a0072060303030303037516010004002600772362735174dadb84c3f0332f1ca836dd6e2c24a81937d68b613eee79c0cb61e6c2f1e634fbcb06b418eb6e2fc9c9f4e91b3d88e791fa917ff4bb4524b947daa93b85f30ca2fe88e2acab974b5d5cc5c2e6ed68a126a4b82de80a2e2d6b6f23f6a83f3bfcad126fb5263b8cf7856ff0bf1136893c947663beec94bb4dad3ea67504000009003c0401a0700275060000018022002675bd0302903d09e894167f3d1b848780a13e3807fd83104a08a1d30d506e6a695c20920f3d728b1544dbfea0b18e45602210e4bb20cb99cb1ee8548868654615b05a651240c320bb0fe00f0c2883da7e7e446f62d9f6c6c36735aeef970025d3f7283c27b104f401a832e97cc784add585910c90fcb96512b7a4fe7736350802110000000802110000000026012a003e010337000f080756b5171d1a7ab4f2ba1f772d068d85c99bb5e970dd48e1dab2e5646bf8c4a0789264c8b18fb5d94d4a0c2189ba2960a0a1f520e6088997fd71e3a6bc54405fbbea505df2b314ea86a90e465fd7846e0121fd4a8e5f9531959189722b231cbcdddb3288bee9248f2d25f370ba760518b1886104073621db6919eab70314432a0fcca3a282f092458cb49f5f11d2aa214521041a78fa0e545e1a237a36b6c12d25fdc20c9411b18c7bd3bbca8f64011983c3a4bdb9e2932724f8e7045d04d7941bb90f85ffd34c34fd040a3959ff5cd0109b11ed9a0212e7e36e9e0ef7a75fbf001f041b68a7ed55fd03134ea47037c3efc18d7375a242ef70b0d9b7a2336512989d60210436080211000001ffffffffffff0301003c040148a90000000600b100000000000600b1000100000036002a0004060d100080950e3c040136a10503010a831f001b0908021100000006000000b910000001000080ffffffffffffff030000000075002a006512505050505050080211000000ffffffffffff3e01007e150e0104080211000000ffffffff5afe5302ffffff7f823b04af0404000000ffffffffffffff010000070000000800000003040802110000010400000001ffffffffffff080000000108021100000104000000680409007f000000000600b100090000004f002a00dd49ffcd494aff28872dd0d093560a203c96cd663f51cfa852f0a5b7ac7a3604a10265a16fb51b435db65eca747ee11f36b360664a0341ef80223787fb54f23f8fd497ecc2d7636d55f7b1000600b1004b19000087002a002503000a8e2503000208751600003d000000230df0c263751379bac1922daeed1c86bd060802110000019f57d3baa99c57029a82cb95fae501fd830d64616d18c8cf040069e646351ad05e713981819b33a4006fb1cbced1bda23fd9dff976c026e8c81ab148e4aedf5ff919597d739242ce6943948d9c7c0438c65a954a4ab01e9e8c00"], 0x418}, 0x1, 0x0, 0x0, 0x404c880}, 0x1) 5.464736428s ago: executing program 1 (id=3796): getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, &(0x7f0000000000), &(0x7f0000000040)=0x30) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = request_key(&(0x7f0000000340)='id_legacy\x00', &(0x7f0000000380)={'syz', 0x0}, 0x0, 0xfffffffffffffffe) request_key(&(0x7f00000001c0)='logon\x00', 0x0, 0x0, r2) r3 = socket(0x25, 0x3, 0x9a50) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8, 0x0, 0x6, 0xffffffffffffffff, 0xfffffe0001000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) fsetxattr$trusted_overlay_redirect(r3, &(0x7f0000000440), &(0x7f0000000480)='./file0\x00', 0x8, 0x1) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r5, 0x0, 0x0, 0x0, 0x0}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0xa0000, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x1cf2c2, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x1, 0x7, 0x8000, 0x1, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r8, 0x0, 0x0}, 0x20) r9 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0xfffffffffff) ioctl$KVM_HYPERV_EVENTFD(r9, 0x400caed0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, 0x0) ioctl$IOMMU_HWPT_ALLOC$NONE(r4, 0x3b89, &(0x7f0000000000)={0x28, 0x7ffffffe, r6, r5, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r4, 0x3b86, &(0x7f0000000040)={0x18, r5}) ioctl$FS_IOC_READ_VERITY_METADATA(r4, 0xc0286687, 0x0) socket$packet(0x11, 0x2, 0x300) 4.913430716s ago: executing program 5 (id=3798): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000900)=ANY=[@ANYBLOB="140000003600010000000000ffdbdf250400008054d94af72fa040fe71178f5004951fe40818b2904e6c9501000000df866000a2491dafed9276a172ce1b76760b2652b021492276e6b86b8fdd5304b1782f6185d961dcedf27d0ae1c3d5afe5581bc3c224dd1903878934fc442a99725478751a0f09244879a3097075a0ec4b190426d5b7ea2586d061af84344f868c3f10d033c5e4632a207b190e50003d09b6db7bfe581932a3870463a47813248c06c7cc62ed8b3c50858522684ea7cd041be4289ed4a5260ad1f5091702dd020ec973b36546819fdfef5e14a289dca6a6f1b6057ec7a3732cdd4dba4e09838c747fab7ed27c8a822aea6d1746e2ac10b24f01dadf41be2b1dbbd1d14d003835b34bdb052ad441263752e6e8924ee2c14827b505bdbe27b28ee6aa1fa13c049030b52021ba89b28f7fb711692a73b2c7e12856be5f7b1c677da79ae1ebbc6b30ffa4f5a2d41bfd805a3ea8ec4a9326436469341987333451563112cdb54165b4208829d6f5fbc5"], 0x14}], 0x1}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000000020605000000000000000000000000030c000300686173683a6970000900020073797a320000000005000400000000000500050002000000050001000600000014000780080006400000000208000c"], 0x58}}, 0x20000000) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000080), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd502"], 0x7c}, 0x1, 0x0, 0x0, 0x8840}, 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) write(r2, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e0000000000000008000f0001000000", 0x24) 4.459886183s ago: executing program 3 (id=3799): socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000380)={'gretap0\x00'}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000b32000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000001c0)=0x40) timer_create(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) timer_delete(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x5, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) socket$kcm(0x2b, 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000e40)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0x340, 0x0, 0x0, 0x1a0, 0x270, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@private0, @private1, [], [], 'veth1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@private1, @loopback, [], [], 'tunl0\x00', 'bridge_slave_1\x00', {}, {0xff}}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x340}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r3, 0x80845663, &(0x7f00000004c0)) madvise(&(0x7f0000735000/0x1000)=nil, 0x1000, 0x65) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="640000000206050000000000000000000000000014000780080011408000000005001500030000000500010006000000050005000200000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574000000002d345d0cbfb92006a12874a9bf94cf262a39856a5938d059c36506ca0a66293f6d591988cb96cfc37dce50d800aa0949ee21a7375da3171c0dfeedb2a3c65c397c865bb91d9439303c08dbceb5d4659fa892388fc86b00ca1507cb073805668f826654462fc7d6f33e2c5facbd0a125cffffafdd16bc10c9bc26e22e9c3b4642654aaa29cadfbcc3d7572d0aa760c4101c4aacfe3686ac0480710c4315b420288d3b707901b6d24020bdd29441fb6310776a63c93dbda8d2e21fec24a8d70e65ca8ca5"], 0x64}}, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40001, 0x0) ioctl$BLKZEROOUT(r5, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) 4.218272899s ago: executing program 5 (id=3800): timerfd_create(0x0, 0x800) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x0, 0x7fff0000}]}) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/vmallocinfo\x00', 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000800)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x5}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000004a40)=@newtfilter={0x68, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_flow={{0x9}, {0x38, 0x2, [@TCA_FLOW_EMATCHES={0x34, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xae35}}, @TCA_EMATCH_TREE_LIST={0x28, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x8, 0x7, 0x2}, {{0x2, 0x1, 0x1}, {0x0, 0x1, 0x0, 0x1}}}}, @TCF_EM_IPSET={0x10, 0x2, 0x0, 0x0, {{0xfff7, 0x8, 0x4}, {0x35ae, 0x2, 0x6}}}]}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r5, 0x3ba0, &(0x7f0000000100)={0x48, 0x1, r6, 0x0, 0x0, 0x3}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r5, 0x3ba0, &(0x7f0000000740)={0x48, 0x2, r6, 0x0, 0x0, 0x0, 0x0}) r8 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r8, &(0x7f0000000880)=[{&(0x7f0000000440)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000180)="03", 0x1}], 0x1}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r8, 0x84, 0x66, &(0x7f0000000480)={0x0, 0xffffffff}, &(0x7f0000000500)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000007c0)={r9, 0x0, 0xffffb9cb, 0x9, 0x9, 0x40, 0x9, 0x1, {r9, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x24}}}, 0x7, 0x0, 0x800, 0x7, 0x9}}, &(0x7f0000000700)=0xb0) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000a00)={r10, 0xa, 0x6, 0x9a8, 0x9}, &(0x7f0000000a40)=0x14) sendmmsg$inet_sctp(r8, &(0x7f0000000b40)=[{&(0x7f0000000400)=@in6={0xa, 0x4e22, 0x419, @empty, 0x6}, 0x1c, &(0x7f0000000400), 0x0, &(0x7f0000000540)=[@init={0x18, 0x84, 0x0, {0x6fc, 0x7, 0x8, 0x4}}, @sndrcv={0x30, 0x84, 0x1, {0xf3c8, 0x2, 0x20d, 0x1, 0xfea, 0x1, 0x9, 0x80000001, r9}}], 0x48, 0x8001}, {&(0x7f00000005c0)=@in6={0xa, 0x4e21, 0x8001, @private2, 0x1bd}, 0x1c, &(0x7f00000006c0)=[{&(0x7f0000000600)="4b1bd8440f3927b190d843ff6321b161e6874de665e5a23b9acf6c", 0x1b}, {&(0x7f0000000640)="8293bb48edf248fb5d6d61fda710236f17e908f394390e74ee4581d5f23220a6e0db1d5a2b15119c30621bd3b1ebafbe9dec2071b443", 0x36}, {&(0x7f0000000680)="b6458f50dc88eb198e4a9b9b3c9f300e56a87ef11e02774febaeb38ea85210b1c276b732b0cb8e", 0x27}], 0x3, &(0x7f00000008c0)=ANY=[@ANYBLOB="18000000000000008400000005000000200000000b00000030000000000000008400000001000000ff030a0005000000400000000d000000ff0300000200000002000000", @ANYRES32=r10, @ANYBLOB="18000000000000008402000000fbffff0800000000000000"], 0x60, 0x4}, {&(0x7f0000000940)=@in6={0xa, 0x4e20, 0x3, @private0, 0x7ff}, 0x1c, &(0x7f00000009c0)=[{&(0x7f0000000980)="a047da7e7566e0", 0x7}], 0x1, &(0x7f0000000a80)=[@dstaddrv6={0x20, 0x84, 0x8, @loopback}, @dstaddrv6={0x20, 0x84, 0x8, @private2={0xfc, 0x2, '\x00', 0x1}}, @sndinfo={0x20, 0x84, 0x2, {0xfffb, 0x8001, 0x6, 0x2, r11}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x6}}, @init={0x18, 0x84, 0x0, {0x5, 0x7fff, 0xa, 0x800}}], 0x90, 0x800}], 0x3, 0x0) lseek(r0, 0x90000000000002, 0x0) r12 = io_uring_setup(0x529f, &(0x7f0000000040)={0x0, 0x5ace, 0x400, 0x3, 0x8}) r13 = syz_io_uring_setup(0xbdc, &(0x7f00000000c0)={0x0, 0xbc62, 0x20, 0xfffffffd, 0x338, 0x0, r12}, &(0x7f0000000200)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r14, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) r18 = io_uring_register$IORING_REGISTER_PERSONALITY(r13, 0x9, 0x0, 0x0) syz_io_uring_submit(r14, r15, &(0x7f0000000380)=@IORING_OP_LINK_TIMEOUT={0xf, 0x36, 0x0, 0x0, 0x0, &(0x7f0000000340)={r16, r17+10000000}, 0x1, 0x0, 0x0, {0x0, r18}}) ioctl$IOMMU_GET_HW_INFO(r5, 0x3b8a, &(0x7f0000000000)={0x28, 0x0, r7, 0x5b, &(0x7f0000000240)=""/91}) io_uring_enter(r13, 0x847ba, 0x0, 0xe, 0x0, 0x0) 4.217764319s ago: executing program 4 (id=3801): accept(0xffffffffffffffff, &(0x7f0000000140)=@in={0x2, 0x0, @remote}, &(0x7f0000000000)=0x80) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) ioctl$VIDIOC_S_STD(0xffffffffffffffff, 0x40085618, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x4089d}, 0xc010) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) r4 = accept4(r3, 0x0, 0x0, 0x800) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000000000)='./file0\x00', 0x8, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x20000023896) ioctl$TCXONC(r5, 0x540a, 0x0) recvmmsg$unix(r4, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) 4.157943029s ago: executing program 1 (id=3802): openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x0, 0x0, 0x0, 0x4, 0x0, 0x806, 0x5, 0xffffffff}, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000040)={0x28, 0x1, 0x0, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000, 0xfffffffffffffffc}) r3 = socket$tipc(0x1e, 0x2, 0x0) getpeername$tipc(r3, &(0x7f0000000080)=@name, &(0x7f0000000180)=0x10) r4 = open(&(0x7f0000000040)='.\x00', 0x0, 0x6c) fcntl$notify(r4, 0x402, 0x5) r5 = openat(0xffffffffffffff9c, 0x0, 0x103a42, 0x32) ftruncate(r3, 0x5fffffc) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x30000, 0x0, 0x1ffffd, 0x0, 0x334e8b}) ioctl$IOMMU_IOAS_UNMAP$ALL(r2, 0x3b86, &(0x7f00000012c0)={0x18}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r4, 0x84009422, &(0x7f0000000680)={0x0, 0x0, {0x0, @struct}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) fsopen(0x0, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x2e, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa000000000000080046000020000000000011fe78ac1414ffac141416008903bc0000000000089078"], 0x0) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x1050) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) r6 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) r7 = ioctl$LOOP_CTL_GET_FREE(r6, 0x4c82) r8 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r8, 0x0, 0x80, &(0x7f0000000600)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000000000000000000031aa00000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000000000000000000000000000000000000000000000000000000000000000000000002abf00000000fcffffff000000002929ecf3421fa7456aa6107dffad51d4acd6a6dffe57293ec825901987fcfef4eee1a90c77580ddab2040cf729"]}, 0x135) ioctl$LOOP_CTL_REMOVE(r6, 0x4c81, r7) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 3.336882747s ago: executing program 2 (id=3803): ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xffffffffffffffff}}, './file0\x00'}) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newqdisc={0x24, 0x24, 0x8, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x5}, {0xffff, 0xffff}, {0xfff3, 0x6}}}, 0x24}}, 0x8040) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001000000140007000000000000000005000000000000000108000f"], 0x74}}, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) ioctl$BLKDISCARD(r1, 0x1277, &(0x7f0000000100)=0x3) syz_open_dev$sndctrl(&(0x7f00000000c0), 0x0, 0x500) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) pwrite64(r6, 0x0, 0x0, 0xd) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r5, {0xc, 0xc}, {0xffff, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@local, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private2}, 0x0, @in6=@ipv4={""/10, ""/2, @private}}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@loopback, @in6=@mcast1, 0x4e24, 0x0, 0x4e24, 0x3, 0xa, 0x20, 0x20, 0x62, r5, r7}, {0x9488, 0x8001, 0x2, 0x16, 0x5, 0x735, 0x7fffffff, 0x5}, {0xffffffffffff0001, 0x9, 0x36fbf541, 0x2}, 0xb8, 0x6e6bb7, 0x2, 0x0, 0x1, 0x3}, {{@in6=@private1, 0x4d3, 0x3c}, 0xa, @in=@rand_addr=0x64010102, 0x0, 0x1, 0x0, 0x6, 0x8, 0x9, 0x1}}, 0xe8) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x80180, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0x10000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(r9, 0xc018aec0, &(0x7f00000000c0)={0x1}) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x2000, @fd, 0xb1a9, 0xd, 0xfffffff8, 0xd, 0x1, {0x1, r10}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) io_uring_enter(0xffffffffffffffff, 0x7277, 0x0, 0x28, 0x0, 0x0) syz_open_dev$cec(&(0x7f0000000180), 0x0, 0x40) 2.886849341s ago: executing program 5 (id=3804): r0 = socket$packet(0x11, 0x2, 0x300) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000200)=[@acquire={0x40046305, 0xfffffffc}], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x4) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@handle={0x73682a85, 0x101}, @flat=@binder={0x73622a85, 0x100, 0x3, 0xf0}, @flat=@binder={0x73622a85, 0x0, 0x3}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, 0x0, 0x40000) setsockopt$packet_rx_ring(r0, 0x107, 0x5, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x100e099, 0x0, 0x3, 0xb4}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xffffff73, 0x0, 0x4) ioctl$VIDIOC_QUERY_EXT_CTRL(0xffffffffffffffff, 0xc0445624, &(0x7f0000000300)={0xf0f000, 0x282, "9a555c14c966e134d198b9aaaa7da80f8e4fa888dece6ffdb507a3c83e58e128", 0x0, 0x100000000, 0xfffffffffdfff004, 0x0, 0x9, 0x5, 0x2, 0x2, [0x9, 0xf5, 0x0, 0xfffffffd]}) syz_io_uring_submit(r7, r8, &(0x7f0000000440)=@IORING_OP_SPLICE={0x1e, 0x1b, 0x0, @fd_index=0x5, 0x5, {}, 0xffff, 0xc, 0x1, {0x0, 0x0, r3}}) io_uring_enter(r6, 0x47f6, 0x0, 0x2, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000640)=@IORING_OP_ASYNC_CANCEL) 2.83781772s ago: executing program 2 (id=3805): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) socket$unix(0x1, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x33e000, 0x1000}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r6, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r6, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000340)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, &(0x7f0000000300)=0x41, 0x4) bind$xdp(r6, &(0x7f0000000100)={0x2c, 0x0, r8}, 0x10) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="1100000002000000", @ANYRES32, @ANYRES32], 0x20) bind$xdp(r0, &(0x7f0000000240)={0x2c, 0x1, r2, 0x0, r6}, 0x60) 2.408144713s ago: executing program 3 (id=3806): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x8, 0x1, 0x40024e}, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_setup(0x10a, &(0x7f0000000680)={0x0, 0x80334c, 0x10, 0x3, 0x3d3, 0x0, r1}, &(0x7f0000000200)=0x0, &(0x7f0000000300)) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r4, 0x0) syz_io_uring_submit(r3, r2, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x60, 0x185100, 0x23456}) io_uring_enter(r1, 0x627, 0xc1040000, 0x43, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x7, 0x4) 2.245658705s ago: executing program 4 (id=3807): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x0) 2.105415995s ago: executing program 3 (id=3808): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'team_slave_0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r8 = syz_io_uring_setup(0x10d2, &(0x7f0000000540)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f0000000600)=0x0, &(0x7f00000005c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r9, r10, &(0x7f0000000140)=@IORING_OP_SEND={0x1a, 0x11, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x8014}) io_uring_enter(r8, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r11) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r13, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r12, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r13, {0x0, 0xd}, {0xffff, 0xb}, {0x7, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x11}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r14, 0x33}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="b8a626319f48ffc54553d60508b9ffad733c6e10766de5a66531a7d74eb6818291aa44ff3a4f742a", 0x28}], 0x1}, 0x404481c) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f0000000200)=0xc) sched_setscheduler(r15, 0x1, &(0x7f0000000280)=0x80) 2.097706683s ago: executing program 1 (id=3809): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000340)='G', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000004c0)='illinois', 0x8) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="002205007a24a0f291df7a3ec383d9525b9a66be00ff9a04000000"], 0x0}, 0x0) shutdown(r0, 0x1) 2.027772511s ago: executing program 4 (id=3810): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000cc0)=ANY=[@ANYBLOB="12010000773604202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000180), r1) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r2, 0x1, 0x70bd28, 0x25dffbfb, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x33}]}, 0x24}, 0x1, 0x0, 0x0, 0x40050}, 0xc4) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000080)={0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="20052a0000007b"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x36, &(0x7f0000000cc0)=ANY=[@ANYBLOB="12010000773604202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000180), r1) (async) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r2, 0x1, 0x70bd28, 0x25dffbfb, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x33}]}, 0x24}, 0x1, 0x0, 0x0, 0x40050}, 0xc4) (async) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000080)={0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="20052a0000007b"], 0x0, 0x0, 0x0, 0x0, 0x0}) (async) 1.017363756s ago: executing program 2 (id=3811): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000900)=ANY=[@ANYBLOB="140000003600010000000000ffdbdf250400008054d94af72fa040fe71178f5004951fe40818b2904e6c9501000000df866000a2491dafed9276a172ce1b76760b2652b021492276e6b86b8fdd5304b1782f6185d961dcedf27d0ae1c3d5afe5581bc3c224dd1903878934fc442a99725478751a0f09244879a3097075a0ec4b190426d5b7ea2586d061af84344f868c3f10d033c5e4632a207b190e50003d09b6db7bfe581932a3870463a47813248c06c7cc62ed8b3c50858522684ea7cd041be4289ed4a5260ad1f5091702dd020ec973b36546819fdfef5e14a289dca6a6f1b6057ec7a3732cdd4dba4e09838c747fab7ed27c8a822aea6d1746e2ac10b24f01dadf41be2b1dbbd1d14d003835b34bdb052ad441263752e6e8924ee2c14827b505bdbe27b28ee6aa1fa13c049030b52021ba89b28f7fb711692a73b2c7e12856be5f7b1c677da79ae1ebbc6b30ffa4f5a2d41bfd805a3ea8ec4a9326436469341987333451563112cdb54165b4208829d6f5fbc5"], 0x14}], 0x1}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000000020605000000000000000000000000030c000300686173683a6970000900020073797a320000000005000400000000000500050002000000050001000600000014000780080006400000000208000c"], 0x58}}, 0x20000000) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000080), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd502"], 0x7c}, 0x1, 0x0, 0x0, 0x8840}, 0x0) write(r2, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e0000000000000008000f0001000000", 0x24) 784.355053ms ago: executing program 2 (id=3812): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xe) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x66) ioctl$TIOCSSOFTCAR(r1, 0x541a, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) inotify_init() sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x4c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {0x1}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x4c}}, 0x0) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x300, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x8, 0x2, 0xfffffffd}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20004000}, 0x4008010) 650.970997ms ago: executing program 2 (id=3813): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x80c80, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) connect$can_j1939(r2, &(0x7f0000000000)={0x1d, r4, 0x2, {0x0, 0x0, 0x4}, 0xfd}, 0x18) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000800)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x5}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000004a40)=@newtfilter={0x68, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_flow={{0x9}, {0x38, 0x2, [@TCA_FLOW_EMATCHES={0x34, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xae35}}, @TCA_EMATCH_TREE_LIST={0x28, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x8, 0x7, 0x2}, {{0x2, 0x1, 0x1}, {0x0, 0x1, 0x0, 0x1}}}}, @TCF_EM_IPSET={0x10, 0x2, 0x0, 0x0, {{0xfff7, 0x8, 0x4}, {0x35ae, 0x2, 0x6}}}]}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x64) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) 500.917936ms ago: executing program 3 (id=3814): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @empty, 0x5}, 0x1c) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3", 0x5) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x800) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, &(0x7f0000000480)={0x2, 'macvlan1\x00', 0x3}, 0x18) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) syz_usb_connect$cdc_ecm(0x1, 0x4d, &(0x7f0000000400)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x2, 0xc73ebdfa468265f4, 0x7}}]}}, &(0x7f0000000940)={0x0, 0x0, 0xf, &(0x7f0000000080)=ANY=[@ANYBLOB="050f0f00010a1003"], 0x1, [{0x0, 0x0}]}) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x16, &(0x7f0000000280)=ANY=[@ANYBLOB="7912b8000000000061138c0000000000bf2000000000000015000000080063033d030100000000009500003a000000006916000000000000bf6700000000000066060500fcff03006706000002000000760300000ee60060bf050000000000003c6500bf000000006507f9ff01000000070700004cdfffff1e75040000000000bf54000000000000070400000400f9ffad43010000000000d5000000000000000500000000000000950000000000000032410000000000000054bb12dc8c27df8ecfc7bdd2d17f2f1754558f22dd399703d6c4f6f3be0b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bdb94a05000000c6c60bf7a13ba1fcf1111ce4fc0d742a81762bab8395fa64810b5b40d893ea8fe0ffffff7f1b546cad3f1d5af65706fd4f68795cce6cf16ab689b555202da2e0ec2871a51445dc8da39e5b0ab71ca9b901627b562ed84b026002d4519af619e3cca4d69e0dee080006774a8f3e691700ec88158f02001b0000c81c8b297dff0445a13d0045fb3cda32a673a6bb55d8c80800dce431e56723888fb126a1403d2b63f16fb2ad9bc117aba7cbebe174aba210d739a018f9bbec63222d20cedbc4d03723f1c932b3a6aa57f1ad2e99e0e67a993716d20000009f0f53acbb40b401e3738270b3156268784f2af9e4bcf8b07a10d6735154be1602f9dd1d7d4301e00000000000460bcc5989ec85e3cbcb6bcfaf0000000000000000bc00f674629709e7e78f4ddc211bc3ebf0bd9d42ca019dd5d0861cd64722cf74686ebfbe2562671cd47840f81d2a8f8f9be3bcd19dc6840aa7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7eab049b1bd47287cd31cc43ea0ffb567b40407d000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="c4000000190001000000000000000000e0000002000000000000000000000000ff02000000000000000000000000000100000000200000000a00000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000082000000000000000000000fbffffffffffffff0000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000c0015"], 0xc4}}, 0x2c000010) socket$nl_generic(0x10, 0x3, 0x10) r6 = memfd_secret(0x80000) setsockopt$inet_int(r6, 0x0, 0x18, &(0x7f0000000000)=0xf, 0x4) ftruncate(r6, 0x9) ftruncate(r6, 0x51a9497) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="b80000001500010000000000fddbdf252001000000000000000000000000000100000000000000000000000000000001000000004e2300000a", @ANYRES8=r5], 0xb8}, 0x1, 0x0, 0x0, 0x4000881}, 0x0) 150.127228ms ago: executing program 4 (id=3815): unshare(0x6a040000) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x940d, 0x0, 0x9, 0x0, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) syz_emit_ethernet(0xc2, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x40505330, &(0x7f0000000180)={0x800100, 0xffffffff, 0x22, 0xe1d9, 0x1101, 0xff}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x34000, 0x0) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000200)={'veth0_virt_wifi\x00'}) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000080)={0x84, @private=0xa010100, 0x15, 0x3, 'sh\x00', 0x28, 0x0, 0x70}, 0x2c) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000340)={&(0x7f0000001e80)=ANY=[@ANYBLOB="b0070000", @ANYRES16=0x0, @ANYBLOB="01002abd7000fedbdf25010000001400020077673000000000000000000000000000060006004e20000008000500010000007007088004000080f00300802c02098064000080060001000a00000014000200200100000000000000000000000000020500030002000000060001000200000008000200ac1414bb0500030002000000060001000a00000014000200fe8000000000000000000000000000bb05000300000000004c000080060001000200000008000200ffffffff0500030002000000060001000200000008000200ffffffff050003000200000006000100020000000800020064010102050003000000000028000080060001000a00000014000200fe880000000000000000000000000101050003000200000064000080060001000a00000014000200fe80000000000000000000000000001b0500030001000000060001000a00000014000200000000000000000000000000000000010500030003000000060001000200000008000200e000000205000300030000001c000080060001000200000008000200640101010500030003000000d0000080060001000a00000014000200fc02000000000000000000000000000005000300030000000600010002000000080002007f0000010500030002000000060001000a00000014000200fc0200000000000000000000000000010500030001000000060001000a0000001400020000000000000000000000ffffe00000020500030002000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000a00000014000200fe8000000000000000000000000000bb05000300020000000800030007000000200004000a004e2100000005fe80000000000000000000000000001b1b00000088010980ac000080060001000a0000001400020000000000000000000000ffffe00000020500030001000000060001000200000008000200ac1414bb0500030003000000060001000200000008000200640101010500030001000000060001000a00000014000200ff0100000000000000000000000000010500030001000000060001000200000008000200ac1e01010500030000000000060001000200000008000200ac1efd010500030003000000400000800600010002000000080002000a0101010500030003000000060001000a00000014000200fc010000000000000000000000000001050003000300000094000080060001000a00000014000200200100000000000000000000000000000500030002000000060001000a00000014000200fc0200000000000000000000000000000500030002000000060001000a00000014000200fe8000000000000000000000000000270500030002000000060001000a000000140002002001000000000000000000000000000105000300010000000400008008000300030000000800030001000000200000801400040002004e20e0000001000000000000000008000a00010000004400008008000a000100000024000200e4458769eecca8fbf17ada961a7ce5920d59ae5e5cc8ade0be5c8f36df8b927d1400040002004e22ffffffff000000000000000028000080060005000d00000006000500b30900001400040002004e20ac141418000000000000000024020080240002002e8803fedbd3a138ace7163838c07008239bc3fb41df1700a0aa6d77b7e3861224000100000000000000000000000000000000000000000000000000000000000000000024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b240002007607121bbc8064095bad37bcee40e54b1780fe53af5b6361642a0be26a1f0656240002002d9ad822c4d6e3d72af1fdb5a2ae2e3a1408751aaad7a993df783c8743523b162400020083aee205afc7ee922ac884507b3ec1ef058b9813d3c5977e61e46c69117fd9010000000000000081c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c000109801c000080060001000200000008000200ac141418050003000000000028000080060001000a00000014000200fc01000000000000000000000000000005000300000000000400008040000080060001000a00000014000200fe8000000000000000000000000000bb0500030003000000060001000200000008000200ac1414bb050003000100000070000080060001000a000000140002000000000000000000000000000000000105000300020000000600010002000000080002007f0000010500030003000000060001000200000008000200ac1414bb05000300010000000600010002000000080002007f00000105000300010000000400008024000200ee463071bed1425aa8fcdc8a3ac20e2f7f31eff0515b1f6a20f70d0ebfd188bac80000801400040002004e22ac14142c0000000000000000200004000a004e24000063cbff020000000000000000000000000001000000802400020076408e3bacde3520bff73d3c281ce398e133f5e7e378a2246fe21f332489eece1400040002004e23ac1414bb00000000000000000800030009000000080003000700000006000500bca600001400040002004e22ac1e0101000000000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39220800030007000000060006004e240000"], 0x7b0}, 0x1, 0x0, 0x0, 0x4000015}, 0x2008c090) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=ANY=[@ANYBLOB="400100001a000100feffffff00010000e0000002000000000000000000000000fc0100000000000000000000000000010001071c4e2300050a0000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000fe80000000000000000000000000002600000000000000009601000000000010a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000fefffffffffffffffefffffffc030000000000008000000005350000020001002000000000000000480003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000b007f000000"], 0x140}}, 0x844) r5 = socket$kcm(0xa, 0x2, 0x0) r6 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_inet_SIOCSIFBRDADDR(r5, 0x891a, &(0x7f0000000100)={'pim6reg\x00', {0x2, 0x4e20, @rand_addr=0x64010101}}) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e24, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xc, 0x9, 0x3}}, 0x44) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000300), 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) connect(0xffffffffffffffff, 0x0, 0x0) sendmsg$sock(r5, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) socket$rds(0x15, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000ffff26bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15170000bcb7040008000a00", @ANYRES32=r8, @ANYBLOB="140012800c0001006d6163767461700004000280080005"], 0x44}, 0x1, 0x0, 0x0, 0x240448d5}, 0x8000002) 0s ago: executing program 2 (id=3816): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') preadv(r0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/216, 0xd8}], 0x1, 0xa3, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f00000000c0)=ANY=[], 0x6a) (fail_nth: 4) kernel console output (not intermixed with test programs): cted state after lo power cmd: 00 [ 1012.490536][ T5896] usb 2-1: Using ep0 maxpacket: 8 [ 1012.501805][ T5896] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1012.525284][ T5896] usb 2-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1012.534505][ T5888] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 1012.548892][ T10] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 1012.561922][ T5896] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1012.583386][ T10] usb 5-1: device descriptor read/8, error -71 [ 1012.596109][ T5896] usb 2-1: Product: syz [ 1012.614011][ T5896] usb 2-1: Manufacturer: syz [ 1012.620214][ T5896] usb 2-1: SerialNumber: syz [ 1012.638649][ T5896] usb 2-1: config 0 descriptor?? [ 1012.662881][ T5896] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1012.695778][ T5888] usb 4-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 1012.738792][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1012.752212][ T5888] usb 4-1: Product: syz [ 1012.756549][ T5888] usb 4-1: Manufacturer: syz [ 1012.761290][ T5888] usb 4-1: SerialNumber: syz [ 1012.777726][ T5888] usb 4-1: config 0 descriptor?? [ 1012.789279][ T5888] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 1012.888837][ T10] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 1012.914286][ T10] usb 5-1: device descriptor read/8, error -71 [ 1013.099128][ T10] usb usb5-port1: unable to enumerate USB device [ 1013.456738][ T5888] gspca_sq905c: sq905c_command: usb_control_msg failed (-71) [ 1013.465874][ T5888] sq905c 4-1:0.0: probe with driver sq905c failed with error -71 [ 1013.479618][ T5888] usb 4-1: USB disconnect, device number 127 [ 1013.718935][T17051] gspca_cpia1: usb_control_msg 05, error -110 [ 1013.725173][T17051] cpia1 6-1:0.0: unexpected systemstate: 00 [ 1013.795747][ T5889] gspca_zc3xx: reg_w_i err -71 [ 1014.222177][ T5888] usb 6-1: USB disconnect, device number 50 [ 1014.244087][ T5896] gspca_zc3xx: reg_w_i err -71 [ 1014.420196][ T5889] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1014.442798][ T5889] gspca_zc3xx 3-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 1014.478670][ T5889] usb 3-1: USB disconnect, device number 117 [ 1014.528132][T19048] syz.5.3340 (19048) used obsolete PPPIOCDETACH ioctl [ 1014.621846][T19050] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3338'. [ 1015.009705][ T5896] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1015.029356][ T5896] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 1015.099685][ T5889] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 1015.137579][ T5896] usb 2-1: USB disconnect, device number 122 [ 1015.418876][ T5889] usb 4-1: Using ep0 maxpacket: 8 [ 1015.464392][ T5889] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1015.562437][ T5889] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1015.634710][ T5889] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1015.668080][ T5889] usb 4-1: Product: syz [ 1015.678927][ T5889] usb 4-1: Manufacturer: syz [ 1015.797245][ T5889] usb 4-1: SerialNumber: syz [ 1015.853584][ T5889] usb 4-1: config 0 descriptor?? [ 1015.872830][ T5889] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1017.028083][T19080] vlan2: entered promiscuous mode [ 1017.033481][T19080] bond0: entered promiscuous mode [ 1017.059331][T19080] bond_slave_0: entered promiscuous mode [ 1017.097213][T19080] bond_slave_1: entered promiscuous mode [ 1017.388839][ T10] usb 6-1: new full-speed USB device number 51 using dummy_hcd [ 1017.452563][T19090] netlink: 27 bytes leftover after parsing attributes in process `syz.2.3349'. [ 1017.485322][ T5889] gspca_zc3xx: reg_w_i err -71 [ 1017.577566][ T10] usb 6-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 1017.587186][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1017.620269][ T10] usb 6-1: config 0 descriptor?? [ 1017.912440][T19084] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1017.967513][T19084] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1017.990758][T17518] IPVS: starting estimator thread 0... [ 1018.016830][T19084] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1018.098787][ T5889] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1018.106269][ T5889] gspca_zc3xx 4-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 1018.115385][T19096] IPVS: using max 32 ests per chain, 76800 per kthread [ 1018.132175][T19084] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1018.185557][ T5889] usb 4-1: USB disconnect, device number 2 [ 1018.210053][ T10] usb 6-1: USB disconnect, device number 51 [ 1018.796644][T19104] FAULT_INJECTION: forcing a failure. [ 1018.796644][T19104] name failslab, interval 1, probability 0, space 0, times 0 [ 1018.814831][T19104] CPU: 1 UID: 0 PID: 19104 Comm: syz.5.3354 Tainted: G L syzkaller #0 PREEMPT(full) [ 1018.814850][T19104] Tainted: [L]=SOFTLOCKUP [ 1018.814855][T19104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1018.814861][T19104] Call Trace: [ 1018.814866][T19104] [ 1018.814871][T19104] dump_stack_lvl+0xe8/0x150 [ 1018.814891][T19104] should_fail_ex+0x412/0x560 [ 1018.814914][T19104] should_failslab+0xa8/0x100 [ 1018.814929][T19104] __kmalloc_noprof+0xe8/0x760 [ 1018.814941][T19104] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1018.814959][T19104] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1018.814977][T19104] ? tomoyo_path_number_perm+0x219/0x630 [ 1018.814989][T19104] tomoyo_path_number_perm+0x246/0x630 [ 1018.815002][T19104] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1018.815015][T19104] ? __lock_acquire+0x6b5/0x2cf0 [ 1018.815034][T19104] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1018.815059][T19104] ? __fget_files+0x2a/0x420 [ 1018.815076][T19104] ? __fget_files+0x2a/0x420 [ 1018.815089][T19104] ? __fget_files+0x3a0/0x420 [ 1018.815102][T19104] ? __fget_files+0x2a/0x420 [ 1018.815118][T19104] security_file_ioctl+0xc3/0x2a0 [ 1018.815130][T19104] __se_sys_ioctl+0x47/0x170 [ 1018.815146][T19104] do_syscall_64+0x14d/0xf80 [ 1018.815156][T19104] ? trace_irq_disable+0x3b/0x150 [ 1018.815170][T19104] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1018.815180][T19104] ? clear_bhb_loop+0x40/0x90 [ 1018.815193][T19104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1018.815203][T19104] RIP: 0033:0x7fa40079c799 [ 1018.815214][T19104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1018.815228][T19104] RSP: 002b:00007fa4015c5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1018.815247][T19104] RAX: ffffffffffffffda RBX: 00007fa400a15fa0 RCX: 00007fa40079c799 [ 1018.815260][T19104] RDX: 0000200000003f80 RSI: 0000000080044dff RDI: 0000000000000006 [ 1018.815272][T19104] RBP: 00007fa4015c5090 R08: 0000000000000000 R09: 0000000000000000 [ 1018.815281][T19104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1018.815292][T19104] R13: 00007fa400a16038 R14: 00007fa400a15fa0 R15: 00007fa400b3fa48 [ 1018.815318][T19104] [ 1018.816010][T19104] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1019.112616][T19108] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3355'. [ 1020.918451][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 1020.918470][ T30] audit: type=1326 audit(1773303357.310:603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19106 comm="syz.2.3356" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4e0e19c799 code=0x0 [ 1021.442662][T19133] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1021.448954][T19133] [U] .h0FwZ,iqgҏV2sO [ 1021.449023][T19133] [U] ` w*BBOLhU [ 1021.449034][T19133] [U] w$n|#%o.z\̧mРw [ 1021.449046][T19133] [U] R{ꫢ S [ 1021.916763][T19137] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1023.256533][T19153] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3366'. [ 1023.440546][T19153] bond1: entered promiscuous mode [ 1023.458239][T19153] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1023.535721][T19165] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3369'. [ 1023.665546][T19166] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3368'. [ 1024.031788][T19172] tipc: Started in network mode [ 1024.038824][ T5928] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 1024.069121][T19172] tipc: Node identity ac14140f, cluster identity 9 [ 1024.105577][T19172] tipc: New replicast peer: 255.255.255.255 [ 1024.125626][T19172] tipc: Enabled bearer , priority 10 [ 1024.220622][ T5928] usb 5-1: Using ep0 maxpacket: 8 [ 1024.272305][ T5928] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1024.298948][ T5928] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1024.324315][ T5928] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1024.338836][T19182] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1024.345291][T19182] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1024.355920][ T5928] usb 5-1: Product: syz [ 1024.374624][ T5928] usb 5-1: Manufacturer: syz [ 1024.374647][ T5928] usb 5-1: SerialNumber: syz [ 1024.454707][ T5928] usb 5-1: config 0 descriptor?? [ 1024.466663][ T30] audit: type=1326 audit(1773303360.870:604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19177 comm="syz.2.3373" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4e0e19c799 code=0x0 [ 1024.543584][ T5928] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1025.158820][ T5829] tipc: Node number set to 2886997007 [ 1025.436138][ T5928] gspca_zc3xx: reg_w_i err -110 [ 1026.038798][ T5928] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1026.045383][ T5928] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1027.768108][T17518] usb 5-1: USB disconnect, device number 27 [ 1028.632982][T19240] netlink: 184 bytes leftover after parsing attributes in process `syz.3.3383'. [ 1028.943178][T19243] netlink: 'syz.2.3387': attribute type 21 has an invalid length. [ 1028.993263][T19243] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3387'. [ 1029.278912][T17518] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 1029.463897][T17518] usb 3-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 1029.474970][T17518] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1029.484043][T17518] usb 3-1: Product: syz [ 1029.488570][T17518] usb 3-1: Manufacturer: syz [ 1029.494636][T17518] usb 3-1: SerialNumber: syz [ 1029.512315][T17518] usb 3-1: config 0 descriptor?? [ 1029.763383][T17518] usb 3-1: f81604_read: reg: 105 failed: -EPROTO [ 1029.772205][T17518] f81604 3-1:0.0: Setting termination of CH#0 failed: -EPROTO [ 1029.780031][T17518] f81604 3-1:0.0: probe with driver f81604 failed with error -71 [ 1029.792602][T17518] usb 3-1: USB disconnect, device number 118 [ 1030.301135][T19259] FAULT_INJECTION: forcing a failure. [ 1030.301135][T19259] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1030.381486][T19259] CPU: 1 UID: 0 PID: 19259 Comm: syz.1.3390 Tainted: G L syzkaller #0 PREEMPT(full) [ 1030.381517][T19259] Tainted: [L]=SOFTLOCKUP [ 1030.381525][T19259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1030.381536][T19259] Call Trace: [ 1030.381545][T19259] [ 1030.381553][T19259] dump_stack_lvl+0xe8/0x150 [ 1030.381585][T19259] should_fail_ex+0x412/0x560 [ 1030.381613][T19259] _copy_from_user+0x2d/0xb0 [ 1030.381642][T19259] ___sys_sendmsg+0x1c6/0x360 [ 1030.381674][T19259] ? __pfx____sys_sendmsg+0x10/0x10 [ 1030.381698][T19259] ? kstrtouint+0x6e/0xe0 [ 1030.381742][T19259] ? __fget_files+0x2a/0x420 [ 1030.381769][T19259] ? __fget_files+0x3a0/0x420 [ 1030.381803][T19259] __sys_sendmmsg+0x27c/0x4e0 [ 1030.381827][T19259] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1030.381844][T19259] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1030.381884][T19259] ? ksys_write+0x242/0x270 [ 1030.381906][T19259] ? __pfx_ksys_write+0x10/0x10 [ 1030.381931][T19259] __x64_sys_sendmmsg+0xa0/0xc0 [ 1030.381952][T19259] do_syscall_64+0x14d/0xf80 [ 1030.381969][T19259] ? trace_irq_disable+0x3b/0x150 [ 1030.381995][T19259] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1030.382013][T19259] ? clear_bhb_loop+0x40/0x90 [ 1030.382035][T19259] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1030.382054][T19259] RIP: 0033:0x7fecff19c799 [ 1030.382072][T19259] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1030.382087][T19259] RSP: 002b:00007fecfffbf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1030.382107][T19259] RAX: ffffffffffffffda RBX: 00007fecff416180 RCX: 00007fecff19c799 [ 1030.382121][T19259] RDX: 17fd147c801ae9af RSI: 0000200000000ac0 RDI: 0000000000000007 [ 1030.382134][T19259] RBP: 00007fecfffbf090 R08: 0000000000000000 R09: 0000000000000000 [ 1030.382146][T19259] R10: 000000000000ff00 R11: 0000000000000246 R12: 0000000000000001 [ 1030.382158][T19259] R13: 00007fecff416218 R14: 00007fecff416180 R15: 00007fecff53fa48 [ 1030.382185][T19259] [ 1030.862677][T19266] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3392'. [ 1030.898827][ T5889] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 1031.171451][ T5889] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1031.187361][ T5889] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1031.234334][ T5889] usb 3-1: New USB device found, idVendor=08b7, idProduct=8000, bcdDevice= 0.00 [ 1031.252271][ T5889] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1031.296638][ T5889] usb 3-1: SerialNumber: syz [ 1032.047368][ T5889] usb 3-1: 0:2 : does not exist [ 1032.271687][T19281] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3396'. [ 1032.289092][ T5889] usb 3-1: USB disconnect, device number 119 [ 1032.357280][T16351] udevd[16351]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1032.929183][ T5889] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 1033.445088][ T5889] usb 2-1: Using ep0 maxpacket: 8 [ 1033.470010][ T5889] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1033.733990][ T5889] usb 2-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1033.886139][ T5829] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 1033.917667][ T5889] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1033.953284][ T5889] usb 2-1: Product: syz [ 1033.957538][ T5889] usb 2-1: Manufacturer: syz [ 1033.966438][ T5889] usb 2-1: SerialNumber: syz [ 1033.974578][ T5889] usb 2-1: config 0 descriptor?? [ 1033.983150][ T5889] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1034.058946][ T5829] usb 4-1: Using ep0 maxpacket: 32 [ 1034.071000][ T5829] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 26, changing to 7 [ 1034.092697][ T5829] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b1, bcdDevice= 0.40 [ 1034.105812][ T5829] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.205360][ T5829] usb 4-1: Product: syz [ 1034.220007][ T5829] usb 4-1: Manufacturer: syz [ 1034.231357][ T5829] usb 4-1: SerialNumber: syz [ 1034.979937][T19326] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3408'. [ 1035.000353][T19326] netlink: 'syz.4.3408': attribute type 10 has an invalid length. [ 1035.023225][T19326] syz_tun: entered promiscuous mode [ 1035.052478][T19326] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1035.334838][ T5889] gspca_zc3xx: reg_w_i err -71 [ 1035.449032][ T10] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 1035.610466][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 1035.630570][ T10] usb 3-1: New USB device found, idVendor=0471, idProduct=030c, bcdDevice=ba.e9 [ 1035.639900][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1035.650451][ T10] usb 3-1: Product: syz [ 1035.654649][ T10] usb 3-1: Manufacturer: syz [ 1035.660204][ T10] usb 3-1: SerialNumber: syz [ 1035.688589][ T10] usb 3-1: config 0 descriptor?? [ 1035.717463][ T10] pwc: Philips PCVC690K (Vesta Pro Scan) USB webcam detected. [ 1035.893639][ T30] audit: type=1326 audit(1773303372.290:605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19335 comm="syz.5.3412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa40079c799 code=0x7ffc0000 [ 1035.936650][ T10] pwc: send_video_command error -71 [ 1035.947647][ T10] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 1035.963188][ T10] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 1035.974831][ T30] audit: type=1326 audit(1773303372.300:606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19335 comm="syz.5.3412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7fa40079c799 code=0x7ffc0000 [ 1036.007047][ T5889] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1036.030535][ T5889] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 1036.048052][ T10] usb 3-1: USB disconnect, device number 120 [ 1036.076110][ T30] audit: type=1326 audit(1773303372.300:607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19335 comm="syz.5.3412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa40079c799 code=0x7ffc0000 [ 1036.108192][ T5889] usb 2-1: USB disconnect, device number 123 [ 1036.118293][ T30] audit: type=1326 audit(1773303372.300:608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19335 comm="syz.5.3412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fa40079c799 code=0x7ffc0000 [ 1036.249774][ T30] audit: type=1326 audit(1773303372.300:609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19335 comm="syz.5.3412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa40079c799 code=0x7ffc0000 [ 1036.338739][ T30] audit: type=1326 audit(1773303372.300:610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19335 comm="syz.5.3412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fa40079c799 code=0x7ffc0000 [ 1036.391150][ T30] audit: type=1326 audit(1773303372.300:611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19335 comm="syz.5.3412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa40079c799 code=0x7ffc0000 [ 1036.469682][ T30] audit: type=1326 audit(1773303372.300:612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19335 comm="syz.5.3412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fa40079c799 code=0x7ffc0000 [ 1036.526724][ T30] audit: type=1326 audit(1773303372.300:613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19335 comm="syz.5.3412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa40079c799 code=0x7ffc0000 [ 1036.933162][ T30] audit: type=1326 audit(1773303372.300:614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19335 comm="syz.5.3412" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7fa40079c799 code=0x7ffc0000 [ 1037.045138][ T5829] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 1037.409047][ T5829] usb 4-1: USB disconnect, device number 3 [ 1038.004743][T19352] vivid-007: ================= START STATUS ================= [ 1038.072180][T19352] vivid-007: Enable Output Cropping: true [ 1038.124527][T19352] vivid-007: Enable Output Composing: true [ 1038.134110][T19352] vivid-007: Enable Output Scaler: true [ 1038.161496][T19352] vivid-007: Tx RGB Quantization Range: Automatic [ 1038.168335][T19352] vivid-007: Transmit Mode: HDMI [ 1038.188825][T19352] vivid-007: Hotplug Present: 0x00000000 [ 1038.194790][T19352] vivid-007: RxSense Present: 0x00000000 [ 1038.200781][T19352] vivid-007: EDID Present: 0x00000000 [ 1038.206298][T19352] vivid-007: ================== END STATUS ================== [ 1038.638820][ T5829] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 1038.959327][ T5829] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1039.049284][ T5829] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1039.279019][ T5829] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1039.338783][ T5829] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1039.372333][ T5829] usb 4-1: config 0 descriptor?? [ 1040.035184][T19355] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3415'. [ 1040.724579][T19387] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3424'. [ 1041.138994][T17518] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 1041.158869][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 1041.288836][T17518] usb 6-1: Using ep0 maxpacket: 16 [ 1041.297038][T17518] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1041.621677][T17518] usb 6-1: config 159 has an invalid interface number: 195 but max is 0 [ 1041.639305][T17518] usb 6-1: config 159 has no interface number 0 [ 1041.646586][T17518] usb 6-1: config 159 interface 195 altsetting 5 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1041.659300][T17518] usb 6-1: config 159 interface 195 has no altsetting 0 [ 1041.686331][T17518] usb 6-1: New USB device found, idVendor=17e9, idProduct=b889, bcdDevice=ec.5c [ 1041.703476][T17518] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.721600][T17518] usb 6-1: Product: syz [ 1041.725948][T17518] usb 6-1: Manufacturer: syz [ 1041.732389][T17518] usb 6-1: SerialNumber: syz [ 1042.459674][T17518] udl 6-1:159.195: [drm] Unrecognized vendor firmware descriptor [ 1042.529869][T19413] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3430'. [ 1042.593252][T17518] [drm:udl_init] *ERROR* Selecting channel failed [ 1042.628967][T17518] [drm] Initialized udl 0.0.1 for 6-1:159.195 on minor 2 [ 1042.646466][T17051] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 1042.654711][T17518] [drm] Initialized udl on minor 2 [ 1042.674934][T17518] udl 6-1:159.195: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1042.708105][T17518] udl 6-1:159.195: [drm] Cannot find any crtc or sizes [ 1042.740319][ T5896] udl 6-1:159.195: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1042.819144][T17051] usb 5-1: Using ep0 maxpacket: 16 [ 1042.880738][ T5896] udl 6-1:159.195: [drm] Cannot find any crtc or sizes [ 1042.887710][T17518] usb 6-1: USB disconnect, device number 52 [ 1042.936290][T17051] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1042.947341][T17051] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1042.956602][T17051] usb 5-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 1042.984476][T17051] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1043.036166][T17051] usb 5-1: config 0 descriptor?? [ 1044.842573][T17051] usb 5-1: string descriptor 0 read error: -71 [ 1044.852250][T17051] usb 5-1: USB disconnect, device number 28 [ 1044.983927][T17518] usb 4-1: USB disconnect, device number 4 [ 1045.258785][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 1045.258803][ T30] audit: type=1326 audit(1773303381.660:672): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.3.3434" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996f39c799 code=0x7ffc0000 [ 1045.416570][ T30] audit: type=1326 audit(1773303381.660:673): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.3.3434" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996f39c799 code=0x7ffc0000 [ 1045.457390][T19435] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1045.516217][T19430] netlink: 52 bytes leftover after parsing attributes in process `syz.5.3433'. [ 1045.645421][ T30] audit: type=1326 audit(1773303381.660:674): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.3.3434" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f996f39c799 code=0x7ffc0000 [ 1045.671266][ T30] audit: type=1326 audit(1773303381.660:675): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.3.3434" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996f39c799 code=0x7ffc0000 [ 1046.158907][ T30] audit: type=1326 audit(1773303381.660:676): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.3.3434" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f996f39c799 code=0x7ffc0000 [ 1046.181669][ T30] audit: type=1326 audit(1773303381.660:677): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.3.3434" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996f39c799 code=0x7ffc0000 [ 1046.205315][ T30] audit: type=1326 audit(1773303381.660:678): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.3.3434" exe="/root/syz-executor" sig=0 arch=c000003e syscall=327 compat=0 ip=0x7f996f39c799 code=0x7ffc0000 [ 1046.228487][ T30] audit: type=1326 audit(1773303381.660:679): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.3.3434" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996f39c799 code=0x7ffc0000 [ 1046.251761][ T30] audit: type=1326 audit(1773303381.670:680): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19432 comm="syz.3.3434" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f996f39c799 code=0x7ffc0000 [ 1046.459817][T19440] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3437'. [ 1046.614712][T19440] input: syz1 as /devices/virtual/input/input53 [ 1046.789150][T19448] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3436'. [ 1047.359615][ T5889] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 1047.698909][ T5889] usb 6-1: Using ep0 maxpacket: 16 [ 1047.762252][ T5889] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1047.780792][ T5889] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1047.818543][ T5889] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1047.870022][ T5889] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1047.896761][ T5889] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1047.935452][ T5889] usb 6-1: config 0 descriptor?? [ 1048.176063][ T5889] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 1048.193301][ T5889] microsoft 0003:045E:07DA.0024: ignoring exceeding usage max [ 1048.235489][ T5889] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 1048.243527][ T5889] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 1048.269372][ T5889] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 1048.282999][ T5889] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 1048.291162][T17051] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 1048.338748][ T5889] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 1048.364592][T19479] syzkaller0: entered promiscuous mode [ 1048.370335][T19479] syzkaller0: entered allmulticast mode [ 1048.385282][T19477] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1048.432238][ T5889] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 1048.448807][ T5889] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 1048.462304][T17051] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1048.472731][T17051] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1048.489028][ T5889] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 1048.506965][T17051] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1048.517576][ T5889] microsoft 0003:045E:07DA.0024: unknown main item tag 0x0 [ 1048.676447][T17051] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1048.707341][ T5889] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0024/input/input54 [ 1048.719254][T17051] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1048.727391][T17051] usb 5-1: Product: syz [ 1048.751478][T17051] usb 5-1: Manufacturer: syz [ 1048.770594][ T5889] microsoft 0003:045E:07DA.0024: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 1048.793826][T17051] usb 5-1: SerialNumber: syz [ 1048.831574][T17051] usb 5-1: config 0 descriptor?? [ 1048.873658][T19467] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1048.885637][T19485] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3448'. [ 1048.888880][T19467] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1048.918012][ T5889] usb 6-1: USB disconnect, device number 53 [ 1048.947139][T19483] fido_id[19483]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 1048.988439][T17051] usb 5-1: ucan: probing device on interface #0 [ 1049.262211][T19491] FAULT_INJECTION: forcing a failure. [ 1049.262211][T19491] name failslab, interval 1, probability 0, space 0, times 0 [ 1049.280992][T19491] CPU: 1 UID: 0 PID: 19491 Comm: syz.5.3450 Tainted: G L syzkaller #0 PREEMPT(full) [ 1049.281028][T19491] Tainted: [L]=SOFTLOCKUP [ 1049.281036][T19491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1049.281046][T19491] Call Trace: [ 1049.281054][T19491] [ 1049.281064][T19491] dump_stack_lvl+0xe8/0x150 [ 1049.281095][T19491] should_fail_ex+0x412/0x560 [ 1049.281124][T19491] should_failslab+0xa8/0x100 [ 1049.281145][T19491] ? skb_clone+0x212/0x3a0 [ 1049.281164][T19491] kmem_cache_alloc_noprof+0x87/0x650 [ 1049.281183][T19491] ? ipv6_chk_mcast_addr+0x2e/0x860 [ 1049.281214][T19491] skb_clone+0x212/0x3a0 [ 1049.281232][T19491] ? ip6_finish_output2+0xed4/0x13e0 [ 1049.281262][T19491] ip6_finish_output2+0xee3/0x13e0 [ 1049.281301][T19491] ip6_fragment+0x14aa/0x1f30 [ 1049.281347][T19491] ? __pfx_ip6_finish_output2+0x10/0x10 [ 1049.281382][T19491] ? __pfx_ip6_fragment+0x10/0x10 [ 1049.281404][T19491] ? ip6_mtu+0x7d/0x490 [ 1049.281426][T19491] ? ip6_mtu+0x38c/0x490 [ 1049.281452][T19491] ? ip6_finish_output+0x37d/0x480 [ 1049.281476][T19491] ? ip6_output+0x126/0x550 [ 1049.281500][T19491] ip6_output+0x340/0x550 [ 1049.281528][T19491] ? ip6_mr_output+0x1f3/0x11c0 [ 1049.281553][T19491] ip6_mr_output+0x549/0x11c0 [ 1049.281588][T19491] ? ip6_mr_output+0x1f3/0x11c0 [ 1049.281612][T19491] ? __pfx_ip6_mr_output+0x10/0x10 [ 1049.281640][T19491] ? __ip6_local_out+0x15c/0x940 [ 1049.281667][T19491] ? __ip6_local_out+0x8f8/0x940 [ 1049.281687][T19491] ? __ip6_local_out+0x15c/0x940 [ 1049.281719][T19491] ? __pfx___ip6_local_out+0x10/0x10 [ 1049.281757][T19491] ? ip6_local_out+0x16e/0x190 [ 1049.281776][T19491] ? ip6_send_skb+0x10f/0x390 [ 1049.281803][T19491] ip6_send_skb+0x1d5/0x390 [ 1049.281833][T19491] rawv6_push_pending_frames+0x65e/0x810 [ 1049.281860][T19491] ? __pfx_rawv6_push_pending_frames+0x10/0x10 [ 1049.281884][T19491] ? __pfx_raw6_getfrag+0x10/0x10 [ 1049.281908][T19491] rawv6_sendmsg+0x1387/0x18e0 [ 1049.281940][T19491] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 1049.281969][T19491] ? aa_sk_perm+0x6d5/0x900 [ 1049.282001][T19491] ? __pfx_aa_sk_perm+0x10/0x10 [ 1049.282027][T19491] ? sock_rps_record_flow+0x19/0x400 [ 1049.282049][T19491] ? inet_sendmsg+0x2f4/0x370 [ 1049.282066][T19491] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1049.282091][T19491] ____sys_sendmsg+0x80a/0x9f0 [ 1049.282119][T19491] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1049.282147][T19491] ? import_iovec+0x73/0xa0 [ 1049.282178][T19491] ___sys_sendmsg+0x2a5/0x360 [ 1049.282203][T19491] ? __pfx____sys_sendmsg+0x10/0x10 [ 1049.282257][T19491] ? __fget_files+0x2a/0x420 [ 1049.282282][T19491] ? __fget_files+0x3a0/0x420 [ 1049.282318][T19491] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1049.282340][T19491] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1049.282368][T19491] ? __pfx_ksys_write+0x10/0x10 [ 1049.282399][T19491] do_syscall_64+0x14d/0xf80 [ 1049.282416][T19491] ? trace_irq_disable+0x3b/0x150 [ 1049.282441][T19491] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1049.282461][T19491] ? clear_bhb_loop+0x40/0x90 [ 1049.282484][T19491] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1049.282503][T19491] RIP: 0033:0x7fa40079c799 [ 1049.282522][T19491] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1049.282538][T19491] RSP: 002b:00007fa4015c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1049.282559][T19491] RAX: ffffffffffffffda RBX: 00007fa400a15fa0 RCX: 00007fa40079c799 [ 1049.282573][T19491] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1049.282585][T19491] RBP: 00007fa4015c5090 R08: 0000000000000000 R09: 0000000000000000 [ 1049.282597][T19491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1049.282609][T19491] R13: 00007fa400a16038 R14: 00007fa400a15fa0 R15: 00007fa400b3fa48 [ 1049.282640][T19491] [ 1049.907226][T17051] ucan 5-1:0.0: probe with driver ucan failed with error -22 [ 1050.055569][T19512] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 1050.065315][T19512] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 1051.282253][ T5829] usb 5-1: USB disconnect, device number 29 [ 1052.379158][T17051] usb 5-1: new full-speed USB device number 30 using dummy_hcd [ 1052.380683][T19550] FAULT_INJECTION: forcing a failure. [ 1052.380683][T19550] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1052.418888][T19550] CPU: 0 UID: 0 PID: 19550 Comm: syz.3.3468 Tainted: G L syzkaller #0 PREEMPT(full) [ 1052.418915][T19550] Tainted: [L]=SOFTLOCKUP [ 1052.418922][T19550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1052.418933][T19550] Call Trace: [ 1052.418941][T19550] [ 1052.418950][T19550] dump_stack_lvl+0xe8/0x150 [ 1052.418980][T19550] should_fail_ex+0x412/0x560 [ 1052.419008][T19550] prepare_alloc_pages+0x22a/0x650 [ 1052.419040][T19550] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1052.419067][T19550] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1052.419093][T19550] ? __pfx_policy_nodemask+0x10/0x10 [ 1052.419118][T19550] ? __lock_acquire+0x6b5/0x2cf0 [ 1052.419154][T19550] alloc_pages_mpol+0x232/0x4a0 [ 1052.419182][T19550] alloc_pages_noprof+0xa8/0x190 [ 1052.419207][T19550] pte_alloc_one+0x22/0x370 [ 1052.419236][T19550] __pte_alloc+0x25/0x1a0 [ 1052.419261][T19550] do_pte_missing+0x2c47/0x3490 [ 1052.419287][T19550] ? do_raw_spin_unlock+0xf5/0x210 [ 1052.419316][T19550] handle_mm_fault+0x1bec/0x3310 [ 1052.419356][T19550] ? handle_mm_fault+0xee/0x3310 [ 1052.419390][T19550] ? __pfx_handle_mm_fault+0x10/0x10 [ 1052.419435][T19550] ? lock_mm_and_find_vma+0xa7/0x340 [ 1052.419458][T19550] do_user_addr_fault+0x75b/0x1340 [ 1052.419492][T19550] exc_page_fault+0x6a/0xc0 [ 1052.419518][T19550] asm_exc_page_fault+0x26/0x30 [ 1052.419536][T19550] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 1052.419555][T19550] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 1052.419571][T19550] RSP: 0018:ffffc90010577d58 EFLAGS: 00050212 [ 1052.419597][T19550] RAX: 00007ffffffff001 RBX: 0000000000000010 RCX: 0000000000000010 [ 1052.419610][T19550] RDX: 0000000000000001 RSI: 0000200000000040 RDI: ffffc90010577dc0 [ 1052.419622][T19550] RBP: ffffc90010577eb8 R08: ffffc90010577dcf R09: 1ffff920020aefb9 [ 1052.419635][T19550] R10: dffffc0000000000 R11: fffff520020aefba R12: 0000000000000010 [ 1052.419647][T19550] R13: 0000000000000010 R14: ffffc90010577dc0 R15: 0000200000000040 [ 1052.419676][T19550] _copy_from_user+0x7a/0xb0 [ 1052.419704][T19550] __sys_connect+0x156/0x450 [ 1052.419731][T19550] ? __pfx___sys_connect+0x10/0x10 [ 1052.419766][T19550] ? __pfx_ksys_write+0x10/0x10 [ 1052.419793][T19550] __x64_sys_connect+0x7a/0x90 [ 1052.419818][T19550] do_syscall_64+0x14d/0xf80 [ 1052.419835][T19550] ? trace_irq_disable+0x3b/0x150 [ 1052.419860][T19550] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1052.419878][T19550] ? clear_bhb_loop+0x40/0x90 [ 1052.419899][T19550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1052.419916][T19550] RIP: 0033:0x7f996f39c799 [ 1052.419932][T19550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1052.419947][T19550] RSP: 002b:00007f996d5f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1052.419965][T19550] RAX: ffffffffffffffda RBX: 00007f996f615fa0 RCX: 00007f996f39c799 [ 1052.419979][T19550] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000003 [ 1052.419991][T19550] RBP: 00007f996d5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1052.420002][T19550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1052.420013][T19550] R13: 00007f996f616038 R14: 00007f996f615fa0 R15: 00007f996f73fa48 [ 1052.420042][T19550] [ 1052.827013][T17051] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1052.861886][T17051] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1052.889570][T17051] usb 5-1: Product: syz [ 1052.893771][T17051] usb 5-1: Manufacturer: syz [ 1052.941094][T17051] usb 5-1: SerialNumber: syz [ 1052.969972][T17051] usb 5-1: config 0 descriptor?? [ 1053.128841][T17518] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 1053.211017][ T5829] usb 5-1: USB disconnect, device number 30 [ 1053.303309][T17518] usb 6-1: Using ep0 maxpacket: 8 [ 1053.322238][T16438] udevd[16438]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1053.330866][T17518] usb 6-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 1053.373551][T17518] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1053.399510][T17518] usb 6-1: Product: syz [ 1053.407887][T17518] usb 6-1: Manufacturer: syz [ 1053.419894][T17518] usb 6-1: SerialNumber: syz [ 1053.499643][T17518] usb 6-1: config 0 descriptor?? [ 1053.521590][T17518] radio-usb-si4713 6-1:0.0: Si4713 development board discovered: (10C4:8244) [ 1053.888919][ T5829] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 1054.163258][T17518] radio-usb-si4713 6-1:0.0: probe with driver radio-usb-si4713 failed with error -71 [ 1054.269005][ T5829] usb 3-1: Using ep0 maxpacket: 16 [ 1054.279080][ T5829] usb 3-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 1054.289755][T17518] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1054.307336][ T5829] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1054.315946][ T5829] usb 3-1: Product: syz [ 1054.322025][ T5829] usb 3-1: Manufacturer: syz [ 1054.328856][ T5829] usb 3-1: SerialNumber: syz [ 1054.335744][T17518] usb 6-1: USB disconnect, device number 54 [ 1054.378148][ T5829] usb 3-1: config 0 descriptor?? [ 1054.395937][ T5829] visor 3-1:0.0: Sony Clie 3.5 converter detected [ 1054.446703][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.454145][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.891957][ T5829] usb 3-1: Sony Clie 3.5 converter now attached to ttyUSB0 [ 1055.045025][T19592] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3478'. [ 1055.059843][ T5829] usb 3-1: USB disconnect, device number 121 [ 1055.072033][ T5829] clie_3.5 ttyUSB0: Sony Clie 3.5 converter now disconnected from ttyUSB0 [ 1055.081532][ T5829] visor 3-1:0.0: device disconnected [ 1055.579055][ T5829] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 1055.582241][T19601] FAULT_INJECTION: forcing a failure. [ 1055.582241][T19601] name failslab, interval 1, probability 0, space 0, times 0 [ 1055.599562][T17518] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 1055.612355][T19601] CPU: 1 UID: 0 PID: 19601 Comm: syz.4.3481 Tainted: G L syzkaller #0 PREEMPT(full) [ 1055.612384][T19601] Tainted: [L]=SOFTLOCKUP [ 1055.612391][T19601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1055.612401][T19601] Call Trace: [ 1055.612409][T19601] [ 1055.612416][T19601] dump_stack_lvl+0xe8/0x150 [ 1055.612445][T19601] should_fail_ex+0x412/0x560 [ 1055.612471][T19601] should_failslab+0xa8/0x100 [ 1055.612492][T19601] ? radix_tree_node_alloc+0x7e/0x3a0 [ 1055.612516][T19601] kmem_cache_alloc_noprof+0x87/0x650 [ 1055.612540][T19601] radix_tree_node_alloc+0x7e/0x3a0 [ 1055.612567][T19601] idr_get_free+0x2b3/0xa70 [ 1055.612599][T19601] idr_alloc_u32+0x18d/0x320 [ 1055.612626][T19601] ? __pfx_idr_alloc_u32+0x10/0x10 [ 1055.612656][T19601] ? tcf_exts_init_ex+0x414/0x7c0 [ 1055.612687][T19601] ? __kmalloc_cache_noprof+0x31c/0x660 [ 1055.612711][T19601] basic_change+0x3de/0xfc0 [ 1055.612731][T19601] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1055.612758][T19601] ? __pfx_basic_change+0x10/0x10 [ 1055.612793][T19601] tc_new_tfilter+0xff8/0x1780 [ 1055.612837][T19601] ? __pfx_tc_new_tfilter+0x10/0x10 [ 1055.612886][T19601] ? __pfx_tc_new_tfilter+0x10/0x10 [ 1055.612910][T19601] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1055.612936][T19601] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1055.612956][T19601] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1055.612976][T19601] ? ref_tracker_free+0x693/0x840 [ 1055.612997][T19601] ? __copy_skb_header+0xa3/0x4a0 [ 1055.613016][T19601] ? __pfx_ref_tracker_free+0x10/0x10 [ 1055.613037][T19601] ? __skb_clone+0x63/0x7a0 [ 1055.613061][T19601] netlink_rcv_skb+0x232/0x4b0 [ 1055.613084][T19601] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1055.613110][T19601] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1055.613140][T19601] ? netlink_deliver_tap+0x2e/0x1b0 [ 1055.613170][T19601] netlink_unicast+0x80f/0x9b0 [ 1055.613207][T19601] ? __pfx_netlink_unicast+0x10/0x10 [ 1055.613231][T19601] ? netlink_sendmsg+0x650/0xb40 [ 1055.613253][T19601] ? skb_put+0x11b/0x210 [ 1055.613281][T19601] netlink_sendmsg+0x813/0xb40 [ 1055.613310][T19601] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1055.613335][T19601] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1055.613355][T19601] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1055.613377][T19601] ____sys_sendmsg+0x972/0x9f0 [ 1055.613401][T19601] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1055.613425][T19601] ? import_iovec+0x73/0xa0 [ 1055.613453][T19601] ___sys_sendmsg+0x2a5/0x360 [ 1055.613476][T19601] ? __pfx____sys_sendmsg+0x10/0x10 [ 1055.613527][T19601] ? __fget_files+0x2a/0x420 [ 1055.613552][T19601] ? __fget_files+0x3a0/0x420 [ 1055.613587][T19601] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1055.613608][T19601] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1055.613635][T19601] ? __pfx_ksys_write+0x10/0x10 [ 1055.613665][T19601] do_syscall_64+0x14d/0xf80 [ 1055.613682][T19601] ? trace_irq_disable+0x3b/0x150 [ 1055.613705][T19601] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1055.613724][T19601] ? clear_bhb_loop+0x40/0x90 [ 1055.613745][T19601] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1055.613763][T19601] RIP: 0033:0x7f8480d9c799 [ 1055.613780][T19601] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1055.613796][T19601] RSP: 002b:00007f8481c7b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1055.613816][T19601] RAX: ffffffffffffffda RBX: 00007f8481015fa0 RCX: 00007f8480d9c799 [ 1055.613830][T19601] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 1055.613842][T19601] RBP: 00007f8481c7b090 R08: 0000000000000000 R09: 0000000000000000 [ 1055.613854][T19601] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1055.613865][T19601] R13: 00007f8481016038 R14: 00007f8481015fa0 R15: 00007f848113fa48 [ 1055.613895][T19601] [ 1055.758803][ T5829] usb 3-1: Using ep0 maxpacket: 16 [ 1055.848776][T17518] usb 4-1: Using ep0 maxpacket: 8 [ 1056.232991][ T5829] usb 3-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 1056.265011][T17518] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1056.281288][T17518] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1056.293802][T17518] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1056.297215][ T5829] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1056.489720][T17518] usb 4-1: Product: syz [ 1056.513697][T17518] usb 4-1: Manufacturer: syz [ 1056.533074][ T5829] usb 3-1: Product: syz [ 1056.537376][ T5829] usb 3-1: Manufacturer: syz [ 1056.541074][T17518] usb 4-1: SerialNumber: syz [ 1056.556670][ T5829] usb 3-1: SerialNumber: syz [ 1056.557197][T17518] usb 4-1: config 0 descriptor?? [ 1056.583659][T17518] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1056.602728][ T5829] usb 3-1: config 0 descriptor?? [ 1056.820855][T15869] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 1056.846715][ T5829] usb 3-1: can't set config #0, error -71 [ 1056.942132][ T5829] usb 3-1: USB disconnect, device number 122 [ 1057.022383][T15869] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1057.035563][T15869] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1057.060031][T15869] usb 5-1: New USB device found, idVendor=5543, idProduct=0081, bcdDevice= 0.00 [ 1057.087323][T15869] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1057.286206][T15869] usb 5-1: config 0 descriptor?? [ 1057.450739][T19622] team_slave_0: entered promiscuous mode [ 1057.457118][T19622] team_slave_1: entered promiscuous mode [ 1057.469774][T19622] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1057.486940][T19622] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1057.551543][T19623] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1057.654642][T19622] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 1057.800187][T19626] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3489'. [ 1058.141380][T17518] gspca_zc3xx: reg_w_i err -71 [ 1058.151321][T19612] kvm: requested 1676 ns i8254 timer period limited to 200000 ns [ 1058.453961][T15869] usb 5-1: string descriptor 0 read error: -71 [ 1058.462817][T15869] uclogic 0003:5543:0081.0025: failed retrieving string descriptor #200: -71 [ 1058.494135][T15869] uclogic 0003:5543:0081.0025: failed retrieving pen parameters: -71 [ 1058.526813][T15869] uclogic 0003:5543:0081.0025: failed probing pen v2 parameters: -71 [ 1058.554721][T15869] uclogic 0003:5543:0081.0025: failed probing parameters: -71 [ 1058.573375][T15869] uclogic 0003:5543:0081.0025: probe with driver uclogic failed with error -71 [ 1058.607439][T15869] usb 5-1: USB disconnect, device number 31 [ 1058.778973][T17518] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1058.791255][T17518] gspca_zc3xx 4-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 1058.823818][T17518] usb 4-1: USB disconnect, device number 5 [ 1059.061056][T19653] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3496'. [ 1059.701812][T19662] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3500'. [ 1060.608956][ T5829] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 1061.086275][T19680] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1061.181392][ T5829] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1061.192935][ T5829] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1061.333708][ T5829] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1061.343318][ T5829] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 1061.413584][ T5829] usb 4-1: Manufacturer: syz [ 1061.436557][ T5829] usb 4-1: config 0 descriptor?? [ 1061.646039][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 1064.472722][ T5829] uclogic 0003:256C:006D.0026: failed retrieving Huion firmware version: -71 [ 1064.528593][ T5829] uclogic 0003:256C:006D.0026: failed probing parameters: -71 [ 1064.606266][ T5829] uclogic 0003:256C:006D.0026: probe with driver uclogic failed with error -71 [ 1064.886407][ T5829] usb 4-1: USB disconnect, device number 6 [ 1065.063675][T19717] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3512'. [ 1065.476071][T15869] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 1065.848756][T15869] usb 2-1: Using ep0 maxpacket: 8 [ 1065.917440][T15869] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1065.964869][T15869] usb 2-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1065.974339][T15869] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1065.993118][T15869] usb 2-1: Product: syz [ 1065.997323][T15869] usb 2-1: Manufacturer: syz [ 1066.028318][T15869] usb 2-1: SerialNumber: syz [ 1066.055121][T15869] usb 2-1: config 0 descriptor?? [ 1066.320063][T15869] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1066.588808][ T5903] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 1066.780330][ T5903] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1066.813922][ T5903] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 62976, setting to 1024 [ 1066.850844][T15869] gspca_zc3xx: reg_w_i err -110 [ 1066.886598][ T5903] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1066.954496][ T5903] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1066.954530][ T5903] usb 3-1: New USB device strings: Mfr=1, Product=130, SerialNumber=3 [ 1066.954551][ T5903] usb 3-1: Product: syz [ 1066.954567][ T5903] usb 3-1: Manufacturer: syz [ 1066.954583][ T5903] usb 3-1: SerialNumber: syz [ 1066.964527][ T5903] cdc_mbim 3-1:1.0: skipping garbage [ 1067.170045][T19727] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1067.507061][T15869] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1067.533192][T15869] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1067.574799][ T5903] cdc_mbim 3-1:1.0: failed GET_NTB_PARAMETERS [ 1067.581090][ T5903] cdc_mbim 3-1:1.0: bind() failure [ 1067.615744][ T5903] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 1067.633110][ T5903] cdc_ncm 3-1:1.1: bind() failure [ 1067.649550][ T5903] usb 3-1: USB disconnect, device number 123 [ 1068.013021][ T5903] usb 2-1: USB disconnect, device number 124 [ 1068.628809][ T10] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 1068.749119][ T5889] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 1068.808939][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 1068.819327][ T10] usb 2-1: config 0 has an invalid interface number: 6 but max is 0 [ 1068.828289][ T10] usb 2-1: config 0 has no interface number 0 [ 1068.882545][ T10] usb 2-1: config 0 interface 6 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1068.900640][ T5889] usb 3-1: Using ep0 maxpacket: 8 [ 1068.910889][ T5889] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 1068.915994][ T10] usb 2-1: config 0 interface 6 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1068.943383][ T5889] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 1068.954270][ T10] usb 2-1: config 0 interface 6 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1068.962446][ T5889] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1069.015598][ T5889] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 1069.041468][ T10] usb 2-1: config 0 interface 6 has no altsetting 0 [ 1069.048095][ T5889] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1069.088847][ T5889] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1069.098793][ T10] usb 2-1: New USB device found, idVendor=28bd, idProduct=0933, bcdDevice= 0.00 [ 1069.119838][ T5889] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1069.139386][ T5889] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1069.156663][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1069.214324][ T10] usb 2-1: config 0 descriptor?? [ 1069.336603][T19781] sctp: [Deprecated]: syz.5.3532 (pid 19781) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1069.336603][T19781] Use struct sctp_sack_info instead [ 1069.424055][ T5889] usb 3-1: usb_control_msg returned -32 [ 1069.432483][ T5889] usbtmc 3-1:16.0: can't read capabilities [ 1069.663794][ T10] uclogic 0003:28BD:0933.0027: interface is invalid, ignoring [ 1069.878838][T15869] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 1069.913328][ T5889] usb 2-1: USB disconnect, device number 125 [ 1069.993784][ C1] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1070.003358][T19766] usbtmc 3-1:16.0: Unable to send data, error -71 [ 1070.019047][T19766] usbtmc 3-1:16.0: usb_control_msg returned -32 [ 1070.034098][T15869] usb 6-1: Using ep0 maxpacket: 16 [ 1070.052853][T15869] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1070.084512][T15869] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1070.210783][T15869] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 1070.242944][T15869] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1070.278847][T15869] usb 6-1: config 0 descriptor?? [ 1070.725040][T15869] usbhid 6-1:0.0: can't add hid device: -71 [ 1070.739378][T15869] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1070.768203][T15869] usb 6-1: USB disconnect, device number 55 [ 1070.838843][ T5903] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 1071.001051][ T5903] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1071.018962][ T5903] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 62976, setting to 1024 [ 1071.031390][ T5903] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1071.065324][ T5903] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1071.075397][ T5903] usb 2-1: New USB device strings: Mfr=1, Product=130, SerialNumber=3 [ 1071.086488][ T5903] usb 2-1: Product: syz [ 1071.096297][ T5903] usb 2-1: Manufacturer: syz [ 1071.114972][ T5903] usb 2-1: SerialNumber: syz [ 1071.147896][ T5903] cdc_mbim 2-1:1.0: skipping garbage [ 1071.308541][T19807] syzkaller0: entered promiscuous mode [ 1071.314884][T19807] syzkaller0: entered allmulticast mode [ 1071.347999][T19800] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1071.428785][ T5889] usb 5-1: new low-speed USB device number 32 using dummy_hcd [ 1071.631991][ T5889] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1071.652417][ T5889] usb 5-1: config 1 has too many interfaces: 67, using maximum allowed: 32 [ 1071.662457][ T5889] usb 5-1: config 1 has 3 interfaces, different from the descriptor's value: 67 [ 1071.713472][ T5889] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1023, setting to 0 [ 1071.758948][ T5889] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1023, setting to 0 [ 1071.773991][ T5889] usb 5-1: config 1 interface 2 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1071.801009][ T5903] cdc_mbim 2-1:1.0: failed GET_NTB_PARAMETERS [ 1071.805948][ T5889] usb 5-1: string descriptor 0 read error: -22 [ 1071.813734][ T5903] cdc_mbim 2-1:1.0: bind() failure [ 1071.814386][ T5889] usb 5-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 1071.834008][ T5889] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1071.846815][ T5903] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1071.851846][ T5889] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1071.862010][ T5889] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 1071.877017][ T5903] cdc_ncm 2-1:1.1: bind() failure [ 1071.889412][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 1071.926382][ T5903] usb 2-1: USB disconnect, device number 126 [ 1072.055560][ T5889] usb 5-1: USB disconnect, device number 32 [ 1072.110727][T15869] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 1072.259868][ T5903] usb 3-1: USB disconnect, device number 124 [ 1072.271720][T15869] usb 4-1: config 27 has an invalid interface number: 25 but max is 0 [ 1072.285324][T15869] usb 4-1: config 27 has an invalid descriptor of length 73, skipping remainder of the config [ 1072.302670][T15869] usb 4-1: config 27 has no interface number 0 [ 1072.309017][T15869] usb 4-1: too many endpoints for config 27 interface 25 altsetting 201: 184, using maximum allowed: 30 [ 1072.359583][T15869] usb 4-1: config 27 interface 25 altsetting 201 has 0 endpoint descriptors, different from the interface descriptor's value: 184 [ 1072.398762][T15869] usb 4-1: config 27 interface 25 has no altsetting 0 [ 1072.405611][T15869] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1072.446181][T15869] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1072.585634][T19827] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3547'. [ 1072.647093][T19827] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3547'. [ 1072.712617][T19832] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3546'. [ 1072.752921][T15869] usb 4-1: string descriptor 0 read error: -71 [ 1072.775742][T15869] usb 4-1: USB disconnect, device number 7 [ 1072.810749][T19827] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3547'. [ 1072.823402][T19827] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3547'. [ 1073.037529][T13162] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1073.106471][T13162] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1073.214207][T13161] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1073.237613][T13161] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1073.759113][T19835] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3548'. [ 1073.791134][ T5889] usb 2-1: new full-speed USB device number 127 using dummy_hcd [ 1073.960600][ T5889] usb 2-1: too many endpoints for config 0 interface 0 altsetting 2: 254, using maximum allowed: 30 [ 1073.971901][ T5889] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1074.003589][ T5889] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1074.061294][ T5889] usb 2-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1074.076330][ T5889] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1074.197682][ T5889] usb 2-1: New USB device found, idVendor=1e7d, idProduct=3138, bcdDevice= 0.00 [ 1074.252117][ T5889] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1074.311625][ T5889] usb 2-1: config 0 descriptor?? [ 1074.783961][ T5889] ryos 0003:1E7D:3138.0028: ignoring exceeding usage max [ 1075.055794][ T5889] ryos 0003:1E7D:3138.0028: hidraw0: USB HID v0.00 Device [HID 1e7d:3138] on usb-dummy_hcd.1-1/input0 [ 1076.410853][ T5888] usb 2-1: USB disconnect, device number 127 [ 1077.508383][T19910] syz_tun: entered allmulticast mode [ 1077.539904][T19910] veth1_to_team: entered allmulticast mode [ 1077.937010][T19918] netlink: 'syz.2.3574': attribute type 1 has an invalid length. [ 1077.949040][ T5889] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 1078.111240][ T5889] usb 6-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1078.160982][ T5889] usb 6-1: config 1 has an invalid descriptor of length 128, skipping remainder of the config [ 1078.172366][ T5889] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1078.181665][ T5889] usb 6-1: config 1 has no interface number 1 [ 1078.203345][ T5889] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1078.229161][ T5889] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1078.238468][ T5889] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1078.274685][ T5889] usb 6-1: Product: syz [ 1078.298869][ T5889] usb 6-1: Manufacturer: syz [ 1078.311668][ T5889] usb 6-1: SerialNumber: syz [ 1078.591293][ T5889] usb 6-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 1078.600787][ T5889] usb 6-1: MIDIStreaming interface descriptor not found [ 1078.651066][T19909] syz_tun: left allmulticast mode [ 1079.004004][ T5889] usb 6-1: USB disconnect, device number 56 [ 1079.063663][T19944] FAULT_INJECTION: forcing a failure. [ 1079.063663][T19944] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1079.126942][T19944] CPU: 0 UID: 0 PID: 19944 Comm: syz.4.3580 Tainted: G L syzkaller #0 PREEMPT(full) [ 1079.126962][T19944] Tainted: [L]=SOFTLOCKUP [ 1079.126967][T19944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1079.126974][T19944] Call Trace: [ 1079.126979][T19944] [ 1079.126984][T19944] dump_stack_lvl+0xe8/0x150 [ 1079.127003][T19944] should_fail_ex+0x412/0x560 [ 1079.127020][T19944] _copy_from_user+0x2d/0xb0 [ 1079.127037][T19944] lowpan_control_write+0x108/0x8f0 [ 1079.127054][T19944] ? __pfx_lowpan_control_write+0x10/0x10 [ 1079.127070][T19944] ? __pfx___debugfs_file_get+0x10/0x10 [ 1079.127087][T19944] full_proxy_write+0x127/0x1f0 [ 1079.127098][T19944] ? __pfx_full_proxy_write+0x10/0x10 [ 1079.127109][T19944] vfs_write+0x29a/0xb90 [ 1079.127125][T19944] ? __pfx_vfs_write+0x10/0x10 [ 1079.127137][T19944] ? __fget_files+0x2a/0x420 [ 1079.127154][T19944] ? __fget_files+0x3a0/0x420 [ 1079.127167][T19944] ? __fget_files+0x2a/0x420 [ 1079.127185][T19944] ksys_write+0x150/0x270 [ 1079.127197][T19944] ? __pfx_ksys_write+0x10/0x10 [ 1079.127213][T19944] do_syscall_64+0x14d/0xf80 [ 1079.127223][T19944] ? trace_irq_disable+0x3b/0x150 [ 1079.127238][T19944] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1079.127248][T19944] ? clear_bhb_loop+0x40/0x90 [ 1079.127260][T19944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1079.127270][T19944] RIP: 0033:0x7f8480d9c799 [ 1079.127281][T19944] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1079.127290][T19944] RSP: 002b:00007f8481c7b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1079.127302][T19944] RAX: ffffffffffffffda RBX: 00007f8481015fa0 RCX: 00007f8480d9c799 [ 1079.127309][T19944] RDX: 000000000000001b RSI: 0000200000000140 RDI: 0000000000000003 [ 1079.127316][T19944] RBP: 00007f8481c7b090 R08: 0000000000000000 R09: 0000000000000000 [ 1079.127322][T19944] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1079.127328][T19944] R13: 00007f8481016038 R14: 00007f8481015fa0 R15: 00007f848113fa48 [ 1079.127344][T19944] [ 1079.670394][T19949] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3583'. [ 1079.925572][T19956] netlink: 'syz.5.3584': attribute type 13 has an invalid length. [ 1081.218750][T17518] usb 3-1: new full-speed USB device number 125 using dummy_hcd [ 1081.431194][T17518] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1081.443669][T17518] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1081.483588][T17518] usb 3-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1081.581431][T17518] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1081.597306][T19978] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3590'. [ 1081.642079][T17518] usb 3-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 1081.651381][ T5889] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 1081.667789][T17518] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1081.700077][T17518] usb 3-1: Product: syz [ 1081.718731][T17518] usb 3-1: Manufacturer: syz [ 1081.723375][T17518] usb 3-1: SerialNumber: syz [ 1081.760386][T17518] usb 3-1: config 0 descriptor?? [ 1081.783821][T17518] snd_usb_toneport 3-1:0.0: Line 6 TonePort UX2 found [ 1081.835395][ T5889] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1081.853744][ T5889] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1081.885405][ T5889] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1081.928611][ T5889] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1081.971269][T17518] snd_usb_toneport 3-1:0.0: cannot get proper max packet size [ 1081.991924][ T5889] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1082.000707][T17518] snd_usb_toneport 3-1:0.0: Line 6 TonePort UX2 now disconnected [ 1082.027163][ T5889] usb 4-1: config 0 descriptor?? [ 1082.032826][T17518] snd_usb_toneport 3-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 1082.275380][T17518] usb 3-1: USB disconnect, device number 125 [ 1082.477193][ T5889] plantronics 0003:047F:FFFF.0029: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 1082.720661][ T5889] usb 4-1: USB disconnect, device number 8 [ 1084.148568][T20003] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3597'. [ 1084.158430][T20003] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3597'. [ 1084.172696][T20003] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3597'. [ 1084.597292][ T5889] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 1084.771316][ T5889] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1084.787705][ T5889] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1084.848728][ T5889] usb 4-1: Product: syz [ 1084.852958][ T5889] usb 4-1: Manufacturer: syz [ 1084.888741][ T5889] usb 4-1: SerialNumber: syz [ 1084.915813][ T5889] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1085.095210][ T5888] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1085.361503][T20026] syzkaller0: entered promiscuous mode [ 1085.367447][T20026] syzkaller0: entered allmulticast mode [ 1086.199171][ T5888] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 1086.217035][ T5888] ath9k_htc: Failed to initialize the device [ 1086.255181][ T5888] usb 4-1: ath9k_htc: USB layer deinitialized [ 1086.282261][T20038] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3605'. [ 1086.636449][ T5889] usb 4-1: USB disconnect, device number 9 [ 1086.758831][ T5903] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 1086.948240][ T5903] usb 2-1: config 0 has an invalid interface number: 251 but max is 0 [ 1086.956739][ T5903] usb 2-1: config 0 has no interface number 0 [ 1086.966446][ T5903] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=77.f4 [ 1086.975960][ T5903] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1086.984237][ T5903] usb 2-1: Product: syz [ 1087.000513][ T5903] usb 2-1: Manufacturer: syz [ 1087.005159][ T5903] usb 2-1: SerialNumber: syz [ 1087.018820][ T5889] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 1087.077622][ T5903] usb 2-1: config 0 descriptor?? [ 1087.098151][T20029] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1087.188809][ T5889] usb 4-1: Using ep0 maxpacket: 8 [ 1087.200345][ T5889] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 1087.217544][ T5889] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1087.237772][ T5889] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1087.257889][ T5889] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 24864, setting to 1024 [ 1087.298576][ T5889] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1087.298798][ T5896] usb 3-1: new full-speed USB device number 126 using dummy_hcd [ 1087.316914][ T5889] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1087.338764][ T5889] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1087.370628][ T5889] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1087.370788][T20029] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1087.399369][T20029] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1087.480760][ T5896] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1087.489825][ T5896] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 1087.508854][ T5896] usb 3-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 1087.532000][ T5896] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1087.548800][ T5896] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1087.567200][ T5896] usb 3-1: Product: syz [ 1087.577354][ T5896] usb 3-1: Manufacturer: syz [ 1087.588777][ T5896] usb 3-1: SerialNumber: syz [ 1087.632967][ T5889] usb 4-1: GET_CAPABILITIES returned 0 [ 1087.652532][ T5889] usbtmc 4-1:16.0: can't read capabilities [ 1087.732335][ T5903] asix 2-1:0.251: probe with driver asix failed with error -71 [ 1087.780687][ T5903] usb 2-1: USB disconnect, device number 2 [ 1087.828385][T20050] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1087.850874][T20050] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1087.864717][ C0] usbtmc 4-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 1087.866096][ T5889] usb 4-1: USB disconnect, device number 10 [ 1088.087359][T20061] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3611'. [ 1088.244456][T20067] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3609'. [ 1088.427859][T20062] bond0: (slave macsec1): Error -34 calling dev_set_mtu [ 1089.541923][ T30] audit: type=1326 audit(1773303425.940:681): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20082 comm="syz.5.3616" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa40079c799 code=0x0 [ 1089.830006][T20088] netlink: 'syz.1.3618': attribute type 1 has an invalid length. [ 1089.841944][T20088] netlink: 'syz.1.3618': attribute type 1 has an invalid length. [ 1090.109464][ T5896] usb 3-1: 2:1 : no or invalid class specific endpoint descriptor [ 1090.117576][ T5896] usb 3-1: 2:1 : unknown format tag 0x0 is detected. processed as MPEG. [ 1090.151487][ T5896] usb 3-1: found format II with max.bitrate = 128, frame size=0 [ 1090.164640][ T5896] usb 3-1: 2:1: All rates were zero [ 1090.198996][T17518] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1090.301840][T20104] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3623'. [ 1090.407699][T17518] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 1090.419278][T17518] usb 2-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1090.646565][T17518] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1090.661577][ T5896] usb 3-1: USB disconnect, device number 126 [ 1090.694509][T17518] usb 2-1: config 220 has no interface number 2 [ 1090.709784][T17518] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1090.781999][T16351] udevd[16351]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1090.819726][T17518] usb 2-1: config 220 interface 0 has no altsetting 0 [ 1090.880105][T17518] usb 2-1: config 220 interface 76 has no altsetting 0 [ 1090.887607][T17518] usb 2-1: config 220 interface 1 has no altsetting 0 [ 1090.914664][T17518] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1090.932979][T17518] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1090.948987][T17518] usb 2-1: Product: syz [ 1090.956436][T17518] usb 2-1: Manufacturer: syz [ 1090.961870][T17518] usb 2-1: SerialNumber: syz [ 1091.159934][ T5896] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 1091.196324][T17518] uvcvideo 2-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1091.206948][T17518] uvcvideo 2-1:220.0: No valid video chain found. [ 1091.217451][T17518] usb 2-1: selecting invalid altsetting 0 [ 1091.250163][T17518] usb 2-1: selecting invalid altsetting 0 [ 1091.256042][T17518] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 1091.350163][T20115] tipc: Started in network mode [ 1091.355239][T20115] tipc: Node identity ba8adb529b76, cluster identity 4711 [ 1091.368727][T20115] tipc: Enabled bearer , priority 0 [ 1091.378342][T20115] syzkaller0: entered promiscuous mode [ 1091.384112][T20115] syzkaller0: entered allmulticast mode [ 1091.389786][ T5896] usb 3-1: Using ep0 maxpacket: 16 [ 1091.392564][T17518] usb 2-1: USB disconnect, device number 3 [ 1091.404736][ T5896] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1091.413805][ T5896] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1091.430664][ T5896] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1091.446894][ T5896] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1091.463820][ T5896] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1091.486986][ T5896] usb 3-1: Product: syz [ 1091.498952][ T5896] usb 3-1: Manufacturer: syz [ 1091.504616][T20109] vivid-000: disconnect [ 1091.513829][ T5896] usb 3-1: SerialNumber: syz [ 1091.530375][T20109] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1091.747804][T20105] vivid-000: reconnect [ 1092.056755][T20111] tipc: Resetting bearer [ 1092.114301][T20111] tipc: Disabling bearer [ 1092.188956][T17518] af_packet: tpacket_rcv: packet too big, clamped from 76 to 4294967272. macoff=96 [ 1092.339102][T15869] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1092.490575][T15869] usb 2-1: config index 0 descriptor too short (expected 62388, got 18) [ 1092.505722][T15869] usb 2-1: config 115 has too many interfaces: 53, using maximum allowed: 32 [ 1092.524948][T15869] usb 2-1: config 115 has an invalid descriptor of length 222, skipping remainder of the config [ 1092.556704][T15869] usb 2-1: config 115 has 0 interfaces, different from the descriptor's value: 53 [ 1092.581469][T15869] usb 2-1: New USB device found, idVendor=0471, idProduct=fffb, bcdDevice=dc.7b [ 1092.594750][T15869] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.629080][T15869] usb 2-1: Product: syz [ 1092.639004][T15869] usb 2-1: Manufacturer: syz [ 1092.678874][T17518] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 1092.718149][T15869] usb 2-1: SerialNumber: syz [ 1092.843116][T17518] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1092.854564][T17518] usb 6-1: config 63 has an invalid interface number: 66 but max is 0 [ 1092.864677][T17518] usb 6-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 1092.878266][T17518] usb 6-1: config 63 has no interface number 0 [ 1092.898852][T17518] usb 6-1: config 63 interface 66 has no altsetting 0 [ 1092.909365][T17518] usb 6-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 1092.922911][T17518] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.931629][T17518] usb 6-1: Product: syz [ 1092.935936][T17518] usb 6-1: Manufacturer: syz [ 1092.941647][T17518] usb 6-1: SerialNumber: syz [ 1092.988023][T20118] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3627'. [ 1093.075244][ T5896] usb 3-1: 0:2 : does not exist [ 1093.088307][ T5896] usb 3-1: 1:0: failed to get current value for ch 0 (-22) [ 1093.128838][ T5888] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 1093.181174][T17518] uvcvideo 6-1:63.66: Found UVC 0.07 device syz (174f:8acf) [ 1093.203544][T17518] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 6 on unit 1: -71 (exp. 1). [ 1093.234228][T20146] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3634'. [ 1093.236438][ T5896] usb 3-1: USB disconnect, device number 127 [ 1093.255169][T17518] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 9 on unit 1: -71 (exp. 1). [ 1093.286389][T17518] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 1 on unit 1: -71 (exp. 1). [ 1093.301744][ T5888] usb 5-1: Using ep0 maxpacket: 16 [ 1093.315534][T16351] udevd[16351]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1093.316253][ T5888] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1093.345098][T17518] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 4 on unit 1: -71 (exp. 1). [ 1093.371099][T17518] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 17 on unit 1: -71 (exp. 1). [ 1093.388018][ T5888] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1093.390671][T20148] FAULT_INJECTION: forcing a failure. [ 1093.390671][T20148] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1093.398101][T17518] uvcvideo 6-1:63.66: No streaming interface found for terminal 29. [ 1093.422772][ T5888] usb 5-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 1093.432230][ T5888] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1093.441042][T17518] uvcvideo 6-1:63.66: Entity type for entity Output 32773 was not initialized! [ 1093.442007][T20148] CPU: 0 UID: 0 PID: 20148 Comm: syz.2.3636 Tainted: G L syzkaller #0 PREEMPT(full) [ 1093.442033][T20148] Tainted: [L]=SOFTLOCKUP [ 1093.442040][T20148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1093.442051][T20148] Call Trace: [ 1093.442061][T20148] [ 1093.442105][T20148] dump_stack_lvl+0xe8/0x150 [ 1093.442137][T20148] should_fail_ex+0x412/0x560 [ 1093.442164][T20148] _copy_from_user+0x2d/0xb0 [ 1093.442190][T20148] lowpan_control_write+0x108/0x8f0 [ 1093.442218][T20148] ? __pfx_lowpan_control_write+0x10/0x10 [ 1093.442247][T20148] ? __pfx___debugfs_file_get+0x10/0x10 [ 1093.442275][T20148] full_proxy_write+0x127/0x1f0 [ 1093.442294][T20148] ? __pfx_full_proxy_write+0x10/0x10 [ 1093.442314][T20148] vfs_write+0x29a/0xb90 [ 1093.442341][T20148] ? __pfx_vfs_write+0x10/0x10 [ 1093.442361][T20148] ? __fget_files+0x2a/0x420 [ 1093.442389][T20148] ? __fget_files+0x3a0/0x420 [ 1093.442412][T20148] ? __fget_files+0x2a/0x420 [ 1093.442443][T20148] ksys_write+0x150/0x270 [ 1093.442464][T20148] ? __pfx_ksys_write+0x10/0x10 [ 1093.442492][T20148] do_syscall_64+0x14d/0xf80 [ 1093.442509][T20148] ? trace_irq_disable+0x3b/0x150 [ 1093.442533][T20148] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1093.442551][T20148] ? clear_bhb_loop+0x40/0x90 [ 1093.442572][T20148] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1093.442590][T20148] RIP: 0033:0x7f4e0e19c799 [ 1093.442607][T20148] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1093.442622][T20148] RSP: 002b:00007f4e0ef92028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1093.442640][T20148] RAX: ffffffffffffffda RBX: 00007f4e0e415fa0 RCX: 00007f4e0e19c799 [ 1093.442653][T20148] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 1093.442663][T20148] RBP: 00007f4e0ef92090 R08: 0000000000000000 R09: 0000000000000000 [ 1093.442673][T20148] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1093.442684][T20148] R13: 00007f4e0e416038 R14: 00007f4e0e415fa0 R15: 00007f4e0e53fa48 [ 1093.442712][T20148] [ 1093.664371][ T5888] usb 5-1: config 0 descriptor?? [ 1093.709567][T17518] usb 6-1: USB disconnect, device number 57 [ 1093.829039][T20156] fuse: Unknown parameter 'fd0xffffffffffffffff00000000000000000000' [ 1094.071647][T17518] usb 6-1: new full-speed USB device number 58 using dummy_hcd [ 1094.087703][ T5888] usbhid 5-1:0.0: can't add hid device: -71 [ 1094.093814][ T5888] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1094.111992][ T5903] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1094.112237][ T5888] usb 5-1: USB disconnect, device number 33 [ 1094.262479][T17518] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1094.271465][T17518] usb 6-1: not running at top speed; connect to a high speed hub [ 1094.284079][T17518] usb 6-1: config 63 has an invalid interface number: 66 but max is 0 [ 1094.293321][ T5903] usb 4-1: Using ep0 maxpacket: 16 [ 1094.295209][T17518] usb 6-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 1094.310918][T17518] usb 6-1: config 63 has no interface number 0 [ 1094.317208][T17518] usb 6-1: config 63 interface 66 has no altsetting 0 [ 1094.360184][ T5903] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1094.406359][T17518] usb 6-1: string descriptor 0 read error: -22 [ 1094.415695][ T5903] usb 4-1: config 0 has no interfaces? [ 1094.421710][T17518] usb 6-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 1094.465615][T17518] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1094.484965][ T5903] usb 4-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 1094.494531][ T5903] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1094.515086][ T5903] usb 4-1: Product: syz [ 1094.523308][ T5903] usb 4-1: Manufacturer: syz [ 1094.528538][ T5903] usb 4-1: SerialNumber: syz [ 1094.536455][T17518] uvcvideo 6-1:63.66: Found UVC 0.07 device (174f:8acf) [ 1094.539044][ T5903] usb 4-1: config 0 descriptor?? [ 1094.856974][T20156] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3637'. [ 1094.866510][T20156] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3637'. [ 1095.004755][T15869] usb 2-1: USB disconnect, device number 4 [ 1095.347342][T17518] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 6 on unit 1: -71 (exp. 1). [ 1095.425987][T17518] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 9 on unit 1: -71 (exp. 1). [ 1095.512885][T17518] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 1 on unit 1: -71 (exp. 1). [ 1095.609269][T17518] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 4 on unit 1: -71 (exp. 1). [ 1095.686659][ T30] audit: type=1326 audit(1773303432.090:682): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20179 comm="syz.4.3644" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8480d9c799 code=0x7ffc0000 [ 1095.780972][ T30] audit: type=1326 audit(1773303432.090:683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20179 comm="syz.4.3644" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8480d9c799 code=0x7ffc0000 [ 1095.823182][ T30] audit: type=1326 audit(1773303432.120:684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20179 comm="syz.4.3644" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f8480d9c799 code=0x7ffc0000 [ 1095.824628][T17518] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 17 on unit 1: -71 (exp. 1). [ 1095.855789][ T30] audit: type=1326 audit(1773303432.130:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20179 comm="syz.4.3644" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8480d9c799 code=0x7ffc0000 [ 1095.911215][ T30] audit: type=1326 audit(1773303432.130:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20179 comm="syz.4.3644" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8480d9c799 code=0x7ffc0000 [ 1095.936326][ T30] audit: type=1326 audit(1773303432.230:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20179 comm="syz.4.3644" exe="/root/syz-executor" sig=0 arch=c000003e syscall=226 compat=0 ip=0x7f8480d9c799 code=0x7ffc0000 [ 1095.960118][ T30] audit: type=1326 audit(1773303432.230:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20179 comm="syz.4.3644" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8480d9c799 code=0x7ffc0000 [ 1096.004752][ T30] audit: type=1326 audit(1773303432.230:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20179 comm="syz.4.3644" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8480d9c799 code=0x7ffc0000 [ 1096.033152][ T30] audit: type=1326 audit(1773303432.320:690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20179 comm="syz.4.3644" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f8480d9c799 code=0x7ffc0000 [ 1096.062795][T20180] netlink: 'syz.4.3644': attribute type 11 has an invalid length. [ 1096.075718][T20180] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3644'. [ 1096.148345][ T30] audit: type=1326 audit(1773303432.320:691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20179 comm="syz.4.3644" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8480d9c799 code=0x7ffc0000 [ 1096.173168][T17518] uvcvideo 6-1:63.66: No streaming interface found for terminal 29. [ 1096.216253][T17518] uvcvideo 6-1:63.66: Entity type for entity Output 32773 was not initialized! [ 1096.262026][T17518] usb 6-1: USB disconnect, device number 58 [ 1096.329007][T20189] fuse: Unknown parameter '*"grou00000000000000000000' [ 1096.528896][T20192] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3647'. [ 1096.781791][ T5903] usb 4-1: USB disconnect, device number 11 [ 1098.235899][ T5829] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 1098.431463][ T5829] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1098.445340][ T5829] usb 6-1: config 63 has an invalid interface number: 66 but max is 0 [ 1098.453907][ T5829] usb 6-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 1098.465641][ T5829] usb 6-1: config 63 has no interface number 0 [ 1098.472298][ T5829] usb 6-1: config 63 interface 66 has no altsetting 0 [ 1098.537248][ T5829] usb 6-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 1098.620648][ T5829] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1098.678390][ T5829] usb 6-1: Product: syz [ 1098.683517][ T5829] usb 6-1: Manufacturer: syz [ 1098.688143][ T5829] usb 6-1: SerialNumber: syz [ 1098.710730][T20229] Attempt to restore checkpoint with obsolete wellknown handles [ 1098.951365][ T5829] uvcvideo 6-1:63.66: Found UVC 0.07 device syz (174f:8acf) [ 1098.968290][ T5829] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 6 on unit 1: -71 (exp. 1). [ 1098.991203][ T5829] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 9 on unit 1: -71 (exp. 1). [ 1099.002967][ T5829] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 1 on unit 1: -71 (exp. 1). [ 1099.013816][ T5829] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 4 on unit 1: -71 (exp. 1). [ 1099.050789][ T5829] uvcvideo 6-1:63.66: Failed to query (GET_INFO) UVC control 17 on unit 1: -71 (exp. 1). [ 1099.068928][ T5829] uvcvideo 6-1:63.66: No streaming interface found for terminal 29. [ 1099.140680][ T5829] uvcvideo 6-1:63.66: Entity type for entity Output 32773 was not initialized! [ 1099.189061][ T5829] usb 6-1: USB disconnect, device number 59 [ 1099.192231][T20242] netlink: 100 bytes leftover after parsing attributes in process `syz.3.3660'. [ 1099.354383][T20242] netlink: 'syz.3.3660': attribute type 3 has an invalid length. [ 1099.401174][T20244] netlink: 364 bytes leftover after parsing attributes in process `syz.4.3662'. [ 1100.110782][T20257] FAULT_INJECTION: forcing a failure. [ 1100.110782][T20257] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1100.144616][T20257] CPU: 1 UID: 0 PID: 20257 Comm: syz.3.3667 Tainted: G L syzkaller #0 PREEMPT(full) [ 1100.144646][T20257] Tainted: [L]=SOFTLOCKUP [ 1100.144653][T20257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1100.144664][T20257] Call Trace: [ 1100.144672][T20257] [ 1100.144687][T20257] dump_stack_lvl+0xe8/0x150 [ 1100.144718][T20257] should_fail_ex+0x412/0x560 [ 1100.144746][T20257] _copy_from_user+0x2d/0xb0 [ 1100.144772][T20257] __copy_msghdr+0x3c5/0x5b0 [ 1100.144794][T20257] ___sys_sendmsg+0x213/0x360 [ 1100.144818][T20257] ? __pfx____sys_sendmsg+0x10/0x10 [ 1100.144878][T20257] __sys_sendmmsg+0x27c/0x4e0 [ 1100.144902][T20257] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1100.144918][T20257] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1100.144958][T20257] ? ksys_write+0x242/0x270 [ 1100.144980][T20257] ? __pfx_ksys_write+0x10/0x10 [ 1100.145005][T20257] __x64_sys_sendmmsg+0xa0/0xc0 [ 1100.145026][T20257] do_syscall_64+0x14d/0xf80 [ 1100.145042][T20257] ? trace_irq_disable+0x3b/0x150 [ 1100.145067][T20257] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1100.145086][T20257] ? clear_bhb_loop+0x40/0x90 [ 1100.145107][T20257] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1100.145125][T20257] RIP: 0033:0x7f996f39c799 [ 1100.145142][T20257] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1100.145158][T20257] RSP: 002b:00007f996d5f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1100.145177][T20257] RAX: ffffffffffffffda RBX: 00007f996f615fa0 RCX: 00007f996f39c799 [ 1100.145190][T20257] RDX: 0000000000000002 RSI: 00002000000094c0 RDI: 0000000000000003 [ 1100.145202][T20257] RBP: 00007f996d5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1100.145213][T20257] R10: 0000000000000010 R11: 0000000000000246 R12: 0000000000000001 [ 1100.145224][T20257] R13: 00007f996f616038 R14: 00007f996f615fa0 R15: 00007f996f73fa48 [ 1100.145251][T20257] [ 1100.728825][ T5903] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 1101.080147][ T5903] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 1101.104281][ T5903] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1101.201925][ T5903] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1101.360886][ T5903] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1101.475572][ T5829] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 1101.540623][ T5903] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1101.550951][ T5903] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1101.598902][ T5903] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1101.620961][ T5903] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1101.669441][ T5829] usb 5-1: Using ep0 maxpacket: 32 [ 1101.675596][ T5903] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1101.696198][ T5829] usb 5-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 1101.708974][ T5829] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1101.732122][ T5829] usb 5-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 1101.741458][ T5903] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1101.758114][ T5903] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1101.769370][ T5829] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1101.790687][ T5903] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1101.809151][ T5829] usb 5-1: config 0 descriptor?? [ 1101.904185][ T5903] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1101.949028][ T5903] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1101.968395][T20282] fuse: Bad value for 'fd' [ 1101.995744][ T5903] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1102.294334][ T5903] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1102.302521][ T5829] corsair-cpro 0003:1B1C:0C10.002A: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.4-1/input0 [ 1102.397388][ T5903] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1102.421669][ T5903] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1102.467095][ T5903] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1102.582946][ T5903] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1102.631586][ T5903] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1102.652650][ T5903] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1102.659645][ T5888] usb 6-1: new full-speed USB device number 60 using dummy_hcd [ 1102.696118][ T5903] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1102.705497][ T5903] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1102.717100][ T5903] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1102.731267][ T5903] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1102.743860][ T5824] Bluetooth: hci0: unexpected event 0x2f length: 509 > 260 [ 1102.805167][ T5903] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1102.821994][ T5903] usb 3-1: Product: syz [ 1102.826187][ T5903] usb 3-1: Manufacturer: syz [ 1102.832394][ T5829] corsair-cpro 0003:1B1C:0C10.002A: probe with driver corsair-cpro failed with error -71 [ 1102.832918][ T5888] usb 6-1: config 0 has an invalid descriptor of length 128, skipping remainder of the config [ 1102.895523][ T5903] usb 3-1: SerialNumber: syz [ 1102.906983][ T5903] usb 3-1: config 0 descriptor?? [ 1102.932620][ T5903] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 1102.932975][ T5896] usb 5-1: USB disconnect, device number 34 [ 1103.132638][ T5888] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1103.160081][ T5888] usb 6-1: New USB device found, idVendor=0755, idProduct=2626, bcdDevice= 0.00 [ 1103.179189][T20301] FAULT_INJECTION: forcing a failure. [ 1103.179189][T20301] name failslab, interval 1, probability 0, space 0, times 0 [ 1103.188312][ T5888] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1103.195241][T20301] CPU: 0 UID: 0 PID: 20301 Comm: syz.3.3680 Tainted: G L syzkaller #0 PREEMPT(full) [ 1103.195270][T20301] Tainted: [L]=SOFTLOCKUP [ 1103.195277][T20301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1103.195288][T20301] Call Trace: [ 1103.195296][T20301] [ 1103.195305][T20301] dump_stack_lvl+0xe8/0x150 [ 1103.195334][T20301] should_fail_ex+0x412/0x560 [ 1103.195361][T20301] should_failslab+0xa8/0x100 [ 1103.195389][T20301] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1103.195410][T20301] ? dup_task_struct+0x57/0x9a0 [ 1103.195438][T20301] dup_task_struct+0x57/0x9a0 [ 1103.195462][T20301] ? _raw_spin_unlock_irq+0x23/0x50 [ 1103.195489][T20301] copy_process+0x508/0x3cf0 [ 1103.195512][T20301] ? stack_depot_save_flags+0x33/0x810 [ 1103.195540][T20301] ? kasan_save_track+0x4f/0x80 [ 1103.195557][T20301] ? kasan_save_track+0x3e/0x80 [ 1103.195574][T20301] ? __kasan_kmalloc+0x93/0xb0 [ 1103.195592][T20301] ? create_io_worker+0xab/0x5c0 [ 1103.195609][T20301] ? io_wq_enqueue+0x675/0x8a0 [ 1103.195632][T20301] ? io_handle_tw_list+0x3db/0x540 [ 1103.195649][T20301] ? tctx_task_work_run+0x55/0x330 [ 1103.195666][T20301] ? tctx_task_work+0x3f/0x90 [ 1103.195683][T20301] ? task_work_run+0x1d9/0x270 [ 1103.195699][T20301] ? get_signal+0x11eb/0x1330 [ 1103.195718][T20301] ? arch_do_signal_or_restart+0xbc/0x830 [ 1103.195737][T20301] ? exit_to_user_mode_loop+0x86/0x480 [ 1103.195757][T20301] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1103.195780][T20301] ? __pfx_copy_process+0x10/0x10 [ 1103.195807][T20301] ? __pfx_io_wq_worker+0x10/0x10 [ 1103.195831][T20301] ? __pfx_io_wq_worker+0x10/0x10 [ 1103.195849][T20301] create_io_thread+0xfc/0x170 [ 1103.195877][T20301] ? __pfx_create_io_thread+0x10/0x10 [ 1103.195907][T20301] ? __pfx_io_wq_worker+0x10/0x10 [ 1103.195929][T20301] ? __raw_spin_lock_init+0x45/0x100 [ 1103.195949][T20301] ? __init_swait_queue_head+0xa9/0x150 [ 1103.195968][T20301] ? create_io_worker+0x27/0x5c0 [ 1103.195985][T20301] create_io_worker+0x181/0x5c0 [ 1103.196006][T20301] io_wq_enqueue+0x675/0x8a0 [ 1103.196030][T20301] ? io_wq_enqueue+0x332/0x8a0 [ 1103.196053][T20301] ? __pfx_io_wq_work_match_item+0x10/0x10 [ 1103.196081][T20301] ? __pfx_io_req_task_submit+0x10/0x10 [ 1103.196106][T20301] io_handle_tw_list+0x3db/0x540 [ 1103.196130][T20301] tctx_task_work_run+0x55/0x330 [ 1103.196151][T20301] tctx_task_work+0x3f/0x90 [ 1103.196171][T20301] task_work_run+0x1d9/0x270 [ 1103.196192][T20301] ? __pfx_task_work_run+0x10/0x10 [ 1103.196220][T20301] get_signal+0x11eb/0x1330 [ 1103.196248][T20301] ? kasan_quarantine_put+0xbb/0x1f0 [ 1103.196266][T20301] ? lockdep_hardirqs_on+0x7a/0x110 [ 1103.196299][T20301] arch_do_signal_or_restart+0xbc/0x830 [ 1103.196321][T20301] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1103.196339][T20301] ? do_sys_openat2+0x14c/0x200 [ 1103.196368][T20301] ? ksys_write+0x242/0x270 [ 1103.196395][T20301] exit_to_user_mode_loop+0x86/0x480 [ 1103.196415][T20301] ? rcu_is_watching+0x15/0xb0 [ 1103.196442][T20301] do_syscall_64+0x32d/0xf80 [ 1103.196457][T20301] ? trace_irq_disable+0x3b/0x150 [ 1103.196482][T20301] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1103.196500][T20301] ? clear_bhb_loop+0x40/0x90 [ 1103.196521][T20301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1103.196539][T20301] RIP: 0033:0x7f996f39c799 [ 1103.196557][T20301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1103.196572][T20301] RSP: 002b:00007f996d5f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 1103.196591][T20301] RAX: 0000000000000006 RBX: 00007f996f615fa0 RCX: 00007f996f39c799 [ 1103.196604][T20301] RDX: 0000000000000000 RSI: 0000000000000084 RDI: 00002000000002c0 [ 1103.196616][T20301] RBP: 00007f996d5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1103.196626][T20301] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1103.196637][T20301] R13: 00007f996f616038 R14: 00007f996f615fa0 R15: 00007f996f73fa48 [ 1103.196665][T20301] [ 1103.608872][ T5888] usb 6-1: config 0 descriptor?? [ 1103.647835][ T5888] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1103.780719][T20305] tipc: Enabled bearer , priority 0 [ 1103.804357][T20305] syzkaller0: entered promiscuous mode [ 1103.833592][T20305] syzkaller0: entered allmulticast mode [ 1103.938158][T20310] usb usb8: usbfs: process 20310 (syz.5.3678) did not claim interface 0 before use [ 1103.993843][ T5888] usb 6-1: USB disconnect, device number 60 [ 1104.027724][ T5829] usb 3-1: USB disconnect, device number 2 [ 1104.037582][ T5829] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 1104.168856][ T5903] usb 5-1: new low-speed USB device number 35 using dummy_hcd [ 1104.374359][ T5903] usb 5-1: config 0 has no interfaces? [ 1104.399120][ T5903] usb 5-1: string descriptor 0 read error: -22 [ 1104.432940][ T5903] usb 5-1: New USB device found, idVendor=0bc7, idProduct=0002, bcdDevice=9e.7c [ 1104.462891][ T5903] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 1104.586074][ T5903] usb 5-1: config 0 descriptor?? [ 1104.822297][T20331] tipc: Failed to obtain node identity [ 1104.827795][T20331] tipc: Enabling of bearer rejected, failed to enable media [ 1104.899002][T20304] tipc: Resetting bearer [ 1105.080519][T20304] tipc: Disabling bearer [ 1105.510727][T20344] netlink: 88 bytes leftover after parsing attributes in process `syz.3.3693'. [ 1105.555811][T20344] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3693'. [ 1105.664037][T20349] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1105.730250][T20349] netlink: 'syz.1.3694': attribute type 20 has an invalid length. [ 1107.610669][T17051] usb 5-1: USB disconnect, device number 35 [ 1108.226532][T20387] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1108.268226][T20388] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1108.359439][ T5829] usb 6-1: new full-speed USB device number 61 using dummy_hcd [ 1108.887651][ T5829] usb 6-1: config 0 has an invalid interface number: 66 but max is 0 [ 1108.896296][ T5903] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 1108.909200][ T5829] usb 6-1: config 0 has an invalid descriptor of length 93, skipping remainder of the config [ 1108.936860][ T5829] usb 6-1: config 0 has no interface number 0 [ 1108.950317][ T5829] usb 6-1: config 0 interface 66 altsetting 29 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 1108.977991][ T5829] usb 6-1: config 0 interface 66 has no altsetting 0 [ 1108.990750][ T5829] usb 6-1: New USB device found, idVendor=150a, idProduct=1203, bcdDevice= 0.00 [ 1109.009134][ T5829] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1109.034654][ T5829] usb 6-1: config 0 descriptor?? [ 1109.049078][ T5903] usb 5-1: Using ep0 maxpacket: 8 [ 1109.056742][ T5903] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1109.069962][ T5903] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1109.083333][ T5903] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1109.084894][T20394] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3705'. [ 1109.130969][ T5903] usb 5-1: Product: syz [ 1109.135198][ T5903] usb 5-1: Manufacturer: syz [ 1109.140136][ T5903] usb 5-1: SerialNumber: syz [ 1109.511846][ T5903] usb 5-1: config 0 descriptor?? [ 1109.628422][ T5903] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1109.644950][ T5829] usb 6-1: string descriptor 0 read error: -71 [ 1110.024006][ T5829] usb 6-1: USB disconnect, device number 61 [ 1110.048824][ T5896] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1110.221265][ T5896] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1110.268851][ T5896] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1110.328734][ T5896] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1110.366011][ T5896] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1110.405699][ T5896] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1110.426024][ T5896] usb 4-1: Product: syz [ 1110.438756][ T5896] usb 4-1: Manufacturer: syz [ 1110.458754][ T5896] usb 4-1: SerialNumber: syz [ 1110.485533][ T5896] usb 4-1: config 0 descriptor?? [ 1110.503563][T20397] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1110.512306][T20397] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1110.551688][ T5896] usb 4-1: ucan: probing device on interface #0 [ 1111.088960][ T5903] gspca_zc3xx: reg_w_i err -71 [ 1111.164037][ T5896] ucan 4-1:0.0: probe with driver ucan failed with error -22 [ 1111.698727][ T5903] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1111.706385][ T5903] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 1111.738624][ T5903] usb 5-1: USB disconnect, device number 36 [ 1112.026237][T20433] binder: 20430:20433 ioctl c0306201 2000000004c0 returned -14 [ 1112.747231][ T5903] usb 4-1: USB disconnect, device number 12 [ 1114.678820][ T5896] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 1114.860369][ T5896] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1114.870660][ T5896] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1114.890120][ T5896] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1114.922199][ T5896] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1114.951849][ T5896] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1114.999134][ T5829] usb 4-1: new full-speed USB device number 13 using dummy_hcd [ 1115.014775][ T5896] usb 3-1: Product: syz [ 1115.024742][ T5896] usb 3-1: Manufacturer: syz [ 1115.033977][ T5896] usb 3-1: SerialNumber: syz [ 1115.053507][ T5896] usb 3-1: config 0 descriptor?? [ 1115.071475][T20479] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1115.103234][T20479] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1115.138258][ T5896] usb 3-1: ucan: probing device on interface #0 [ 1115.138776][ T5829] usb 4-1: device descriptor read/64, error -71 [ 1115.408800][ T5829] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 1115.523276][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 1115.523292][ T30] audit: type=1326 audit(1773303451.930:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20498 comm="syz.1.3739" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecff19c799 code=0x7ffc0000 [ 1115.553276][ T5829] usb 4-1: device descriptor read/64, error -71 [ 1115.577371][ T30] audit: type=1326 audit(1773303451.930:729): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20498 comm="syz.1.3739" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecff19c799 code=0x7ffc0000 [ 1115.600155][ T5903] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 1115.611756][ T30] audit: type=1326 audit(1773303451.980:730): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20498 comm="syz.1.3739" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecff19c799 code=0x7ffc0000 [ 1115.664127][ T30] audit: type=1326 audit(1773303451.980:731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20498 comm="syz.1.3739" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecff19c799 code=0x7ffc0000 [ 1115.691259][ T5829] usb usb4-port1: attempt power cycle [ 1115.711946][ T30] audit: type=1326 audit(1773303451.980:732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20498 comm="syz.1.3739" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fecff19c799 code=0x7ffc0000 [ 1115.757558][ T5896] ucan 3-1:0.0: probe with driver ucan failed with error -22 [ 1115.794029][ T5903] usb 6-1: Using ep0 maxpacket: 32 [ 1115.818507][ T5903] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 1115.827049][ T5903] usb 6-1: config 0 has no interface number 0 [ 1115.834860][ T30] audit: type=1326 audit(1773303452.020:733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20498 comm="syz.1.3739" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecff19c799 code=0x7ffc0000 [ 1115.857677][ T5903] usb 6-1: config 0 interface 184 has no altsetting 0 [ 1115.882721][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.883188][ T5903] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1115.889743][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.898269][ T5903] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1115.916119][ T30] audit: type=1326 audit(1773303452.020:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20498 comm="syz.1.3739" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecff19c799 code=0x7ffc0000 [ 1115.944973][ T5903] usb 6-1: Product: syz [ 1115.962450][ T5903] usb 6-1: Manufacturer: syz [ 1115.991204][ T5903] usb 6-1: SerialNumber: syz [ 1116.015715][ T5903] usb 6-1: config 0 descriptor?? [ 1116.028815][ T30] audit: type=1326 audit(1773303452.020:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20498 comm="syz.1.3739" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecff19c799 code=0x7ffc0000 [ 1116.051869][ T5829] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 1116.087161][ T5829] usb 4-1: device descriptor read/8, error -71 [ 1116.188216][ T30] audit: type=1326 audit(1773303452.050:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20498 comm="syz.1.3739" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecff19c799 code=0x7ffc0000 [ 1116.250698][ T30] audit: type=1326 audit(1773303452.050:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20498 comm="syz.1.3739" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7fecff19c799 code=0x7ffc0000 [ 1116.276020][T20509] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1116.302794][T20501] kvm: requested 180190 ns i8254 timer period limited to 200000 ns [ 1116.312398][T20509] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1116.321931][T20501] kvm: requested 45257 ns i8254 timer period limited to 200000 ns [ 1116.370362][ T5903] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1116.382571][ T5829] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 1116.390366][ T5903] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 1116.400222][T20501] kvm: requested 133257 ns i8254 timer period limited to 200000 ns [ 1116.426431][T20501] kvm: requested 120685 ns i8254 timer period limited to 200000 ns [ 1116.432006][ T5903] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 1116.445606][ T5829] usb 4-1: device descriptor read/8, error -71 [ 1116.480073][ T5903] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -71 [ 1116.548357][ T5903] usb 6-1: USB disconnect, device number 62 [ 1116.569477][ T5829] usb usb4-port1: unable to enumerate USB device [ 1117.078776][ T5896] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 1117.395343][ T5896] usb 2-1: Using ep0 maxpacket: 16 [ 1117.420030][ T5896] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 1117.432971][ T5896] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1117.442629][ T5896] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1117.466309][ T5896] usb 2-1: Product: syz [ 1117.477324][ T5829] usb 3-1: USB disconnect, device number 3 [ 1117.491913][ T5896] usb 2-1: Manufacturer: syz [ 1117.541774][ T5896] usb 2-1: SerialNumber: syz [ 1117.568068][ T5896] usb 2-1: config 0 descriptor?? [ 1117.836226][ T5896] usb 2-1: USB disconnect, device number 5 [ 1118.068889][ T5829] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 1118.738943][ T5829] usb 6-1: Using ep0 maxpacket: 8 [ 1118.748549][ T5829] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 1118.942506][ T5829] usb 6-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 1118.958885][ T5829] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1119.003033][ T5829] usb 6-1: Product: syz [ 1119.007242][ T5829] usb 6-1: Manufacturer: syz [ 1119.034322][T20548] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3750'. [ 1119.055266][T20548] AppArmor: change_hat: Invalid input, NULL hat and NULL magic [ 1119.056103][T20548] syzkaller0: entered promiscuous mode [ 1119.069839][T20548] syzkaller0: entered allmulticast mode [ 1119.083360][ T5829] usb 6-1: SerialNumber: syz [ 1119.100208][ T5829] usb 6-1: config 0 descriptor?? [ 1119.127990][ T5829] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 1119.669106][ T5829] gspca_zc3xx: reg_w_i err -110 [ 1120.268778][ T5829] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 1120.275250][ T5829] gspca_zc3xx 6-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 1121.278898][ T10] usb 6-1: USB disconnect, device number 63 [ 1122.481218][T20601] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1123.690007][T20610] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3766'. [ 1123.803157][T20610] bridge_slave_1 (unregistering): left allmulticast mode [ 1123.810422][T20610] bridge_slave_1 (unregistering): left promiscuous mode [ 1123.819539][T20610] bridge0: port 2(bridge_slave_1) entered disabled state [ 1124.499319][ T5888] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 1124.920335][ T5888] usb 5-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 1124.950402][T20621] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3769'. [ 1125.038545][ T5888] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1125.162207][ T5888] usb 5-1: config 1 has no interface number 0 [ 1125.241950][ T5888] usb 5-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1125.309991][ T5888] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1125.342816][ T5888] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1125.484072][ T5888] usb 5-1: Product: syz [ 1125.488287][ T5888] usb 5-1: SerialNumber: syz [ 1125.551827][ T5888] usb 5-1: selecting invalid altsetting 1 [ 1126.183264][T20614] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1126.192920][T20614] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1126.383116][ T5888] cdc_ncm 5-1:1.1: SET_CRC_MODE failed [ 1126.391478][ T5888] cdc_ncm 5-1:1.1: SET_NTB_FORMAT failed [ 1126.421504][ T5888] usb 5-1: selecting invalid altsetting 1 [ 1126.490175][ T5888] cdc_ncm 5-1:1.1: bind() failure [ 1126.551111][ T5888] usb 5-1: USB disconnect, device number 37 [ 1127.595125][T20647] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3775'. [ 1127.686920][T20647] bridge0: port 2(bridge_slave_1) entered disabled state [ 1127.694331][T20647] bridge0: port 1(bridge_slave_0) entered disabled state [ 1127.768827][T20652] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3776'. [ 1127.964243][T20658] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3778'. [ 1128.045333][T20658] FAULT_INJECTION: forcing a failure. [ 1128.045333][T20658] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1128.112474][T20658] CPU: 1 UID: 0 PID: 20658 Comm: syz.3.3778 Tainted: G L syzkaller #0 PREEMPT(full) [ 1128.112506][T20658] Tainted: [L]=SOFTLOCKUP [ 1128.112513][T20658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1128.112524][T20658] Call Trace: [ 1128.112533][T20658] [ 1128.112541][T20658] dump_stack_lvl+0xe8/0x150 [ 1128.112571][T20658] should_fail_ex+0x412/0x560 [ 1128.112600][T20658] _copy_from_user+0x2d/0xb0 [ 1128.112628][T20658] kstrtouint_from_user+0xd6/0x180 [ 1128.112654][T20658] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1128.112693][T20658] proc_fail_nth_write+0x8e/0x210 [ 1128.112718][T20658] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1128.112748][T20658] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1128.112772][T20658] vfs_write+0x29a/0xb90 [ 1128.112797][T20658] ? __pfx_vfs_write+0x10/0x10 [ 1128.112818][T20658] ? __fget_files+0x2a/0x420 [ 1128.112847][T20658] ? __fget_files+0x3a0/0x420 [ 1128.112882][T20658] ? __fget_files+0x2a/0x420 [ 1128.112914][T20658] ksys_write+0x150/0x270 [ 1128.112936][T20658] ? __pfx_ksys_write+0x10/0x10 [ 1128.112966][T20658] do_syscall_64+0x14d/0xf80 [ 1128.112988][T20658] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1128.113007][T20658] ? clear_bhb_loop+0x40/0x90 [ 1128.113030][T20658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1128.113048][T20658] RIP: 0033:0x7f996f35cfce [ 1128.113067][T20658] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1128.113082][T20658] RSP: 002b:00007f996d5f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1128.113102][T20658] RAX: ffffffffffffffda RBX: 00007f996d5f66c0 RCX: 00007f996f35cfce [ 1128.113115][T20658] RDX: 0000000000000001 RSI: 00007f996d5f60a0 RDI: 0000000000000004 [ 1128.113126][T20658] RBP: 00007f996d5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1128.113136][T20658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1128.113146][T20658] R13: 00007f996f616038 R14: 00007f996f615fa0 R15: 00007f996f73fa48 [ 1128.113174][T20658] [ 1128.602069][T20644] syzkaller0: entered promiscuous mode [ 1128.607691][T20644] syzkaller0: entered allmulticast mode [ 1129.145971][T20678] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1129.175765][T20680] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1129.252965][ T5903] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1129.279734][T20680] vimc vimc.0: first entity in the pipe 'Scaler' is not a source [ 1129.517376][ T5903] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1129.611870][ T5903] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1129.649119][ T5903] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1129.683720][ T5903] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1129.742821][ T5903] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1129.791449][ T5903] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1129.839794][ T5903] usb 2-1: config 0 descriptor?? [ 1130.309095][ T5903] plantronics 0003:047F:FFFF.002B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 1130.429544][T20690] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1130.544405][T20690] vimc vimc.0: first entity in the pipe 'Scaler' is not a source [ 1130.910127][T20645] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1130.919953][T20645] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1130.938779][ T5888] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1131.079907][ T5888] usb 4-1: device descriptor read/64, error -71 [ 1131.140259][ T5903] usb 2-1: USB disconnect, device number 6 [ 1131.180702][ T5928] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 1131.328837][ T5888] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1131.339045][ T5928] usb 6-1: Using ep0 maxpacket: 8 [ 1131.352355][ T5928] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 1131.388244][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1131.400450][ T5928] usb 6-1: Product: syz [ 1131.416267][T20702] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3790'. [ 1131.425313][T20702] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 1131.445686][ T5928] usb 6-1: Manufacturer: syz [ 1131.450854][ T5928] usb 6-1: SerialNumber: syz [ 1131.458995][ T5888] usb 4-1: device descriptor read/64, error -71 [ 1131.467059][T20702] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1131.843457][ T5888] usb usb4-port1: attempt power cycle [ 1131.869594][ T5928] usb 6-1: config 0 descriptor?? [ 1131.978870][ T5903] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 1132.079849][ T5928] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1132.133316][ T5903] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 1132.158545][ T5903] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1132.219576][ T5888] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 1132.231002][ T5903] usb 5-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 1132.241011][ T5903] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1132.249944][ T5903] usb 5-1: Product: syz [ 1132.267954][ T5888] usb 4-1: device descriptor read/8, error -71 [ 1132.274535][ T5903] usb 5-1: Manufacturer: syz [ 1132.280943][ T5903] usb 5-1: SerialNumber: syz [ 1132.296042][ T5903] usb 5-1: config 0 descriptor?? [ 1132.319047][T20700] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1132.332703][T20700] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1132.384066][T20707] netlink: 'syz.1.3792': attribute type 1 has an invalid length. [ 1132.453402][T20707] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1132.548815][ T5888] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 1132.555815][T20700] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1132.569157][T20700] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1132.599638][ T5888] usb 4-1: device descriptor read/8, error -71 [ 1132.670075][T20715] syzkaller0: entered promiscuous mode [ 1132.675630][T20715] syzkaller0: entered allmulticast mode [ 1132.687743][T20715] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3794'. [ 1132.713079][ T5888] usb usb4-port1: unable to enumerate USB device [ 1132.714165][ T5928] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1132.736811][ T5928] usb 6-1: USB disconnect, device number 64 [ 1132.815192][T20719] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1133.315447][T20725] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3798'. [ 1133.396214][ T5903] dm9601 5-1:0.0 (unnamed net_device) (uninitialized): Error reading MODE_CTRL [ 1133.419039][ T5903] usb 5-1: USB disconnect, device number 38 [ 1134.030708][T20731] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1134.880349][T20745] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3803'. [ 1135.121938][T20745] netlink: 'syz.2.3803': attribute type 5 has an invalid length. [ 1135.132043][T20745] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3803'. [ 1135.157003][T20745] geneve2: entered promiscuous mode [ 1135.165048][T20745] geneve2: entered allmulticast mode [ 1135.174930][ T83] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 1135.184086][ T83] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 1135.207556][ T83] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 1135.237549][ T83] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 1136.489031][ T5896] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 1136.496697][T17051] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 1136.602797][T20749] syzkaller0: entered promiscuous mode [ 1136.608295][T20749] syzkaller0: entered allmulticast mode [ 1136.688833][T17051] usb 2-1: device descriptor read/64, error -71 [ 1136.708796][ T5896] usb 5-1: Using ep0 maxpacket: 32 [ 1136.727327][ T5896] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 1136.736128][ T5896] usb 5-1: config 0 has no interface number 0 [ 1136.814973][ T5896] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1136.833599][ T5896] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1136.851554][ T5896] usb 5-1: Product: syz [ 1136.855875][ T5896] usb 5-1: Manufacturer: syz [ 1136.865071][ T5896] usb 5-1: SerialNumber: syz [ 1136.880648][ T5896] usb 5-1: config 0 descriptor?? [ 1136.939675][T17051] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 1137.206596][T20773] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3811'. [ 1137.229603][T17051] usb 2-1: device descriptor read/64, error -71 [ 1137.349496][T17051] usb usb2-port1: attempt power cycle [ 1137.356230][ T5896] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1137.395847][ T5896] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1137.708757][T17051] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 1137.749490][T17051] usb 2-1: device descriptor read/8, error -71 [ 1137.830149][T20766] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1137.869576][T20766] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1137.972632][ T5896] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1138.009251][ T5896] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 1138.017786][T17051] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 1138.079540][T17051] usb 2-1: device descriptor read/8, error -71 [ 1138.088753][ T5896] usb 5-1: USB disconnect, device number 39 [ 1138.109049][ T5888] usb 4-1: new low-speed USB device number 21 using dummy_hcd [ 1138.206229][T17051] usb usb2-port1: unable to enumerate USB device [ 1138.403829][ T5888] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1138.444893][ T5888] usb 4-1: string descriptor 0 read error: -22 [ 1138.449938][T20788] [ 1138.453442][T20788] ====================================================== [ 1138.454231][ T5888] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1138.460551][T20788] WARNING: possible circular locking dependency detected [ 1138.460580][T20788] syzkaller #0 Tainted: G L [ 1138.460590][T20788] ------------------------------------------------------ [ 1138.460597][T20788] syz.2.3816/20788 is trying to acquire lock: [ 1138.460607][T20788] ffffffff8e85d2a8 (pcpu_alloc_mutex){+.+.}-{4:4}, at: pcpu_alloc_noprof+0x218/0x19c0 [ 1138.460653][T20788] [ 1138.460653][T20788] but task is already holding lock: [ 1138.460659][T20788] ffff888026141370 (&q->q_usage_counter(io)#70){++++}-{0:0}, at: blk_throtl_init+0x279/0x410 [ 1138.460704][T20788] [ 1138.460704][T20788] which lock already depends on the new lock. [ 1138.460704][T20788] [ 1138.460711][T20788] [ 1138.460711][T20788] the existing dependency chain (in reverse order) is: [ 1138.460718][T20788] [ 1138.460718][T20788] -> #2 (&q->q_usage_counter(io)#70){++++}-{0:0}: [ 1138.460749][T20788] blk_alloc_queue+0x546/0x680 [ 1138.460772][T20788] __blk_mq_alloc_disk+0x197/0x390 [ 1138.460790][T20788] loop_add+0x482/0xb40 [ 1138.460816][T20788] loop_control_ioctl+0x2f8/0x5a0 [ 1138.460836][T20788] __se_sys_ioctl+0xfc/0x170 [ 1138.460854][T20788] do_syscall_64+0x14d/0xf80 [ 1138.460869][T20788] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1138.460888][T20788] [ 1138.460888][T20788] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 1138.460914][T20788] fs_reclaim_acquire+0x71/0x100 [ 1138.460933][T20788] prepare_alloc_pages+0x152/0x650 [ 1138.460952][T20788] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1138.460972][T20788] __alloc_pages_noprof+0xa/0x30 [ 1138.460991][T20788] pcpu_populate_chunk+0x182/0xb30 [ 1138.461008][T20788] pcpu_alloc_noprof+0xc6c/0x19c0 [ 1138.461025][T20788] xt_percpu_counter_alloc+0x161/0x220 [ 1138.461044][T20788] translate_table+0x134a/0x2110 [ 1138.461063][T20788] ipt_register_table+0x11b/0x7f0 [ 1138.461081][T20788] iptable_nat_table_init+0x43/0x2e0 [ 1138.461102][T20788] xt_find_table_lock+0x30c/0x3e0 [ 1138.461119][T20788] xt_request_find_table_lock+0x26/0x100 [ 1138.461137][T20788] do_ipt_get_ctl+0x716/0x1240 [ 1138.461155][T20788] nf_getsockopt+0x26e/0x290 [ 1138.461171][T20788] ip_getsockopt+0x19e/0x230 [ 1138.461189][T20788] do_sock_getsockopt+0x2d3/0x3f0 [ 1138.461214][T20788] __x64_sys_getsockopt+0x1a4/0x240 [ 1138.461239][T20788] do_syscall_64+0x14d/0xf80 [ 1138.461254][T20788] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1138.461271][T20788] [ 1138.461271][T20788] -> #0 (pcpu_alloc_mutex){+.+.}-{4:4}: [ 1138.461298][T20788] __lock_acquire+0x15a5/0x2cf0 [ 1138.461318][T20788] lock_acquire+0xf0/0x2e0 [ 1138.461338][T20788] __mutex_lock+0x19f/0x1300 [ 1138.461353][T20788] pcpu_alloc_noprof+0x218/0x19c0 [ 1138.461371][T20788] __percpu_counter_init_many+0x43/0x380 [ 1138.461391][T20788] blkg_rwstat_init+0x2c/0x170 [ 1138.461409][T20788] throtl_pd_alloc+0xb6/0x460 [ 1138.461427][T20788] blkcg_activate_policy+0x692/0xb40 [ 1138.461444][T20788] blk_throtl_init+0x2f6/0x410 [ 1138.461463][T20788] tg_set_conf+0x1d6/0x4c0 [ 1138.461482][T20788] cgroup_file_write+0x36f/0x790 [ 1138.461504][T20788] kernfs_fop_write_iter+0x3af/0x540 [ 1138.461520][T20788] vfs_write+0x61d/0xb90 [ 1138.461536][T20788] ksys_write+0x150/0x270 [ 1138.461552][T20788] do_syscall_64+0x14d/0xf80 [ 1138.461568][T20788] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1138.461585][T20788] [ 1138.461585][T20788] other info that might help us debug this: [ 1138.461585][T20788] [ 1138.461593][T20788] Chain exists of: [ 1138.461593][T20788] pcpu_alloc_mutex --> fs_reclaim --> &q->q_usage_counter(io)#70 [ 1138.461593][T20788] [ 1138.461631][T20788] Possible unsafe locking scenario: [ 1138.461631][T20788] [ 1138.461638][T20788] CPU0 CPU1 [ 1138.461645][T20788] ---- ---- [ 1138.461651][T20788] lock(&q->q_usage_counter(io)#70); [ 1138.461670][T20788] lock(fs_reclaim); [ 1138.461683][T20788] lock(&q->q_usage_counter(io)#70); [ 1138.461703][T20788] lock(pcpu_alloc_mutex); [ 1138.461717][T20788] [ 1138.461717][T20788] *** DEADLOCK *** [ 1138.461717][T20788] [ 1138.461723][T20788] 7 locks held by syz.2.3816/20788: [ 1138.461734][T20788] #0: ffff888035dd50b8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 1138.461786][T20788] #1: ffff8880798cc420 (sb_writers#10){.+.+}-{0:0}, at: vfs_write+0x227/0xb90 [ 1138.461839][T20788] #2: ffff888062970888 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1de/0x540 [ 1138.461880][T20788] #3: [ 1138.473712][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1138.477906][T20788] ffff888035acf3c8 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x231/0x540 [ 1138.477967][T20788] #4: ffff888026141578 (&q->rq_qos_mutex){+.+.}-{4:4}, at: blkg_conf_open_bdev+0x2b0/0x3c0 [ 1138.478009][T20788] #5: ffff888026141370 (&q->q_usage_counter(io)#70){++++}-{0:0}, at: blk_throtl_init+0x279/0x410 [ 1138.478060][T20788] #6: ffff8880261413a8 (&q->q_usage_counter(queue)#53){+.+.}-{0:0}, at: blk_throtl_init+0x279/0x410 [ 1138.478110][T20788] [ 1138.478110][T20788] stack backtrace: [ 1138.478123][T20788] CPU: 0 UID: 0 PID: 20788 Comm: syz.2.3816 Tainted: G L syzkaller #0 PREEMPT(full) [ 1138.478147][T20788] Tainted: [L]=SOFTLOCKUP [ 1138.478155][T20788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026 [ 1138.478166][T20788] Call Trace: [ 1138.478174][T20788] [ 1138.478183][T20788] dump_stack_lvl+0xe8/0x150 [ 1138.478206][T20788] print_circular_bug+0x2e1/0x300 [ 1138.478233][T20788] check_noncircular+0x12e/0x150 [ 1138.478260][T20788] __lock_acquire+0x15a5/0x2cf0 [ 1138.478288][T20788] ? do_raw_spin_lock+0x12b/0x2f0 [ 1138.478307][T20788] lock_acquire+0xf0/0x2e0 [ 1138.478327][T20788] ? pcpu_alloc_noprof+0x218/0x19c0 [ 1138.478349][T20788] __mutex_lock+0x19f/0x1300 [ 1138.478366][T20788] ? pcpu_alloc_noprof+0x218/0x19c0 [ 1138.478383][T20788] ? kasan_save_track+0x4f/0x80 [ 1138.478399][T20788] ? kasan_save_track+0x3e/0x80 [ 1138.478414][T20788] ? __kasan_kmalloc+0x93/0xb0 [ 1138.478432][T20788] ? __kmalloc_cache_node_noprof+0x3ef/0x6b0 [ 1138.478452][T20788] ? blkcg_activate_policy+0x692/0xb40 [ 1138.478468][T20788] ? blk_throtl_init+0x2f6/0x410 [ 1138.478488][T20788] ? tg_set_conf+0x1d6/0x4c0 [ 1138.478507][T20788] ? pcpu_alloc_noprof+0x218/0x19c0 [ 1138.478524][T20788] ? kernfs_fop_write_iter+0x3af/0x540 [ 1138.478541][T20788] ? vfs_write+0x61d/0xb90 [ 1138.478558][T20788] ? ksys_write+0x150/0x270 [ 1138.478574][T20788] ? do_syscall_64+0x14d/0xf80 [ 1138.478590][T20788] ? __pfx___mutex_lock+0x10/0x10 [ 1138.478612][T20788] pcpu_alloc_noprof+0x218/0x19c0 [ 1138.478634][T20788] ? rcu_is_watching+0x15/0xb0 [ 1138.478658][T20788] __percpu_counter_init_many+0x43/0x380 [ 1138.478679][T20788] ? __kmalloc_cache_node_noprof+0x3ef/0x6b0 [ 1138.478706][T20788] blkg_rwstat_init+0x2c/0x170 [ 1138.478726][T20788] throtl_pd_alloc+0xb6/0x460 [ 1138.478744][T20788] ? __pfx_throtl_pd_alloc+0x10/0x10 [ 1138.478763][T20788] blkcg_activate_policy+0x692/0xb40 [ 1138.478788][T20788] blk_throtl_init+0x2f6/0x410 [ 1138.478810][T20788] tg_set_conf+0x1d6/0x4c0 [ 1138.478833][T20788] ? __pfx_tg_set_conf+0x10/0x10 [ 1138.478855][T20788] ? kernfs_root+0x1c/0x230 [ 1138.478877][T20788] ? kernfs_root+0x1c/0x230 [ 1138.478898][T20788] ? kernfs_root+0x1c/0x230 [ 1138.478919][T20788] ? kernfs_root+0x1ea/0x230 [ 1138.478940][T20788] ? __pfx_tg_set_conf_uint+0x10/0x10 [ 1138.478962][T20788] cgroup_file_write+0x36f/0x790 [ 1138.478986][T20788] ? __pfx_cgroup_file_write+0x10/0x10 [ 1138.479018][T20788] ? __pfx_cgroup_file_write+0x10/0x10 [ 1138.479038][T20788] kernfs_fop_write_iter+0x3af/0x540 [ 1138.479059][T20788] vfs_write+0x61d/0xb90 [ 1138.479079][T20788] ? __pfx_vfs_write+0x10/0x10 [ 1138.479100][T20788] ? __fget_files+0x2a/0x420 [ 1138.479126][T20788] ksys_write+0x150/0x270 [ 1138.479144][T20788] ? __pfx_ksys_write+0x10/0x10 [ 1138.479165][T20788] do_syscall_64+0x14d/0xf80 [ 1138.479180][T20788] ? trace_irq_disable+0x3b/0x150 [ 1138.479204][T20788] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1138.479221][T20788] ? clear_bhb_loop+0x40/0x90 [ 1138.479239][T20788] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1138.479257][T20788] RIP: 0033:0x7f4e0e19c799 [ 1138.479273][T20788] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1138.479288][T20788] RSP: 002b:00007f4e0ef92028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1138.479307][T20788] RAX: ffffffffffffffda RBX: 00007f4e0e415fa0 RCX: 00007f4e0e19c799 [ 1138.479321][T20788] RDX: 000000000000006a RSI: 00002000000000c0 RDI: 0000000000000005 [ 1138.479333][T20788] RBP: 00007f4e0ef92090 R08: 0000000000000000 R09: 0000000000000000 [ 1138.479343][T20788] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1138.479354][T20788] R13: 00007f4e0e416038 R14: 00007f4e0e415fa0 R15: 00007f4e0e53fa48 [ 1138.479373][T20788] [ 1139.386423][ T5888] usb 4-1: bad CDC descriptors [ 1139.650688][T20780] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3814'. [ 1139.660766][ T5829] usb 4-1: USB disconnect, device number 21