last executing test programs: 10m56.371473678s ago: executing program 32 (id=1254): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='md0', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/raid_disks\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='1', 0x1) 10m54.348087666s ago: executing program 33 (id=1267): mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r0, &(0x7f0000000800), 0x0) 6m15.5547765s ago: executing program 4 (id=3051): r0 = socket$key(0xf, 0x3, 0x2) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000140), 0x1, 0x100) ioctl$MON_IOCX_GET(r2, 0x400c9206, &(0x7f00000003c0)={0x0, 0x0}) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r3, 0xc018937e, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2c, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r4, 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x8910, 0x0) socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000000440), 0x0, 0x2000000022, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) 6m15.455157244s ago: executing program 4 (id=3052): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = syz_io_uring_setup(0xd3a, &(0x7f0000001800)={0x0, 0x9a, 0x0, 0x0, 0x3}, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x2c040080, &(0x7f0000000000)={0x2, 0x24e23, @empty}, 0x10) recvmmsg(r0, &(0x7f00000005c0), 0x40000000000026c, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000500)={0x1, 0x1, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)=""/37, 0x25}], &(0x7f0000000440)=[0x0, 0x10000, 0x90000000, 0x6, 0x1ae4, 0x0, 0x81, 0x8a, 0x0]}, 0x20) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file3\x00', 0x105042, 0x0) mount(0x0, &(0x7f0000000040)='./file3\x00', &(0x7f0000000000)='ceph\x00', 0x0, &(0x7f0000000380)='acl') ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0x541b, &(0x7f0000000000)={0xffffffffffffffff, 0x8e59, 0x0, 0x3}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d1c0302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c3f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d330800603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x400000000003, 0x7, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/pool_threads\x00', 0x2, 0x0) read(r3, 0x0, 0x0) mlock2(&(0x7f0000198000/0x3000)=nil, 0x3000, 0x1) close_range(r2, 0xffffffffffffffff, 0x0) 6m14.575431843s ago: executing program 6 (id=3063): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000380)={0x40, 0xc}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000640)={0x0, 0xe, 0x1, "06"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000f80)=ANY=[@ANYBLOB="00df19"], 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000bc0)={0x2c, &(0x7f0000000980)={0x0, 0x16}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000d80)={0x34, &(0x7f0000000a00)={0x0, 0x10}, 0x0, 0x0, 0x0, 0x0, 0x0}) 6m14.378813825s ago: executing program 4 (id=3065): r0 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$restrict_keyring(0x1d, r0, 0x0, 0x0) add_key$keyring(&(0x7f0000000200), 0x0, 0x0, 0x0, r0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendmsg$NL80211_CMD_CHANNEL_SWITCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x1194}, 0x1, 0x0, 0x0, 0x4048000}, 0x4000880) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x50, 0x1, 0x1, 0xacd294f27ffa9b17, 0x0, 0x0, {0xa}, [@CTA_TUPLE_REPLY={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, {0xfffffffffffffe80, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}]}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x899}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x402) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0xf000, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) madvise(&(0x7f0000786000/0x3000)=nil, 0x3000, 0x17) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000001c0)='./dev/sda1\x00', 0x4) 6m13.850745981s ago: executing program 6 (id=3070): sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0xa, 0x1234, 0xfffffffe, @loopback}, 0x1c, 0x0}, 0x8dff) r0 = socket$kcm(0x29, 0x2, 0x0) close(r0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) accept$phonet_pipe(r3, &(0x7f00000003c0), &(0x7f0000000400)=0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bond0\x00'}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r2, 0x8983, &(0x7f00000002c0)={0x7, 'geneve0\x00', {0x8b4}, 0xb}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0xe, 0xfffffffffffffd85, &(0x7f00000000c0)="61df712bc884fed5722780b6c2a7", 0x0, 0x739d, 0x0, 0x7, 0xfffffffffffffff3}, 0x28) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10, 0x0}, 0x30004040) setsockopt$sock_attach_bpf(r0, 0x1, 0xd, &(0x7f00000000c0), 0xfe11) close(r1) 6m13.66750887s ago: executing program 6 (id=3072): bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xb, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000200000000000000000850000002a0000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@call={0x85, 0x0, 0x0, 0x7b}]}, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000800000000000000000000001801000000646c2500000000002020207b1af8ff00000000bfa10000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) 6m13.430989121s ago: executing program 3 (id=3074): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x20, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r2, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x66, &(0x7f0000000540)={@multicast, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x30, 0x3a, 0x0, @rand_addr=' \x01\x00', @mcast2, {[], @dest_unreach={0x1, 0x3, 0x0, 0x7f, '\x00', {0x0, 0x6, "e1f588", 0x7, 0x0, 0xff, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}}}}}, 0x0) 6m13.43058606s ago: executing program 6 (id=3075): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = syz_io_uring_setup(0xd3a, &(0x7f0000001800)={0x0, 0x9a, 0x0, 0x0, 0x3}, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x2c040080, &(0x7f0000000000)={0x2, 0x24e23, @empty}, 0x10) recvmmsg(r0, &(0x7f00000005c0), 0x40000000000026c, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000500)={0x1, 0x1, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)=""/37, 0x25}], &(0x7f0000000440)=[0x0, 0x10000, 0x90000000, 0x6, 0x1ae4, 0x0, 0x81, 0x8a, 0x0]}, 0x20) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file3\x00', 0x105042, 0x0) mount(0x0, &(0x7f0000000040)='./file3\x00', &(0x7f0000000000)='ceph\x00', 0x0, &(0x7f0000000380)='acl') ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0x541b, &(0x7f0000000000)={0xffffffffffffffff, 0x8e59, 0x0, 0x3}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d1c0302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c3f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d330800603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc810149d79691c7ad75d", 0x1d8, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x400000000003, 0x7, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/pool_threads\x00', 0x2, 0x0) read(r3, 0x0, 0x0) mlock2(&(0x7f0000198000/0x3000)=nil, 0x3000, 0x1) close_range(r2, 0xffffffffffffffff, 0x0) 6m13.073066513s ago: executing program 3 (id=3077): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0100000004000000040000000001000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00008f1e37ab7e28592200"/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x10, &(0x7f0000000580)=@framed={{}, [@map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}]}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) write(0xffffffffffffffff, &(0x7f0000000140), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x10) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) r1 = syz_io_uring_setup(0x34b8, &(0x7f0000000440)={0x0, 0x79bf, 0x2000, 0x0, 0x288}, &(0x7f0000000180)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000400)=0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x34000, 0x0) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000040)={0x30, 0x0}) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r1}) r5 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r6 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x20, 0x4, 0x0, &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5}, 0x94) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r7, 0x0, 0x0) 6m13.070576716s ago: executing program 4 (id=3078): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[], 0x0, 0x26, 0x0, 0xa}, 0x28) connect$inet6(r0, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x60c81, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448cb, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000100)=@ethtool_coalesce={0x12, 0x0, 0x1000, 0x0, 0x400000, 0x7ff, 0x40004, 0xc0000000, 0x402, 0x9, 0x4, 0x5, 0x3, 0x4006, 0x84, 0xfffffffc, 0x0, 0x37e9, 0x80000004, 0x1, 0x5, 0x424f, 0x4}}) 6m11.430942512s ago: executing program 3 (id=3079): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r0) recvmmsg(r0, &(0x7f0000002900)=[{{0x0, 0x0, &(0x7f0000002e00)=[{&(0x7f00000000c0)=""/167, 0xa7}, {&(0x7f0000002000)=""/118, 0x76}, {&(0x7f0000004540)=""/4073, 0xfe9}, {&(0x7f00000001c0)=""/93, 0x5d}, {&(0x7f0000000280)=""/209, 0xd1}, {&(0x7f0000000540)=""/170, 0xaa}, {&(0x7f0000000440)=""/172, 0xac}], 0x7}, 0x9}], 0x1, 0x100a0, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x44000) 6m11.245879433s ago: executing program 4 (id=3082): sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0xa, 0x1234, 0xfffffffe, @loopback}, 0x1c, 0x0}, 0x8dff) r0 = socket$kcm(0x29, 0x2, 0x0) close(r0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) accept$phonet_pipe(r3, &(0x7f00000003c0), &(0x7f0000000400)=0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bond0\x00'}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r2, 0x8983, &(0x7f00000002c0)={0x7, 'geneve0\x00', {0x8b4}, 0xb}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0xe, 0xfffffffffffffd85, &(0x7f00000000c0)="61df712bc884fed5722780b6c2a7", 0x0, 0x739d, 0x0, 0x7, 0xfffffffffffffff3}, 0x28) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10, 0x0}, 0x30004040) setsockopt$sock_attach_bpf(r0, 0x1, 0xd, &(0x7f00000000c0), 0xfe11) close(r1) 6m11.172588837s ago: executing program 4 (id=3083): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=@newtfilter={0x70, 0x2c, 0xf3f, 0x70bd2c, 0x25dddbbd, {0x0, 0x0, 0x0, r4, {0x2, 0x3da48c8682330ab8}, {}, {0x7, 0xfffa}}, [@filter_kind_options=@f_basic={{0xa}, {0x40, 0x2, [@TCA_BASIC_EMATCHES={0x3c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x2, 0x3, 0x5}, {0x9, 0xfffffff9, 0x0, 0x3}}}, @TCF_EM_NBYTE={0x10, 0x2, 0x0, 0x0, {{0x1, 0x2, 0x80}, {0x7, 0x0, 0x1}}}]}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x200058c0}, 0x4880) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r4, 0x7}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)="03", 0x12}], 0x1}, 0x20004014) 6m11.11940432s ago: executing program 6 (id=3084): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_VERSION(r2, 0xc0046209, &(0x7f0000001040)) openat$binderfs_log(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs_log(0xffffffffffffff9c, 0x0, 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000003140)=""/16, 0x10) syz_io_uring_setup(0x43af, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000080)=0x13) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x3) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @broadcast}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="0100"}) syz_open_dev$vim2m(&(0x7f0000000040), 0xfffffffd, 0x2) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x700, 0x0) close(r7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) 6m11.105669168s ago: executing program 3 (id=3085): bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xb, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000200000000000000000850000002a0000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@call={0x85, 0x0, 0x0, 0x7b}]}, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000800000000000000000000001801000000646c2500000000002020207b1af8ff00000000bfa10000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) 6m11.065692429s ago: executing program 6 (id=3086): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r1, &(0x7f00000006c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048014) r2 = syz_open_dev$vim2m(&(0x7f0000000280), 0x6, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r2, 0xc0285628, &(0x7f0000000080)={0x3, @win={{0x7, 0x4, 0x806, 0x4}, 0x2, 0x4017, &(0x7f00000021c0)={{0x3, 0x2, 0x9, 0x4c}}, 0x3317, 0x0, 0x8}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400", 0x2}], 0x1}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f60002030109021200010000000009"], 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x20000804) r4 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7}, 0x30004084) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r5, 0xc03064ca, &(0x7f0000000140)={0x0, 0x0}) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000040)={0x84, @local, 0x4e1f, 0xfffffffe, 'sh\x00', 0x11, 0x10000004, 0x8}, 0x2c) ioctl$AUTOFS_IOC_CATATONIC(0xffffffffffffffff, 0x9362, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[], 0x18}}, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000032073797a6b616c6c65723000001800128008000100767266000c000280080001"], 0x48}, 0x1, 0x0, 0x0, 0x20044040}, 0x0) ioctl$sock_inet_udp_SIOCINQ(r7, 0x541b, 0x0) sendmmsg(r7, &(0x7f0000000000), 0x4000000000001f2, 0xfc) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x7a7241, 0x0) 6m10.896936448s ago: executing program 3 (id=3089): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x280c02, 0x48) signalfd4(r0, &(0x7f0000000100)={[0xc35]}, 0x8, 0x80000) 6m10.726976969s ago: executing program 3 (id=3091): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, r0) r1 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, &(0x7f0000000e80), 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ftruncate(r3, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r3, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000480)=[{&(0x7f0000000380)=""/129, 0x81}], 0x1) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) ioctl$EVIOCGLED(0xffffffffffffffff, 0x80404519, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000002380)={0x2020}, 0x2020) shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000280)=""/102) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) fcntl$setstatus(r4, 0x4, 0x3c00) 5m55.982074743s ago: executing program 34 (id=3086): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0xb, 0x1, 0x4, 0x0, 0x7}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r1, &(0x7f00000006c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048014) r2 = syz_open_dev$vim2m(&(0x7f0000000280), 0x6, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r2, 0xc0285628, &(0x7f0000000080)={0x3, @win={{0x7, 0x4, 0x806, 0x4}, 0x2, 0x4017, &(0x7f00000021c0)={{0x3, 0x2, 0x9, 0x4c}}, 0x3317, 0x0, 0x8}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) syz_clone(0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400", 0x2}], 0x1}, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f60002030109021200010000000009"], 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x20000804) r4 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7}, 0x30004084) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x2000) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r5, 0xc03064ca, &(0x7f0000000140)={0x0, 0x0}) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r6, 0x0, 0x482, &(0x7f0000000040)={0x84, @local, 0x4e1f, 0xfffffffe, 'sh\x00', 0x11, 0x10000004, 0x8}, 0x2c) ioctl$AUTOFS_IOC_CATATONIC(0xffffffffffffffff, 0x9362, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[], 0x18}}, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000032073797a6b616c6c65723000001800128008000100767266000c000280080001"], 0x48}, 0x1, 0x0, 0x0, 0x20044040}, 0x0) ioctl$sock_inet_udp_SIOCINQ(r7, 0x541b, 0x0) sendmmsg(r7, &(0x7f0000000000), 0x4000000000001f2, 0xfc) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x7a7241, 0x0) 5m55.884874456s ago: executing program 35 (id=3083): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x5001}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=@newtfilter={0x70, 0x2c, 0xf3f, 0x70bd2c, 0x25dddbbd, {0x0, 0x0, 0x0, r4, {0x2, 0x3da48c8682330ab8}, {}, {0x7, 0xfffa}}, [@filter_kind_options=@f_basic={{0xa}, {0x40, 0x2, [@TCA_BASIC_EMATCHES={0x3c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x2, 0x3, 0x5}, {0x9, 0xfffffff9, 0x0, 0x3}}}, @TCF_EM_NBYTE={0x10, 0x2, 0x0, 0x0, {{0x1, 0x2, 0x80}, {0x7, 0x0, 0x1}}}]}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x200058c0}, 0x4880) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r4, 0x7}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000200)="03", 0x12}], 0x1}, 0x20004014) 5m55.631976465s ago: executing program 36 (id=3091): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, r0) r1 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, &(0x7f0000000e80), 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ftruncate(r3, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r3, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000480)=[{&(0x7f0000000380)=""/129, 0x81}], 0x1) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) ioctl$EVIOCGLED(0xffffffffffffffff, 0x80404519, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000002380)={0x2020}, 0x2020) shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000280)=""/102) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) fcntl$setstatus(r4, 0x4, 0x3c00) 2m48.717839248s ago: executing program 7 (id=4041): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0) ioctl(r0, 0x933, 0x0) 2m48.407362221s ago: executing program 7 (id=4044): socketpair(0x1, 0x1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) accept(r1, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x14, r4, 0x1}, 0x14}, 0x1, 0x900}, 0x0) 2m47.174008436s ago: executing program 7 (id=4047): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000640)={0x60, 0x1, 0x2, "93d7"}, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x82, 0x3, &(0x7f0000000200)='\x00\x00\x00') syz_usb_ep_write(r0, 0x81, 0x8, &(0x7f0000000240)="9d152a5c0b096d0a") 2m43.222645338s ago: executing program 7 (id=4062): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000680)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x10, 0x0, &(0x7f00000049c0)=[@clear_death], 0x0, 0x0, 0x0}) 2m42.727146685s ago: executing program 7 (id=4064): openat$vcsu(0xffffffffffffff9c, &(0x7f00000000c0), 0x901, 0x0) r0 = syz_io_uring_setup(0x34b9, &(0x7f0000000540)={0x0, 0x69ec, 0xc00, 0x5, 0x50}, 0x0, &(0x7f0000000080)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(0x0, r1, r2, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x2004, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0xfffffffffffffff2, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x521c, 0x1, 0x61, 0x0, 0x18) 2m42.48827096s ago: executing program 7 (id=4065): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='tcp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r1, 0x0, 0x0) 2m26.181517464s ago: executing program 37 (id=4065): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='tcp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r1, 0x0, 0x0) 1m51.766371481s ago: executing program 5 (id=4310): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000180)={0x0, 0x5, 0x10}, 0xc) sendmmsg(r0, &(0x7f0000002880)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000002c0)="f5", 0x1}], 0x1}}], 0x1, 0x2000401d) 1m51.65967314s ago: executing program 5 (id=4314): r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\r\a'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 1m48.49749273s ago: executing program 5 (id=4331): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000300)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}]}, 0x44}}, 0x4000) open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x9101) openat(0xffffffffffffff9c, 0x0, 0x40080, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x3ba9bfc6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) sendmmsg$inet(r0, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e24, @empty}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000000000)="97", 0xfdef}], 0x1}}], 0x1, 0x4000800) 1m47.414603352s ago: executing program 5 (id=4332): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0x97, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000005"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000c80)={0x44, &(0x7f00000009c0)={0x0, 0xe, 0x2, "810b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1m45.297573578s ago: executing program 5 (id=4339): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0x0) 1m45.215701014s ago: executing program 5 (id=4340): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = syz_io_uring_setup(0xd3a, &(0x7f0000001800)={0x0, 0x9a, 0x0, 0x0, 0x3}, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x2c040080, &(0x7f0000000000)={0x2, 0x24e23, @empty}, 0x10) recvmmsg(r0, &(0x7f00000005c0), 0x40000000000026c, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000500)={0x2, 0x1, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/146, 0x92}, {&(0x7f0000000180)=""/37, 0x25}], &(0x7f0000000440)=[0x0, 0x10000, 0x90000000, 0x6, 0x1ae4, 0x0, 0x81, 0x8a, 0x0]}, 0x20) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file3\x00', 0x105042, 0x0) mount(0x0, &(0x7f0000000040)='./file3\x00', &(0x7f0000000000)='ceph\x00', 0x0, &(0x7f0000000380)='acl') ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0x541b, &(0x7f0000000000)={0xffffffffffffffff, 0x8e59, 0x0, 0x3}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d1c0302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c3f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d330800603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc81014", 0x1d1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x400000000003, 0x7, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/pool_threads\x00', 0x2, 0x0) read(r3, 0x0, 0x0) mlock2(&(0x7f0000198000/0x3000)=nil, 0x3000, 0x1) close_range(r2, 0xffffffffffffffff, 0x0) 1m28.864927833s ago: executing program 38 (id=4340): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = syz_io_uring_setup(0xd3a, &(0x7f0000001800)={0x0, 0x9a, 0x0, 0x0, 0x3}, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x2c040080, &(0x7f0000000000)={0x2, 0x24e23, @empty}, 0x10) recvmmsg(r0, &(0x7f00000005c0), 0x40000000000026c, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, &(0x7f0000000500)={0x2, 0x1, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/146, 0x92}, {&(0x7f0000000180)=""/37, 0x25}], &(0x7f0000000440)=[0x0, 0x10000, 0x90000000, 0x6, 0x1ae4, 0x0, 0x81, 0x8a, 0x0]}, 0x20) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file3\x00', 0x105042, 0x0) mount(0x0, &(0x7f0000000040)='./file3\x00', &(0x7f0000000000)='ceph\x00', 0x0, &(0x7f0000000380)='acl') ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0x541b, &(0x7f0000000000)={0xffffffffffffffff, 0x8e59, 0x0, 0x3}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="308201d43082017ba00302010202142eea648d7f17e62e9e5869c887c68e1bd0f86fde300a06082a8648ce3d1c0302303a3138303606035504030c2f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793020170d3234303431333232313632365a180f32313234303332303232313632365a303a3138303606035504030c3f436572746966696361746520766572696669636174696f6e2045434453412073656c662d74657374696e67206b65793059301306072a8648ce3d020106082a8648ce3d0301070342000407e56b51affc19412c88926b775771039ee2fe6e6a714ec7299f90e177189fc2e70a82d08ae181a9717c5a73fb25b95b1e248c739ff838f848b4ad1619c022c6a35d305b301d0603551d0e041604142900bcea1deb7bc8479a84a23d758efdfdd2b2d3301f0603551d230418301680142900bcea1deb7bc8479a84a23d758efdfdd2b2d330800603551d130101ff04023000300b0603551d0f040403020780300a06082a8648ce3d040302034700304402201ad7ac07c89738f489437ec7666ea5007c121db409760c996b8c265de9705cb4022073b7c77a5adb670a964219cf4f674f356aee2925f24fc81014", 0x1d1, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x400000000003, 0x7, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/pool_threads\x00', 0x2, 0x0) read(r3, 0x0, 0x0) mlock2(&(0x7f0000198000/0x3000)=nil, 0x3000, 0x1) close_range(r2, 0xffffffffffffffff, 0x0) 8.04816352s ago: executing program 9 (id=4808): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000300)="8b", 0x1, 0x0, 0x0, 0x0) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000002c0)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @multicast2}]}, &(0x7f0000000340)=0x10) 7.992991015s ago: executing program 9 (id=4809): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x304}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(r0, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0xc8a) writev(r0, &(0x7f0000000300)=[{&(0x7f00000005c0)="6e2d3c94288948959426d1de787672fa8d3705a324cefea880e8c0bd80226c9eb3d90a4e08c79410f56616b3a74447ce08834e294e4f434f3e4aea8add09078987227848f2f3afb37adb6af1bad9389c927333df0d9b7fb8ca914cbfeb6ebb21e2495be7c3d2c697c0c0ac2266181511a87dddd889f912df0822095bfea15a483a65d0b80e1a3f81a8748a6900683b154513e649542d8ffec2c058b20b55688dd5f01933a90fb1dcb5c990028e2e9b17d234a5470fe03290ff9c6b7f4333654564be0b5f074feee291dc5daf806c811fe508b19319cccaf2b0236d0c941b20ae95e047af56935bd8fc5f5101287a12623cee4de00cf3af4942a2fbadfb76e4f2cdb1089af1d79ee99a61b8003112c2d43ba025c6e4631d2a186fdf9c64ab60b8064b051343c313a28355ba59bb6ea25d668899af0d5bc16c40ce7ee8cd", 0x13d}, {&(0x7f0000000340)="bf67a361000138944b854b78cc4e2237f68791bd7786513b715bf9ad6389844bc809b10b216304437e8d4b9e9cec7b31a34a02854029d58ba77b51b6479ef73e43d95fb478cc230a625897", 0x4b}], 0x2) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) mprotect(&(0x7f0000199000/0x4000)=nil, 0x4000, 0x4) 7.980980989s ago: executing program 1 (id=4810): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/1/root/var\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/1/root/var/run/gssproxy.sock\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/self/root/var\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/self/root/var/run\x00', 0x1ff) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000240)=@file={0x1, './proc/1/root/var/run/gssproxy.sock\x00'}, 0x6e) listen(r0, 0x5) listen(0xffffffffffffffff, 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./proc/net/rpc/use-gss-proxy\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000380)='./sys\x00', &(0x7f00000003c0)='sysfs\x00', 0x0, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/kernel/sunrpc/xprt-switches/switch-0/add_xprt\x00', 0x1, 0x0) write(r2, &(0x7f0000000480)='1', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/kernel/sunrpc/xprt-switches/switch-1/add_xprt\x00', 0x1, 0x0) write(r3, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/kernel/sunrpc/xprt-switches/switch-0/xprt-1-local/xprt_state\x00', 0x1, 0x0) write(r4, &(0x7f00000005c0)='offline\x00', 0x7) r5 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/kernel/sunrpc/xprt-switches/switch-0/xprt-1-local/del_xprt\x00', 0x1, 0x0) write(r5, &(0x7f0000000640)='1', 0x1) openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/kernel/sunrpc/xprt-switches/switch-0/xprt-2-local/xprt_state\x00', 0x1, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/kernel/sunrpc/xprt-switches/switch-0/xprt-2-local/del_xprt\x00', 0x1, 0x0) write(r6, &(0x7f0000000740)='1', 0x1) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r7 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r7, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/kernel/sunrpc/xprt-switches/switch-1/xprt-2-local/del_xprt\x00', 0x1, 0x0) 7.793677376s ago: executing program 1 (id=4811): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000012c0)=ANY=[@ANYBLOB, @ANYRESHEX], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r1, 0x5b24, 0x0) 7.698517564s ago: executing program 9 (id=4812): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @main=@item_012={0x2, 0x0, 0x9, '{|'}, @global=@item_4={0x3, 0x1, 0x8, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @local=@item_4={0x3, 0x2, 0x0, "eb212189"}, @main=@item_4={0x3, 0x0, 0x8}, @main=@item_4={0x3, 0x0, 0x9, "cdd2f361"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) 6.652150797s ago: executing program 2 (id=4815): syz_usb_connect(0x2, 0x24, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000002c0)={0x2020}, 0x2020) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) 5.514922871s ago: executing program 0 (id=4822): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000200)={@val={0x0, 0x805}, @val={0x2, 0x3, 0x9, 0x8, 0x9, 0xd}, @arp=@ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x4, @broadcast, @loopback, @broadcast, @broadcast}}, 0x2a) 5.44799907s ago: executing program 0 (id=4823): syz_usb_connect(0x0, 0x24, 0x0, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0xae00) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000100)={&(0x7f0000000240)=[{0x7, 0x4200, 0x0, 0x0}, {0x7, 0x8050, 0x0, 0x0}], 0x2}) 4.831378693s ago: executing program 0 (id=4827): syz_emit_vhci(&(0x7f0000001bc0)=ANY=[@ANYBLOB="043e060c6b"], 0x9) 4.504729561s ago: executing program 1 (id=4828): syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000000)=ANY=[@ANYRES16], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 4.404567735s ago: executing program 9 (id=4829): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000340), 0x123000, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x1) ioctl$PPPIOCSFLAGS1(r1, 0x80047455, 0x0) 4.363013575s ago: executing program 9 (id=4830): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100) openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) 4.294166738s ago: executing program 9 (id=4831): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='tcp 2', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='1', 0x1) 4.293075537s ago: executing program 0 (id=4832): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) socket(0xa, 0x1, 0x0) pipe2$9p(&(0x7f0000000080), 0x90800) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x1ff, 0xf806, 0x5, 0x0, 0x1}, 0x14) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r4, &(0x7f00000003c0)='\x00', 0x1, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x20, @loopback, 0x1}, 0x1c) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x800010, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000280)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r5, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000000)='htcp', 0x4) recvfrom$inet(r5, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) shutdown(r5, 0x1) 4.124153963s ago: executing program 8 (id=4833): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000200)={@val={0x0, 0x805}, @val={0x2, 0x3, 0x9, 0x8, 0x9, 0xd}, @arp=@ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x4, @broadcast, @loopback, @broadcast, @broadcast}}, 0x2a) 3.115232269s ago: executing program 2 (id=4834): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000dc0), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000080)={0x28, r1, 0x9, 0x70bdb1, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x2004c800}, 0x20000014) 3.035808328s ago: executing program 2 (id=4835): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000840)={0x84, &(0x7f0000000300)=ANY=[@ANYBLOB="2048fc"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.951275347s ago: executing program 8 (id=4836): syz_usb_connect$uac3(0x5, 0xb3, &(0x7f0000000cc0)=ANY=[@ANYBLOB="12010000000000406d0490094000010203010902a100030101c010080b0002010130070904000000010130000a2401103d0007000000132403050101060250ff07000009000900ff010c240b0701fcffffff08060014240202060205"], 0x0) 2.743383394s ago: executing program 0 (id=4837): syz_usb_connect(0x0, 0x24, 0x0, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0xae00) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000100)={&(0x7f0000000240)=[{0x7, 0x4200, 0x0, 0x0}, {0x7, 0x8050, 0x0, 0x0}], 0x2}) 2.362914776s ago: executing program 8 (id=4838): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000012c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109024a0001100000000904", @ANYRESHEX], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$HIDIOCGUSAGE(r1, 0x5b24, 0x0) 2.115229689s ago: executing program 0 (id=4839): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @main=@item_012={0x2, 0x0, 0x9, '{|'}, @global=@item_4={0x3, 0x1, 0x8, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @local=@item_4={0x3, 0x2, 0x0, "eb212189"}, @main=@item_4={0x3, 0x0, 0x8}, @main=@item_4={0x3, 0x0, 0x9, "cdd2f361"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) 1.757890087s ago: executing program 8 (id=4840): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) close(r0) 1.186907898s ago: executing program 2 (id=4841): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0001}]}) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000200)={0x1f, 0x0, 0x1}, 0x6) close_range(r0, 0xffffffffffffffff, 0x0) 1.114924238s ago: executing program 1 (id=4842): syz_open_dev$loop(0x0, 0x1000000020000e4e, 0x42580) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x40002, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) prctl$PR_CAPBSET_DROP(0x18, 0x17) r1 = getpgrp(0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x80200, 0x0) 1.09972067s ago: executing program 2 (id=4843): r0 = socket(0x2b, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) setsockopt$MRT6_TABLE(r0, 0x29, 0xcf, &(0x7f0000000000)=0xfe, 0x4) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) sendmmsg(r3, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) recvmmsg(r3, &(0x7f0000000d00), 0xf000, 0x10002, 0x0) recvmmsg(r3, 0x0, 0x0, 0x140, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 1.024825943s ago: executing program 8 (id=4844): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) syz_80211_inject_frame(&(0x7f0000000040)=@device_b, 0x0, 0x0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b000000", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 925.732542ms ago: executing program 1 (id=4845): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000080), 0x1) sendto$inet6(r0, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)='|', 0x1, 0x4010, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20004000, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000001ac0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000000) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000001580)=ANY=[], 0x6d) 727.731328ms ago: executing program 1 (id=4846): r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f2110"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f00000002c0)='(') 157.6463ms ago: executing program 8 (id=4847): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000300)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}]}, 0x44}}, 0x4000) open_tree(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x9101) openat(0xffffffffffffff9c, 0x0, 0x40080, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x3ba9bfc6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x1f6, 0x4) sendmmsg$inet(r0, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e24, @empty}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000000000)="97", 0xfdef}], 0x1}}], 0x1, 0x4000800) 0s ago: executing program 2 (id=4848): r0 = syz_open_dev$video(0x0, 0x8, 0x0) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000940)={0xa, 0x0, 0x0, {0x8, 0x80000000, 0x8, 0x10000}}) kernel console output (not intermixed with test programs): } for pid=17699 comm="syz.9.4055" name="file0" dev="sda1" ino=2048 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=chr_file permissive=1 [ 778.087318][ C0] net_ratelimit: 143 callbacks suppressed [ 778.225776][ T6489] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 778.253265][ T6489] usbhid 3-1:0.0: can't add hid device: -71 [ 778.253401][ T6489] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 778.299023][ T6489] usb 3-1: USB disconnect, device number 46 [ 778.505736][ T30] audit: type=1400 audit(1791277148.306:811): avc: denied { write } for pid=17703 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 778.830671][ T30] audit: type=1400 audit(1791277148.611:812): avc: denied { write } for pid=17728 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 778.916716][ T6978] hsr_slave_0: left promiscuous mode [ 778.933111][ T6978] hsr_slave_1: left promiscuous mode [ 778.959424][ T6978] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 778.966084][ T6978] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 781.240137][ T6978] team0 (unregistering): Port device team_slave_1 removed [ 781.324598][ T6978] team0 (unregistering): Port device team_slave_0 removed [ 781.866919][T17591] bridge0: port 1(bridge_slave_0) entered blocking state [ 781.867088][T17591] bridge0: port 1(bridge_slave_0) entered disabled state [ 781.867269][T17591] bridge_slave_0: entered allmulticast mode [ 781.869012][T17591] bridge_slave_0: entered promiscuous mode [ 781.897698][ T5267] 8021q: adding VLAN 0 to HW filter on device eth10 [ 781.922642][T17591] bridge0: port 2(bridge_slave_1) entered blocking state [ 781.922729][T17591] bridge0: port 2(bridge_slave_1) entered disabled state [ 781.922887][T17591] bridge_slave_1: entered allmulticast mode [ 781.931974][T17591] bridge_slave_1: entered promiscuous mode [ 782.042429][T17591] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 782.062133][T17591] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 782.278991][T17591] team0: Port device team_slave_0 added [ 782.286928][T17591] team0: Port device team_slave_1 added [ 782.492471][ T25] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 782.517246][ T25] hid-generic 0000:0000:0000.000F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 783.065156][T17591] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 783.065165][T17591] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 783.065185][T17591] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 783.167751][T17591] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 783.167763][T17591] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 783.167788][T17591] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 783.410974][ T30] audit: type=1400 audit(1791277152.837:813): avc: denied { write } for pid=17778 comm="syz.9.4079" name="hidraw0" dev="devtmpfs" ino=3631 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 783.642269][T17591] hsr_slave_0: entered promiscuous mode [ 783.652753][T17591] hsr_slave_1: entered promiscuous mode [ 783.655215][T17591] debugfs: 'hsr0' already exists in 'hsr' [ 783.655231][T17591] Cannot create hsr debugfs directory [ 783.733599][ C0] net_ratelimit: 116 callbacks suppressed [ 784.688092][ T30] audit: type=1400 audit(1791277153.898:814): avc: denied { write } for pid=17783 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 784.688146][ T30] audit: type=1400 audit(1791277153.990:815): avc: denied { write } for pid=17803 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 785.193563][ T5267] 8021q: adding VLAN 0 to HW filter on device eth11 [ 785.632410][ T30] audit: type=1400 audit(1791277154.876:816): avc: denied { write } for pid=17822 comm="syz.9.4089" name="functions" dev="configfs" ino=8954 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 785.685577][ T30] audit: type=1400 audit(1791277154.941:817): avc: denied { setopt } for pid=17822 comm="syz.9.4089" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 785.774056][ T30] audit: type=1400 audit(1791277155.024:818): avc: denied { write } for pid=17822 comm="syz.9.4089" name="fs" dev="configfs" ino=52184 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 785.812260][ T30] audit: type=1400 audit(1791277155.051:819): avc: denied { write } for pid=17822 comm="syz.9.4089" name="header" dev="configfs" ino=52177 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 785.837348][ T30] audit: type=1400 audit(1791277155.061:820): avc: denied { write } for pid=17822 comm="syz.9.4089" name="c.1" dev="configfs" ino=8959 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 785.837397][ T30] audit: type=1400 audit(1791277155.061:821): avc: denied { write } for pid=17822 comm="syz.9.4089" name="c.1" dev="configfs" ino=8959 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 785.865080][ T30] audit: type=1400 audit(1791277155.079:822): avc: denied { write } for pid=17822 comm="syz.9.4089" name="mjpeg" dev="configfs" ino=52179 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 786.298646][T17849] fuse: Bad value for 'fd' [ 786.829887][T17591] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 786.876413][T17591] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 786.881144][T17591] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 786.935687][T17591] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 786.936463][T17591] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 787.004806][T17591] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 787.006074][T17591] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 787.055305][T17591] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 787.559167][T17591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 787.745066][T17912] siw: device registration error -23 [ 788.544226][T17591] 8021q: adding VLAN 0 to HW filter on device team0 [ 788.595294][ T6972] bridge0: port 1(bridge_slave_0) entered blocking state [ 788.595401][ T6972] bridge0: port 1(bridge_slave_0) entered forwarding state [ 788.637706][ T6972] bridge0: port 2(bridge_slave_1) entered blocking state [ 788.637806][ T6972] bridge0: port 2(bridge_slave_1) entered forwarding state [ 788.892563][ T6489] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 789.135317][ T6489] usb 3-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 789.136509][ T6489] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 789.136553][ T6489] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 789.136580][ T6489] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 789.136609][ T6489] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 789.136678][ T6489] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 789.185107][ C1] net_ratelimit: 131 callbacks suppressed [ 789.659020][ T6489] gud 3-1:1.0: No supported pixel formats found [ 789.659054][ T6489] gud 3-1:1.0: probe with driver gud failed with error -22 [ 789.700643][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 789.700659][ T30] audit: type=1400 audit(1791277158.641:834): avc: denied { write } for pid=17933 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 789.885612][ T30] audit: type=1400 audit(1791277158.807:835): avc: denied { write } for pid=17957 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 790.241205][T17970] siw: device registration error -23 [ 790.442734][T17591] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 790.975651][T17591] veth0_vlan: entered promiscuous mode [ 790.991876][T17591] veth1_vlan: entered promiscuous mode [ 791.042442][T17591] veth0_macvtap: entered promiscuous mode [ 791.047859][T17591] veth1_macvtap: entered promiscuous mode [ 791.081502][ T25] usb 3-1: USB disconnect, device number 47 [ 791.150205][T17591] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 791.200353][T17591] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 791.377359][ T6975] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 791.377688][ T6975] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 791.378028][ T6975] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 791.378066][ T6975] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 791.813447][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 791.813461][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 791.956113][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 791.956129][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 792.654900][ T10] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 792.874912][ T10] usb 10-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 792.876745][ T10] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 792.876789][ T10] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 792.889155][ T10] as10x_usb: device has been detected [ 792.895203][ T10] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 792.896748][T18029] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 793.052630][ T10] usb 10-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 793.229106][ T10] as10x_usb: error during firmware upload part1 [ 793.229760][ T10] Registered device Abilis Systems DVB-Titan [ 794.142638][ T5716] usb 10-1: USB disconnect, device number 9 [ 794.482352][ T5716] Unregistered device Abilis Systems DVB-Titan [ 794.495113][ T5716] as10x_usb: device has been disconnected [ 794.656058][ T5719] net_ratelimit: 342 callbacks suppressed [ 795.108586][T18059] siw: device registration error -23 [ 796.837008][T18079] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 796.977410][ T5709] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 797.044737][T18091] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4153'. [ 797.044865][T18091] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4153'. [ 797.166208][ T5709] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 797.167735][ T5709] usb 10-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 797.171931][ T5709] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 797.171956][ T5709] usb 10-1: Product: syz [ 797.171974][ T5709] usb 10-1: Manufacturer: syz [ 797.171993][ T5709] usb 10-1: SerialNumber: syz [ 797.466764][ T5709] usblp 10-1:1.0: usblp0: USB Unidirectional printer dev 10 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 797.487258][ T5716] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 797.589201][ T5604] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 797.601929][T18109] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 797.621795][ T5604] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 797.624148][ T5604] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 797.642313][ T5604] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 797.645367][ T5604] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 797.651674][ T5716] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 797.657387][ T5716] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 797.695642][ T5716] usb 3-1: config 0 descriptor?? [ 797.939375][ T5716] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 798.053899][T18126] netlink: 48 bytes leftover after parsing attributes in process `syz.8.4165'. [ 798.054161][T18126] netlink: 48 bytes leftover after parsing attributes in process `syz.8.4165'. [ 798.341228][ T5716] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1 [ 798.341251][ T5716] [drm] Initialized udl on minor 1 [ 799.429614][ T5716] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 1 failed err ffffffb9 [ 799.430004][ T5716] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 799.455890][ T5716] usb 3-1: USB disconnect, device number 48 [ 799.468726][ T5338] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 799.851333][ T5604] Bluetooth: hci3: command tx timeout [ 799.903631][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 800.120299][ C0] net_ratelimit: 173 callbacks suppressed [ 800.485084][T18144] syzkaller0: entered promiscuous mode [ 800.485104][T18144] syzkaller0: entered allmulticast mode [ 800.520119][T18107] lo speed is unknown, defaulting to 1000 [ 801.477439][T18166] netlink: 48 bytes leftover after parsing attributes in process `syz.8.4175'. [ 801.477603][T18166] netlink: 48 bytes leftover after parsing attributes in process `syz.8.4175'. [ 802.103728][ T5604] Bluetooth: hci3: command tx timeout [ 802.502734][ T30] audit: type=1400 audit(1791277169.981:836): avc: denied { getopt } for pid=18173 comm="syz.2.4178" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 802.856827][T18107] bridge0: port 1(bridge_slave_0) entered blocking state [ 802.856961][T18107] bridge0: port 1(bridge_slave_0) entered disabled state [ 802.857109][T18107] bridge_slave_0: entered allmulticast mode [ 802.858852][T18107] bridge_slave_0: entered promiscuous mode [ 802.901271][T18107] bridge0: port 2(bridge_slave_1) entered blocking state [ 802.901406][T18107] bridge0: port 2(bridge_slave_1) entered disabled state [ 802.901571][T18107] bridge_slave_1: entered allmulticast mode [ 802.909861][T18107] bridge_slave_1: entered promiscuous mode [ 803.031241][T18107] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 803.047604][T18107] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 803.077780][T18192] syzkaller0: entered promiscuous mode [ 803.077824][T18192] syzkaller0: entered allmulticast mode [ 803.156564][T18107] team0: Port device team_slave_0 added [ 803.160089][T18107] team0: Port device team_slave_1 added [ 803.217241][T18107] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 803.217253][T18107] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 803.217277][T18107] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 803.231999][T18107] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 803.232013][T18107] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 803.232039][T18107] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 803.506225][T18107] hsr_slave_0: entered promiscuous mode [ 803.509065][T18107] hsr_slave_1: entered promiscuous mode [ 803.509735][T18107] debugfs: 'hsr0' already exists in 'hsr' [ 803.509745][T18107] Cannot create hsr debugfs directory [ 803.749725][T18204] netlink: 48 bytes leftover after parsing attributes in process `syz.8.4186'. [ 803.792768][T18204] netlink: 48 bytes leftover after parsing attributes in process `syz.8.4186'. [ 804.369993][ T5615] Bluetooth: hci3: command tx timeout [ 804.420659][T18107] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 804.545616][T18107] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 804.744480][T18107] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 805.256233][ T25] usb 10-1: USB disconnect, device number 10 [ 805.302441][ T25] usblp0: removed [ 805.343911][T18107] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 805.378254][T18225] netlink: 92 bytes leftover after parsing attributes in process `syz.9.4192'. [ 805.385947][T18225] bridge0: port 1(bridge_slave_0) entered disabled state [ 805.718123][T18238] 9p: Bad value for 'wfdno' [ 805.831785][ C0] net_ratelimit: 144 callbacks suppressed [ 805.877738][T18107] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 805.904297][T18107] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 805.907897][T18107] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 805.959351][T18107] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 805.963908][T18107] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 806.005010][T18107] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 806.014147][T18107] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 806.036844][T18107] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 806.113655][T16811] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 806.205667][T18107] 8021q: adding VLAN 0 to HW filter on device bond0 [ 806.232467][T18107] 8021q: adding VLAN 0 to HW filter on device team0 [ 806.247241][ T6984] bridge0: port 1(bridge_slave_0) entered blocking state [ 806.247349][ T6984] bridge0: port 1(bridge_slave_0) entered forwarding state [ 806.260178][ T6984] bridge0: port 2(bridge_slave_1) entered blocking state [ 806.260279][ T6984] bridge0: port 2(bridge_slave_1) entered forwarding state [ 806.269436][ T5604] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 806.278088][T16811] usb 10-1: Using ep0 maxpacket: 32 [ 806.281041][T16811] usb 10-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 806.283282][T16811] usb 10-1: config 0 has an invalid interface number: 188 but max is 0 [ 806.283307][T16811] usb 10-1: config 0 has no interface number 0 [ 806.283348][T16811] usb 10-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 806.337789][T16811] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 806.337811][T16811] usb 10-1: Product: syz [ 806.337827][T16811] usb 10-1: Manufacturer: syz [ 806.337844][T16811] usb 10-1: SerialNumber: syz [ 806.355277][T16811] usb 10-1: config 0 descriptor?? [ 806.358827][T18247] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 806.411279][T18107] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 806.411297][T18107] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 806.591128][T18247] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 806.630729][ T5604] Bluetooth: hci3: command tx timeout [ 807.496098][T18107] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 807.620255][T18107] veth0_vlan: entered promiscuous mode [ 807.640167][T18107] veth1_vlan: entered promiscuous mode [ 807.719664][T18107] veth0_macvtap: entered promiscuous mode [ 807.739004][T18107] veth1_macvtap: entered promiscuous mode [ 808.233181][T18107] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 808.260228][T18107] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 808.347247][ T6957] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 808.370922][ T6970] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 808.372630][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 808.372676][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 808.672768][ T6954] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 808.672783][ T6954] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 808.691126][T18304] binder: 18302:18304 ioctl 4018620d 0 returned -22 [ 808.711549][T18304] binder: 18302:18304 ioctl c0306201 2000000002c0 returned -14 [ 808.771699][ T6984] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 808.771714][ T6984] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 808.884648][T16811] asix 10-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 808.884678][T16811] asix 10-1:0.188 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0088: ffffffb9 [ 808.884896][T16811] asix 10-1:0.188: probe with driver asix failed with error -71 [ 808.916071][T16811] usb 10-1: USB disconnect, device number 11 [ 808.928769][T18311] fuse: Bad value for 'fd' [ 809.398122][ T5709] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 809.588340][ T5709] usb 1-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 809.624653][ T5709] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 809.626903][ T5709] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 809.829387][ T5709] as10x_usb: device has been detected [ 809.829857][ T5709] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 809.871903][ T5709] usb 1-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 809.874678][T16811] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 809.925417][ T5709] as10x_usb: error during firmware upload part1 [ 809.926022][ T5709] Registered device Abilis Systems DVB-Titan [ 810.518829][T16811] usb 6-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 810.529557][T16811] usb 6-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 810.529588][T16811] usb 6-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 810.529617][T16811] usb 6-1: config 0 interface 0 has no altsetting 0 [ 810.529671][T16811] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 810.536748][T16811] usb 6-1: config 0 descriptor?? [ 810.616465][T18336] binder: 18335:18336 ioctl 4018620d 0 returned -22 [ 810.620150][T18336] binder: 18335:18336 ioctl c0306201 2000000002c0 returned -14 [ 810.786404][T18323] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 810.787303][T18323] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 810.807228][T16811] usbhid 6-1:0.0: can't add hid device: -71 [ 810.807391][T16811] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 810.825177][T16811] usb 6-1: USB disconnect, device number 12 [ 810.848689][T18345] fuse: Bad value for 'fd' [ 810.904470][T18345] FAULT_INJECTION: forcing a failure. [ 810.904470][T18345] name failslab, interval 1, probability 0, space 0, times 0 [ 810.904509][T18345] CPU: 0 UID: 0 PID: 18345 Comm: syz.9.4226 Not tainted syzkaller #0 PREEMPT(full) [ 810.904537][T18345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 810.904551][T18345] Call Trace: [ 810.904561][T18345] [ 810.904569][T18345] dump_stack_lvl+0x100/0x190 [ 810.904613][T18345] should_fail_ex.cold+0x5/0xa [ 810.904649][T18345] should_failslab+0xc2/0x120 [ 810.904682][T18345] kmem_cache_alloc_noprof+0x92/0x6a0 [ 810.904712][T18345] ? pidfs_register_pid_gfp+0x98/0x1f0 [ 810.904846][T18345] pidfs_register_pid_gfp+0x98/0x1f0 [ 810.904884][T18345] pidfs_stash_dentry+0x7a/0xf0 [ 810.904915][T18345] ? __pfx_pidfs_stash_dentry+0x10/0x10 [ 810.904948][T18345] path_from_stashed+0x4e6/0x760 [ 810.905007][T18345] pidfs_alloc_file+0xf8/0x290 [ 810.905040][T18345] ? __pfx_pidfs_alloc_file+0x10/0x10 [ 810.905082][T18345] pidfd_prepare+0x107/0x1b0 [ 810.905111][T18345] __x64_sys_pidfd_open+0x105/0x1a0 [ 810.905145][T18345] ? __pfx___x64_sys_pidfd_open+0x10/0x10 [ 810.905187][T18345] do_syscall_64+0x123/0x790 [ 810.905217][T18345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 810.905241][T18345] RIP: 0033:0x7fadd6f9e199 [ 810.905259][T18345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 810.905282][T18345] RSP: 002b:00007fadd7ea1018 EFLAGS: 00000246 ORIG_RAX: 00000000000001b2 [ 810.905305][T18345] RAX: ffffffffffffffda RBX: 00007fadd7225fa0 RCX: 00007fadd6f9e199 [ 810.905321][T18345] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000219 [ 810.905336][T18345] RBP: 00007fadd70358e0 R08: 0000000000000000 R09: 0000000000000000 [ 810.905351][T18345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 810.905364][T18345] R13: 00007fadd7226038 R14: 00007fadd7225fa0 R15: 00007ffcc25636e8 [ 810.905396][T18345] [ 811.286297][ T5716] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 811.467707][ C0] net_ratelimit: 348 callbacks suppressed [ 811.478258][ T5716] usb 3-1: Using ep0 maxpacket: 8 [ 811.479133][ T5716] usb 3-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 811.480863][ T5716] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 811.480886][ T5716] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 811.480949][ T5716] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 811.481005][ T5716] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 811.490362][ T5716] hub 3-1:1.0: bad descriptor, ignoring hub [ 811.490382][ T5716] hub 3-1:1.0: probe with driver hub failed with error -5 [ 811.491940][ T5716] cdc_wdm 3-1:1.0: skipping garbage [ 811.491956][ T5716] cdc_wdm 3-1:1.0: skipping garbage [ 811.492049][ T5716] cdc_wdm 3-1:1.0: probe with driver cdc_wdm failed with error -22 [ 811.836777][ T5716] usb 3-1: USB disconnect, device number 49 [ 812.158962][T18369] binder: BINDER_SET_CONTEXT_MGR already set [ 812.158991][T18369] binder: 18368:18369 ioctl 4018620d 200000004a80 returned -16 [ 812.441824][T18379] fuse: Bad value for 'fd' [ 813.334593][T18394] jffs2: notice: (18394) jffs2_build_xattr_subsystem: complete building xattr subsystem, 4 of xdatum (2 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. [ 813.359255][ T30] audit: type=1400 audit(1791277180.472:837): avc: denied { write } for pid=18393 comm="syz.9.4244" name="/" dev="jffs2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 813.359326][ T30] audit: type=1400 audit(1791277180.472:838): avc: denied { create } for pid=18393 comm="syz.9.4244" name="fillfile" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 813.439355][ T30] audit: type=1400 audit(1791277180.536:839): avc: denied { read write open } for pid=18393 comm="syz.9.4244" path="/194/mnt/fillfile" dev="jffs2" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 813.454187][T18399] binder: BINDER_SET_CONTEXT_MGR already set [ 813.454199][T18399] binder: 18397:18399 ioctl 4018620d 200000004a80 returned -16 [ 813.927958][T18412] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 814.046856][ T5716] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 814.210205][ T5716] usb 3-1: Using ep0 maxpacket: 32 [ 814.211159][ T5716] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 814.212519][ T5716] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 814.212536][ T5716] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 814.212598][ T5716] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 814.265704][ T5716] usb 3-1: config 0 descriptor?? [ 814.283303][ T5716] hub 3-1:0.0: USB hub found [ 814.398110][ T30] audit: type=1400 audit(1791277181.431:840): avc: denied { write } for pid=18413 comm="syz.5.4250" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 814.402044][ T30] audit: type=1400 audit(1791277181.431:841): avc: denied { read } for pid=18413 comm="syz.5.4250" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 814.496816][ T5716] hub 3-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 814.960008][ C0] raw-gadget.1 gadget.2: ignoring, device is not running [ 814.966765][ T5716] usbhid 3-1:0.0: can't add hid device: -71 [ 814.966911][ T5716] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 815.024991][ T5716] usb 3-1: USB disconnect, device number 50 [ 815.866346][T18441] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 815.879840][ T5696] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 816.051910][ T5696] usb 3-1: Using ep0 maxpacket: 16 [ 816.052739][ T5696] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 816.053766][ T5696] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 816.053793][ T5696] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 816.055038][ T5696] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 816.055050][ T5696] usb 3-1: SerialNumber: syz [ 816.112663][T16023] usb 1-1: USB disconnect, device number 39 [ 816.114760][ T5696] usb 3-1: 0:2 : does not exist [ 816.201584][T16023] Unregistered device Abilis Systems DVB-Titan [ 816.206506][T16023] as10x_usb: device has been disconnected [ 816.295225][ T5696] usb 3-1: USB disconnect, device number 51 [ 816.531516][T18452] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 816.637023][T18453] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 816.772317][T18454] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 816.940497][ T5604] Bluetooth: hci4: command 0x0406 tx timeout [ 817.024097][ T6984] net_ratelimit: 170 callbacks suppressed [ 818.251900][ T967] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 818.414560][ T967] usb 1-1: Using ep0 maxpacket: 32 [ 818.415523][ T967] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 818.417205][ T967] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 818.417241][ T967] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 818.417312][ T967] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 818.420768][ T967] usb 1-1: config 0 descriptor?? [ 818.475337][ T967] hub 1-1:0.0: USB hub found [ 818.667858][ T967] hub 1-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 818.859798][T18477] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 819.158162][ T967] usbhid 1-1:0.0: can't add hid device: -71 [ 819.158318][ T967] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 819.194494][ T967] usb 1-1: USB disconnect, device number 40 [ 820.403032][T18492] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 820.512971][T18493] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 820.623946][T18494] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 821.524930][ T5615] Bluetooth: hci5: command 0xfc11 tx timeout [ 821.530619][ T5604] Bluetooth: hci5: Entering manufacturer mode failed (-110) [ 822.489516][ C0] net_ratelimit: 158 callbacks suppressed [ 823.188899][T18479] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4278'. [ 823.606052][ T967] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 823.616369][T18507] siw: device registration error -23 [ 823.781176][ T967] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 823.785440][ T967] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 823.851828][ T967] usb 1-1: config 0 descriptor?? [ 824.416293][ T967] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 824.683233][ T967] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 1 [ 824.683259][ T967] [drm] Initialized udl on minor 1 [ 824.829993][ T967] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 824.858923][ T967] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 824.874913][ T967] usb 1-1: USB disconnect, device number 41 [ 824.978174][T18522] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 825.633983][T18534] 9p: Bad value for 'wfdno' [ 826.109304][ T5709] usb 3-1: new full-speed USB device number 52 using dummy_hcd [ 826.295326][ T5709] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 826.297616][ T5709] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 826.297639][ T5709] usb 3-1: config 0 has no interface number 0 [ 826.297680][ T5709] usb 3-1: config 0 interface 41 has no altsetting 0 [ 826.300086][ T5709] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 826.300109][ T5709] usb 3-1: Product: syz [ 826.300126][ T5709] usb 3-1: Manufacturer: syz [ 826.300143][ T5709] usb 3-1: SerialNumber: syz [ 826.364566][ T5709] usb 3-1: config 0 descriptor?? [ 827.424218][ T5709] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 828.114282][ C1] net_ratelimit: 154 callbacks suppressed [ 828.559652][ T5709] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 828.559756][ T5709] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): Failed to power up PHY: -71 [ 828.559909][ T5709] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -71 [ 828.563797][ T5709] usb 3-1: USB disconnect, device number 52 [ 829.450409][ T5709] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 829.703145][ T5709] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 829.722218][ T5709] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 829.741752][ T5709] usb 3-1: config 0 descriptor?? [ 829.977224][ T5709] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 830.253266][ T5709] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1 [ 830.253290][ T5709] [drm] Initialized udl on minor 1 [ 830.438171][ T5709] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 830.506514][ T5696] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 830.509082][ T5709] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 830.577595][ T5709] usb 3-1: USB disconnect, device number 53 [ 830.602856][ T5696] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 831.302603][T18567] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 831.449042][T18533] netlink: 20 bytes leftover after parsing attributes in process `syz.8.4297'. [ 831.575319][T18572] 9p: Bad value for 'wfdno' [ 831.753220][T18578] si4713 0-0063: IRQ not configured. Using timeouts. [ 831.753287][T18578] si4713 0-0063: Error while sending command 0x01 [ 831.753331][T18578] si4713 0-0063: Failed to probe device information. [ 831.810700][T18578] si4713 0-0063: probe with driver si4713 failed with error -5 [ 831.811020][T18578] i2c i2c-0: new_device: Instantiated device si4713 at 0x63 [ 831.994240][T16811] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 832.224845][T16811] usb 6-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 832.302053][T16811] usb 6-1: config 0 has an invalid interface number: 41 but max is 0 [ 832.302077][T16811] usb 6-1: config 0 has no interface number 0 [ 832.302116][T16811] usb 6-1: config 0 interface 41 has no altsetting 0 [ 832.307873][T16811] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 832.307885][T16811] usb 6-1: Product: syz [ 832.307894][T16811] usb 6-1: Manufacturer: syz [ 832.307903][T16811] usb 6-1: SerialNumber: syz [ 832.320380][T16811] usb 6-1: config 0 descriptor?? [ 832.677702][ T5709] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 832.840283][ T5709] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 832.841650][ T5709] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 832.844891][ T5709] usb 3-1: config 0 descriptor?? [ 833.075575][ T5709] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 833.221101][T16811] CoreChips 6-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 833.337027][ T5709] [drm:udl_init] *ERROR* Selecting channel failed [ 833.366505][ T5709] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1 [ 833.366530][ T5709] [drm] Initialized udl on minor 1 [ 833.394236][ T5709] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 833.394668][ T5709] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 833.423829][ T5709] usb 3-1: USB disconnect, device number 54 [ 833.576625][ C0] net_ratelimit: 152 callbacks suppressed [ 833.743964][T18618] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 834.369478][T16811] CoreChips 6-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 834.369504][T16811] CoreChips 6-1:0.41 (unnamed net_device) (uninitialized): Failed to power up PHY: -71 [ 834.369689][T16811] CoreChips 6-1:0.41: probe with driver CoreChips failed with error -71 [ 834.374267][T16811] usb 6-1: USB disconnect, device number 13 [ 836.216898][T18638] FAULT_INJECTION: forcing a failure. [ 836.216898][T18638] name failslab, interval 1, probability 0, space 0, times 0 [ 836.216935][T18638] CPU: 0 UID: 0 PID: 18638 Comm: syz.2.4333 Not tainted syzkaller #0 PREEMPT(full) [ 836.216967][T18638] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 836.216983][T18638] Call Trace: [ 836.216994][T18638] [ 836.217005][T18638] dump_stack_lvl+0x100/0x190 [ 836.217051][T18638] should_fail_ex.cold+0x5/0xa [ 836.217087][T18638] should_failslab+0xc2/0x120 [ 836.217123][T18638] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 836.217158][T18638] ? __d_alloc+0x35/0xa50 [ 836.217241][T18638] __d_alloc+0x35/0xa50 [ 836.217282][T18638] d_alloc_pseudo+0x1c/0xc0 [ 836.217309][T18638] alloc_file_pseudo_noaccount+0x118/0x290 [ 836.217350][T18638] ? __pfx_alloc_file_pseudo_noaccount+0x10/0x10 [ 836.217390][T18638] ? iput+0x3a/0x40 [ 836.217416][T18638] bdev_file_open_by_dev+0x13a/0x210 [ 836.217455][T18638] setup_bdev_super+0x78/0x770 [ 836.217484][T18638] get_tree_bdev_flags+0x363/0x620 [ 836.217531][T18638] ? __pfx_xfs_fs_fill_super+0x10/0x10 [ 836.217612][T18638] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 836.217643][T18638] ? cap_capable+0x107/0x430 [ 836.217671][T18638] ? bpf_lsm_capable+0x9/0x10 [ 836.217730][T18638] ? security_capable+0x80/0x260 [ 836.217760][T18638] vfs_get_tree+0x92/0x320 [ 836.217785][T18638] path_mount+0x7d0/0x24c0 [ 836.217848][T18638] ? __pfx_path_mount+0x10/0x10 [ 836.217871][T18638] ? lockdep_hardirqs_on+0x7d/0x110 [ 836.217905][T18638] ? putname+0xb1/0x110 [ 836.217939][T18638] ? kmem_cache_free+0x127/0x6c0 [ 836.217974][T18638] ? __x64_sys_mount+0x293/0x310 [ 836.217996][T18638] __x64_sys_mount+0x293/0x310 [ 836.218019][T18638] ? __pfx___x64_sys_mount+0x10/0x10 [ 836.218054][T18638] do_syscall_64+0x123/0x790 [ 836.218086][T18638] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 836.218114][T18638] RIP: 0033:0x7f54eeb9e199 [ 836.218136][T18638] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 836.218163][T18638] RSP: 002b:00007f54ef98e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 836.218188][T18638] RAX: ffffffffffffffda RBX: 00007f54eee25fa0 RCX: 00007f54eeb9e199 [ 836.218202][T18638] RDX: 0000200000000080 RSI: 0000200000000040 RDI: 0000200000000140 [ 836.218216][T18638] RBP: 00007f54eec358e0 R08: 0000000000000000 R09: 0000000000000000 [ 836.218229][T18638] R10: 0000000000200001 R11: 0000000000000246 R12: 0000000000000000 [ 836.218243][T18638] R13: 00007f54eee26038 R14: 00007f54eee25fa0 R15: 00007ffd69009468 [ 836.218282][T18638] [ 836.295970][T18638] /dev/nullb0: Can't open blockdev [ 836.474886][T16811] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 836.644413][T16811] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 836.645597][T16811] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 836.649547][T16811] usb 6-1: config 0 descriptor?? [ 836.678625][T16811] cp210x 6-1:0.0: cp210x converter detected [ 837.106463][T16811] cp210x 6-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 837.346203][T16811] cp210x 6-1:0.0: failed to get vendor val 0x370c size 15: -71 [ 837.346227][T16811] cp210x 6-1:0.0: GPIO initialisation failed: -71 [ 837.390588][T16811] usb 6-1: cp210x converter now attached to ttyUSB0 [ 837.402317][T16811] usb 6-1: USB disconnect, device number 14 [ 837.411883][T16811] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 837.429733][T16811] cp210x 6-1:0.0: device disconnected [ 838.235659][T18657] ceph: No source [ 839.040886][ C0] net_ratelimit: 126 callbacks suppressed [ 839.352186][ T30] audit: type=1400 audit(1791277204.453:842): avc: denied { write } for pid=18660 comm="syz.2.4342" name="nullb" dev="configfs" ino=1309 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 840.522546][ T5604] Bluetooth: hci6: unexpected event 0x04 length: 4 < 10 [ 840.569404][T18662] Dev nullb1: unable to read RDB block 8 [ 840.569553][T18662] nullb1: unable to read partition table [ 840.605254][T18662] null_blk: disk nullb1 created [ 841.553427][T18708] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 841.636837][T18709] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 841.723970][T18710] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 842.292730][ T967] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 842.753214][ T967] usb 3-1: Using ep0 maxpacket: 32 [ 842.794361][ T967] usb 3-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 842.919104][ T967] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 842.919124][ T967] usb 3-1: Product: syz [ 842.919140][ T967] usb 3-1: Manufacturer: syz [ 842.919155][ T967] usb 3-1: SerialNumber: syz [ 843.832725][T16023] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 844.089957][T16023] usb 1-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 844.092687][T16023] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 844.092741][T16023] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 844.092773][T16023] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 844.092838][T16023] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 844.551194][ T30] audit: type=1400 audit(1791277209.251:843): avc: denied { ioctl } for pid=18728 comm="syz.0.4362" path="socket:[57011]" dev="sockfs" ino=57011 ioctlcmd=0x6153 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 844.627330][T16023] cxacru 1-1:1.0: send of cm 0x90 failed (-71) [ 844.638403][T18768] cxacru 1-1:1.0: Direct firmware load for cxacru-fw.bin failed with error -2 [ 844.638419][T18768] cxacru 1-1:1.0: Falling back to sysfs fallback for: cxacru-fw.bin [ 844.667704][T16023] usb 1-1: USB disconnect, device number 42 [ 844.674310][ C0] net_ratelimit: 154 callbacks suppressed [ 845.189145][ T5709] usb 3-1: USB disconnect, device number 55 [ 846.050969][ T5709] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 846.213917][ T5709] usb 3-1: Using ep0 maxpacket: 8 [ 846.219835][ T5709] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 846.284641][ T5709] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 846.284783][ T5709] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 846.284815][ T5709] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 846.284844][ T5709] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 846.284905][ T5709] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 846.284931][ T5709] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 846.285049][ T5709] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 846.706468][ T5709] usb 3-1: usb_control_msg returned -32 [ 846.706516][ T5709] usbtmc 3-1:16.0: can't read capabilities [ 847.073055][ T5604] Bluetooth: hci3: unexpected event 0x04 length: 7 < 10 [ 849.179711][T18826] siw: device registration error -23 [ 849.566419][ T25] usb 3-1: USB disconnect, device number 56 [ 850.105816][T18840] siw: device registration error -23 [ 850.136531][ C1] net_ratelimit: 115 callbacks suppressed [ 852.047302][ T5615] Bluetooth: hci5: command 0xfc11 tx timeout [ 852.050279][ T5604] Bluetooth: hci5: Entering manufacturer mode failed (-110) [ 854.219988][T18852] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 854.461457][ T967] usb 3-1: new full-speed USB device number 57 using dummy_hcd [ 854.624246][ T967] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 854.625758][ T967] usb 3-1: config 0 has an invalid interface number: 41 but max is 0 [ 854.625783][ T967] usb 3-1: config 0 has no interface number 0 [ 854.625825][ T967] usb 3-1: config 0 interface 41 has no altsetting 0 [ 854.628236][ T967] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 854.628259][ T967] usb 3-1: Product: syz [ 854.628276][ T967] usb 3-1: Manufacturer: syz [ 854.628294][ T967] usb 3-1: SerialNumber: syz [ 854.653040][ T967] usb 3-1: config 0 descriptor?? [ 854.715715][T18881] kAFS: Invalid Command on /proc/fs/afs/cells file [ 854.770211][ T5604] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 854.778269][ T5604] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 854.791142][ T5604] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 854.792961][ T5604] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 854.794067][ T5604] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 855.588199][ T967] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 855.641417][T18904] net_ratelimit: 189 callbacks suppressed [ 855.708880][T18882] lo speed is unknown, defaulting to 1000 [ 856.792834][ T967] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 856.792900][ T967] CoreChips 3-1:0.41 (unnamed net_device) (uninitialized): Failed to power up PHY: -71 [ 856.805795][ T967] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -71 [ 856.873302][ T967] usb 3-1: USB disconnect, device number 57 [ 856.952260][T18882] bridge0: port 1(bridge_slave_0) entered blocking state [ 856.952361][T18882] bridge0: port 1(bridge_slave_0) entered disabled state [ 856.955243][T18882] bridge_slave_0: entered allmulticast mode [ 856.960820][T18882] bridge_slave_0: entered promiscuous mode [ 856.979988][T18882] bridge0: port 2(bridge_slave_1) entered blocking state [ 856.980082][T18882] bridge0: port 2(bridge_slave_1) entered disabled state [ 856.980240][T18882] bridge_slave_1: entered allmulticast mode [ 856.992576][T18882] bridge_slave_1: entered promiscuous mode [ 857.074213][ T5604] Bluetooth: hci5: command tx timeout [ 857.184057][T18882] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 857.208598][T18882] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 857.317024][T18882] team0: Port device team_slave_0 added [ 857.319964][T18882] team0: Port device team_slave_1 added [ 857.326542][T18932] netlink: 68 bytes leftover after parsing attributes in process `syz.8.4427'. [ 857.405459][T18882] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 857.405471][T18882] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 857.405498][T18882] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 857.407565][T18882] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 857.407577][T18882] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 857.407603][T18882] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 857.680762][T18882] hsr_slave_0: entered promiscuous mode [ 857.683347][T18882] hsr_slave_1: entered promiscuous mode [ 857.683781][T18882] debugfs: 'hsr0' already exists in 'hsr' [ 857.683798][T18882] Cannot create hsr debugfs directory [ 857.798843][ T25] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 857.972380][ T25] usb 3-1: Using ep0 maxpacket: 16 [ 857.973271][ T25] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 857.976123][ T25] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 857.976149][ T25] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 857.978506][ T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 857.978531][ T25] usb 3-1: SerialNumber: syz [ 858.067272][ T25] usb 3-1: 0:2 : does not exist [ 858.306075][ T25] usb 3-1: USB disconnect, device number 58 [ 858.569866][T18882] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 859.063226][T18882] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 859.330187][ T5604] Bluetooth: hci5: command tx timeout [ 859.376188][T18882] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 859.424515][ T967] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 859.545521][T18882] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 859.685646][ T967] usb 3-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01 [ 859.693923][ T967] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 859.694212][ T967] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 860.051760][ T5696] usb 10-1: new full-speed USB device number 12 using dummy_hcd [ 860.102979][ T967] as10x_usb: device has been detected [ 860.103669][ T967] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 860.170970][ T967] usb 3-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 860.197665][ T967] as10x_usb: error during firmware upload part1 [ 860.199160][ T967] Registered device Abilis Systems DVB-Titan [ 860.227337][ T5696] usb 10-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 860.230710][ T5696] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 860.230731][ T5696] usb 10-1: Product: syz [ 860.230748][ T5696] usb 10-1: Manufacturer: syz [ 860.230765][ T5696] usb 10-1: SerialNumber: syz [ 860.235936][ T5696] usb 10-1: config 0 descriptor?? [ 860.472030][ T5696] usb 10-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 860.636395][T18959] netlink: 68 bytes leftover after parsing attributes in process `syz.8.4439'. [ 860.815755][T18882] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 860.852221][T18882] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 860.854896][T18882] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 860.884344][T18882] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 860.887163][T18882] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 860.922093][T18882] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 860.924024][T18882] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 860.954112][T18882] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 861.013252][T18975] netlink: 48 bytes leftover after parsing attributes in process `syz.8.4443'. [ 861.016328][T18975] netlink: 48 bytes leftover after parsing attributes in process `syz.8.4443'. [ 861.147691][ C0] net_ratelimit: 136 callbacks suppressed [ 861.211968][T18882] 8021q: adding VLAN 0 to HW filter on device bond0 [ 861.250461][T18882] 8021q: adding VLAN 0 to HW filter on device team0 [ 861.264493][ T6978] bridge0: port 1(bridge_slave_0) entered blocking state [ 861.264579][ T6978] bridge0: port 1(bridge_slave_0) entered forwarding state [ 861.273294][ T6978] bridge0: port 2(bridge_slave_1) entered blocking state [ 861.273385][ T6978] bridge0: port 2(bridge_slave_1) entered forwarding state [ 861.582924][ T5604] Bluetooth: hci5: command tx timeout [ 861.691818][T18882] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 861.752134][T18882] veth0_vlan: entered promiscuous mode [ 861.768587][T18882] veth1_vlan: entered promiscuous mode [ 861.805026][T18882] veth0_macvtap: entered promiscuous mode [ 861.817597][T18882] veth1_macvtap: entered promiscuous mode [ 861.840105][T18882] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 861.861316][T18882] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 861.912821][ T6954] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.913238][ T6954] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.913597][ T6954] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.943942][ T6954] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.080142][ T5696] dvb_usb_rtl28xxu 10-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 862.102116][ T5696] usb 10-1: USB disconnect, device number 12 [ 862.149715][ T6957] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 862.149730][ T6957] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 862.228003][ T6978] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 862.228019][ T6978] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 862.781237][ T5739] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 863.006492][ T5739] usb 2-1: New USB device found, idVendor=041e, idProduct=30df, bcdDevice= 0.40 [ 863.335449][ T5739] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 17, changing to 7 [ 863.335503][ T5739] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 218, changing to 7 [ 863.351391][ T5739] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.351427][ T5739] usb 2-1: Product: syz [ 863.351450][ T5739] usb 2-1: Manufacturer: syz [ 863.351473][ T5739] usb 2-1: SerialNumber: syz [ 863.387684][ T5739] usb 2-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 863.637953][ T5739] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 863.713828][T19007] netlink: 68 bytes leftover after parsing attributes in process `syz.8.4450'. [ 863.836074][ T5604] Bluetooth: hci5: command tx timeout [ 863.936365][ T5739] usb 2-1: USB disconnect, device number 31 [ 864.363636][T19015] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4453'. [ 864.363842][T19015] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4453'. [ 865.211801][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 865.222632][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 865.558607][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 865.688662][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 865.894575][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 866.114877][ T5739] usb 3-1: USB disconnect, device number 59 [ 866.284289][ T5739] Unregistered device Abilis Systems DVB-Titan [ 866.316128][ T5739] as10x_usb: device has been disconnected [ 866.696739][ C0] net_ratelimit: 321 callbacks suppressed [ 867.579958][T19048] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4461'. [ 867.871024][ T5604] Bluetooth: hci5: unexpected event 0x10 length: 8 > 1 [ 867.874170][ T5615] Bluetooth: hci5: hardware error 0x00 [ 869.958208][T19085] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 870.167335][ T5615] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 870.450567][T19058] lo speed is unknown, defaulting to 1000 [ 870.498564][T19085] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 870.514935][T19089] block nbd0: Cannot use ioctl interface on a netlink controlled device. [ 870.527303][T19085] i2c i2c-0: Failed to register i2c client pi3usb30532 at 0x05 (-16) [ 871.400914][ T5739] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 871.445736][T19103] FAULT_INJECTION: forcing a failure. [ 871.445736][T19103] name failslab, interval 1, probability 0, space 0, times 0 [ 871.445780][T19103] CPU: 0 UID: 0 PID: 19103 Comm: syz.0.4479 Not tainted syzkaller #0 PREEMPT(full) [ 871.445812][T19103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 871.445830][T19103] Call Trace: [ 871.445842][T19103] [ 871.445852][T19103] dump_stack_lvl+0x100/0x190 [ 871.445895][T19103] should_fail_ex.cold+0x5/0xa [ 871.445947][T19103] should_failslab+0xc2/0x120 [ 871.445999][T19103] kmem_cache_alloc_node_noprof+0x94/0x6e0 [ 871.446029][T19103] ? __alloc_skb+0x5b7/0x710 [ 871.446166][T19103] ? __alloc_skb+0x140/0x710 [ 871.446207][T19103] __alloc_skb+0x140/0x710 [ 871.446257][T19103] ? __alloc_skb+0x5b7/0x710 [ 871.446291][T19103] ? __pfx___alloc_skb+0x10/0x10 [ 871.446328][T19103] ? selinux_file_permission+0x8f/0x6d0 [ 871.446372][T19103] vhci_write+0xc1/0x490 [ 871.446448][T19103] vfs_write+0x6af/0x1050 [ 871.446483][T19103] ? __pfx_vhci_write+0x10/0x10 [ 871.446529][T19103] ? __pfx_vfs_write+0x10/0x10 [ 871.446554][T19103] ? find_held_lock+0x2b/0x80 [ 871.446635][T19103] ksys_write+0x12a/0x250 [ 871.446667][T19103] ? __pfx_ksys_write+0x10/0x10 [ 871.446716][T19103] do_syscall_64+0x123/0x790 [ 871.446751][T19103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 871.446785][T19103] RIP: 0033:0x7f7df375e9ce [ 871.446807][T19103] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 871.446836][T19103] RSP: 002b:00007f7df474bfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 871.446861][T19103] RAX: ffffffffffffffda RBX: 00007f7df474c6c0 RCX: 00007f7df375e9ce [ 871.446880][T19103] RDX: 0000000000000007 RSI: 0000200000000000 RDI: 00000000000000ca [ 871.446896][T19103] RBP: 00007f7df38358e0 R08: 0000000000000000 R09: 0000000000000000 [ 871.446910][T19103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 871.446925][T19103] R13: 00007f7df3a26038 R14: 00007f7df3a25fa0 R15: 00007ffcc1785408 [ 871.446965][T19103] [ 871.585974][T19103] XFS (nullb0): Invalid superblock magic number [ 871.683396][ T5739] usb 10-1: Using ep0 maxpacket: 16 [ 871.736234][ T5739] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 871.763482][ T5739] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 871.763500][ T5739] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 871.805851][ T5739] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 871.805871][ T5739] usb 10-1: Product: syz [ 871.805888][ T5739] usb 10-1: Manufacturer: syz [ 871.805904][ T5739] usb 10-1: SerialNumber: syz [ 871.888348][ T5739] usb 10-1: 0:2 : does not exist [ 871.915374][T19112] netlink: 'syz.1.4480': attribute type 268 has an invalid length. [ 872.083489][ T5739] usb 10-1: 5:0: failed to get current value for ch 0 (-22) [ 872.216915][ T5739] usb 10-1: USB disconnect, device number 13 [ 872.505710][ C0] net_ratelimit: 212 callbacks suppressed [ 874.163028][T18739] udevd[18739]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 874.950861][T19159] fuse: fd is not a fuse device [ 875.125262][T19164] XFS (nullb0): Invalid superblock magic number [ 875.161683][ T30] audit: type=1400 audit(1791277237.476:844): avc: denied { write } for pid=19172 comm="syz.2.4499" name="mouse0" dev="devtmpfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 875.420697][T19173] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input26 [ 875.865474][ T5739] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 876.115807][ T5739] usb 10-1: Using ep0 maxpacket: 32 [ 876.116614][ T5739] usb 10-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 876.117758][ T5739] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 876.117786][ T5739] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 876.117847][ T5739] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 876.170185][ T5739] usb 10-1: config 0 descriptor?? [ 876.188554][ T5739] hub 10-1:0.0: USB hub found [ 876.410752][ T5739] hub 10-1:0.0: 1 port detected [ 876.900261][ T5739] usb 10-1: USB disconnect, device number 14 [ 877.316831][ T30] audit: type=1400 audit(1791277239.478:845): avc: denied { write } for pid=19210 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 877.558050][ T30] audit: type=1400 audit(1791277239.700:846): avc: denied { write } for pid=19231 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 877.729497][ T5739] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 877.903380][ T5739] usb 2-1: Using ep0 maxpacket: 16 [ 877.904145][ T5739] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 877.905624][ T5739] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 877.905640][ T5739] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 877.905654][ T5739] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 877.905689][ T5739] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 877.929173][ T5739] usb 2-1: config 0 descriptor?? [ 877.954323][ T6489] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 877.967872][ C0] net_ratelimit: 190 callbacks suppressed [ 878.143861][ T6489] usb 10-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 878.146951][ T6489] usb 10-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 878.146985][ T6489] usb 10-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 878.147040][ T6489] usb 10-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 878.147108][ T6489] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 878.216197][T19238] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 878.370071][ T30] audit: type=1400 audit(1791277240.456:847): avc: denied { write } for pid=19240 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 878.493407][ T5739] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0010/input/input28 [ 878.613670][ T5739] microsoft 0003:045E:07DA.0010: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 878.688382][ T30] audit: type=1400 audit(1791277240.752:848): avc: denied { write } for pid=19253 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 878.688727][ T5709] usb 2-1: USB disconnect, device number 32 [ 878.828720][T19255] fido_id[19255]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 879.353651][ T6489] aiptek 10-1:17.0: Aiptek using 400 ms programming speed [ 879.382658][ T6489] input: Aiptek as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:17.0/input/input27 [ 879.524753][ T6489] usb 10-1: USB disconnect, device number 15 [ 879.524911][ C1] aiptek 10-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 879.697895][ T30] audit: type=1400 audit(1791277241.684:849): avc: denied { write } for pid=19258 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 880.022021][ T30] audit: type=1400 audit(1791277241.979:850): avc: denied { write } for pid=19279 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 880.157272][ T5709] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 880.249654][T19290] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4523'. [ 880.250219][T19290] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4523'. [ 880.298327][ T5709] usb 2-1: device descriptor read/64, error -71 [ 880.558298][ T5709] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 880.607451][ T30] audit: type=1400 audit(1791277242.523:851): avc: denied { write } for pid=19292 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 880.691148][ T30] audit: type=1400 audit(1791277242.597:852): avc: denied { write } for pid=19313 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 880.700157][ T5709] usb 2-1: device descriptor read/64, error -71 [ 880.818555][ T5709] usb usb2-port1: attempt power cycle [ 880.941210][ T30] audit: type=1400 audit(1791277242.828:853): avc: denied { write } for pid=19318 comm="syz.9.4530" name="subsystems" dev="configfs" ino=12442 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 880.941383][ T30] audit: type=1400 audit(1791277242.828:854): avc: denied { write } for pid=19318 comm="syz.9.4530" name="subsystems" dev="configfs" ino=12442 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 881.104636][T19324] FAULT_INJECTION: forcing a failure. [ 881.104636][T19324] name failslab, interval 1, probability 0, space 0, times 0 [ 881.104668][T19324] CPU: 0 UID: 0 PID: 19324 Comm: syz.2.4533 Not tainted syzkaller #0 PREEMPT(full) [ 881.104696][T19324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 881.104711][T19324] Call Trace: [ 881.104720][T19324] [ 881.104730][T19324] dump_stack_lvl+0x100/0x190 [ 881.104774][T19324] should_fail_ex.cold+0x5/0xa [ 881.104811][T19324] should_failslab+0xc2/0x120 [ 881.104847][T19324] __kmalloc_noprof+0xfc/0x840 [ 881.104877][T19324] ? lsm_blob_alloc+0x68/0x90 [ 881.104907][T19324] lsm_blob_alloc+0x68/0x90 [ 881.104931][T19324] security_prepare_creds+0x2d/0x290 [ 881.104975][T19324] prepare_creds+0x5d6/0x950 [ 881.105036][T19324] join_session_keyring+0x17/0x350 [ 881.105068][T19324] lookup_user_key+0xbf9/0x1300 [ 881.105100][T19324] ? __pfx_lookup_user_key+0x10/0x10 [ 881.105133][T19324] ? lock_acquire+0x1d1/0x380 [ 881.105162][T19324] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 881.105205][T19324] __do_sys_add_key+0x2a6/0x460 [ 881.105231][T19324] ? __pfx___do_sys_add_key+0x10/0x10 [ 881.105266][T19324] do_syscall_64+0x123/0x790 [ 881.105295][T19324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 881.105321][T19324] RIP: 0033:0x7f54eeb9e199 [ 881.105342][T19324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 881.105364][T19324] RSP: 002b:00007f54ef98e028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 881.105388][T19324] RAX: ffffffffffffffda RBX: 00007f54eee25fa0 RCX: 00007f54eeb9e199 [ 881.105404][T19324] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 881.105420][T19324] RBP: 00007f54eec358e0 R08: fffffffffffffffd R09: 0000000000000000 [ 881.105437][T19324] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 881.105452][T19324] R13: 00007f54eee26038 R14: 00007f54eee25fa0 R15: 00007ffd69009468 [ 881.105482][T19324] [ 881.187116][ T5709] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 881.210842][ T5709] usb 2-1: device descriptor read/8, error -71 [ 881.237799][T19330] netlink: 28 bytes leftover after parsing attributes in process `syz.8.4536'. [ 881.266987][T19330] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4096 sclass=netlink_route_socket pid=19330 comm=syz.8.4536 [ 881.469032][ T5709] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 881.497542][ T5709] usb 2-1: device descriptor read/8, error -71 [ 881.610025][ T5709] usb usb2-port1: unable to enumerate USB device [ 881.771966][ T5716] usb 3-1: new full-speed USB device number 60 using dummy_hcd [ 881.937063][ T5716] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 881.939755][ T5716] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 881.939820][ T5716] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 881.939879][ T5716] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 881.944907][ T5716] usb 3-1: config 0 descriptor?? [ 881.996530][ T5716] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 882.974978][ T6489] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 883.162042][ T6489] usb 10-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice= 0.40 [ 883.163306][ T6489] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 883.163329][ T6489] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 883.165972][ T6489] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 883.165995][ T6489] usb 10-1: Product: syz [ 883.166012][ T6489] usb 10-1: Manufacturer: syz [ 883.166029][ T6489] usb 10-1: SerialNumber: syz [ 883.179862][T19358] 9pnet_fd: Insufficient options for proto=fd [ 883.454810][ T5721] net_ratelimit: 166 callbacks suppressed [ 883.476199][ T6489] usb 10-1: 0:1 : does not exist [ 883.510777][ T6489] usb 10-1: USB disconnect, device number 16 [ 884.673519][ T5716] usb 3-1: USB disconnect, device number 60 [ 884.745694][T19371] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 884.825175][T19372] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 884.922611][T19373] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 889.035585][ T5709] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 889.153358][ T6980] net_ratelimit: 126 callbacks suppressed [ 889.209702][ T5709] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 889.232946][ T5709] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 889.233776][ T5709] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 889.277710][ T5709] usb 2-1: config 0 descriptor?? [ 890.117087][ T5709] keytouch 0003:0926:3333.0011: fixing up Keytouch IEC report descriptor [ 890.143745][ T5709] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.0011/input/input29 [ 890.178052][T19402] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 890.599813][T19416] siw: device registration error -23 [ 891.620661][T19376] vivid-002: kernel_thread() failed [ 892.978998][ T5709] keytouch 0003:0926:3333.0011: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 892.998333][ T5709] usb 2-1: USB disconnect, device number 37 [ 893.248611][T19430] fido_id[19430]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 893.582228][T19442] i2c i2c-0: Failed to register i2c client si4713 at 0x63 (-16) [ 893.750258][T19441] FAULT_INJECTION: forcing a failure. [ 893.750258][T19441] name failslab, interval 1, probability 0, space 0, times 0 [ 893.750289][T19441] CPU: 0 UID: 0 PID: 19441 Comm: syz.2.4567 Not tainted syzkaller #0 PREEMPT(full) [ 893.750316][T19441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 893.750333][T19441] Call Trace: [ 893.750342][T19441] [ 893.750352][T19441] dump_stack_lvl+0x100/0x190 [ 893.750397][T19441] should_fail_ex.cold+0x5/0xa [ 893.750431][T19441] should_failslab+0xc2/0x120 [ 893.750481][T19441] kmem_cache_alloc_lru_noprof+0x8e/0x6a0 [ 893.750511][T19441] ? selinux_inode_alloc_security+0x109/0x290 [ 893.750550][T19441] ? __d_alloc+0x35/0xa50 [ 893.750590][T19441] __d_alloc+0x35/0xa50 [ 893.750628][T19441] path_from_stashed+0x431/0x760 [ 893.750658][T19441] pidfs_alloc_file+0xf8/0x290 [ 893.750695][T19441] ? __pfx_pidfs_alloc_file+0x10/0x10 [ 893.750740][T19441] pidfd_prepare+0x107/0x1b0 [ 893.750770][T19441] __x64_sys_pidfd_open+0x105/0x1a0 [ 893.750805][T19441] ? __pfx___x64_sys_pidfd_open+0x10/0x10 [ 893.750849][T19441] do_syscall_64+0x123/0x790 [ 893.750879][T19441] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 893.750905][T19441] RIP: 0033:0x7f54eeb9e199 [ 893.750925][T19441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 893.750949][T19441] RSP: 002b:00007f54ef98e018 EFLAGS: 00000246 ORIG_RAX: 00000000000001b2 [ 893.750970][T19441] RAX: ffffffffffffffda RBX: 00007f54eee25fa0 RCX: 00007f54eeb9e199 [ 893.750991][T19441] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000470 [ 893.751016][T19441] RBP: 00007f54eec358e0 R08: 0000000000000000 R09: 0000000000000000 [ 893.751033][T19441] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 893.751049][T19441] R13: 00007f54eee26038 R14: 00007f54eee25fa0 R15: 00007ffd69009468 [ 893.751082][T19441] [ 894.701505][ C0] net_ratelimit: 286 callbacks suppressed [ 896.892603][ T5716] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 897.053230][ T5716] usb 3-1: Using ep0 maxpacket: 8 [ 897.054366][ T5716] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 897.057926][ T5716] usb 3-1: config index 0 descriptor too short (expected 74, got 45) [ 897.058000][ T5716] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 897.058055][ T5716] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 897.058084][ T5716] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 897.058109][ T5716] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 897.058135][ T5716] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 897.058231][ T5716] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.182358][ T5716] usbtmc 3-1:16.0: probe with driver usbtmc failed with error -22 [ 897.637810][T19467] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 897.681799][ T6489] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 897.845250][ T6489] usb 10-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 897.846896][ T6489] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 897.846958][ T6489] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 897.875259][ T6489] usb 10-1: config 0 descriptor?? [ 898.062143][T19490] siw: device registration error -23 [ 898.694183][ T6489] keytouch 0003:0926:3333.0012: fixing up Keytouch IEC report descriptor [ 898.720451][ T6489] input: HID 0926:3333 as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/0003:0926:3333.0012/input/input30 [ 899.286227][ T6489] keytouch 0003:0926:3333.0012: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.9-1/input0 [ 899.664660][ T6489] usb 10-1: USB disconnect, device number 17 [ 900.074671][T16811] usb 3-1: USB disconnect, device number 61 [ 900.119653][T19502] fido_id[19502]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.9/usb10/report_descriptor': No such file or directory [ 900.150492][T19508] XFS (nullb0): Invalid superblock magic number [ 900.252359][ C0] net_ratelimit: 353 callbacks suppressed [ 900.649619][T16811] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 900.936872][T16811] usb 3-1: Using ep0 maxpacket: 16 [ 900.982014][T16811] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 900.983339][T16811] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 900.983360][T16811] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 900.984782][T16811] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 900.984806][T16811] usb 3-1: SerialNumber: syz [ 901.069182][T16811] usb 3-1: 0:2 : does not exist [ 901.236896][T19519] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 901.381555][T19530] siw: device registration error -23 [ 902.128974][T16811] usb 3-1: USB disconnect, device number 62 [ 902.179886][T18739] udevd[18739]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 902.435080][T18991] wiimote 0005:057E:0306.0013: unbalanced collection at end of report description [ 902.435510][T18991] wiimote 0005:057E:0306.0013: HID parse failed [ 902.435821][T18991] wiimote 0005:057E:0306.0013: probe with driver wiimote failed with error -22 [ 902.646202][T16811] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 902.699672][T18991] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 902.820137][T16811] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 902.821185][T16811] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 902.821215][T16811] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 902.821231][T16811] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 902.821268][T16811] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 902.905584][T18991] usb 10-1: Using ep0 maxpacket: 32 [ 902.906352][T18991] usb 10-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 902.907632][T18991] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 902.907657][T18991] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 902.907715][T18991] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 902.910291][T18991] usb 10-1: config 0 descriptor?? [ 903.200836][ T5604] Bluetooth: hci2: command 0x0406 tx timeout [ 903.266578][T16811] cxacru 3-1:1.0: send of cm 0x91 failed (-71) [ 903.266654][T16811] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 903.266701][T16811] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 903.314209][T16811] cxacru 3-1:1.0: probe with driver cxacru failed with error -71 [ 903.328562][T16811] usb 3-1: USB disconnect, device number 63 [ 903.375480][T18991] koneplus 0003:1E7D:2D51.0014: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.9-1/input0 [ 903.469683][T19553] binder: 19552:19553 ioctl c0306201 2000000002c0 returned -14 [ 903.574845][T18991] koneplus 0003:1E7D:2D51.0014: couldn't init struct koneplus_device [ 903.574892][T18991] koneplus 0003:1E7D:2D51.0014: couldn't install mouse [ 903.579505][T18991] koneplus 0003:1E7D:2D51.0014: probe with driver koneplus failed with error -71 [ 903.586433][T18991] usb 10-1: USB disconnect, device number 18 [ 903.772590][T16811] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 903.935341][T16811] usb 2-1: Using ep0 maxpacket: 16 [ 903.936504][T16811] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89 [ 903.939089][T16811] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 903.939110][T16811] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 903.940210][T16811] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 903.940222][T16811] usb 2-1: SerialNumber: syz [ 903.997591][T16811] usb 2-1: 0:2 : does not exist [ 904.152215][T18991] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 904.192609][T16811] usb 2-1: USB disconnect, device number 38 [ 904.330943][T18991] usb 3-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice= 0.40 [ 904.333231][T18991] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 904.333256][T18991] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 904.335835][T18991] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 904.335858][T18991] usb 3-1: Product: syz [ 904.335876][T18991] usb 3-1: Manufacturer: syz [ 904.335893][T18991] usb 3-1: SerialNumber: syz [ 904.988325][T18991] usb 3-1: 0:1 : does not exist [ 904.988464][T18991] usb 3-1: unit 2 not found! [ 904.988491][T18991] usb 3-1: unit 80 not found! [ 905.023534][T18991] usb 3-1: USB disconnect, device number 64 [ 905.072520][T18739] udevd[18739]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 905.137182][T19567] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 905.377606][T19583] binder: 19581:19583 ioctl c0306201 2000000002c0 returned -14 [ 905.497463][T19587] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4618'. [ 905.497483][T19587] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4618'. [ 905.497502][T19587] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4618'. [ 905.531331][ T5615] Bluetooth: hci3: unexpected event 0x10 length: 8 > 1 [ 905.534573][ T5604] Bluetooth: hci3: hardware error 0x00 [ 905.712530][ C1] net_ratelimit: 311 callbacks suppressed [ 905.745093][ T5733] usb 10-1: new full-speed USB device number 19 using dummy_hcd [ 905.821267][ T5739] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 905.835064][T19594] lo speed is unknown, defaulting to 1000 [ 905.909751][ T5733] usb 10-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 905.915093][ T5733] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 905.915115][ T5733] usb 10-1: Product: syz [ 905.915133][ T5733] usb 10-1: Manufacturer: syz [ 905.915150][ T5733] usb 10-1: SerialNumber: syz [ 905.919787][ T5733] usb 10-1: config 0 descriptor?? [ 905.985431][ T5739] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 905.986766][ T5739] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 905.986883][ T5739] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 905.986913][ T5739] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 905.986977][ T5739] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 906.143716][ T5733] usb 10-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 906.496872][ T5739] cxacru 2-1:1.0: send of cm 0x91 failed (-71) [ 906.496896][ T5739] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 906.496909][ T5739] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 906.568496][ T5739] cxacru 2-1:1.0: probe with driver cxacru failed with error -71 [ 906.614632][ T5716] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 906.632329][ T5739] usb 2-1: USB disconnect, device number 39 [ 906.790691][ T5716] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 906.794545][ T5716] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 906.794740][ T5716] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 906.836789][ T5716] usb 3-1: config 0 descriptor?? [ 907.582843][T19604] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 907.641397][T19607] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 907.644009][T19604] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 907.796281][ T5604] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 907.921496][ T5716] usbhid 3-1:0.0: can't add hid device: -71 [ 907.921759][ T5716] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 907.964558][ T5716] usb 3-1: USB disconnect, device number 65 [ 907.976973][ T5733] dvb_usb_rtl28xxu 10-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 908.018443][ T5733] usb 10-1: USB disconnect, device number 19 [ 908.307646][T19621] binder: 19620:19621 ioctl c0306201 2000000002c0 returned -14 [ 908.725460][ T5733] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 908.754657][T19641] loop7: detected capacity change from 0 to 16384 [ 908.868929][ T5733] usb 2-1: device descriptor read/64, error -71 [ 908.876520][T19643] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4640'. [ 908.920887][ T5696] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 908.987509][T19644] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4096 sclass=netlink_route_socket pid=19644 comm=syz.2.4640 [ 909.026153][ C0] I/O error, dev loop7, sector 13184 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 2 [ 909.026251][ C0] I/O error, dev loop7, sector 13440 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 909.026390][T19642] loop7: detected capacity change from 16384 to 0 [ 909.094244][ T5696] usb 10-1: Using ep0 maxpacket: 8 [ 909.095028][ T5696] usb 10-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 909.096113][ T5696] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 909.096134][ T5696] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 909.096198][ T5696] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 909.096259][ T5696] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 909.139409][ T5733] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 909.272622][ T5696] hub 10-1:1.0: bad descriptor, ignoring hub [ 909.272644][ T5696] hub 10-1:1.0: probe with driver hub failed with error -5 [ 909.273290][ T5696] cdc_wdm 10-1:1.0: skipping garbage [ 909.273306][ T5696] cdc_wdm 10-1:1.0: skipping garbage [ 909.290182][ T5696] cdc_wdm 10-1:1.0: cdc-wdm0: USB WDM device [ 909.290199][ T5696] cdc_wdm 10-1:1.0: Unknown control protocol [ 909.313673][ T5733] usb 2-1: device descriptor read/64, error -71 [ 909.783695][ T5733] usb usb2-port1: attempt power cycle [ 909.939832][ T6489] usb 10-1: USB disconnect, device number 20 [ 910.145242][ T5733] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 910.188651][ T5733] usb 2-1: device descriptor read/8, error -71 [ 910.450755][ T5733] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 910.471506][ T5733] usb 2-1: device descriptor read/8, error -71 [ 910.590347][ T5733] usb usb2-port1: unable to enumerate USB device [ 910.936547][ T5733] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 910.975379][T19680] netlink: 28 bytes leftover after parsing attributes in process `syz.8.4652'. [ 911.032785][T19680] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4096 sclass=netlink_route_socket pid=19680 comm=syz.8.4652 [ 911.099856][ T5733] usb 10-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 911.101044][ T5733] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 911.101112][ T5733] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 911.105463][ T5733] usb 10-1: config 0 descriptor?? [ 911.174806][ C1] net_ratelimit: 151 callbacks suppressed [ 911.282836][T19685] binder: 19684:19685 ioctl c0306201 2000000002c0 returned -14 [ 911.340207][T19672] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 911.362453][T19672] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 911.854770][ T5733] usbhid 10-1:0.0: can't add hid device: -71 [ 911.856855][ T5733] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 911.914893][ T5733] usb 10-1: USB disconnect, device number 21 [ 912.253433][T18768] cxacru 1-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 912.864577][T19708] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4663'. [ 913.085764][ T30] audit: type=1400 audit(1791277272.493:855): avc: denied { getopt } for pid=19710 comm="syz.1.4665" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 913.875901][T19708] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4096 sclass=netlink_route_socket pid=19708 comm=syz.2.4663 [ 914.424227][T19723] i2c i2c-0: Failed to register i2c client si4713 at 0x63 (-16) [ 914.707944][T16023] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 914.762198][ T5716] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 914.858775][ T30] audit: type=1400 audit(1791277274.117:856): avc: denied { setopt } for pid=19729 comm="syz.9.4670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 914.860142][ T5696] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 914.886785][T16023] usb 1-1: New USB device found, idVendor=04d8, idProduct=f002, bcdDevice= 0.00 [ 914.906295][T16023] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 914.906314][T16023] usb 1-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 914.906332][T16023] usb 1-1: config 0 interface 0 has no altsetting 0 [ 914.906369][T16023] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 914.917811][T16023] usb 1-1: config 0 descriptor?? [ 914.943219][ T30] audit: type=1400 audit(1791277274.181:857): avc: denied { read } for pid=19729 comm="syz.9.4670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 914.984478][ T5716] usb 2-1: Using ep0 maxpacket: 8 [ 914.989829][ T30] audit: type=1400 audit(1791277274.227:858): avc: denied { write } for pid=19729 comm="syz.9.4670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 915.010395][ T5716] usb 2-1: New USB device found, idVendor=0413, idProduct=6a04, bcdDevice=27.2b [ 915.022480][ T5716] usb 2-1: config 135 interface 0 has no altsetting 0 [ 915.034788][ T5716] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 915.034811][ T5716] usb 2-1: Product: syz [ 915.034827][ T5716] usb 2-1: Manufacturer: syz [ 915.034840][ T5716] usb 2-1: SerialNumber: syz [ 915.109737][ T5696] usb 3-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 915.111323][ T5696] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 915.111350][ T5696] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 915.111364][ T5696] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 915.111390][ T5696] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 915.111471][ T5696] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 915.407301][T16023] usbhid 1-1:0.0: can't add hid device: -71 [ 915.407470][T16023] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 915.419032][T16023] usb 1-1: USB disconnect, device number 43 [ 915.567532][ T5716] usb 2-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 915.568564][ T5716] dvb_usb_af9015 2-1:135.0: probe with driver dvb_usb_af9015 failed with error -22 [ 915.572177][ T5716] usb 2-1: USB disconnect, device number 44 [ 915.572818][ T5696] gud 3-1:1.0: probe with driver gud failed with error -71 [ 915.595195][ T5696] usb 3-1: USB disconnect, device number 66 [ 916.028901][T19742] 9p: Could not find request transport: fd0x0000000000000003 [ 916.177087][T16023] usb 10-1: new high-speed USB device number 22 using dummy_hcd [ 916.276842][T19748] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4676'. [ 916.325180][T19748] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4096 sclass=netlink_route_socket pid=19748 comm=syz.2.4676 [ 916.541906][T16023] usb 10-1: device descriptor read/64, error -71 [ 916.544155][ T30] audit: type=1400 audit(1791277275.676:859): avc: denied { mount } for pid=19751 comm="syz.2.4678" name="/" dev="ecryptfs" ino=2448 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ecryptfs_t tclass=filesystem permissive=1 [ 916.600186][ T30] audit: type=1400 audit(1791277275.731:860): avc: denied { unmount } for pid=13317 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ecryptfs_t tclass=filesystem permissive=1 [ 916.799619][T16023] usb 10-1: new high-speed USB device number 23 using dummy_hcd [ 916.897108][ C0] net_ratelimit: 184 callbacks suppressed [ 916.941413][T16023] usb 10-1: device descriptor read/64, error -71 [ 917.060221][T16023] usb usb10-port1: attempt power cycle [ 917.366010][T19781] siw: device registration error -23 [ 917.461204][T16023] usb 10-1: new high-speed USB device number 24 using dummy_hcd [ 917.484638][T16023] usb 10-1: device descriptor read/8, error -71 [ 917.547562][T16811] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 917.729090][T16811] usb 3-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 917.760675][T16811] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 917.761185][T16811] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 917.761774][T16811] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 917.762249][T16811] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 917.811207][T16023] usb 10-1: new high-speed USB device number 25 using dummy_hcd [ 917.812268][T16811] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 917.852918][T16023] usb 10-1: device descriptor read/8, error -71 [ 917.975939][T16023] usb usb10-port1: unable to enumerate USB device [ 918.231999][T19787] netlink: 28 bytes leftover after parsing attributes in process `syz.8.4689'. [ 918.276003][T19787] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4096 sclass=netlink_route_socket pid=19787 comm=syz.8.4689 [ 918.486088][T19792] siw: device registration error -23 [ 918.496540][T16811] gud 3-1:1.0: probe with driver gud failed with error -71 [ 918.780270][T16811] usb 3-1: USB disconnect, device number 67 [ 920.019430][T16023] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 920.180941][T16023] usb 1-1: Using ep0 maxpacket: 8 [ 920.181703][T16023] usb 1-1: New USB device found, idVendor=0413, idProduct=6a04, bcdDevice=27.2b [ 920.182788][T16023] usb 1-1: config 135 interface 0 has no altsetting 0 [ 920.185154][T16023] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 920.185176][T16023] usb 1-1: Product: syz [ 920.185189][T16023] usb 1-1: Manufacturer: syz [ 920.185204][T16023] usb 1-1: SerialNumber: syz [ 920.300223][ T5709] usb 10-1: new high-speed USB device number 26 using dummy_hcd [ 920.462766][ T5709] usb 10-1: Using ep0 maxpacket: 32 [ 920.521275][ T5709] usb 10-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 920.539162][ T5709] usb 10-1: config index 0 descriptor too short (expected 19, got 18) [ 920.546736][ T5709] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 920.546758][ T5709] usb 10-1: Product: syz [ 920.546768][ T5709] usb 10-1: Manufacturer: syz [ 920.546778][ T5709] usb 10-1: SerialNumber: syz [ 920.613952][ T5709] usb 10-1: config 0 descriptor?? [ 920.638737][ T5709] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 920.681725][ T5709] dvb-usb: bulk message failed: -22 (2/0) [ 920.699812][ T5709] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 920.700774][ T5709] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 920.700890][ T5709] usb 10-1: media controller created [ 920.742201][T19829] i2c i2c-0: Failed to register i2c client si4713 at 0x63 (-16) [ 920.823391][ T5709] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 920.899063][T16023] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 920.899855][T16023] dvb_usb_af9015 1-1:135.0: probe with driver dvb_usb_af9015 failed with error -22 [ 920.899995][ T30] audit: type=1400 audit(1791277279.699:861): avc: denied { map } for pid=19832 comm="syz.8.4706" path="socket:[61183]" dev="sockfs" ino=61183 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 920.903631][ T5709] usb 10-1: selecting invalid altsetting 7 [ 920.903715][ T5709] cxusb: set interface failed [ 920.903734][ T5709] dvb-usb: bulk message failed: -22 (1/0) [ 920.981004][T16023] usb 1-1: USB disconnect, device number 44 [ 921.037345][ T5716] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 921.076810][ T5709] DVB: Unable to find symbol lgdt330x_attach() [ 921.076820][ T5709] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 921.179607][ T5716] usb 3-1: device descriptor read/64, error -71 [ 921.204462][T19847] 9pnet_fd: Insufficient options for proto=fd [ 921.245700][ T5709] rc_core: IR keymap rc-dvico-portable not found [ 921.245718][ T5709] Registered IR keymap rc-empty [ 921.250624][ T5709] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.9/usb10/10-1/rc/rc0 [ 921.256233][ T5709] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.9/usb10/10-1/rc/rc0/input31 [ 921.278426][ T5709] dvb-usb: schedule remote query interval to 100 msecs. [ 921.278442][ T5709] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 921.315934][ T5709] usb 10-1: USB disconnect, device number 26 [ 921.449539][ T5716] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 921.603761][ T5716] usb 3-1: device descriptor read/64, error -71 [ 921.731584][ T5716] usb usb3-port1: attempt power cycle [ 921.793419][ T5709] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 922.446044][ C1] net_ratelimit: 194 callbacks suppressed [ 923.031350][ T5716] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 923.327825][ T5716] usb 3-1: device descriptor read/8, error -71 [ 923.584414][ T5716] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 923.607778][ T5716] usb 3-1: device descriptor read/8, error -71 [ 923.731517][ T5716] usb usb3-port1: unable to enumerate USB device [ 923.964104][T19883] md: could not open device unknown-block(1,0). [ 923.964159][T19883] md: md_import_device returned -16 [ 924.873787][T16023] usb 2-1: new full-speed USB device number 45 using dummy_hcd [ 925.037983][T16023] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 925.039352][T16023] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 925.039369][T16023] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 925.039409][T16023] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 925.042288][T16023] usb 2-1: config 0 descriptor?? [ 925.052447][T16023] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 925.426624][ T5709] usb 10-1: new high-speed USB device number 27 using dummy_hcd [ 925.567603][ T5709] usb 10-1: device descriptor read/64, error -71 [ 925.710735][ T30] audit: type=1400 audit(1791277284.137:862): avc: denied { connect } for pid=19935 comm="syz.8.4744" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 925.714408][ T30] audit: type=1400 audit(1791277284.137:863): avc: denied { read } for pid=19935 comm="syz.8.4744" laddr=fe80::b lport=60800 faddr=::1 fport=20004 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 925.838436][ T5709] usb 10-1: new high-speed USB device number 28 using dummy_hcd [ 925.979257][ T5709] usb 10-1: device descriptor read/64, error -71 [ 926.098843][ T5709] usb usb10-port1: attempt power cycle [ 926.174363][ T5604] Bluetooth: hci7: Opcode 0x0c03 failed: -110 [ 926.477833][ T5709] usb 10-1: new high-speed USB device number 29 using dummy_hcd [ 926.500316][ T5709] usb 10-1: device descriptor read/8, error -71 [ 926.551102][ T5615] Bluetooth: hci7: sending frame failed (-49) [ 926.551340][ T5604] Bluetooth: hci7: Entering manufacturer mode failed (-49) [ 926.760277][ T5709] usb 10-1: new high-speed USB device number 30 using dummy_hcd [ 926.783415][ T5709] usb 10-1: device descriptor read/8, error -71 [ 926.801581][T19959] netlink: 'syz.8.4753': attribute type 21 has an invalid length. [ 926.801595][T19959] netlink: 'syz.8.4753': attribute type 5 has an invalid length. [ 926.801603][T19959] netlink: 152 bytes leftover after parsing attributes in process `syz.8.4753'. [ 926.854785][ T5604] Bluetooth: hci6: unexpected event 0x10 length: 8 > 1 [ 926.858926][ T5604] Bluetooth: hci6: hardware error 0x00 [ 926.900981][ T5709] usb usb10-port1: unable to enumerate USB device [ 927.081086][T19961] lo speed is unknown, defaulting to 1000 [ 927.923112][ C0] net_ratelimit: 184 callbacks suppressed [ 927.943923][ T5696] usb 2-1: USB disconnect, device number 45 [ 928.159862][T19981] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4763'. [ 928.195729][T19981] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4096 sclass=netlink_route_socket pid=19981 comm=syz.2.4763 [ 928.342862][T19984] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 928.453144][T19985] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 928.573251][ T5696] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 928.574044][T19986] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 928.929084][ T5696] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 929.125469][ T5604] Bluetooth: hci6: Opcode 0x0c03 failed: -110 [ 929.187174][ T5696] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.187198][ T5696] usb 2-1: Product: syz [ 929.187216][ T5696] usb 2-1: Manufacturer: syz [ 929.187234][ T5696] usb 2-1: SerialNumber: syz [ 929.847123][ T5696] usb 2-1: config 0 descriptor?? [ 930.082383][ T5696] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 930.157651][T19999] fuse: Bad value for 'fd' [ 930.182306][T19999] FAULT_INJECTION: forcing a failure. [ 930.182306][T19999] name failslab, interval 1, probability 0, space 0, times 0 [ 930.182336][T19999] CPU: 1 UID: 0 PID: 19999 Comm: syz.2.4769 Not tainted syzkaller #0 PREEMPT(full) [ 930.182364][T19999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 930.182379][T19999] Call Trace: [ 930.182389][T19999] [ 930.182398][T19999] dump_stack_lvl+0x100/0x190 [ 930.182476][T19999] should_fail_ex.cold+0x5/0xa [ 930.182511][T19999] should_failslab+0xc2/0x120 [ 930.182548][T19999] kmem_cache_alloc_noprof+0x92/0x6a0 [ 930.182638][T19999] ? pidfs_register_pid_gfp+0x98/0x1f0 [ 930.182682][T19999] pidfs_register_pid_gfp+0x98/0x1f0 [ 930.182724][T19999] pidfs_stash_dentry+0x7a/0xf0 [ 930.182756][T19999] ? __pfx_pidfs_stash_dentry+0x10/0x10 [ 930.182787][T19999] path_from_stashed+0x4e6/0x760 [ 930.182817][T19999] pidfs_alloc_file+0xf8/0x290 [ 930.182848][T19999] ? __pfx_pidfs_alloc_file+0x10/0x10 [ 930.182888][T19999] pidfd_prepare+0x107/0x1b0 [ 930.182920][T19999] __x64_sys_pidfd_open+0x105/0x1a0 [ 930.182958][T19999] ? __pfx___x64_sys_pidfd_open+0x10/0x10 [ 930.183013][T19999] do_syscall_64+0x123/0x790 [ 930.183045][T19999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 930.183080][T19999] RIP: 0033:0x7f54eeb9e199 [ 930.183101][T19999] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 930.183128][T19999] RSP: 002b:00007f54ef98e018 EFLAGS: 00000246 ORIG_RAX: 00000000000001b2 [ 930.183154][T19999] RAX: ffffffffffffffda RBX: 00007f54eee25fa0 RCX: 00007f54eeb9e199 [ 930.183171][T19999] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000004e0 [ 930.183187][T19999] RBP: 00007f54eec358e0 R08: 0000000000000000 R09: 0000000000000000 [ 930.183204][T19999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 930.183220][T19999] R13: 00007f54eee26038 R14: 00007f54eee25fa0 R15: 00007ffd69009468 [ 930.183250][T19999] [ 930.899314][ T5739] usb 1-1: new full-speed USB device number 45 using dummy_hcd [ 931.063169][ T5739] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 931.065830][ T5739] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 931.065860][ T5739] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 931.065886][ T5739] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 931.065952][ T5739] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 931.073854][ T5739] usb 1-1: config 0 descriptor?? [ 931.523587][ T5739] usbhid 1-1:0.0: can't add hid device: -71 [ 931.523751][ T5739] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 931.534370][ T5739] usb 1-1: USB disconnect, device number 45 [ 931.625673][T18991] usb 10-1: new high-speed USB device number 31 using dummy_hcd [ 931.660405][ T5696] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 931.669137][ T5696] usb 2-1: USB disconnect, device number 46 [ 931.766568][T18991] usb 10-1: device descriptor read/64, error -71 [ 932.026726][T18991] usb 10-1: new high-speed USB device number 32 using dummy_hcd [ 932.167703][T18991] usb 10-1: device descriptor read/64, error -71 [ 932.288045][T18991] usb usb10-port1: attempt power cycle [ 932.395259][ T5733] usb 1-1: new full-speed USB device number 46 using dummy_hcd [ 932.546861][T16023] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 932.569857][ T5733] usb 1-1: not running at top speed; connect to a high speed hub [ 932.569887][ T5733] usb 1-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 932.570888][ T5733] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 932.570905][ T5733] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 932.570917][ T5733] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 932.570994][ T5733] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 932.579871][ T5733] uvcvideo 1-1:1.0: Found UVC 1.00 device (046d:0825) [ 932.709430][T18991] usb 10-1: new high-speed USB device number 33 using dummy_hcd [ 932.709477][T16023] usb 2-1: Using ep0 maxpacket: 8 [ 932.711137][T16023] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 932.712242][T16023] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 932.712255][T16023] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 932.712293][T16023] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 932.712327][T16023] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 932.733545][T16023] hub 2-1:1.0: bad descriptor, ignoring hub [ 932.733567][T16023] hub 2-1:1.0: probe with driver hub failed with error -5 [ 932.733772][T18991] usb 10-1: device descriptor read/8, error -71 [ 932.734367][T16023] cdc_wdm 2-1:1.0: skipping garbage [ 932.734403][T16023] cdc_wdm 2-1:1.0: skipping garbage [ 932.734479][T16023] cdc_wdm 2-1:1.0: probe with driver cdc_wdm failed with error -22 [ 932.823048][ T5733] uvcvideo 1-1:1.0: Failed to query (GET_INFO) UVC control 2 on unit 1: -71 (exp. 1). [ 932.825159][ T5733] uvcvideo 1-1:1.0: Failed to query (GET_INFO) UVC control 3 on unit 1: -71 (exp. 1). [ 932.825242][ T5733] uvcvideo 1-1:1.0: No streaming interface found for terminal 32770. [ 932.872794][ T5733] usb 1-1: USB disconnect, device number 46 [ 932.991241][T18991] usb 10-1: new high-speed USB device number 34 using dummy_hcd [ 933.013998][T18991] usb 10-1: device descriptor read/8, error -71 [ 933.058671][T16023] usb 2-1: USB disconnect, device number 47 [ 933.132969][T18991] usb usb10-port1: unable to enumerate USB device [ 933.440655][T20055] XFS (nullb0): Invalid superblock magic number [ 933.543882][ C0] net_ratelimit: 172 callbacks suppressed [ 933.784594][T20074] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4794'. [ 934.140134][ T9] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 934.303084][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=0990, bcdDevice= 0.40 [ 934.303958][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 934.303976][ T9] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 934.305748][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 934.305761][ T9] usb 2-1: Product: syz [ 934.305770][ T9] usb 2-1: Manufacturer: syz [ 934.305778][ T9] usb 2-1: SerialNumber: syz [ 934.538276][ T9] usb 2-1: 0:1 : does not exist [ 934.538322][ T9] usb 2-1: unit 80 not found! [ 934.552595][ T5733] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 934.571627][ T9] usb 2-1: USB disconnect, device number 48 [ 934.604491][T18739] udevd[18739]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 934.710864][T20092] FAULT_INJECTION: forcing a failure. [ 934.710864][T20092] name failslab, interval 1, probability 0, space 0, times 0 [ 934.710885][T20092] CPU: 1 UID: 0 PID: 20092 Comm: syz.9.4802 Not tainted syzkaller #0 PREEMPT(full) [ 934.710901][T20092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 934.710910][T20092] Call Trace: [ 934.710915][T20092] [ 934.710920][T20092] dump_stack_lvl+0x100/0x190 [ 934.710946][T20092] should_fail_ex.cold+0x5/0xa [ 934.710966][T20092] should_failslab+0xc2/0x120 [ 934.710985][T20092] kmem_cache_alloc_noprof+0x92/0x6a0 [ 934.710999][T20092] ? __pfx_map_id_range_down+0x10/0x10 [ 934.711091][T20092] ? security_inode_alloc+0x3b/0x2c0 [ 934.711113][T20092] security_inode_alloc+0x3b/0x2c0 [ 934.711133][T20092] inode_init_always_gfp+0xc6f/0xfb0 [ 934.711173][T20092] alloc_inode+0x8e/0x250 [ 934.711208][T20092] new_inode+0x22/0x1c0 [ 934.711238][T20092] shmem_get_inode+0x1e3/0xf70 [ 934.711321][T20092] ? __pfx_shmem_get_inode+0x10/0x10 [ 934.711343][T20092] __shmem_file_setup+0x382/0x460 [ 934.711362][T20092] ? __pfx___shmem_file_setup+0x10/0x10 [ 934.711381][T20092] ? vm_area_alloc+0x1f/0x160 [ 934.711420][T20092] shmem_zero_setup+0x96/0x1b0 [ 934.711435][T20092] __mmap_region+0x26b6/0x32e0 [ 934.711453][T20092] ? __pfx___mmap_region+0x10/0x10 [ 934.711475][T20092] ? process_measurement+0x1567/0x2350 [ 934.711494][T20092] ? __pfx___might_resched+0x10/0x10 [ 934.711509][T20092] ? find_held_lock+0x2b/0x80 [ 934.711527][T20092] ? process_measurement+0x4c8/0x2350 [ 934.711542][T20092] ? process_measurement+0x4c8/0x2350 [ 934.711558][T20092] ? down_write+0x146/0x1f0 [ 934.711618][T20092] mmap_region+0x3db/0x6d0 [ 934.711633][T20092] ? __pfx_mmap_region+0x10/0x10 [ 934.711646][T20092] ? shmem_get_unmapped_area+0x141/0x960 [ 934.711665][T20092] ? selinux_mmap_addr+0x2b/0x110 [ 934.711679][T20092] ? bpf_lsm_mmap_addr+0x9/0x30 [ 934.711717][T20092] ? security_mmap_addr+0x71/0x1e0 [ 934.711736][T20092] ? __get_unmapped_area+0x255/0x3e0 [ 934.711774][T20092] do_mmap+0x12c7/0x1c30 [ 934.711795][T20092] ? lock_acquire+0x1d1/0x380 [ 934.711810][T20092] ? __pfx_do_mmap+0x10/0x10 [ 934.711833][T20092] ? __pfx_down_write_killable+0x10/0x10 [ 934.711853][T20092] vm_mmap_pgoff+0x28d/0x470 [ 934.711890][T20092] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 934.711908][T20092] ? __pfx_do_futex+0x10/0x10 [ 934.711932][T20092] ksys_mmap_pgoff+0xe4/0x610 [ 934.711949][T20092] ? __x64_sys_futex+0x358/0x4d0 [ 934.711967][T20092] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 934.711982][T20092] ? fput+0x7c/0x100 [ 934.711999][T20092] ? __pfx___x64_sys_futex+0x10/0x10 [ 934.712016][T20092] ? ksys_write+0x1ac/0x250 [ 934.712030][T20092] ? __pfx_ksys_write+0x10/0x10 [ 934.712046][T20092] __x64_sys_mmap+0x125/0x190 [ 934.712064][T20092] do_syscall_64+0x123/0x790 [ 934.712080][T20092] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.712093][T20092] RIP: 0033:0x7fadd6f9e199 [ 934.712105][T20092] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 934.712119][T20092] RSP: 002b:00007fadd7ea1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 934.712134][T20092] RAX: ffffffffffffffda RBX: 00007fadd7225fa0 RCX: 00007fadd6f9e199 [ 934.712144][T20092] RDX: 0000000000000006 RSI: 0000000000b36000 RDI: 0000200000000000 [ 934.712152][T20092] RBP: 00007fadd70358e0 R08: ffffffffffffffff R09: 000000006a855000 [ 934.712163][T20092] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 934.712172][T20092] R13: 00007fadd7226038 R14: 00007fadd7225fa0 R15: 00007ffcc25636e8 [ 934.712192][T20092] [ 934.770933][ T5733] usb 1-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 934.831836][ T5733] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 934.831898][ T5733] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 934.851829][ T5604] Bluetooth: hci7: Opcode 0x0c03 failed: -110 [ 934.963778][ T5733] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 934.963801][ T5733] usb 1-1: Product: syz [ 934.963819][ T5733] usb 1-1: Manufacturer: syz [ 934.963837][ T5733] usb 1-1: SerialNumber: syz [ 935.182068][ T5733] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 935.182245][ T5733] gspca_mr97310a: reg write [21] error -8 [ 935.182302][ T5733] mr97310a 1-1:1.0: probe with driver mr97310a failed with error -8 [ 935.776518][ T9] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 935.863254][ T5696] usb 10-1: new high-speed USB device number 35 using dummy_hcd [ 935.917428][ T9] usb 2-1: device descriptor read/64, error -71 [ 936.004143][ T5696] usb 10-1: device descriptor read/64, error -71 [ 936.177573][ T9] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 936.264777][ T5696] usb 10-1: new high-speed USB device number 36 using dummy_hcd [ 936.320999][ T9] usb 2-1: device descriptor read/64, error -71 [ 936.405143][ T5696] usb 10-1: device descriptor read/64, error -71 [ 936.437920][ T9] usb usb2-port1: attempt power cycle [ 936.524698][ T5696] usb usb10-port1: attempt power cycle [ 936.806234][ T9] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 936.829270][ T9] usb 2-1: device descriptor read/8, error -71 [ 936.892827][ T5696] usb 10-1: new high-speed USB device number 37 using dummy_hcd [ 936.915300][ T5696] usb 10-1: device descriptor read/8, error -71 [ 937.087875][ T9] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 937.111068][ T9] usb 2-1: device descriptor read/8, error -71 [ 937.174553][ T5696] usb 10-1: new high-speed USB device number 38 using dummy_hcd [ 937.196789][ T5696] usb 10-1: device descriptor read/8, error -71 [ 937.229148][ T9] usb usb2-port1: unable to enumerate USB device [ 937.316474][ T5696] usb usb10-port1: unable to enumerate USB device [ 937.454476][T20136] siw: device registration error -23 [ 937.547510][ T5733] usb 1-1: USB disconnect, device number 47 [ 939.092876][ C1] net_ratelimit: 142 callbacks suppressed [ 939.340629][ T5696] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 940.046765][ T5604] Bluetooth: hci7: Opcode 0x0c03 failed: -110 [ 940.058388][ T5696] usb 2-1: device descriptor read/64, error -71 [ 940.317759][ T5696] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 940.459853][ T5696] usb 2-1: device descriptor read/64, error -71 [ 940.580036][ T5696] usb usb2-port1: attempt power cycle [ 940.599434][ T5709] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 940.762812][ T5709] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 940.763833][ T5709] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 940.763876][ T5709] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 940.765772][ T5709] usb 3-1: config 0 descriptor?? [ 940.771808][ T5709] pwc: Askey VC010 type 2 USB webcam detected. [ 940.946176][ T5696] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 940.968600][ T5696] usb 2-1: device descriptor read/8, error -71 [ 941.210997][ T5709] pwc: recv_control_msg error -32 req 02 val 2b00 [ 941.211898][ T5709] pwc: recv_control_msg error -32 req 02 val 2700 [ 941.212789][ T5709] pwc: recv_control_msg error -32 req 02 val 2c00 [ 941.213563][ T5709] pwc: recv_control_msg error -32 req 04 val 1000 [ 941.214471][ T5709] pwc: recv_control_msg error -32 req 04 val 1300 [ 941.215086][ T5709] pwc: recv_control_msg error -32 req 04 val 1400 [ 941.215696][ T5709] pwc: recv_control_msg error -32 req 02 val 2000 [ 941.216380][ T5709] pwc: recv_control_msg error -32 req 02 val 2100 [ 941.217311][ T5709] pwc: recv_control_msg error -32 req 04 val 1500 [ 941.219755][ T5709] pwc: recv_control_msg error -32 req 02 val 2500 [ 941.224348][ T5709] pwc: recv_control_msg error -32 req 02 val 2400 [ 941.228015][ T5696] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 941.250525][ T5696] usb 2-1: device descriptor read/8, error -71 [ 941.262636][ T5709] pwc: recv_control_msg error -32 req 02 val 2600 [ 941.369291][ T5696] usb usb2-port1: unable to enumerate USB device [ 941.401310][ T9] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 941.486232][ T5709] pwc: recv_control_msg error -71 req 02 val 2800 [ 941.488309][ T5709] pwc: recv_control_msg error -71 req 04 val 1100 [ 941.488800][ T5709] pwc: recv_control_msg error -71 req 04 val 1200 [ 941.543735][ T9] usb 1-1: device descriptor read/64, error -71 [ 941.548955][ T5709] pwc: Registered as video103. [ 941.552571][ T5709] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input32 [ 941.569843][ T5709] usb 3-1: USB disconnect, device number 72 [ 941.802333][ T9] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 941.945661][ T9] usb 1-1: device descriptor read/64, error -71 [ 942.062939][ T9] usb usb1-port1: attempt power cycle [ 942.144904][T20195] FAULT_INJECTION: forcing a failure. [ 942.144904][T20195] name failslab, interval 1, probability 0, space 0, times 0 [ 942.144924][T20195] CPU: 1 UID: 0 PID: 20195 Comm: syz.1.4842 Not tainted syzkaller #0 PREEMPT(full) [ 942.144939][T20195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 942.144947][T20195] Call Trace: [ 942.144953][T20195] [ 942.144959][T20195] dump_stack_lvl+0x100/0x190 [ 942.144983][T20195] should_fail_ex.cold+0x5/0xa [ 942.145002][T20195] should_failslab+0xc2/0x120 [ 942.145021][T20195] __kmalloc_cache_noprof+0x91/0x6d0 [ 942.145033][T20195] ? __lock_acquire+0x5c0/0x1f40 [ 942.145048][T20195] ? snd_timer_instance_new+0x47/0x350 [ 942.145179][T20195] snd_timer_instance_new+0x47/0x350 [ 942.145200][T20195] snd_seq_timer_open+0x1d4/0x5c0 [ 942.145263][T20195] ? __pfx_snd_seq_timer_open+0x10/0x10 [ 942.145281][T20195] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 942.145302][T20195] ? mark_held_locks+0x40/0x70 [ 942.145316][T20195] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 942.145332][T20195] queue_use+0xdc/0x1f0 [ 942.145346][T20195] snd_seq_queue_alloc+0x2e5/0x540 [ 942.145365][T20195] snd_seq_ioctl_create_queue+0xa9/0x370 [ 942.145407][T20195] call_seq_client_ctl+0xa3/0x130 [ 942.145426][T20195] snd_seq_kernel_client_ctl+0x35/0x50 [ 942.145445][T20195] alloc_seq_queue+0xdb/0x180 [ 942.145464][T20195] ? __pfx_alloc_seq_queue+0x10/0x10 [ 942.145490][T20195] ? find_held_lock+0x2b/0x80 [ 942.145509][T20195] ? mark_held_locks+0x40/0x70 [ 942.145526][T20195] snd_seq_oss_open+0x2b2/0xa10 [ 942.145547][T20195] odev_open+0x6f/0x90 [ 942.145563][T20195] ? __pfx_odev_open+0x10/0x10 [ 942.145580][T20195] soundcore_open+0x2e3/0x5a0 [ 942.145631][T20195] ? __pfx_soundcore_open+0x10/0x10 [ 942.145649][T20195] chrdev_open+0x234/0x6a0 [ 942.145668][T20195] ? __pfx_chrdev_open+0x10/0x10 [ 942.145686][T20195] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 942.145703][T20195] do_dentry_open+0x6ab/0x14d0 [ 942.145720][T20195] ? __pfx_chrdev_open+0x10/0x10 [ 942.145739][T20195] vfs_open+0x82/0x3f0 [ 942.145759][T20195] path_openat+0x19fa/0x2440 [ 942.145779][T20195] ? __pfx_path_openat+0x10/0x10 [ 942.145801][T20195] do_file_open+0x20e/0x430 [ 942.145819][T20195] ? __pfx_do_file_open+0x10/0x10 [ 942.145854][T20195] ? _raw_spin_unlock+0x28/0x50 [ 942.145874][T20195] ? alloc_fd+0x471/0x7a0 [ 942.145897][T20195] do_sys_openat2+0x10f/0x1e0 [ 942.145917][T20195] ? __pfx_do_sys_openat2+0x10/0x10 [ 942.145942][T20195] __x64_sys_openat+0x12d/0x210 [ 942.145961][T20195] ? __pfx___x64_sys_openat+0x10/0x10 [ 942.145985][T20195] do_syscall_64+0x123/0x790 [ 942.146001][T20195] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 942.146015][T20195] RIP: 0033:0x7f461199e199 [ 942.146027][T20195] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 942.146041][T20195] RSP: 002b:00007f4612948028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 942.146054][T20195] RAX: ffffffffffffffda RBX: 00007f4611c25fa0 RCX: 00007f461199e199 [ 942.146064][T20195] RDX: 0000000000080200 RSI: 0000200000000280 RDI: ffffffffffffff9c [ 942.146073][T20195] RBP: 00007f4611a358e0 R08: 0000000000000000 R09: 0000000000000000 [ 942.146081][T20195] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 942.146089][T20195] R13: 00007f4611c26038 R14: 00007f4611c25fa0 R15: 00007fffe1d5bec8 [ 942.146106][T20195] [ 942.444176][ T9] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 942.477508][ T9] usb 1-1: device descriptor read/8, error -71 [ 942.534738][T20206] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 942.537884][T20206] netlink: 1688 bytes leftover after parsing attributes in process `syz.8.4844'. [ 942.734637][ T9] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 942.756701][ T9] usb 1-1: device descriptor read/8, error -71 [ 942.876015][ T9] usb usb1-port1: unable to enumerate USB device [ 943.102849][T16023] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 943.254484][ C0] wireguard: wg0: Handshake for peer 74 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 13) [ 943.254524][ C1] wireguard: wg2: Handshake for peer 24 (127.0.0.1:20002) did not complete after 5 seconds, retrying (try 18) [ 943.254575][ C0] wireguard: wg2: Handshake for peer 78 (127.0.0.1:20002) did not complete after 5 seconds, retrying (try 2) [ 943.254596][ C1] wireguard: wg1: Handshake for peer 46 (127.0.0.1:20003) did not complete after 5 seconds, retrying (try 5) [ 943.254634][ C0] wireguard: wg2: Handshake for peer 72 (127.0.0.1:20002) did not complete after 5 seconds, retrying (try 9) [ 943.255415][ T31] INFO: task syz.7.4065:17751 blocked for more than 143 seconds. [ 943.255437][ T31] Not tainted syzkaller #0 [ 943.255449][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 943.255459][ T31] task:syz.7.4065 state:D stack:27944 pid:17751 tgid:17747 ppid:14603 task_flags:0x400040 flags:0x00080002 [ 943.255597][ T31] Call Trace: [ 943.255606][ T31] [ 943.255619][ T31] __schedule+0x1259/0x6920 [ 943.255672][ T31] ? __lock_acquire+0x5c0/0x1f40 [ 943.255706][ T31] ? do_raw_spin_lock+0x128/0x260 [ 943.255741][ T31] ? lock_acquire+0x1d1/0x380 [ 943.255768][ T31] ? __pfx___schedule+0x10/0x10 [ 943.255788][ T31] ? find_held_lock+0x2b/0x80 [ 943.255822][ T31] ? schedule+0x225/0x2c0 [ 943.255848][ T31] schedule+0xdd/0x2c0 [ 943.255870][ T31] schedule_preempt_disabled+0x13/0x30 [ 943.255893][ T31] __mutex_lock+0xccb/0x1bd0 [ 943.255920][ T31] ? nfsd_nrthreads+0x57/0xd0 [ 943.255982][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 943.256013][ T31] ? lock_acquire+0x1d1/0x380 [ 943.256043][ T31] ? net_generic+0xea/0x2a0 [ 943.256068][ T31] ? net_generic+0xea/0x2a0 [ 943.256101][ T31] ? nfsd_nrthreads+0x57/0xd0 [ 943.256128][ T31] nfsd_nrthreads+0x57/0xd0 [ 943.256157][ T31] write_threads+0x34a/0x600 [ 943.256193][ T31] ? __pfx_write_threads+0x10/0x10 [ 943.256225][ T31] ? __might_fault+0xc5/0x140 [ 943.256250][ T31] ? __might_fault+0xc5/0x140 [ 943.256291][ T31] ? __might_fault+0xc5/0x140 [ 943.256318][ T31] ? __pfx_write_threads+0x10/0x10 [ 943.256352][ T31] ? __pfx_write_threads+0x10/0x10 [ 943.256385][ T31] ? _copy_from_user+0x59/0xd0 [ 943.256417][ T31] ? __pfx_write_threads+0x10/0x10 [ 943.256450][ T31] nfsctl_transaction_write+0x106/0x1a0 [ 943.256484][ T31] vfs_write+0x2aa/0x1050 [ 943.256527][ T31] ? __pfx_nfsctl_transaction_write+0x10/0x10 [ 943.256560][ T31] ? lock_acquire+0x1d1/0x380 [ 943.256585][ T31] ? __fget_files+0x34/0x3d0 [ 943.256617][ T31] ? __pfx_vfs_write+0x10/0x10 [ 943.256641][ T31] ? find_held_lock+0x2b/0x80 [ 943.256709][ T31] ? __fget_files+0x215/0x3d0 [ 943.256746][ T31] ? __fget_files+0x21f/0x3d0 [ 943.256785][ T31] ksys_write+0x12a/0x250 [ 943.256812][ T31] ? __pfx_ksys_write+0x10/0x10 [ 943.256848][ T31] do_syscall_64+0x123/0x790 [ 943.256877][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 943.256902][ T31] RIP: 0033:0x7fd081d9e199 [ 943.256922][ T31] RSP: 002b:00007fd082b85028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 943.256944][ T31] RAX: ffffffffffffffda RBX: 00007fd082026090 RCX: 00007fd081d9e199 [ 943.256960][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000 ** replaying previous printk message ** [ 943.256960][ T31] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 943.256975][ T31] RBP: 00007fd081e358e0 R08: 0000000000000000 R09: 0000000000000000 [ 943.256989][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 943.257003][ T31] R13: 00007fd082026128 R14: 00007fd082026090 R15: 00007ffd274003a8 [ 943.257037][ T31] [ 943.257083][ T31] [ 943.257083][ T31] Showing all locks held in the system: [ 943.257207][ T31] locks held by khungtaskd/31: 1, last CPU#0: [ 943.257302][ T31] #0: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 943.258203][ T31] locks held by getty/5359: 2, on CPU#1: [ 943.258224][ T31] #0: ffff888037d040a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 943.258382][ T31] #1: ffffc9000321e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 [ 943.258649][ T31] locks held by syz-executor/13317: 2, last CPU#1: [ 943.258667][ T31] #0: ffffffff8f90b238 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_number_perm+0x22e/0x580 [ 943.258727][ T31] #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 [ 943.258880][ T31] locks held by kworker/1:1/16023: 6, last CPU#1: [ 943.258898][ T31] #0: ffff8880232c2940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 943.258965][ T31] #1: ffffc900051ffd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 943.259030][ T31] #2: ffff88802aac11d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bb/0x4420 [ 943.259099][ T31] #3: ffff88802aac5568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x2b3e/0x4420 [ 943.259150][ T31] #4: ffff88802a95b860 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2b67/0x4420 [ 943.259199][ T31] #5: ffffffff902835a8 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x1a1/0x1bd0 [ 943.259270][ T31] locks held by syz.7.4065/17748: 3, on CPU#0: [ 943.259286][ T31] #0: ffff88807b8e95f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 943.259347][ T31] #1: ffff8880359da460 (sb_writers#25){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 943.259407][ T31] #2: ffffffff8f289bc0 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0 [ 943.259464][ T31] locks held by syz.7.4065/17751: 3, on CPU#0: [ 943.259479][ T31] #0: ffff8880267b62b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 943.259536][ T31] #1: ffff8880359da460 (sb_writers#25){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 943.259594][ T31] #2: ffffffff8f289bc0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nrthreads+0x57/0xd0 [ 943.259655][ T31] locks held by syz.5.4340/18657: 2, on CPU#1: [ 943.259672][ T31] #0: ffff88807d4d75f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 943.259732][ T31] #1: ffffffff8f289bc0 (nfsd_mutex){+.+.}-{4:4}, at: write_pool_threads+0x110/0x800 [ 943.259795][ T31] locks held by syz.9.4831/20167: 3, on CPU#0: [ 943.259811][ T31] #0: ffff8880287bc630 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 943.259871][ T31] #1: ffff88808b796460 (sb_writers#25){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 943.259945][ T31] #2: ffffffff8f289bc0 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0 [ 943.260004][ T31] locks held by syz.9.4831/20171: 3, on CPU#1: [ 943.260021][ T31] #0: ffff88807a02d0b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 943.260081][ T31] #1: ffff88808b796460 (sb_writers#25){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 943.260139][ T31] #2: ffffffff8f289bc0 (nfsd_mutex){+.+.}-{4:4}, at: write_threads+0x288/0x600 [ 943.264145][ T31] locks held by syz.8.4847/20210: 1, on CPU#0: [ 943.264163][ T31] #0: ffff88807e6b2800 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1f5/0x470 [ 943.264235][ T31] locks held by syz.8.4847/20211: 2, last CPU#1: [ 943.264251][ T31] #0: ffff88807e6b2800 (&mm->mmap_lock){++++}-{4:4}, at: __mm_populate+0x229/0x3a0 [ 943.264320][ T31] #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: do_fault+0x9a8/0x1830 [ 943.264383][ T31] [ 943.264389][ T31] ============================================= [ 943.264389][ T31] [ 943.264408][ T31] NMI backtrace for cpu 0 [ 943.264423][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 943.264448][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 943.264462][ T31] Call Trace: [ 943.264469][ T31] [ 943.264479][ T31] dump_stack_lvl+0x100/0x190 [ 943.264513][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 943.264549][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 943.264576][ T31] nmi_trigger_cpumask_backtrace+0x21f/0x2a0 [ 943.264654][ T31] sys_info+0x141/0x190 [ 943.264709][ T31] watchdog+0xcb1/0x1030 [ 943.264743][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 943.264766][ T31] ? __pfx_watchdog+0x10/0x10 [ 943.264794][ T31] ? __kthread_parkme+0x18f/0x230 [ 943.264825][ T31] ? kthread+0x13a/0x450 [ 943.264855][ T31] ? __pfx_watchdog+0x10/0x10 [ 943.264880][ T31] kthread+0x373/0x450 [ 943.264910][ T31] ? __pfx_kthread+0x10/0x10 [ 943.264942][ T31] ret_from_fork+0x730/0xd60 [ 943.264970][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 943.264997][ T31] ? __switch_to+0x800/0x10f0 [ 943.265057][ T31] ? __pfx_kthread+0x10/0x10 [ 943.265089][ T31] ret_from_fork_asm+0x1a/0x30 [ 943.265129][ T31] [ 943.265138][ T31] Sending NMI from CPU 0 to CPUs 1: [ 943.265258][ C1] NMI backtrace for cpu 1 [ 943.265272][ C1] CPU: 1 UID: 0 PID: 20211 Comm: syz.8.4847 Not tainted syzkaller #0 PREEMPT(full) [ 943.265294][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 943.265306][ C1] RIP: 0010:get_page_from_freelist+0x226/0x35d0 [ 943.265331][ C1] Code: 4b 8d 3c e3 48 89 f8 48 c1 e8 03 80 3c 28 00 0f 85 e9 2e 00 00 48 89 d8 4f 8b 2c e3 48 c1 e8 03 80 3c 28 00 0f 85 4b 31 00 00 <48> 8b 74 24 58 4d 03 6b 20 48 89 f0 48 c1 e8 03 0f b6 14 28 48 89 [ 943.265350][ C1] RSP: 0018:ffffc900068aeec0 EFLAGS: 00000246 [ 943.265366][ C1] RAX: 1ffff11027fff824 RBX: ffff88813fffc120 RCX: ffffffff82717e58 [ 943.265380][ C1] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88813fffc108 [ 943.265393][ C1] RBP: dffffc0000000000 R08: 0000000000000000 R09: ffffed1027fff8df [ 943.265406][ C1] R10: ffff88813fffc6ff R11: ffff88813fffc100 R12: 0000000000000001 [ 943.265420][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffff92000d15e24 [ 943.265434][ C1] FS: 00007f193f1ba6c0(0000) GS:ffff888123c4e000(0000) knlGS:0000000000000000 [ 943.265454][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 943.265468][ C1] CR2: 0000000000000000 CR3: 000000007d08b000 CR4: 00000000003526f0 [ 943.265481][ C1] Call Trace: [ 943.265488][ C1] [ 943.265506][ C1] ? __pfx_get_page_from_freelist+0x10/0x10 [ 943.265545][ C1] ? prepare_alloc_pages+0x1f0/0x5b0 [ 943.265576][ C1] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 943.265607][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 943.265631][ C1] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 943.265656][ C1] ? __css_rstat_updated+0x1ce/0x590 [ 943.265685][ C1] ? lock_acquire+0x1d1/0x380 [ 943.265708][ C1] ? do_raw_spin_lock+0x128/0x260 [ 943.265734][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 943.265767][ C1] ? find_held_lock+0x2b/0x80 [ 943.265800][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 943.265823][ C1] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 943.265849][ C1] ? policy_nodemask+0xed/0x4f0 [ 943.265880][ C1] alloc_pages_mpol+0x201/0x550 [ 943.265909][ C1] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 943.265942][ C1] folio_alloc_mpol_noprof+0x36/0x260 [ 943.265962][ C1] shmem_alloc_folio+0x135/0x160 [ 943.265996][ C1] shmem_alloc_and_add_folio+0x371/0xd40 [ 943.266030][ C1] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 943.266063][ C1] ? shmem_allowable_huge_orders+0x1d7/0x470 [ 943.266099][ C1] shmem_get_folio_gfp+0x75b/0x1980 [ 943.266122][ C1] ? __pfx_shmem_get_folio_gfp+0x10/0x10 [ 943.266143][ C1] ? filemap_map_pages+0x1155/0x2060 [ 943.266200][ C1] shmem_fault+0x1fb/0xa30 [ 943.266220][ C1] ? __pfx_shmem_fault+0x10/0x10 [ 943.266241][ C1] ? __pfx_filemap_map_pages+0x10/0x10 [ 943.266271][ C1] ? find_held_lock+0x2b/0x80 [ 943.266301][ C1] ? __pfx_filemap_map_pages+0x10/0x10 [ 943.266329][ C1] __do_fault+0x10b/0x440 [ 943.266353][ C1] do_fault+0xb3f/0x1830 [ 943.266378][ C1] ? __pfx___thp_vma_allowable_orders+0x10/0x10 [ 943.266419][ C1] ? __pfx_do_fault+0x10/0x10 [ 943.266444][ C1] ? rcu_read_unlock+0x2d/0xb0 [ 943.266463][ C1] ? rcu_read_unlock+0x2d/0xb0 [ 943.266481][ C1] ? __pte_offset_map+0x179/0x310 [ 943.266528][ C1] __handle_mm_fault+0x150b/0x2f60 [ 943.266562][ C1] ? __pfx___handle_mm_fault+0x10/0x10 [ 943.266594][ C1] ? pte_offset_map_lock+0x174/0x320 [ 943.266618][ C1] ? find_held_lock+0x2b/0x80 [ 943.266647][ C1] ? find_held_lock+0x2b/0x80 [ 943.266675][ C1] ? follow_page_pte+0x536/0x1050 [ 943.266718][ C1] handle_mm_fault+0x363/0xa20 [ 943.266751][ C1] __get_user_pages+0x8ae/0x2c30 [ 943.266785][ C1] ? __pfx_mt_find+0x10/0x10 [ 943.266810][ C1] ? __pfx___get_user_pages+0x10/0x10 [ 943.266841][ C1] populate_vma_page_range+0x267/0x3f0 [ 943.266869][ C1] ? __pfx_populate_vma_page_range+0x10/0x10 [ 943.266908][ C1] ? __pfx_find_vma_intersection+0x10/0x10 [ 943.266939][ C1] __mm_populate+0x107/0x3a0 [ 943.266965][ C1] ? __pfx___mm_populate+0x10/0x10 [ 943.266993][ C1] ? up_write+0x2dc/0x5b0 [ 943.267020][ C1] vm_mmap_pgoff+0x441/0x470 [ 943.267045][ C1] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 943.267072][ C1] ? __pfx_do_futex+0x10/0x10 [ 943.267104][ C1] ksys_mmap_pgoff+0xe4/0x610 [ 943.267129][ C1] ? __x64_sys_futex+0x358/0x4d0 [ 943.267158][ C1] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 943.267183][ C1] ? xfd_validate_state+0x129/0x190 [ 943.267209][ C1] __x64_sys_mmap+0x125/0x190 [ 943.267234][ C1] do_syscall_64+0x123/0x790 [ 943.267257][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 943.267279][ C1] RIP: 0033:0x7f193e39e199 [ 943.267311][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 943.267330][ C1] RSP: 002b:00007f193f1ba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 943.267349][ C1] RAX: ffffffffffffffda RBX: 00007f193e625fa0 RCX: 00007f193e39e199 [ 943.267363][ C1] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 [ 943.267376][ C1] RBP: 00007f193e4358e0 R08: ffffffffffffffff R09: 0000000000000000 [ 943.267390][ C1] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 943.267403][ C1] R13: 00007f193e626038 R14: 00007f193e625fa0 R15: 00007ffd10c539e8 [ 943.267425][ C1] [ 943.283058][T16023] raw-gadget.0 gadget.1: gadget resumed [ 943.283109][T16023] dummy_hcd dummy_hcd.1: port status 0x00100503 has changes [ 943.283237][ C1] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 943.283265][ C1] kcov: kcov_start: t = ffff88801f6b0000, size = 262144, area = ffffc900022a2000 [ 943.283305][ C1] kcov: kcov_move_area: ffffc900243d8000 1048576 <= ffffc900022a2000 73 [ 943.283343][ C1] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 943.283363][ C1] kcov: kcov_start: t = ffff88801f6b0000, size = 262144, area = ffffc900022a2000 [ 943.283396][ C1] kcov: kcov_move_area: ffffc900243d8000 1048576 <= ffffc900022a2000 29 [ 943.283633][ T5590] eth0: xmit ffff88805f0b5770 42:01:0a:80:00:01 [ 943.283662][ T5590] Added buffer head 3 to ffff88802cf39e00 [ 943.283700][ C1] virtqueue callback for ffff88802cf39e00 (ffffffff86ed2540) [ 943.283725][ C1] Sent skb ffff88805f0b5770 [ 943.283742][ C1] No more buffers in queue [ 943.283956][T20212] kcov: kcov_start: t = ffff888032ae0000, size = 524288, area = ffffc90011db0000 [ 943.286250][ C1] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 943.286274][ C1] kcov: kcov_start: t = ffff888067754b00, size = 262144, area = ffffc900022a2000 [ 943.286313][ C1] kcov: kcov_move_area: ffffc900243d8000 1048576 <= ffffc900022a2000 29 [ 943.287922][ C1] virtqueue callback for ffff888073ace200 (ffffffff86ec9790) [ 943.287963][ C1] No more buffers in queue [ 943.288000][ C1] Receiving skb proto 0x0800 len 1108 type 0 [ 943.288028][ C1] No more buffers in queue [ 943.288288][ C1] eth0: xmit ffff88807639d140 42:01:0a:80:00:01 [ 943.288318][ C1] Added buffer head 3 to ffff88802cf39e00 [ 943.288340][ C1] virtqueue callback for ffff88802cf39e00 (ffffffff86ed2540) [ 943.288388][ C1] Sent skb ffff88807639d140 [ 943.288435][ C1] No more buffers in queue [ 943.288452][ C1] No more buffers in queue [ 943.318829][T20214] kcov: kcov_start: t = ffff888031d60000, size = 524288, area = ffffc900119af000 [ 943.329398][T20214] kcov: kcov_task_exit: t = ffff888031d60000, kcov->t = ffff888031d60000 [ 943.353060][ C1] dummy_udc dummy_udc.1: set_address = 57 [ 943.353111][ C1] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 943.353134][ C1] kcov: kcov_start: t = ffff888026c7a580, size = 262144, area = ffffc900022a2000 [ 943.353171][ C1] kcov: kcov_move_area: ffffc900243d8000 1048576 <= ffffc900022a2000 39 [ 943.369979][ C1] virtqueue callback for ffff888073ace200 (ffffffff86ec9790) [ 943.370010][ C1] No more buffers in queue [ 943.370522][ C1] Receiving skb proto 0x0800 len 52 type 0 [ 943.370551][ C1] No more buffers in queue [ 943.417191][ C1] eth0: xmit ffff888034b34c80 42:01:0a:80:00:01 [ 943.417209][T20215] kcov: kcov_start: t = ffff88801fee0000, size = 524288, area = ffffc9001d962000 [ 943.417228][ C1] Added buffer head 3 to ffff88802cf39e00 [ 943.417333][ C1] virtqueue callback for ffff88802cf39e00 (ffffffff86ed2540) [ 943.417375][ C1] Sent skb ffff888034b34c80 [ 943.417428][ C1] No more buffers in queue [ 943.594204][T16023] usb 2-1: Using ep0 maxpacket: 32 [ 943.594814][ C1] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 943.594840][ C1] kcov: kcov_start: t = ffff88807d1ca580, size = 262144, area = ffffc900022a2000 [ 943.594877][ C1] kcov: kcov_move_area: ffffc900243d8000 1048576 <= ffffc900022a2000 29 [ 943.594999][T16023] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.00 [ 943.595046][T16023] usb 2-1: no configurations [ 943.595059][T16023] usb 2-1: can't read configurations, error -22 [ 943.595138][T16023] raw-gadget.0 gadget.1: gadget suspended [ 943.595248][ C1] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 943.595270][ C1] kcov: kcov_start: t = ffff88801f6b0000, size = 262144, area = ffffc900022a2000 [ 943.595305][ C1] kcov: kcov_move_area: ffffc900243d8000 1048576 <= ffffc900022a2000 29 [ 943.595375][T16023] kobject: '2-1' (ffff888026c0d0b0): kobject_cleanup, parent 0000000000000000 [ 943.595398][T16023] kobject: '2-1' (ffff888026c0d0b0): calling ktype release [ 943.595429][T16023] kobject: '2-1': free name [ 943.595546][T16023] raw-gadget.0 gadget.1: gadget reset [ 943.595652][ C1] kcov: kcov_remote_start: handle = 100000000000002, context: softirq [ 943.595674][ C1] kcov: kcov_start: t = ffff88801f6b0000, size = 262144, area = ffffc900022a2000 [ 943.595708][ C1] kcov: kcov_move_area: ffffc900243d8000 1048576 <= ffffc900022a2000 29 [ 943.608436][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 945.058967][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 945.068070][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 945.078111][ T31] Call Trace: [ 945.081376][ T31] [ 945.084291][ T31] dump_stack_lvl+0x100/0x190 [ 945.088970][ T31] vpanic+0x553/0x970 [ 945.092939][ T31] ? __pfx_vpanic+0x10/0x10 [ 945.097433][ T31] panic+0xd1/0xe0 [ 945.101149][ T31] ? __pfx_panic+0x10/0x10 [ 945.105567][ T31] ? nmi_trigger_cpumask_backtrace+0x263/0x2a0 [ 945.111717][ T31] ? nmi_trigger_cpumask_backtrace+0x26d/0x2a0 [ 945.117862][ T31] ? watchdog.cold+0x1ec/0x234 [ 945.122614][ T31] watchdog.cold+0x1fd/0x234 [ 945.127195][ T31] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 945.132988][ T31] ? __pfx_watchdog+0x10/0x10 [ 945.137656][ T31] ? __kthread_parkme+0x18f/0x230 [ 945.142672][ T31] ? kthread+0x13a/0x450 [ 945.146907][ T31] ? __pfx_watchdog+0x10/0x10 [ 945.151579][ T31] kthread+0x373/0x450 [ 945.155641][ T31] ? __pfx_kthread+0x10/0x10 [ 945.160225][ T31] ret_from_fork+0x730/0xd60 [ 945.164806][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 945.169921][ T31] ? __switch_to+0x800/0x10f0 [ 945.174594][ T31] ? __pfx_kthread+0x10/0x10 [ 945.179179][ T31] ret_from_fork_asm+0x1a/0x30 [ 945.183944][ T31] [ 945.187305][ T31] Kernel Offset: disabled [ 945.191622][ T31] Rebooting in 86400 seconds..