last executing test programs: 7.551025719s ago: executing program 2 (id=6662): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000c80)={0xe8, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0xd4, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010101}, {0x8, 0x2, @private=0xa010102}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x84, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x3a}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @broadcast}}}]}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0x5c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 7.30013463s ago: executing program 2 (id=6666): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000d6", @ANYRES16=0x0, @ANYBLOB="020027bd7000fedbdf25060000000c009900000000000c000000080005000a000000"], 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="6f01000008000000", @ANYRES32=r4, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB="e0c236e31f8f5fb4c84cb71404edf45f6cee4be25457525e59c20114edaf3699054a469db80900c4a311777a60ea7c4c15ee1ff4053cb4f06d9738ecb89f0b782121e1eb7aa2", @ANYRES16=r3, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r4, @ANYBLOB="0a0034000202020202020000080026006c090000"], 0x30}}, 0x0) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(0x0, 0x0, 0x0) nanosleep(0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) nanosleep(&(0x7f0000000000)={0x77359400}, &(0x7f00000002c0)) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000013c0)="d8000000100081040100000000000000021d080b01000000e8fe55a118001500060014000300001208000d0074be0000a8001600a400014020000600ffffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ceb6bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x0) socket(0x23, 0x803, 0x10000) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000100)={[0xfffffffffffffffb, 0x1800006, 0x81, 0x7fffffff, 0xfff8, 0x0, 0x1000, 0x38, 0x2000004bfb, 0x4, 0x200000000002, 0x20000000000004, 0x3, 0x5, 0x9, 0x100000090], 0x0, 0x28657}) r6 = socket$unix(0x1, 0x1, 0x0) bind$unix(r6, &(0x7f0000000180)=@file={0x1}, 0x6e) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$cont(0x21, r7, 0x5, 0x4) 5.693196431s ago: executing program 2 (id=6672): r0 = openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x101100, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) accept$unix(r1, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) mremap(&(0x7f00001a9000/0x3000)=nil, 0x3000, 0x4000, 0x7, &(0x7f000069d000/0x4000)=nil) 4.605387727s ago: executing program 1 (id=6680): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000d6", @ANYRES16=0x0, @ANYBLOB="020027bd7000fedbdf25060000000c009900000000000c000000080005000a000000"], 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="6f01000008000000", @ANYRES32=r4, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB="e0c236e31f8f5fb4c84cb71404edf45f6cee4be25457525e59c20114edaf3699054a469db80900c4a311777a60ea7c4c15ee1ff4053cb4f06d9738ecb89f0b782121e1eb7aa2", @ANYRES16=r3, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r4, @ANYBLOB="0a0034000202020202020000080026006c090000"], 0x30}}, 0x0) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(0x0, 0x0, 0x0) nanosleep(0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) nanosleep(&(0x7f0000000000)={0x77359400}, &(0x7f00000002c0)) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000013c0)="d8000000100081040100000000000000021d080b01000000e8fe55a118001500060014000300001208000d0074be0000a8001600a400014020000600ffffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ceb6bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x0) socket(0x23, 0x803, 0x10000) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000100)={[0xfffffffffffffffb, 0x1800006, 0x81, 0x7fffffff, 0xfff8, 0x0, 0x1000, 0x38, 0x2000004bfb, 0x4, 0x200000000002, 0x20000000000004, 0x3, 0x5, 0x9, 0x100000090], 0x0, 0x28657}) r6 = socket$unix(0x1, 0x1, 0x0) listen(r6, 0x0) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$cont(0x21, r7, 0x5, 0x4) 4.453495728s ago: executing program 0 (id=6681): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60083, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xf) ioctl$TIOCVHANGUP(r0, 0x5437, 0x100000) 4.335126956s ago: executing program 2 (id=6682): capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) r0 = getpid() kcmp(r0, r0, 0x69b92bb5bfa41147, 0xffffffffffffffff, 0xffffffffffffffff) r1 = syz_open_dev$ndb(&(0x7f0000004480), 0x0, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r2) r3 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_connect$midi(0x4, 0x0, 0x0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x41e}}, {0x2, &(0x7f0000000180)=ANY=[@ANYBLOB="b72d4b3e764273cc742a8ea43d2bf60be0bd040b482a3fbf62eb7fe031dfe7c63a2deea836e90b0eea23389c6d303efc4a4725fe26b79dfcfd13e1757a16e1ac09964f05399de96bfab96c970262c0dd77537f34e696b78dabff8cd24a20ca8f1e3ac750fcef205506173e07577486fadf82696f9df81c59aab0"]}]}) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_ep_write(r2, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") r4 = socket$kcm(0xa, 0x1, 0x106) connect(r4, &(0x7f0000000080)=@ax25={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x8}, [@bcast, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x80) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, 0x0) 4.334823137s ago: executing program 3 (id=6683): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000270001002bbd013106329370ad405ce3d320e34b7000fcdbdf2510000000"], 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20004844) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$netlink(0x10, 0x3, 0x5) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000680)={&(0x7f0000000580)=[0x0], &(0x7f00000005c0)=[0x0], &(0x7f0000000600)=[0x0, 0x0], &(0x7f0000000640)=[0x0], 0x1, 0x1, 0x2, 0x1}) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000005800010200000000000000000200000408000340000039d3080001000300001f08000440008000f8070001"], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x8080) r2 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r2, &(0x7f0000000200)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x47}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000080)="513b5a9c0c0000fb4c4241fc05", 0xd}, {&(0x7f00000000c0)="05", 0x1}], 0x2}, 0x40080) 4.134863551s ago: executing program 0 (id=6684): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe2(&(0x7f0000001cc0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) socket$inet_smc(0x2b, 0x1, 0x0) mount$9p_fd(0x20, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x121484b, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 4.007741776s ago: executing program 3 (id=6685): r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f00000002c0)={'team_slave_1\x00', 0xa6bb}) r1 = inotify_init() clock_nanosleep(0x9, 0x0, &(0x7f0000000080)={0x0, 0x3938700}, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r3 = socket$unix(0x1, 0x2, 0x0) ioctl$int_in(r3, 0x5421, &(0x7f0000000000)=0x5) connect$unix(r3, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r3, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000040)='rxrpc\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) r4 = socket(0x2, 0x80805, 0x0) setsockopt$MRT_TABLE(r4, 0x0, 0xcf, 0x0, 0x0) syz_usb_connect(0x0, 0x46, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f6276000905000000000000000705e37e1b82e60905f2020000060000090501", @ANYRESHEX=r4, @ANYRES64=r0], 0x0) 3.810607295s ago: executing program 0 (id=6686): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000780)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000100), r3, 0x0, 0x1, 0x4}}, 0x20) r4 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) pwritev(r4, &(0x7f0000000440)=[{&(0x7f00000002c0)='0', 0x1}], 0x1, 0x8000, 0x1) syz_usb_disconnect(r1) r5 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000400)={'ip6gretap0\x00', 0x0}) sendto$packet(r6, &(0x7f00000002c0)="3303120081fd140000007ef52f555f2a0c09000000fd88a800f788a83baa88a80f8588a832f4", 0x26, 0x40000, &(0x7f00000000c0)={0x11, 0x8906, r7, 0x1, 0xcf}, 0x14) syz_usb_control_io$hid(r5, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r8) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x3c, r9, 0x1, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000054}, 0x0) epoll_pwait2(0xffffffffffffffff, &(0x7f0000009bc0), 0x0, &(0x7f0000009c00)={0x0, 0x989680}, 0x0, 0x0) syz_usb_connect$midi(0x4, 0x0, 0x0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x5a, &(0x7f0000000300)=@string={0x5a, 0x3, "96c6744dc98588583069a3dcc0fc241403a90cd22ada9e6ceb3e21c5b918baf5e1cde63d3fb307f5a085c3a1667fc7a231b76fa1cc0ef8d9a7f8cb9778158796195aed7a12c7aaebfa65eca2b1343904f3bcb1aae8020685"}}]}) syz_usb_connect(0x6, 0x535, &(0x7f0000000c80)={{0x12, 0x1, 0x300, 0xde, 0xcf, 0x7d, 0x20, 0x7c4, 0xa003, 0xfda0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x523, 0x2, 0x9c, 0x1, 0x60, 0x7, "", [{{0x9, 0x4, 0x27, 0x3, 0x8, 0xea, 0x4b, 0xc6, 0x10, [], [{{0x9, 0x5, 0xc, 0x3, 0x10, 0x2, 0x7f, 0xb9, [@generic={0xdb, 0xd, "494d3c89b976489efb6dc215c01b35dca5245e5b338dcb2675c8cfc34ee56aa1d677eb7daf5c5cd8c9301df1d5dd51cc70df835a302ebfe160590528f875d537568f2c46820f9805c6a87648d0565103764a42d0e0fe2b09d0ca77a0743a59816880b3cc318ccf0ddefca3038f59d23f7d0d8ae54dd3ff255513b07b4c2119e859a24ab2252a79931559b6fc0a01a20de01e7586b12d236f74e0b837ff91544af2aaa67b026aae8c0aeb99deae0116476787b03dc3b32c6b1a408b830d8d3964610a3c2fe591719564545cfe0a07e57cd4a5cd64fef85b8d08"}]}}, {{0x9, 0x5, 0xa, 0x8, 0x20, 0xda, 0x83, 0x8e, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x2, 0x1}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0xff, 0x7}]}}, {{0x9, 0x5, 0x3, 0x10, 0x0, 0x9, 0xe, 0x1}}, {{0x9, 0x5, 0x2, 0x0, 0x20, 0x3, 0x2, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0xe, 0x5}, @generic={0x17, 0xd, "1391ef4bdb50604d3c9984e5a2dcab7f9affbaeb44"}]}}, {{0x9, 0x5, 0x3, 0x3, 0x10, 0x10, 0x8, 0x3, [@generic={0x1d, 0xb, "99df4120aec97404c6b55c6f1fbae9bf40ca3e5a38aef7cd52be62"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0xdd}]}}, {{0x9, 0x5, 0xd, 0x0, 0x3ff, 0x4, 0x2, 0xfd}}, {{0x9, 0x5, 0xa, 0x3, 0x200, 0x27, 0xf, 0x0, [@generic={0x93, 0x21, "79b9ce8836abadc0f63b140afe10bbe50f10b0ac6027a89fe3238fc2f8d538a1d7fe5641c389811bafe75e2b028395e7fbf453774c94a669d44539df3c35babfca0d4eed1ea17b182d2c92e95b5bed358843d945cffb5315cd749923a33479e8ffe0a3d3f40b601372fd90db61b29ac0ba0124b3850195fe398449ca1dacc021aac8017e29d9bc7160b5ee0d8387fda720"}, @generic={0xcd, 0x8, "c202e3804e1772cec4ede4221201adf47ed4902cfde45a146a27c17d0a8cc57d04ab4f6265fefde9a6949b331f7c8a554631b5dd5227a2ec7456f9b30c95dc760ff88b085ed4723c7c9384908d46a46bd06cfbb0de8465983bf30583a8f14d716044de47f341c5b7160bd9b5b27480b692281a1666fe80abde1ad9c465903e328ca06867fc1ac3ca8be55679c425a0fb702c4ec8ea4d73326a4c3a921b2de425f646f8525b05da3fb8d0bf895a500077ab7d7a30f13710f53dbc57c487fff1fde31f08ec3b7488d1b85fe9"}]}}, {{0x9, 0x5, 0x6, 0x0, 0x10, 0x1, 0x5, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x7, 0x1}, @generic={0xdc, 0x7, "7a971c72f74bb5dff8d57a593818df383a1c880521b6a2219c4e181a707d5a9d11a9b9d8c80710c4db084d44a85004aba71fe637451804663aa6befa8e894c132777c0501809c390ba0f9d3c13fdc513a727745218b019fdd224db95e9d65cd4a53e56bba83186c96bd0996e24d9053160bc56e91ac41fa64deb0ba8dc45bf45086c09945c59bffff5983a8b7e0248744a76620d2064de0232d8978a7630a6ecebf00c87981669d3d39c2e3d748d46792a74de011d18a45c8b16fdd47e91bd456f56e4770e5036606c2463b1cac4c6f3037248f62d12ee1d18a8"}]}}]}}, {{0x9, 0x4, 0xdc, 0x4, 0x2, 0xff, 0x79, 0x4, 0x6, [@uac_control={{0xa, 0x24, 0x1, 0x81, 0x28}, [@input_terminal={0xc, 0x24, 0x2, 0x3, 0x203, 0x4, 0x3e, 0x6, 0x6, 0xa}, @output_terminal={0x9, 0x24, 0x3, 0x6, 0x400, 0x4, 0x4, 0x2}, @selector_unit={0x9, 0x24, 0x5, 0x6, 0xd7, "20bc8ee2"}]}, @hid_hid={0x9, 0x21, 0xa, 0x81, 0x1, {0x22, 0x102}}], [{{0x9, 0x5, 0x6, 0x0, 0x200, 0x8, 0x6, 0x40, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x8, 0x8}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0xff, 0x7}]}}, {{0x9, 0x5, 0xc, 0xc, 0x40, 0x3, 0x5, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x5, 0xfff}, @generic={0xfa, 0x31, "eb896a72f8e3d69a09376b4dc76ba40f90e59e8a5994b07b83ce7b551a336beb107ed7dd8336329ab7950b81dabe719539c1d83f1a8ee0b34630a23df559a502df08069a51be0fc7fbd3c9acab1f22b092cdd4a6a45ae7ad2dbe92214caf6fdcbbfcfc46ae98d35f4c71569e064e8d7e8336eacbbf497407eb6e29194ca1b9bca2efa66d6f294c33bc3940391c9cfef75cc14a810d0a56e06bbae60f1c9211f0d56813d75e9fddcc2ab73d30e863040727b373cc28a07fb4524a419ebb1593d2feddf741a32224c7ecf22d4e28ca45777e9b84086a25d40f689d1ec9abee594e24c5e8a223f4336b893515c10b3c9d34aa63de5975cfed3e"}]}}]}}]}}]}}, &(0x7f00000018c0)={0xa, &(0x7f00000011c0)={0xa, 0x6, 0x100, 0x6e, 0x0, 0x4, 0x40, 0x5}, 0x4b, &(0x7f0000001200)={0x5, 0xf, 0x4b, 0x4, [@ssp_cap={0x20, 0x10, 0xa, 0xc, 0x5, 0x3, 0x0, 0x3, [0xcf, 0x2070, 0xdf40, 0x600f, 0xc000]}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x2, 0x0, 0x9}, @wireless={0xb, 0x10, 0x1, 0x8, 0x4c, 0xa0, 0x8, 0xe36f, 0xd1}, @ss_container_id={0x14, 0x10, 0x4, 0xd, "4b5e1d7647f260c2d6dcfb30a718adfe"}]}, 0x9, [{0x4, &(0x7f0000001300)=@lang_id={0x4, 0x3, 0x809}}, {0xb5, &(0x7f0000001340)=@string={0xb5, 0x3, "1f61d113e3196cc968d3e33b71f5df3557448736fe3f440ae797d127873c850dfd57c4f37050daa800de8f5314fed58912a7fa0a4f37d38b8575754be39f486d8883dc49e382ff5f6b81b3fdc117d0660452abfe79c6df39f041c9dda203e1d49cff360643c165b3ecb9c4364e085acd40c0c94671d5cfcaf5fe1a970931dd48e78ec952071f7c4233b194fd8f00c99353804b3b99669e579a93ffc34eb8c5b0aa0eaa7f310b677f156c71fd094dac60e8f87c"}}, {0x4, &(0x7f0000001400)=@lang_id={0x4, 0x3, 0x422}}, {0xa3, &(0x7f0000001440)=@string={0xa3, 0x3, "dfd636ce5fade40959cce7c8f1decb1077d66e4ebddfb1f7cffcbe1df3ff90536d53ad2f28cb2a63b3e4a2b0f69f3f2566fd4870f3e7a8d2d722535b756906ad3770e9a2c37c72ee47d2f9c4088ce364fd9897313a2bfce3d50d9a4835b3e99fa79c1773fbf2facccf02d598b83906a64581f320d7fff624486aa7cbc91c8169f003ada6434880406d0aaa9da7a980b3af1a59fddb9c21fc7050742b9d8ea98b84"}}, {0xc1, &(0x7f0000001500)=@string={0xc1, 0x3, "0c5213be750c472ba53e6cffd6b82f6c520b0efe119e90cdb2321922bf4374b05bed93496d77360ec05408ce575ccca7f77fddd0379e51601e86275f4256b36382fef794ae2297fc5795d640b0c686ac9b70f034d422a12db51dd1ca3a87fbe210fa663ae4270bf911bf1c11de3e537120d05c9ea6fe48d5144d7323b8970fc5df2bc63844453bc2603cf6544ab8940b912ac4ce0b5e1c88360c3a609dbbabf4bc88db2615f782787e976c8734127e61b06ac5a726b9c66d156084278f8e3f"}}, {0x4, &(0x7f0000001600)=@lang_id={0x4, 0x3, 0x405}}, {0xbd, &(0x7f0000001640)=@string={0xbd, 0x3, "0f8488c0dc48f79970a6505dfb564634cf682a4b6a569bac9fbd2cb40edda1f1a5cb88bc2bc9b94dc4e82f7919bee2c31aad09c1905134a6af29f6de4952eb9c1377eeec2bb1ed542d296138e7d578ff39003969733fe6ccc96e0123ddee9958ef3610eb118a03ce6cb7e0c55c39febe142aef0704a0a8905b919d138f4f3afbd7d5dde1c7a404d2a82b7e8360cc4409897a26eca162f437c617f8a9da3a7d5b25d5e36c225819262799b48cac61fbc8f7a45d6da35693c0626a09"}}, {0x100, &(0x7f0000001700)=@string={0x100, 0x3, "927d8d36f3754c6ef006d5c2f687bd83a7d152f2c65c8acf6d4c8ad4d2880f469a18ba3a0f86ea297ff43536edecd272944d30ed833aded71741d6ad0101528c038aa3babfffb6560ea28c9b5f21580b50af2b25d84f44ea933d765232930e803a75adac3f8b2e9aa2c306965bdaa7bd730ebb8b69d20d02ce04553923b7658c43ce5c231b8e2dd1c7ab9a465274ef79459ffcf35c8e2355617f3d20adf41da3a4786c38402c6f531ed57d00357b7e660b224f32ab55ffb3295a4b2932d4700d7f6933bd5f616d4f88da6e6d4b2ea19b195dfc3d231d586755a7231232836340601f51679c68e9a1d336072d7efcdcab1143a6ada6aa54fc3722ffef70d3"}}, {0x8e, &(0x7f0000001800)=@string={0x8e, 0x3, "6f4ce1a905e033c7a8ddabb8ecacdff1b0ef8a85124d1bcd0d063bc280e4e3c8a73c7ff19661971159e031a4977ca6521bd7ca32dfe607d05c4ce46e4bf02bbab82196b8408881077ed3bbc8bfa2640fca4a4e3ec55cd4daf565e338d6f0efc85887dd922dc1836d4e6cd8ed01d4783cc4a2806150f8b65e97f3646847b5f0a953a7c4786091a80c938323d7"}}]}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x1, 0x70, &(0x7f0000000680)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5e, 0x2, 0x1, 0xa, 0x100, 0xe, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x7, 0x24, 0x6, 0x0, 0x1, '~b'}, {0x5, 0x24, 0x0, 0x80}, {0xd, 0x24, 0xf, 0x1, 0x400, 0xe, 0x3, 0x8}, {0x6, 0x24, 0x1a, 0x401}}, {{0x9, 0x5, 0x81, 0x3, 0x40, 0xff, 0x7, 0x5d}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x400, 0x7, 0x1, 0x81}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0xa7, 0x0, 0xb}}}}}}}]}}, &(0x7f0000000c00)={0xa, &(0x7f00000007c0)={0xa, 0x6, 0x300, 0x3, 0x7, 0xea, 0x40, 0x5}, 0x1d, &(0x7f0000000180)={0x5, 0xf, 0x1d, 0x1, [@ssp_cap={0x18, 0x10, 0xa, 0xff, 0x3, 0x30, 0xf, 0x7, [0xf, 0xffc0, 0xf]}]}, 0x8, [{0xbb, &(0x7f0000000840)=@string={0xbb, 0x3, "1dcf3596fe8862d7247fd71003b2aa66c91a9f74df30c5c1562420762285a217faf44e245395a6bf5e500ca8f65ca119d45d59c37c0cd257c88062d5d41ebbcb921d147ae24f7c399d8656570f54110e06fb41118f4ac6393f91ce4b423a4490a2daa2d625d0f6899030b38049dd5ae20f50ae7b99fad6b98fcd612866c5b39ce8c6567fe1d77d5ef37aa9c3ceefd3229c01b2935e016977212dd222035e11ac7ea364c203f1b3d23bdb7095cc832d2ae16dad030a4c6c50e7"}}, {0xc9, &(0x7f0000001a40)=@string={0xc9, 0x3, "48ad65ef4e995d0eb5561aab91b8b4eeea535a3c309b033f97bc2fcc3196d07d2366dfa743e18eb511acff794c5840d67b1e87198fb24c4b8daae0452eed4c83c5d6fd94e6dd2d8d869c90a267560e95d5b0db17d420b62a569cad8e13f0d094c3b62baf29f33828803dbad172030fcc85736362b97b0362bd767bd317e1e5668593e032ed20484e086771c8f192f71c4ea1da5818ab47523c64cfc913c40b2cafb010540ffba6b61266d304ced78dfe054d2715aed2caf116d753888dd58e60997d61ee3154d9"}}, {0x4, &(0x7f0000000940)=@lang_id={0x4, 0x3, 0x422}}, {0x3b, &(0x7f0000000140)=@string={0x3b, 0x3, "ce81bbb5c394d4604a6e4c5ed6652b15e53cfb6037131d58b175045aa6a5ae1e06f2056f0698c4e277e5e26cb5e7ff59e2f1cf4d0053706fde"}}, {0xd5, &(0x7f00000009c0)=@string={0xd5, 0x3, "30b8e5d2d7973a95348081fb9d187b5770ab0c4f9a8767952913a5cbe6c82c9defbeb22ac968e88445b9bfb5acfcc499faff95ec06a7359dd653c1833f0b74224d9938c202d22de15c9cf6d9425a33033227b563cdfa088c67a47df7b0006575d6d85ceb7bedfe7126a843bb1afc9e2508f26f4edf855e915020e7f3ec13d6466c7da4a60d7e4ced7cf04e886b2c197247f13d0ae93991497a69dc69047b6b1ed47235285384e4c7328173f539ca7b690585ad98b99934c656f4df37a1e0e406345aad3c43377e8e831e386daa8073c991aab5"}}, {0xaa, &(0x7f0000000ac0)=@string={0xaa, 0x3, "3e74fccab905209f5bbfea6c2ff769461be9e785582b1f8f924cca631b235b1b0b723e528e1ddb5710568132a65d923ae243d6f61ce7871f8064afeb13e2171c64ee1079f2caf2dcefa1556c38cc66027eb8ba86bab45709f282cfc84ff768630b29b59811c177efed6581b575f7d260013943c3d6a346e88e6782e92deb7f4bb09132f562a43257830a38b8167761d2a707195d2875c1bc9af64f7f701e04f86575cd9650c0bbfd"}}, {0x4, &(0x7f0000000b80)=@lang_id={0x4, 0x3, 0x280a}}, {0x4, &(0x7f0000000bc0)=@lang_id={0x4, 0x3, 0x2c0a}}]}) syz_usb_ep_write(r1, 0x2, 0x81, &(0x7f0000001980)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000f328ec0bcfc3d78fdbd90f114b898cded66d233194de7bfb64a2c39b58d465e815978abb882bc40f93071d797eb8b7bf36cab513084a28ee") sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) writev(r2, &(0x7f0000000640)=[{&(0x7f0000000540)="71fa3be3130f1c231cd3563f7fc2067a803677b437155eb78168277038e3f6337db57638331913369a2ccbbb1cd2af0af860bd6207674ae609f3c2821ebe5f65dc8d2dd71db075945cf5731ed0ab76f283f72026050cf5583a55af70c316791b876d8c59493987e8c2758d1703e0067e744ec4ae8289547e7bb3bd66de3851b54d0b51ff4ee13dbdc8e65d79b7d71e41b15ff45ae16ac467f000e6935ad2852f8e864e2d776145437a62f745a6c3f64579b8eee6ceac8663b2c60719f2f598878c778983b4ebc3498a2b71e8fbd82e678d0a524563e12dbfcb6787a8", 0xdc}], 0x1) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc4c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000020000380100000800c00018006000100d10300000c000080080003400000000214000000110001"], 0xb0}, 0x1, 0x0, 0x0, 0x14}, 0x40) syz_usb_ep_write(r1, 0x3, 0x9f, &(0x7f0000000380)="da4756d1f8c22f3f17c22d8e229df308fb7e963cb18d881d991323332c453126bf6da29822d371a85be6fdcb5d56c35ca7e17c65a9881adab917a5b63c0df48dd1fb612fe0dba894795367a5709d29e8ab0b1c2417f90bbbaf0ea9a38c25c39a5f40f8de86d5a4347a159e46d75e7a25503b7683dd5768716d36c7b71feb7d62e88f218e46b7c142dc5226ebb2e5c760ddec10b0e7fdd9d6b20be334725b1e") r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB="e80000000d0a010800000000000000000a0008010900020073797a31000000000900010073797a3100000000bc000380b80000800800034000000002"], 0xe8}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) 3.031448379s ago: executing program 1 (id=6687): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000ac1e0101000000001100000000000000fe8000008000000000000000002000aa0000000000000c9c0a00103000000000", @ANYRES32, @ANYRES32=0xee01, @ANYRES64=0x0], 0xb8}, 0x1, 0x0, 0x0, 0x84811}, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa07, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x300, 0x800000, @mcast2={0xff, 0x3}, 0x5}, 0x1c) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @private1, 0x7}, 0x1c) 2.903947613s ago: executing program 1 (id=6688): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x17d) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)=""/245, 0xf5) 2.829638581s ago: executing program 1 (id=6689): newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000340), 0x6000) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_usb_connect(0x1, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x86, 0xe0, 0x64, 0x8, 0x5c6, 0x9031, 0xe51d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x40, 0x4, 0x0, 0x1, "", [{{0x9, 0x4, 0x5, 0x7, 0x1, 0x16, 0x5c, 0xf6, 0x6, [], [{{0x9, 0x5, 0x4, 0x3, 0x200, 0x39, 0x7, 0x9}}]}}]}}]}}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x5, [{0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x407}}, {0x4, &(0x7f00000000c0)=@lang_id={0x4, 0x3, 0x438}}, {0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x44a}}, {0xd2, &(0x7f0000000140)=@string={0xd2, 0x3, "1f37c3f32460554ab2fb07c51e660881765c2c174b905f826cc15145787def206f0288343536f0b9a74f5d3b0842ef4db609f3c962ae4146e3110310ff91faf2b0b33d234b19cd23c5f43d71432fbbab139d842eda4550eb725cd079e41db8cee345f8a67d07d6c1b903572754da37848817f6fe708cbd1cabe0171939c8499329d30fd54a103596ddc477d22c88851b47336102b4c7d1109b52faea923933355601d0db4ffa47da7f1d59d91640ff1e8430d1c5610330361e53098e8fb0d4e2948057d7d323ec5056333e62fca1b26e"}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x861}}]}) 2.5428058s ago: executing program 3 (id=6690): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r2, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x28000) ioctl$XFS_IOC_FSGEOMETRY_V1(r0, 0x80705864, &(0x7f0000000100)) 2.501165702s ago: executing program 3 (id=6691): syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x63, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf25020000000800feff", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="410301"], 0x4) 2.246190142s ago: executing program 3 (id=6692): r0 = syz_usb_connect$uac2(0x3, 0x7b, &(0x7f0000000280)=ANY=[@ANYBLOB="120110030000004066241080400001020301090269000301053009080b00010107208c090400000001012000092401004004090007090401000001022000090401010101022000490501090002030b0408250100004004000904020000010220000904020101010220000905820908004006030825018203f30600"], &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000140)=0xda) ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000580)={0x0, 0xc1, 0x80, 0x34325241, 0x3, [0x2], [0x80ffff, 0x0, 0x1000000, 0xfffffffa], [], [0x400000000000000, 0x0, 0x0, 0x5]}) syz_usb_control_io(r0, &(0x7f0000000700)={0x2c, 0x0, &(0x7f00000005c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44d}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000200)={0x2c, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="000f0f000000050f0f00010a1003020400137f0300347832c1cabd1e4272a9b9d2536eb04de43221d6c3e09325c3e2276bf415934a14a706e02d8944ad5c5243f11ee79e89dc212b4883c3d0bf07367f1b8202055235aedc920e002947ae69d873cdd2f54f5b1ad2b89945cc1d75fed91fbc4e08f0709cd58dc36d55f414fbd91eaccbb41fc6"], &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0x65, 0x0, 0xa1, 0x1, "9f2378d5", "fc53bf5e"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x0, 0x2, 0x2, 0x80, 0x6, 0x2, 0x1}}}, &(0x7f0000000980)={0x84, 0x0, 0x0, &(0x7f0000000540)={0x0, 0x8, 0x1, 0xb}, &(0x7f0000000580)={0x20, 0x0, 0x4, {0x2, 0x3}}, &(0x7f0000000300)=ANY=[@ANYBLOB="20000400000001008000ad591e03a67bb162f4aac87794ad2c347aed453fe9662fbd09e46f0f9d31981146694987d21a1b0d60d4040000005c6ae07476a5936e16e6e8971080616b0503c115baf79a3497db11351ee8496387b792b5613e3d74d749111053fd05064142924904"], &(0x7f0000000640)={0x40, 0x7, 0x2, 0x8}, &(0x7f0000000680)={0x40, 0x9, 0x1}, &(0x7f00000006c0)={0x40, 0xb, 0x2, 'um'}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x7fff}, &(0x7f0000000780)={0x40, 0x13, 0x6, @random="661965e9a3fe"}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @broadcast}, &(0x7f0000000800)={0x40, 0x19, 0x2, "2d01"}, &(0x7f0000000840)={0x40, 0x1a, 0x2, 0xfff7}, &(0x7f00000008c0)={0x40, 0x1c, 0x1, 0xf}, &(0x7f0000000900)={0x40, 0x1e, 0x1, 0x7}, &(0x7f0000000940)={0x40, 0x21, 0x1, 0x6}}) syz_usb_control_io$uac2(r0, 0x0, 0x0) 1.351796993s ago: executing program 1 (id=6693): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000270001002bbd013106329370ad405ce3d320e34b7000fcdbdf2510000000"], 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20004844) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$netlink(0x10, 0x3, 0x5) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000680)={&(0x7f0000000580)=[0x0], &(0x7f00000005c0)=[0x0], &(0x7f0000000600)=[0x0, 0x0], &(0x7f0000000640)=[0x0], 0x1, 0x1, 0x2, 0x1}) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000005800010200000000000000000200000408000340000039d3080001000300001f08000440008000f8070001"], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x8080) r2 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r2, &(0x7f0000000200)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x47}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000080)="513b5a9c0c0000fb4c4241fc05", 0xd}, {&(0x7f00000000c0)="05", 0x1}], 0x2}, 0x40080) 1.224867223s ago: executing program 2 (id=6694): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000240)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f00000000c0)="510003000000", 0x6) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000180)={0x51, 0x706, 0x0, {0x2, 0x9}, {0x1, 0x3}, @const={0xff, {0xf4d3, 0x8, 0x9, 0x7}}}) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, &(0x7f0000000040)=0x601, 0x4) r7 = syz_open_dev$tty1(0xc, 0x4, 0x4) writev(r7, &(0x7f0000000300)=[{&(0x7f0000000080)="5e938b3838edb4ebaefc51040994a6ef3d258f5f6fdd070883b5a2baa8eec9aa5bba78c5402233240ecd1966d0ef5e6f32d11e9aacefc1321e20c172a0bd9f25068142a77328c720ee94d665cca680ff5b12e7fa888f62cdaf32c5b168313f96efc72b379136260e9b3b323348", 0x6d}], 0x1) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000340)="d80000001c0081044e81f782db44b904021d0802010000000500f0a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x20004800) r9 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r9, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), r3) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, 0x0, &(0x7f0000000380)) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="9c003df7fc10", @ANYRES16=r4, @ANYBLOB="010426bd5d00f8dbdf2502000008000100", @ANYRESOCT=r2], 0x1c}}, 0x4008054) write$nci(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="410301"], 0x4) 984.508146ms ago: executing program 1 (id=6695): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000d6", @ANYRES16=0x0, @ANYBLOB="020027bd7000fedbdf25060000000c009900000000000c000000080005000a000000"], 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="6f01000008000000", @ANYRES32=r4, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB="e0c236e31f8f5fb4c84cb71404edf45f6cee4be25457525e59c20114edaf3699054a469db80900c4a311777a60ea7c4c15ee1ff4053cb4f06d9738ecb89f0b782121e1eb7aa2", @ANYRES16=r3, @ANYBLOB="050000000000000000002e00000008000300", @ANYRES32=r4, @ANYBLOB="0a0034000202020202020000080026006c090000"], 0x30}}, 0x0) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(0x0, 0x0, 0x0) nanosleep(0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) nanosleep(&(0x7f0000000000)={0x77359400}, &(0x7f00000002c0)) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000013c0)="d8000000100081040100000000000000021d080b01000000e8fe55a118001500060014000300001208000d0074be0000a8001600a400014020000600ffffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ceb6bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x0) socket(0x23, 0x803, 0x10000) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000100)={[0xfffffffffffffffb, 0x1800006, 0x81, 0x7fffffff, 0xfff8, 0x0, 0x1000, 0x38, 0x2000004bfb, 0x4, 0x200000000002, 0x20000000000004, 0x3, 0x5, 0x9, 0x100000090], 0x0, 0x28657}) r6 = socket$unix(0x1, 0x1, 0x0) listen(r6, 0x0) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) ptrace$cont(0x21, r7, 0x5, 0x4) 359.136344ms ago: executing program 2 (id=6696): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000200)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000040)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 356.290327ms ago: executing program 0 (id=6697): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x17d) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)=""/245, 0xf5) 197.835664ms ago: executing program 0 (id=6698): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$NILFS_IOCTL_GET_SUSTAT(r0, 0x80306e85, &(0x7f0000000040)) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f0000002080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0xf, &(0x7f0000000080)=0x4, 0x4) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000000)={0x1d, &(0x7f0000000140)=[{0x25, '\x00', @data=0x8, 0x3}]}) 122.703808ms ago: executing program 0 (id=6699): r0 = socket(0x10, 0x803, 0x0) r1 = syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905ba3e79"], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB="40010400000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000001d80)="900736ffd7fb87465963b0d3522d82eab665c2832180d084a2b466cc4ea717ab45c96aea10a8c013fdd2a867d155cff2cc400602ee3af3f80c92a078afe315445c352d1695da6c390258ae2e7efc2c02fc161e1b5e271d98a04e5d977b6ca58c3c61f2e559489bcad21796d816c99b330ad4f7f0ff31a95635d4e18731539a4485d53546337f6453f17004a64899aa1c42bceea63fb4bb4a43deb4de7ddf18f773c836c304b2f2edf9c37e2859da3e0f28a1db43866032877a5b3218da48534a923d2b864964cf53bc0156359c23b20c4b5ed905fb9b6dd9178e6110aa63b24a24c71ff171dbf7bb65c26a4f3e3b960e1fe4e5c38c458170e7e5d38a2fa77262a334b70da13159214b59e99043f2d45738cfe619d4e54d9d9d52faad4185dc1461e3de1d4a8e2bac117f496b9198352ed12b367de480013f50733fcce28686f100f105d037fe1d3c387164fd3bb6d9f758e8c35de274cc824e0ef8a4ec4d74", 0x15f}], 0x1}, 0x84) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, 0x0, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) move_mount(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000380)='./file0\x00', 0x304) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 0s ago: executing program 3 (id=6700): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa8f94000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$netlink(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f00000003c0)={0x0, 0x0}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r5, 0xc008561c, &(0x7f0000000040)={0x7ffffff, 0xf, @name="211ac0912fb1a36f4826fb7943a679c23dc6871e0875cc8f7b171f10622e1233"}) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) lsetxattr$system_posix_acl(&(0x7f00000001c0)='.\x00', 0x0, 0x0, 0x0, 0x3) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r6, 0xc03864bc, 0x0) kernel console output (not intermixed with test programs): 0000010 [ 842.418584][T20324] RBP: 00007f8a72976090 R08: 0000000000000000 R09: 0000000000000000 [ 842.418598][T20324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 842.418612][T20324] R13: 00007f8a749a6038 R14: 00007f8a749a5fa0 R15: 00007ffc36823f38 [ 842.418649][T20324] [ 842.626450][T20331] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5677'. [ 842.972452][ T5699] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 843.120628][ T5699] usb 2-1: Using ep0 maxpacket: 32 [ 843.123144][ T5699] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 843.126426][ T5699] usb 2-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 843.126458][ T5699] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 843.126481][ T5699] usb 2-1: Product: syz [ 843.126498][ T5699] usb 2-1: Manufacturer: syz [ 843.126514][ T5699] usb 2-1: SerialNumber: syz [ 843.183365][ T5699] usb 2-1: config 0 descriptor?? [ 843.199887][ T5699] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 843.310031][ T5753] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 843.342724][T20362] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5691'. [ 843.396529][ T5601] Bluetooth: hci3: unexpected event for opcode 0x0c1c [ 843.462299][ T5753] usb 1-1: Using ep0 maxpacket: 16 [ 843.467911][ T5753] usb 1-1: config 0 has an invalid interface number: 34 but max is 0 [ 843.467943][ T5753] usb 1-1: config 0 has no interface number 0 [ 843.467993][ T5753] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 843.468023][ T5753] usb 1-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 843.515110][ T5753] usb 1-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 843.515144][ T5753] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 843.515167][ T5753] usb 1-1: Product: syz [ 843.515183][ T5753] usb 1-1: Manufacturer: syz [ 843.515199][ T5753] usb 1-1: SerialNumber: syz [ 843.559028][ T5753] usb 1-1: config 0 descriptor?? [ 843.564998][T20356] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 843.565273][T20356] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 843.601825][ T5699] gspca_pac7302: reg_w() failed i: 78 v: 00 error -71 [ 843.603192][ T5699] gspca_pac7302 2-1:0.0: probe with driver gspca_pac7302 failed with error -71 [ 843.627494][ T5699] usb 2-1: USB disconnect, device number 87 [ 843.768470][T20356] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 843.793651][T20356] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 843.814815][ T5753] asix 1-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 843.815026][ T5753] asix 1-1:0.34: probe with driver asix failed with error -32 [ 844.596696][ T5599] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 844.617267][ T5699] usb 2-1: new full-speed USB device number 88 using dummy_hcd [ 844.746327][ T5599] usb 3-1: Using ep0 maxpacket: 32 [ 844.748533][ T5599] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 844.748568][ T5599] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 844.748611][ T5599] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 844.748638][ T5599] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 844.754524][ T5599] usb 3-1: config 0 descriptor?? [ 844.794081][ T5599] hub 3-1:0.0: USB hub found [ 844.825325][ T5699] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 844.825357][ T5699] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 844.825437][ T5699] usb 2-1: Product: syz [ 844.825454][ T5699] usb 2-1: Manufacturer: syz [ 844.825471][ T5699] usb 2-1: SerialNumber: syz [ 844.861198][T16479] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 844.896191][ T5699] usb 2-1: config 0 descriptor?? [ 844.959556][ T5599] hub 3-1:0.0: 1 port detected [ 845.027623][T16479] usb 4-1: New USB device found, idVendor=055f, idProduct=c420, bcdDevice=6a.33 [ 845.027694][T16479] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 845.034622][T16479] usb 4-1: config 0 descriptor?? [ 845.071972][T16479] gspca_main: sunplus-2.14.0 probing 055f:c420 [ 845.112660][ T5699] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 845.166614][ T5599] hub 3-1:0.0: hub_hub_status failed (err = -71) [ 845.166940][ T5599] hub 3-1:0.0: config failed, can't get hub status (err -71) [ 845.198934][ T5599] usbhid 3-1:0.0: can't add hid device: -71 [ 845.199075][ T5599] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 845.236131][ T5599] usb 3-1: USB disconnect, device number 68 [ 845.464887][T20410] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 845.465541][T20410] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 845.472186][T20410] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 845.472816][T20410] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 845.508703][T20410] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 845.509457][T20410] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 845.709204][T16479] gspca_sunplus: reg_w_riv err -71 [ 845.709527][T16479] sunplus 4-1:0.0: probe with driver sunplus failed with error -71 [ 845.745891][T16479] usb 4-1: USB disconnect, device number 20 [ 846.042948][ T9] usb 3-1: new full-speed USB device number 69 using dummy_hcd [ 846.068497][ T5753] usb 1-1: USB disconnect, device number 69 [ 846.195198][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 846.195228][ T9] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 846.217819][ T9] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 846.217851][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 846.217874][ T9] usb 3-1: Product: syz [ 846.217890][ T9] usb 3-1: Manufacturer: syz [ 846.217906][ T9] usb 3-1: SerialNumber: syz [ 846.267428][ T9] usb 3-1: config 0 descriptor?? [ 846.768243][ T5699] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 847.328968][T20458] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 847.354270][T20458] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 847.534495][T20458] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 847.534585][T20458] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 847.796364][T20458] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 847.872144][ T5599] usb 2-1: USB disconnect, device number 88 [ 847.972638][T20458] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 847.972766][T20458] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 848.062424][T20458] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 848.130204][T20458] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 848.130329][T20458] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 848.196547][T20458] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 848.506772][ T5753] usb 2-1: new full-speed USB device number 89 using dummy_hcd [ 848.688450][ T5753] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 848.688487][ T5753] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 848.688516][ T5753] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 848.688534][ T5753] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 848.695055][ T5753] usb 2-1: config 0 descriptor?? [ 848.813491][T16479] usb 3-1: USB disconnect, device number 69 [ 849.154027][ T5753] pyra 0003:1E7D:2CF6.0019: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.1-1/input0 [ 849.344779][ T5753] pyra 0003:1E7D:2CF6.0019: couldn't init struct pyra_device [ 849.344820][ T5753] pyra 0003:1E7D:2CF6.0019: couldn't install mouse [ 849.356466][ T5601] Bluetooth: hci3: command 0x0405 tx timeout [ 849.382144][ T5753] pyra 0003:1E7D:2CF6.0019: probe with driver pyra failed with error -71 [ 849.428340][ T5753] usb 2-1: USB disconnect, device number 89 [ 849.594071][ T5601] Bluetooth: hci0: command 0x0c1a tx timeout [ 849.993213][ T5601] Bluetooth: hci1: command 0x0c1a tx timeout [ 850.142928][ T5601] Bluetooth: hci2: command 0x0c1a tx timeout [ 851.419860][ T5601] Bluetooth: hci3: command 0x0405 tx timeout [ 851.659127][ T5601] Bluetooth: hci0: command 0x0c1a tx timeout [ 852.058202][ T5601] Bluetooth: hci1: command 0x0c1a tx timeout [ 852.217987][ T5601] Bluetooth: hci2: command 0x0c1a tx timeout [ 853.744549][ T5601] Bluetooth: hci0: command 0x0c1a tx timeout [ 854.143780][ T5601] Bluetooth: hci1: command 0x0c1a tx timeout [ 854.294393][ T5601] Bluetooth: hci2: command 0x0c1a tx timeout [ 869.624793][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.624905][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 881.453550][T16351] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 881.607944][T16351] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 881.607978][T16351] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 881.634937][T16351] usb 2-1: config 0 descriptor?? [ 881.642590][T16351] cp210x 2-1:0.0: cp210x converter detected [ 881.663392][ T5599] usb 3-1: new full-speed USB device number 70 using dummy_hcd [ 881.820515][ T5599] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 881.820764][ T5599] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 881.820790][ T5599] usb 3-1: Product: syz [ 881.820806][ T5599] usb 3-1: Manufacturer: syz [ 881.820822][ T5599] usb 3-1: SerialNumber: syz [ 881.869147][ T5599] usb 3-1: config 0 descriptor?? [ 882.088544][ T5599] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 882.305779][T16351] cp210x 2-1:0.0: failed to get vendor val 0x370b size 1: -71 [ 882.305941][T16351] cp210x 2-1:0.0: querying part number failed [ 882.362048][T16351] usb 2-1: cp210x converter now attached to ttyUSB0 [ 882.381051][T16351] usb 2-1: USB disconnect, device number 90 [ 882.476266][T16351] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 882.498617][T16351] cp210x 2-1:0.0: device disconnected [ 883.726516][ T5599] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 884.205478][T20573] overlayfs: failed to resolve './file0': -2 [ 884.569141][ T9] usb 2-1: new full-speed USB device number 91 using dummy_hcd [ 884.732674][ T9] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 884.737787][ T9] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 884.737822][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 884.737845][ T9] usb 2-1: Product: syz [ 884.737861][ T9] usb 2-1: Manufacturer: syz [ 884.737877][ T9] usb 2-1: SerialNumber: syz [ 884.775590][T20601] FAULT_INJECTION: forcing a failure. [ 884.775590][T20601] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 884.775694][T20601] CPU: 1 UID: 0 PID: 20601 Comm: syz.3.5791 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 884.775780][T20601] Tainted: [L]=SOFTLOCKUP [ 884.775802][T20601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 884.775842][T20601] Call Trace: [ 884.775865][T20601] [ 884.775896][T20601] dump_stack_lvl+0xe8/0x150 [ 884.776016][T20601] should_fail_ex+0x467/0x600 [ 884.776140][T20601] _copy_to_user+0x31/0xb0 [ 884.776216][T20601] simple_read_from_buffer+0xe1/0x170 [ 884.776324][T20601] proc_fail_nth_read+0x1be/0x230 [ 884.776433][T20601] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 884.776532][T20601] ? rw_verify_area+0x250/0x4d0 [ 884.776599][T20601] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 884.776693][T20601] vfs_read+0x219/0xa90 [ 884.776768][T20601] ? __pfx_vfs_read+0x10/0x10 [ 884.776839][T20601] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 884.776904][T20601] ? lockdep_hardirqs_on+0x7a/0x110 [ 884.776967][T20601] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 884.777031][T20601] ? mutex_lock_nested+0x152/0x1d0 [ 884.777115][T20601] ? fdget_pos+0x252/0x320 [ 884.777236][T20601] ksys_read+0x156/0x270 [ 884.777296][T20601] ? __pfx_ksys_read+0x10/0x10 [ 884.777389][T20601] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 884.777459][T20601] do_syscall_64+0x174/0x580 [ 884.777515][T20601] ? trace_irq_disable+0x3b/0x140 [ 884.777572][T20601] ? clear_bhb_loop+0x40/0x90 [ 884.777667][T20601] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 884.777690][T20601] RIP: 0033:0x7ffa8e29e68e [ 884.777729][T20601] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 884.777798][T20601] RSP: 002b:00007ffa8c535fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 884.777888][T20601] RAX: ffffffffffffffda RBX: 00007ffa8c5366c0 RCX: 00007ffa8e29e68e [ 884.777941][T20601] RDX: 000000000000000f RSI: 00007ffa8c5360a0 RDI: 0000000000000005 [ 884.777983][T20601] RBP: 00007ffa8c536090 R08: 0000000000000000 R09: 0000000000000000 [ 884.778018][T20601] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 884.778051][T20601] R13: 00007ffa8e566038 R14: 00007ffa8e565fa0 R15: 00007ffe708eb018 [ 884.778180][T20601] [ 885.040200][T16479] usb 3-1: USB disconnect, device number 70 [ 885.041180][ T9] usb 2-1: config 0 descriptor?? [ 885.378150][T20615] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 885.568464][T16479] usb 3-1: new full-speed USB device number 71 using dummy_hcd [ 885.725157][T16479] usb 3-1: config 5 has an invalid interface number: 77 but max is 2 [ 885.725192][T16479] usb 3-1: config 5 has an invalid interface number: 131 but max is 2 [ 885.725216][T16479] usb 3-1: config 5 has an invalid interface number: 67 but max is 2 [ 885.725240][T16479] usb 3-1: config 5 has no interface number 0 [ 885.725258][T16479] usb 3-1: config 5 has no interface number 1 [ 885.725276][T16479] usb 3-1: config 5 has no interface number 2 [ 885.725361][T16479] usb 3-1: config 5 interface 77 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 885.725386][T16479] usb 3-1: config 5 interface 77 altsetting 6 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 885.725417][T16479] usb 3-1: config 5 interface 77 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 885.725442][T16479] usb 3-1: config 5 interface 77 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 885.725466][T16479] usb 3-1: config 5 interface 77 altsetting 6 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 885.725503][T16479] usb 3-1: config 5 interface 77 altsetting 6 has a duplicate endpoint with address 0x1, skipping [ 885.725531][T16479] usb 3-1: config 5 interface 77 altsetting 6 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 885.725562][T16479] usb 3-1: config 5 interface 77 altsetting 6 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 885.725592][T16479] usb 3-1: config 5 interface 77 altsetting 6 has a duplicate endpoint with address 0x8, skipping [ 885.725616][T16479] usb 3-1: config 5 interface 77 altsetting 6 has a duplicate endpoint with address 0x1, skipping [ 885.725640][T16479] usb 3-1: config 5 interface 77 altsetting 6 has a duplicate endpoint with address 0x2, skipping [ 885.725689][T16479] usb 3-1: config 5 interface 131 altsetting 5 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 885.725717][T16479] usb 3-1: config 5 interface 131 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 885.725740][T16479] usb 3-1: config 5 interface 131 altsetting 5 endpoint 0xA has an invalid bInterval 156, changing to 4 [ 885.725768][T16479] usb 3-1: config 5 interface 131 altsetting 5 has a duplicate endpoint with address 0x7, skipping [ 885.725792][T16479] usb 3-1: config 5 interface 131 altsetting 5 has an endpoint descriptor with address 0x55, changing to 0x5 [ 885.725832][T16479] usb 3-1: config 5 interface 131 altsetting 5 has a duplicate endpoint with address 0x5, skipping [ 885.725854][T16479] usb 3-1: config 5 interface 131 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 885.725895][T16479] usb 3-1: config 5 interface 131 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 885.725919][T16479] usb 3-1: config 5 interface 131 altsetting 5 has a duplicate endpoint with address 0x2, skipping [ 885.725944][T16479] usb 3-1: config 5 interface 131 altsetting 5 has a duplicate endpoint with address 0x6, skipping [ 885.725997][T16479] usb 3-1: config 5 interface 67 altsetting 255 has a duplicate endpoint with address 0x7, skipping [ 885.726023][T16479] usb 3-1: config 5 interface 67 altsetting 255 has an invalid descriptor for endpoint zero, skipping [ 885.726047][T16479] usb 3-1: config 5 interface 67 altsetting 255 has a duplicate endpoint with address 0x4, skipping [ 885.726074][T16479] usb 3-1: config 5 interface 67 altsetting 255 has a duplicate endpoint with address 0x5, skipping [ 885.726100][T16479] usb 3-1: config 5 interface 67 altsetting 255 has a duplicate endpoint with address 0x8, skipping [ 885.726127][T16479] usb 3-1: config 5 interface 67 altsetting 255 has a duplicate endpoint with address 0x5, skipping [ 885.726152][T16479] usb 3-1: config 5 interface 67 altsetting 255 has a duplicate endpoint with address 0x7, skipping [ 885.726176][T16479] usb 3-1: config 5 interface 67 altsetting 255 has a duplicate endpoint with address 0x4, skipping [ 885.727544][T16479] usb 3-1: config 5 interface 77 has no altsetting 0 [ 885.727568][T16479] usb 3-1: config 5 interface 131 has no altsetting 0 [ 885.727588][T16479] usb 3-1: config 5 interface 67 has no altsetting 0 [ 885.876365][T16479] usb 3-1: New USB device found, idVendor=19d2, idProduct=1142, bcdDevice=a2.ff [ 885.876460][T16479] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 885.876525][T16479] usb 3-1: Manufacturer: 暭메땯뗴䎹螧恇䱤햕Ⱟ㝧췧걈攊≠䕊ᴻ˹陒曃쑨♪ᶉ材ᜃ퉸흭䓪ὉᲐ햽㍑奮퐥㾼ꯢˡꪣ擳죯깯Å昫㴡Չṟ毶摨쉗ᡦ⩲戤穅跥悖⚞蹴⡥롟 [ 885.876607][T16479] usb 3-1: SerialNumber: ࠉ [ 886.167354][T20610] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 886.383122][T16479] option 3-1:5.77: GSM modem (1-port) converter detected [ 886.484992][T16479] usb 3-1: USB disconnect, device number 71 [ 886.527239][T16479] option 3-1:5.77: device disconnected [ 887.301799][T20675] netlink: 4816 bytes leftover after parsing attributes in process `syz.0.5822'. [ 887.443324][ T5599] usb 2-1: USB disconnect, device number 91 [ 887.555238][T20676] netlink: 'syz.2.5821': attribute type 2 has an invalid length. [ 888.194642][ T9] usb 2-1: new full-speed USB device number 92 using dummy_hcd [ 888.367542][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 888.368159][ T9] usb 2-1: not running at top speed; connect to a high speed hub [ 888.369356][ T9] usb 2-1: config 4 has an invalid interface number: 5 but max is 1 [ 888.369382][ T9] usb 2-1: config 4 has an invalid interface number: 53 but max is 1 [ 888.369405][ T9] usb 2-1: config 4 has an invalid interface number: 67 but max is 1 [ 888.369426][ T9] usb 2-1: config 4 has 3 interfaces, different from the descriptor's value: 2 [ 888.369450][ T9] usb 2-1: config 4 has no interface number 0 [ 888.369468][ T9] usb 2-1: config 4 has no interface number 1 [ 888.369486][ T9] usb 2-1: config 4 has no interface number 2 [ 888.369563][ T9] usb 2-1: config 4 interface 53 altsetting 4 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 888.369594][ T9] usb 2-1: too many endpoints for config 4 interface 67 altsetting 115: 202, using maximum allowed: 30 [ 888.369635][ T9] usb 2-1: config 4 interface 67 altsetting 115 has 0 endpoint descriptors, different from the interface descriptor's value: 202 [ 888.369666][ T9] usb 2-1: config 4 interface 5 has no altsetting 0 [ 888.369690][ T9] usb 2-1: config 4 interface 53 has no altsetting 0 [ 888.369710][ T9] usb 2-1: config 4 interface 67 has no altsetting 0 [ 888.440501][ T9] usb 2-1: New USB device found, idVendor=1410, idProduct=1430, bcdDevice= 9.58 [ 888.440536][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 888.440559][ T9] usb 2-1: Product: syz [ 888.440575][ T9] usb 2-1: Manufacturer: syz [ 888.440591][ T9] usb 2-1: SerialNumber: syz [ 888.916817][T20694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 888.917465][T20694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 889.281172][ T9] option 2-1:4.5: GSM modem (1-port) converter detected [ 889.310656][ T9] option 2-1:4.53: GSM modem (1-port) converter detected [ 889.335945][ T9] hub 2-1:4.67: Invalid hub with more than one config or interface [ 889.335999][ T9] hub 2-1:4.67: probe with driver hub failed with error -22 [ 889.337782][ T9] option 2-1:4.67: GSM modem (1-port) converter detected [ 889.372258][ T9] usb 2-1: USB disconnect, device number 92 [ 889.394279][ T9] option 2-1:4.5: device disconnected [ 889.409902][ T9] option 2-1:4.53: device disconnected [ 889.447410][ T9] option 2-1:4.67: device disconnected [ 889.662347][T16351] usb 3-1: new full-speed USB device number 72 using dummy_hcd [ 889.823542][T16351] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 889.823576][T16351] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.823609][T16351] usb 3-1: Product: syz [ 889.823627][T16351] usb 3-1: Manufacturer: syz [ 889.823644][T16351] usb 3-1: SerialNumber: syz [ 889.854196][T16351] usb 3-1: config 0 descriptor?? [ 890.097898][T16351] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 891.490493][T16479] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 891.652465][T16479] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 891.652492][T16479] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 891.652784][T16479] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 891.652804][T16479] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 891.704619][T16479] usb 2-1: config 0 descriptor?? [ 892.127802][T16351] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 892.163756][T16479] hid_parser_main: 217 callbacks suppressed [ 892.163774][T16479] playstation 0003:054C:0DF2.001A: unknown main item tag 0x0 [ 892.163800][T16479] playstation 0003:054C:0DF2.001A: unknown main item tag 0x0 [ 892.163819][T16479] playstation 0003:054C:0DF2.001A: unknown main item tag 0x0 [ 892.163839][T16479] playstation 0003:054C:0DF2.001A: unknown main item tag 0x0 [ 892.163858][T16479] playstation 0003:054C:0DF2.001A: unknown main item tag 0x0 [ 892.250428][T16479] playstation 0003:054C:0DF2.001A: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.1-1/input0 [ 892.338299][T20794] playstation 0003:054C:0DF2.001A: pid 20794 passed too large report [ 892.348136][T16479] playstation 0003:054C:0DF2.001A: Failed to retrieve feature with reportID 9: -71 [ 892.348235][T16479] playstation 0003:054C:0DF2.001A: Failed to retrieve DualSense pairing info: -71 [ 892.348302][T16479] playstation 0003:054C:0DF2.001A: Failed to get MAC address from DualSense [ 892.348345][T16479] playstation 0003:054C:0DF2.001A: Failed to create dualsense. [ 892.490041][T16479] playstation 0003:054C:0DF2.001A: probe with driver playstation failed with error -71 [ 892.528117][T16479] usb 2-1: USB disconnect, device number 93 [ 893.196469][ T9] usb 3-1: USB disconnect, device number 72 [ 893.248849][ T5599] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 893.387726][ T5599] usb 1-1: device descriptor read/64, error -71 [ 893.539313][T15649] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 893.627447][ T5599] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 893.677451][T15649] usb 2-1: device descriptor read/64, error -71 [ 893.760006][ T5599] usb 1-1: device descriptor read/64, error -71 [ 893.867405][ T5599] usb usb1-port1: attempt power cycle [ 893.926496][T15649] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 894.006947][T16351] usb 3-1: new full-speed USB device number 73 using dummy_hcd [ 894.077040][T15649] usb 2-1: device descriptor read/64, error -71 [ 894.164657][T16351] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 894.164691][T16351] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 894.164713][T16351] usb 3-1: Product: syz [ 894.164730][T16351] usb 3-1: Manufacturer: syz [ 894.164746][T16351] usb 3-1: SerialNumber: syz [ 894.198500][T15649] usb usb2-port1: attempt power cycle [ 894.205134][T16351] usb 3-1: config 0 descriptor?? [ 894.218167][ T5599] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 894.241699][ T5599] usb 1-1: device descriptor read/8, error -71 [ 894.418486][T16351] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 894.476375][ T5599] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 894.501263][ T5599] usb 1-1: device descriptor read/8, error -71 [ 894.536319][T15649] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 894.557687][T15649] usb 2-1: device descriptor read/8, error -71 [ 894.606678][ T5599] usb usb1-port1: unable to enumerate USB device [ 894.825913][T15649] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 894.851777][T15649] usb 2-1: device descriptor read/8, error -71 [ 894.966113][T15649] usb usb2-port1: unable to enumerate USB device [ 896.454861][T16351] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 897.381529][T20960] FAULT_INJECTION: forcing a failure. [ 897.381529][T20960] name failslab, interval 1, probability 0, space 0, times 0 [ 897.381569][T20960] CPU: 0 UID: 0 PID: 20960 Comm: syz.0.5948 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 897.381599][T20960] Tainted: [L]=SOFTLOCKUP [ 897.381608][T20960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 897.381622][T20960] Call Trace: [ 897.381631][T20960] [ 897.381642][T20960] dump_stack_lvl+0xe8/0x150 [ 897.381678][T20960] should_fail_ex+0x467/0x600 [ 897.381718][T20960] should_failslab+0xa8/0x100 [ 897.381754][T20960] __kmalloc_noprof+0xfb/0x790 [ 897.381787][T20960] ? tomoyo_encode+0x2ad/0x570 [ 897.381810][T20960] ? tomoyo_encode+0x2ad/0x570 [ 897.381842][T20960] tomoyo_encode+0x2ad/0x570 [ 897.381874][T20960] tomoyo_realpath_from_path+0x5fa/0x640 [ 897.381911][T20960] ? tomoyo_path_number_perm+0x219/0x5f0 [ 897.381945][T20960] tomoyo_path_number_perm+0x246/0x5f0 [ 897.381988][T20960] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 897.382021][T20960] ? __lock_acquire+0x6df/0x2e40 [ 897.382058][T20960] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 897.382083][T20960] ? lockdep_hardirqs_on+0x7a/0x110 [ 897.382125][T20960] ? __fget_files+0x2a/0x420 [ 897.382161][T20960] ? __fget_files+0x2a/0x420 [ 897.382194][T20960] ? __fget_files+0x3a8/0x420 [ 897.382226][T20960] ? __fget_files+0x2a/0x420 [ 897.382271][T20960] security_file_ioctl+0xb9/0x260 [ 897.382306][T20960] __se_sys_ioctl+0x47/0x170 [ 897.382333][T20960] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.382359][T20960] do_syscall_64+0x174/0x580 [ 897.382381][T20960] ? trace_irq_disable+0x3b/0x140 [ 897.382404][T20960] ? clear_bhb_loop+0x40/0x90 [ 897.382433][T20960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.382457][T20960] RIP: 0033:0x7f8b67c8de59 [ 897.382479][T20960] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 897.382500][T20960] RSP: 002b:00007f8b65ee6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 897.382525][T20960] RAX: ffffffffffffffda RBX: 00007f8b67f15fa0 RCX: 00007f8b67c8de59 [ 897.382542][T20960] RDX: 0000200000000040 RSI: 00000000c0306201 RDI: 0000000000000004 [ 897.382558][T20960] RBP: 00007f8b65ee6090 R08: 0000000000000000 R09: 0000000000000000 [ 897.382572][T20960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 897.382586][T20960] R13: 00007f8b67f16038 R14: 00007f8b67f15fa0 R15: 00007ffdaa658278 [ 897.382622][T20960] [ 897.382747][T20960] ERROR: Out of memory at tomoyo_realpath_from_path. [ 897.771036][ T9] usb 3-1: USB disconnect, device number 73 [ 898.194931][ T9] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 898.378173][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 898.378212][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 898.378256][ T9] usb 3-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 898.378282][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 898.410865][ T9] usb 3-1: config 0 descriptor?? [ 898.414083][T15649] usb 2-1: new full-speed USB device number 98 using dummy_hcd [ 898.620416][T15649] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 898.620450][T15649] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 898.620525][T15649] usb 2-1: Product: syz [ 898.620543][T15649] usb 2-1: Manufacturer: syz [ 898.620560][T15649] usb 2-1: SerialNumber: syz [ 898.680843][T15649] usb 2-1: config 0 descriptor?? [ 898.928328][T15649] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 898.949219][ T9] playstation 0003:054C:0DF2.001B: unknown main item tag 0x0 [ 898.949476][ T9] playstation 0003:054C:0DF2.001B: unknown main item tag 0x0 [ 898.949507][ T9] playstation 0003:054C:0DF2.001B: unknown main item tag 0x0 [ 898.949535][ T9] playstation 0003:054C:0DF2.001B: unknown main item tag 0x0 [ 898.949562][ T9] playstation 0003:054C:0DF2.001B: unknown main item tag 0x0 [ 899.022608][ T9] playstation 0003:054C:0DF2.001B: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.2-1/input0 [ 899.086133][ T9] playstation 0003:054C:0DF2.001B: Failed to retrieve feature with reportID 9: -71 [ 899.086168][ T9] playstation 0003:054C:0DF2.001B: Failed to retrieve DualSense pairing info: -71 [ 899.086227][ T9] playstation 0003:054C:0DF2.001B: Failed to get MAC address from DualSense [ 899.086630][ T9] playstation 0003:054C:0DF2.001B: Failed to create dualsense. [ 899.246315][ T9] playstation 0003:054C:0DF2.001B: probe with driver playstation failed with error -71 [ 899.310263][ T9] usb 3-1: USB disconnect, device number 74 [ 900.150593][T21066] FAULT_INJECTION: forcing a failure. [ 900.150593][T21066] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 900.150633][T21066] CPU: 1 UID: 0 PID: 21066 Comm: syz.3.5999 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 900.150665][T21066] Tainted: [L]=SOFTLOCKUP [ 900.150674][T21066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 900.150689][T21066] Call Trace: [ 900.150698][T21066] [ 900.150707][T21066] dump_stack_lvl+0xe8/0x150 [ 900.150742][T21066] should_fail_ex+0x467/0x600 [ 900.150782][T21066] _copy_from_iter+0x1d3/0x1660 [ 900.150819][T21066] ? trace_kmem_cache_alloc+0x29/0xe0 [ 900.150853][T21066] ? __pfx__copy_from_iter+0x10/0x10 [ 900.150876][T21066] ? __alloc_skb+0x276/0x7a0 [ 900.150906][T21066] ? __alloc_skb+0x276/0x7a0 [ 900.150945][T21066] ? netlink_sendmsg+0x650/0xb40 [ 900.150966][T21066] ? skb_put+0x112/0x210 [ 900.151011][T21066] netlink_sendmsg+0x6c0/0xb40 [ 900.151044][T21066] ? __pfx_netlink_sendmsg+0x10/0x10 [ 900.151069][T21066] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 900.151101][T21066] ? __kernel_text_address+0xd/0x30 [ 900.151136][T21066] ? unwind_get_return_address+0x4d/0x90 [ 900.151162][T21066] ? __pfx_netlink_sendmsg+0x10/0x10 [ 900.151184][T21066] sock_sendmsg_nosec+0x13a/0x180 [ 900.151215][T21066] ____sys_sendmsg+0x565/0x870 [ 900.151264][T21066] ? __pfx_____sys_sendmsg+0x10/0x10 [ 900.151311][T21066] ? import_iovec+0x73/0xa0 [ 900.151342][T21066] ___sys_sendmsg+0x2a5/0x360 [ 900.151378][T21066] ? __lock_acquire+0x6df/0x2e40 [ 900.151404][T21066] ? __pfx____sys_sendmsg+0x10/0x10 [ 900.151478][T21066] ? __fget_files+0x2a/0x420 [ 900.151511][T21066] ? __fget_files+0x3a8/0x420 [ 900.151557][T21066] __x64_sys_sendmsg+0x1b7/0x290 [ 900.151582][T21066] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 900.151622][T21066] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.151647][T21066] do_syscall_64+0x174/0x580 [ 900.151670][T21066] ? trace_irq_disable+0x3b/0x140 [ 900.151692][T21066] ? clear_bhb_loop+0x40/0x90 [ 900.151722][T21066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.151745][T21066] RIP: 0033:0x7ffa8e2dde59 [ 900.151766][T21066] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 900.151787][T21066] RSP: 002b:00007ffa8c536028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 900.151810][T21066] RAX: ffffffffffffffda RBX: 00007ffa8e565fa0 RCX: 00007ffa8e2dde59 [ 900.151827][T21066] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 900.151842][T21066] RBP: 00007ffa8c536090 R08: 0000000000000000 R09: 0000000000000000 [ 900.151856][T21066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 900.151870][T21066] R13: 00007ffa8e566038 R14: 00007ffa8e565fa0 R15: 00007ffe708eb018 [ 900.151904][T21066] [ 900.552837][T15649] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 900.575349][ T32] usb 2-1: USB disconnect, device number 98 [ 900.626961][T21071] FAULT_INJECTION: forcing a failure. [ 900.626961][T21071] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 900.626999][T21071] CPU: 0 UID: 0 PID: 21071 Comm: syz.0.6002 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 900.627028][T21071] Tainted: [L]=SOFTLOCKUP [ 900.627036][T21071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 900.627049][T21071] Call Trace: [ 900.627059][T21071] [ 900.627069][T21071] dump_stack_lvl+0xe8/0x150 [ 900.627102][T21071] should_fail_ex+0x467/0x600 [ 900.627141][T21071] _copy_to_user+0x31/0xb0 [ 900.627170][T21071] simple_read_from_buffer+0xe1/0x170 [ 900.627208][T21071] proc_fail_nth_read+0x1be/0x230 [ 900.627245][T21071] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 900.627281][T21071] ? rw_verify_area+0x250/0x4d0 [ 900.627305][T21071] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 900.627338][T21071] vfs_read+0x219/0xa90 [ 900.627367][T21071] ? __pfx_vfs_read+0x10/0x10 [ 900.627390][T21071] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 900.627414][T21071] ? lockdep_hardirqs_on+0x7a/0x110 [ 900.627446][T21071] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 900.627470][T21071] ? mutex_lock_nested+0x152/0x1d0 [ 900.627497][T21071] ? fdget_pos+0x252/0x320 [ 900.627537][T21071] ksys_read+0x156/0x270 [ 900.627560][T21071] ? __pfx_ksys_read+0x10/0x10 [ 900.627588][T21071] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.627613][T21071] do_syscall_64+0x174/0x580 [ 900.627653][T21071] ? trace_irq_disable+0x3b/0x140 [ 900.627673][T21071] ? clear_bhb_loop+0x40/0x90 [ 900.627703][T21071] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.627727][T21071] RIP: 0033:0x7f8b67c4e68e [ 900.627748][T21071] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 900.627768][T21071] RSP: 002b:00007f8b65ee5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 900.627792][T21071] RAX: ffffffffffffffda RBX: 00007f8b65ee66c0 RCX: 00007f8b67c4e68e [ 900.627809][T21071] RDX: 000000000000000f RSI: 00007f8b65ee60a0 RDI: 0000000000000004 [ 900.627824][T21071] RBP: 00007f8b65ee6090 R08: 0000000000000000 R09: 0000000000000000 [ 900.627838][T21071] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 900.627852][T21071] R13: 00007f8b67f16038 R14: 00007f8b67f15fa0 R15: 00007ffdaa658278 [ 900.627887][T21071] [ 901.181524][T21079] overlayfs: failed to verify origin (338/file1, ino=1739, err=-116) [ 901.185066][T21079] overlayfs: failed to verify origin (338/file1, ino=1739, err=-116) [ 901.520054][T15649] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 901.689703][T15649] usb 2-1: Using ep0 maxpacket: 8 [ 901.693896][T15649] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 901.693925][T15649] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 901.693993][T15649] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 28, changing to 7 [ 901.698010][T15649] usb 2-1: New USB device found, idVendor=15ca, idProduct=0101, bcdDevice= 0.40 [ 901.698037][T15649] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 901.703534][T15649] usb 2-1: Product: syz [ 901.703556][T15649] usb 2-1: Manufacturer: syz [ 901.703572][T15649] usb 2-1: SerialNumber: syz [ 902.108570][ T32] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 902.136884][T21106] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 902.137036][ T9] lo speed is unknown, defaulting to 1000 [ 902.189943][T15649] usb 2-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 902.193509][T15649] usb 2-1: unit 3 not found! [ 902.257597][ T32] usb 3-1: Using ep0 maxpacket: 16 [ 902.259972][ T32] usb 3-1: config 0 has an invalid interface number: 105 but max is 0 [ 902.259999][ T32] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 902.260020][ T32] usb 3-1: config 0 has no interface number 0 [ 902.262601][ T32] usb 3-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 902.262626][ T32] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 902.262646][ T32] usb 3-1: Product: syz [ 902.262661][ T32] usb 3-1: Manufacturer: syz [ 902.262676][ T32] usb 3-1: SerialNumber: syz [ 902.333307][ T32] usb 3-1: config 0 descriptor?? [ 902.377017][ T32] uvcvideo 3-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 902.377057][ T32] uvcvideo 3-1:0.105: No valid video chain found. [ 902.462948][T15649] usb 2-1: USB disconnect, device number 99 [ 902.514783][T21027] udevd[21027]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 902.552848][T16351] usb 3-1: USB disconnect, device number 75 [ 903.816364][T15649] usb 3-1: new full-speed USB device number 76 using dummy_hcd [ 903.966086][ T11] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 903.992695][T15649] usb 3-1: config 2 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 903.992732][T15649] usb 3-1: config 2 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 903.992758][T15649] usb 3-1: config 2 interface 0 has no altsetting 0 [ 903.992793][T15649] usb 3-1: New USB device found, idVendor=04e7, idProduct=0009, bcdDevice= 0.00 [ 903.992828][T15649] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 904.146114][ T11] usb 2-1: Using ep0 maxpacket: 16 [ 904.172554][ T11] usb 2-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 904.172586][ T11] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 904.172839][ T11] usb 2-1: Product: syz [ 904.172857][ T11] usb 2-1: Manufacturer: syz [ 904.172873][ T11] usb 2-1: SerialNumber: syz [ 904.232159][ T11] usb 2-1: config 0 descriptor?? [ 904.250938][T21184] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 904.261576][T21184] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 904.403955][T15649] usbhid 3-1:2.0: can't add hid device: -71 [ 904.404875][T15649] usbhid 3-1:2.0: probe with driver usbhid failed with error -71 [ 904.459117][T15649] usb 3-1: USB disconnect, device number 76 [ 904.646504][ T11] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 904.720901][ T11] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 904.727184][ T11] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 904.727288][ T11] usb 2-1: media controller created [ 904.765174][ T11] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 904.889134][ T11] zl10353_read_register: readreg error (reg=127, ret==0) [ 904.889269][ T11] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 904.889342][ T11] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 904.907125][ T11] usb 2-1: USB disconnect, device number 100 [ 904.937730][T15649] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 905.108075][ T11] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 905.120820][T15649] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 905.120927][T15649] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 905.121052][T15649] usb 3-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 905.121126][T15649] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 905.198732][T15649] usb 3-1: config 0 descriptor?? [ 905.584343][ T5601] Bluetooth: hci3: command 0x0405 tx timeout [ 905.621498][T15649] usbhid 3-1:0.0: can't add hid device: -71 [ 905.621628][T15649] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 905.648593][T15649] usb 3-1: USB disconnect, device number 77 [ 906.562225][T21309] FAULT_INJECTION: forcing a failure. [ 906.562225][T21309] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 906.562266][T21309] CPU: 0 UID: 0 PID: 21309 Comm: syz.3.6113 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 906.562297][T21309] Tainted: [L]=SOFTLOCKUP [ 906.562305][T21309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 906.562320][T21309] Call Trace: [ 906.562329][T21309] [ 906.562339][T21309] dump_stack_lvl+0xe8/0x150 [ 906.562376][T21309] should_fail_ex+0x467/0x600 [ 906.562417][T21309] strncpy_from_user+0x36/0x2c0 [ 906.562455][T21309] do_getname+0x77/0x250 [ 906.562488][T21309] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 906.562514][T21309] __se_sys_rename+0x2b/0x2c0 [ 906.562546][T21309] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 906.562572][T21309] do_syscall_64+0x174/0x580 [ 906.562596][T21309] ? trace_irq_disable+0x3b/0x140 [ 906.562619][T21309] ? clear_bhb_loop+0x40/0x90 [ 906.562647][T21309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 906.562670][T21309] RIP: 0033:0x7ffa8e2dde59 [ 906.562690][T21309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 906.562710][T21309] RSP: 002b:00007ffa8c536028 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 [ 906.562734][T21309] RAX: ffffffffffffffda RBX: 00007ffa8e565fa0 RCX: 00007ffa8e2dde59 [ 906.562752][T21309] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000200000000140 [ 906.562767][T21309] RBP: 00007ffa8c536090 R08: 0000000000000000 R09: 0000000000000000 [ 906.562782][T21309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 906.562795][T21309] R13: 00007ffa8e566038 R14: 00007ffa8e565fa0 R15: 00007ffe708eb018 [ 906.562845][T21309] [ 907.993135][T21383] netlink: 1232 bytes leftover after parsing attributes in process `syz.0.6149'. [ 908.165036][T21394] fuse: Bad value for 'fd' [ 908.239133][T21398] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 908.239694][T21398] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 908.431471][T16351] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 908.571928][T16351] usb 1-1: device descriptor read/64, error -71 [ 908.631338][T15649] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 908.784771][T15649] usb 2-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 908.784803][T15649] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 908.789784][T15649] usb 2-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 908.789816][T15649] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 908.789867][T15649] usb 2-1: Product: syz [ 908.789884][T15649] usb 2-1: Manufacturer: syz [ 908.789901][T15649] usb 2-1: SerialNumber: syz [ 908.811492][T16351] usb 1-1: new high-speed USB device number 75 using dummy_hcd [ 908.820860][T15649] usb 2-1: config 0 descriptor?? [ 908.877212][T15649] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 908.951019][T16351] usb 1-1: device descriptor read/64, error -71 [ 908.991311][ T5753] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 909.061375][T16351] usb usb1-port1: attempt power cycle [ 909.073710][T21434] wg0: entered promiscuous mode [ 909.076507][T21434] netlink: 'syz.3.6169': attribute type 1 has an invalid length. [ 909.076528][T21434] netlink: 9 bytes leftover after parsing attributes in process `syz.3.6169'. [ 909.162998][ T5753] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 909.163022][ T5753] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 909.163084][ T5753] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 909.196235][ T5753] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 909.196453][ T5753] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 909.196514][ T5753] usb 3-1: Product: syz [ 909.196694][ T5753] usb 3-1: Manufacturer: syz [ 909.196736][ T5753] usb 3-1: SerialNumber: syz [ 909.276804][T15649] gspca_sunplus: reg_r err -71 [ 909.277030][T15649] sunplus 2-1:0.0: probe with driver sunplus failed with error -71 [ 909.303512][T15649] usb 2-1: USB disconnect, device number 101 [ 909.400550][T16351] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 909.421254][T16351] usb 1-1: device descriptor read/8, error -71 [ 909.485818][T21440] FAULT_INJECTION: forcing a failure. [ 909.485818][T21440] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 909.485853][T21440] CPU: 1 UID: 0 PID: 21440 Comm: syz.3.6172 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 909.485880][T21440] Tainted: [L]=SOFTLOCKUP [ 909.485887][T21440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 909.485900][T21440] Call Trace: [ 909.485907][T21440] [ 909.485916][T21440] dump_stack_lvl+0xe8/0x150 [ 909.485950][T21440] should_fail_ex+0x467/0x600 [ 909.485986][T21440] _copy_to_user+0x31/0xb0 [ 909.486015][T21440] simple_read_from_buffer+0xe1/0x170 [ 909.486054][T21440] proc_fail_nth_read+0x1be/0x230 [ 909.486102][T21440] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 909.486138][T21440] ? rw_verify_area+0x250/0x4d0 [ 909.486156][T21440] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 909.486188][T21440] vfs_read+0x219/0xa90 [ 909.486217][T21440] ? __pfx_vfs_read+0x10/0x10 [ 909.486243][T21440] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 909.486264][T21440] ? lockdep_hardirqs_on+0x7a/0x110 [ 909.486283][T21440] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 909.486312][T21440] ? mutex_lock_nested+0x152/0x1d0 [ 909.486340][T21440] ? fdget_pos+0x252/0x320 [ 909.486382][T21440] ksys_read+0x156/0x270 [ 909.486407][T21440] ? __pfx_ksys_read+0x10/0x10 [ 909.486437][T21440] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 909.486462][T21440] do_syscall_64+0x174/0x580 [ 909.486483][T21440] ? trace_irq_disable+0x3b/0x140 [ 909.486504][T21440] ? clear_bhb_loop+0x40/0x90 [ 909.486531][T21440] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 909.486558][T21440] RIP: 0033:0x7ffa8e29e68e [ 909.486579][T21440] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 909.486600][T21440] RSP: 002b:00007ffa8c535fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 909.486624][T21440] RAX: ffffffffffffffda RBX: 00007ffa8c5366c0 RCX: 00007ffa8e29e68e [ 909.486640][T21440] RDX: 000000000000000f RSI: 00007ffa8c5360a0 RDI: 0000000000000003 [ 909.486654][T21440] RBP: 00007ffa8c536090 R08: 0000000000000000 R09: 0000000000000000 [ 909.486668][T21440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 909.486681][T21440] R13: 00007ffa8e566038 R14: 00007ffa8e565fa0 R15: 00007ffe708eb018 [ 909.486716][T21440] [ 909.487357][ T5753] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 78 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 909.890300][T16351] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 909.896548][T21445] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6174'. [ 909.921872][T16351] usb 1-1: device descriptor read/8, error -71 [ 909.948257][T21450] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6175'. [ 910.034634][T16351] usb usb1-port1: unable to enumerate USB device [ 910.082117][ T5753] usb 3-1: USB disconnect, device number 78 [ 910.233903][ T5753] usblp0: removed [ 910.552187][T21473] FAULT_INJECTION: forcing a failure. [ 910.552187][T21473] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 910.552227][T21473] CPU: 0 UID: 0 PID: 21473 Comm: syz.3.6186 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 910.552259][T21473] Tainted: [L]=SOFTLOCKUP [ 910.552268][T21473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 910.552282][T21473] Call Trace: [ 910.552292][T21473] [ 910.552303][T21473] dump_stack_lvl+0xe8/0x150 [ 910.552337][T21473] should_fail_ex+0x467/0x600 [ 910.552377][T21473] _copy_from_user+0x2d/0xb0 [ 910.552405][T21473] get_itimerspec64+0xaa/0x310 [ 910.552435][T21473] ? __pfx_get_itimerspec64+0x10/0x10 [ 910.552460][T21473] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 910.552484][T21473] ? rt_mutex_slowunlock+0x219/0x460 [ 910.552523][T21473] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 910.552554][T21473] __x64_sys_timer_settime+0x15c/0x270 [ 910.552587][T21473] ? __pfx___x64_sys_timer_settime+0x10/0x10 [ 910.552636][T21473] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 910.552660][T21473] do_syscall_64+0x174/0x580 [ 910.552682][T21473] ? trace_irq_disable+0x3b/0x140 [ 910.552703][T21473] ? clear_bhb_loop+0x40/0x90 [ 910.552735][T21473] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 910.552759][T21473] RIP: 0033:0x7ffa8e2dde59 [ 910.552781][T21473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 910.552801][T21473] RSP: 002b:00007ffa8c536028 EFLAGS: 00000246 ORIG_RAX: 00000000000000df [ 910.552825][T21473] RAX: ffffffffffffffda RBX: 00007ffa8e565fa0 RCX: 00007ffa8e2dde59 [ 910.552842][T21473] RDX: 0000200000000440 RSI: 0000000000000001 RDI: 0000000000000000 [ 910.552857][T21473] RBP: 00007ffa8c536090 R08: 0000000000000000 R09: 0000000000000000 [ 910.552871][T21473] R10: 0000200000000480 R11: 0000000000000246 R12: 0000000000000001 [ 910.552886][T21473] R13: 00007ffa8e566038 R14: 00007ffa8e565fa0 R15: 00007ffe708eb018 [ 910.552920][T21473] [ 911.166438][T21494] befs: (nbd2): No write support. Marking filesystem read-only [ 911.168352][T21494] befs: (nbd2): unable to read superblock [ 911.508388][T21515] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6205'. [ 911.888819][T15649] usb 2-1: new full-speed USB device number 102 using dummy_hcd [ 911.943867][T21537] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6216'. [ 912.023982][T21543] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6218'. [ 912.041827][T15649] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 912.057521][T15649] usb 2-1: New USB device found, idVendor=0572, idProduct=0041, bcdDevice=70.54 [ 912.057555][T15649] usb 2-1: New USB device strings: Mfr=1, Product=34, SerialNumber=7 [ 912.057579][T15649] usb 2-1: Product: syz [ 912.057596][T15649] usb 2-1: Manufacturer: syz [ 912.057613][T15649] usb 2-1: SerialNumber: syz [ 912.082829][T15649] usb 2-1: config 0 descriptor?? [ 912.126471][T15649] gspca_main: conex-2.14.0 probing 0572:0041 [ 912.282613][T21549] fuse: Unknown parameter 'f ' [ 912.477927][T15649] usb 2-1: USB disconnect, device number 102 [ 913.079099][T21584] tipc: Started in network mode [ 913.079118][T21584] tipc: Node identity -, cluster identity 4711 [ 913.255062][T21598] sctp: [Deprecated]: syz.2.6242 (pid 21598) Use of int in max_burst socket option deprecated. [ 913.255062][T21598] Use struct sctp_assoc_value instead [ 914.347917][T13973] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 914.397832][T13973] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 914.404766][T13973] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 914.429157][T13973] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 914.449529][T13973] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 915.495208][ T5753] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 915.645103][ T5753] usb 3-1: device descriptor read/64, error -71 [ 915.904736][ T5753] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 916.036776][ T5753] usb 3-1: device descriptor read/64, error -71 [ 916.147926][ T5753] usb usb3-port1: attempt power cycle [ 916.380800][T18716] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 916.505736][ T5753] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 916.530812][ T5601] Bluetooth: hci4: command tx timeout [ 916.557963][ T5753] usb 3-1: device descriptor read/8, error -71 [ 916.668677][ T11] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 916.701722][T21632] lo speed is unknown, defaulting to 1000 [ 916.794996][ T5753] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 916.816290][ T11] usb 2-1: Using ep0 maxpacket: 16 [ 916.818282][ T5753] usb 3-1: device descriptor read/8, error -71 [ 916.819613][ T11] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 916.819640][ T11] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 916.819667][ T11] usb 2-1: config 0 has no interface number 0 [ 916.889129][ T11] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 916.889164][ T11] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 916.889179][ T11] usb 2-1: Product: syz [ 916.889190][ T11] usb 2-1: Manufacturer: syz [ 916.889201][ T11] usb 2-1: SerialNumber: syz [ 916.936550][ T5753] usb usb3-port1: unable to enumerate USB device [ 916.941197][ T11] usb 2-1: config 0 descriptor?? [ 916.968479][ T11] uvcvideo 2-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 916.968505][ T11] uvcvideo 2-1:0.105: No valid video chain found. [ 917.171201][T16351] usb 2-1: USB disconnect, device number 103 [ 917.338573][T18716] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 917.844965][T18716] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 918.545204][T16351] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 918.559579][T18716] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 918.602639][ T5601] Bluetooth: hci4: command tx timeout [ 918.692435][T16351] usb 1-1: Using ep0 maxpacket: 16 [ 918.696058][T16351] usb 1-1: unable to get BOS descriptor or descriptor too short [ 918.698799][T16351] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 918.698825][T16351] usb 1-1: config 0 has no interfaces? [ 918.735970][T16351] usb 1-1: language id specifier not provided by device, defaulting to English [ 918.749263][T16351] usb 1-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 918.749295][T16351] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 918.749318][T16351] usb 1-1: Product: syz [ 918.749334][T16351] usb 1-1: Manufacturer: 멙ꋽቈ巟㟚鮳ꫝ皸占쟎ᨋ딕२ᮃ♮좑餵죒⯄⽜輧몖鹢퀡䵸უ살ﶻ眾Ⲃࠠ썙翪奈腅綁脖帮抃譝䦜丼찰鳆卾ﯵ䷗际྅怱熋▗↍ꗷ灼앬禝욍ꁪ찻歰꧲ꙕ폯鸡 [ 918.749364][T16351] usb 1-1: SerialNumber: syz [ 918.816051][T16351] usb 1-1: config 0 descriptor?? [ 920.058166][T21796] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 920.059950][T21796] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 920.192278][T21632] bridge0: port 1(bridge_slave_0) entered blocking state [ 920.193894][T21632] bridge0: port 1(bridge_slave_0) entered disabled state [ 920.194172][T21632] bridge_slave_0: entered allmulticast mode [ 920.214271][T21632] bridge_slave_0: entered promiscuous mode [ 920.242431][T15649] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 920.328426][T21632] bridge0: port 2(bridge_slave_1) entered blocking state [ 920.328900][T21632] bridge0: port 2(bridge_slave_1) entered disabled state [ 920.329194][T21632] bridge_slave_1: entered allmulticast mode [ 920.375125][T21632] bridge_slave_1: entered promiscuous mode [ 920.461365][T15649] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 920.461425][T15649] usb 2-1: config 2 interface 0 altsetting 178 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 920.461478][T15649] usb 2-1: config 2 interface 0 has no altsetting 0 [ 920.467074][T15649] usb 2-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 920.467109][T15649] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 920.467133][T15649] usb 2-1: Product: syz [ 920.467150][T15649] usb 2-1: Manufacturer: syz [ 920.467167][T15649] usb 2-1: SerialNumber: syz [ 920.682053][ T5601] Bluetooth: hci4: command tx timeout [ 920.985876][T21806] FAULT_INJECTION: forcing a failure. [ 920.985876][T21806] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 920.985981][T21806] CPU: 0 UID: 0 PID: 21806 Comm: syz.2.6321 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 920.986014][T21806] Tainted: [L]=SOFTLOCKUP [ 920.986023][T21806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 920.986037][T21806] Call Trace: [ 920.986046][T21806] [ 920.986057][T21806] dump_stack_lvl+0xe8/0x150 [ 920.986095][T21806] should_fail_ex+0x467/0x600 [ 920.986135][T21806] _copy_from_iter+0x1d3/0x1660 [ 920.986167][T21806] ? trace_kmem_cache_alloc+0x29/0xe0 [ 920.986202][T21806] ? __pfx__copy_from_iter+0x10/0x10 [ 920.986226][T21806] ? __alloc_skb+0x276/0x7a0 [ 920.986257][T21806] ? __alloc_skb+0x276/0x7a0 [ 920.986294][T21806] ? netlink_sendmsg+0x650/0xb40 [ 920.986317][T21806] ? skb_put+0x112/0x210 [ 920.986353][T21806] netlink_sendmsg+0x6c0/0xb40 [ 920.986386][T21806] ? __pfx_netlink_sendmsg+0x10/0x10 [ 920.986412][T21806] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 920.986449][T21806] ? __pfx_netlink_sendmsg+0x10/0x10 [ 920.986472][T21806] sock_sendmsg_nosec+0x13a/0x180 [ 920.986502][T21806] ____sys_sendmsg+0x565/0x870 [ 920.986549][T21806] ? __pfx_____sys_sendmsg+0x10/0x10 [ 920.986594][T21806] ? import_iovec+0x73/0xa0 [ 920.986624][T21806] ___sys_sendmsg+0x2a5/0x360 [ 920.986659][T21806] ? __lock_acquire+0x6df/0x2e40 [ 920.986687][T21806] ? __pfx____sys_sendmsg+0x10/0x10 [ 920.986756][T21806] ? __fget_files+0x2a/0x420 [ 920.986787][T21806] ? __fget_files+0x3a8/0x420 [ 920.986832][T21806] __x64_sys_sendmsg+0x1b7/0x290 [ 920.986857][T21806] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 920.986898][T21806] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 920.986932][T21806] do_syscall_64+0x174/0x580 [ 920.986959][T21806] ? clear_bhb_loop+0x40/0x90 [ 920.986986][T21806] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 920.987008][T21806] RIP: 0033:0x7f8e18efde59 [ 920.987030][T21806] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 920.987051][T21806] RSP: 002b:00007f8e17156028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 920.987075][T21806] RAX: ffffffffffffffda RBX: 00007f8e19185fa0 RCX: 00007f8e18efde59 [ 920.987092][T21806] RDX: 0000000000048050 RSI: 0000200000000300 RDI: 0000000000000003 [ 920.987108][T21806] RBP: 00007f8e17156090 R08: 0000000000000000 R09: 0000000000000000 [ 920.987122][T21806] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 920.987136][T21806] R13: 00007f8e19186038 R14: 00007f8e19185fa0 R15: 00007ffe90133b08 [ 920.987170][T21806] [ 921.170929][T15649] ims_pcu 2-1:2.0: Missing CDC union descriptor [ 921.171107][T15649] ims_pcu 2-1:2.0: probe with driver ims_pcu failed with error -22 [ 921.224644][T15649] usb 2-1: USB disconnect, device number 104 [ 921.374808][T21632] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 921.562919][ T5601] Bluetooth: hci2: unexpected event for opcode 0x200b [ 921.566510][ T5601] Bluetooth: hci2: unexpected event for opcode 0x200b [ 921.610634][T21632] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 921.813369][T18716] bridge_slave_1: left allmulticast mode [ 921.813407][T18716] bridge_slave_1: left promiscuous mode [ 921.813705][T18716] bridge0: port 2(bridge_slave_1) entered disabled state [ 921.906024][T21825] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6330'. [ 921.919081][T16479] usb 3-1: new full-speed USB device number 83 using dummy_hcd [ 922.008812][T18716] bridge_slave_0: left allmulticast mode [ 922.008852][T18716] bridge_slave_0: left promiscuous mode [ 922.009130][T18716] bridge0: port 1(bridge_slave_0) entered disabled state [ 922.049753][T16479] usb 3-1: device descriptor read/64, error -71 [ 922.300485][T16479] usb 3-1: new full-speed USB device number 84 using dummy_hcd [ 922.490902][T16479] usb 3-1: device descriptor read/64, error -71 [ 922.631825][T16479] usb usb3-port1: attempt power cycle [ 922.759278][ T5601] Bluetooth: hci4: command tx timeout [ 923.045430][T16479] usb 3-1: new full-speed USB device number 85 using dummy_hcd [ 923.061079][T16479] usb 3-1: device descriptor read/8, error -71 [ 923.201604][ T32] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 923.298903][T16479] usb 3-1: new full-speed USB device number 86 using dummy_hcd [ 923.321392][T16479] usb 3-1: device descriptor read/8, error -71 [ 923.348744][ T32] usb 2-1: Using ep0 maxpacket: 32 [ 923.351097][ T32] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 923.351127][ T32] usb 2-1: config 0 has no interface number 0 [ 923.351176][ T32] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 923.392780][ T32] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 923.392815][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.392838][ T32] usb 2-1: Product: syz [ 923.392854][ T32] usb 2-1: Manufacturer: syz [ 923.392871][ T32] usb 2-1: SerialNumber: syz [ 923.431189][T16479] usb usb3-port1: unable to enumerate USB device [ 923.432540][ T32] usb 2-1: config 0 descriptor?? [ 923.434065][T21859] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 923.532598][T18716] (unregistering): (slave bond_slave_0): Releasing backup interface [ 923.562640][T15649] usb 1-1: USB disconnect, device number 78 [ 923.639400][T21856] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 923.658852][T18716] (unregistering): (slave bond_slave_1): Releasing backup interface [ 923.693758][T18716] (unregistering): Released all slaves [ 923.927671][ T32] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 923.927985][ T32] asix 2-1:0.188: probe with driver asix failed with error -71 [ 923.963107][ T32] usb 2-1: USB disconnect, device number 105 [ 924.019788][T21632] team0: Port device team_slave_0 added [ 924.093831][T21632] team0: Port device team_slave_1 added [ 924.333688][T21632] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 924.333705][T21632] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 924.333736][T21632] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 924.337790][T21632] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 924.337808][T21632] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 924.340114][T21632] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 925.232780][T21632] hsr_slave_0: entered promiscuous mode [ 925.235121][T21632] hsr_slave_1: entered promiscuous mode [ 925.249742][T21632] debugfs: 'hsr0' already exists in 'hsr' [ 925.249769][T21632] Cannot create hsr debugfs directory [ 925.307799][ T11] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 925.467641][ T11] usb 2-1: Using ep0 maxpacket: 16 [ 925.470291][ T11] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 925.470388][ T11] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 925.491070][ T11] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 925.491180][ T11] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 925.491260][ T11] usb 2-1: Product: syz [ 925.491319][ T11] usb 2-1: Manufacturer: syz [ 925.491361][ T11] usb 2-1: SerialNumber: syz [ 925.568642][ T11] usb 2-1: config 0 descriptor?? [ 925.605139][ T11] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 925.605177][ T11] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 925.919255][ T5255] 8021q: adding VLAN 0 to HW filter on device eth1 [ 926.024753][T21918] XFS (md0): SB validate failed with error -5. [ 926.223997][ T11] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 926.224823][ T11] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 926.885707][ T11] em28xx 2-1:0.0: Unknown AC97 audio processor detected! [ 926.904894][ T11] em28xx 2-1:0.0: couldn't setup AC97 register 2 [ 926.913943][ T11] em28xx 2-1:0.0: couldn't setup AC97 register 4 [ 926.914428][ T11] em28xx 2-1:0.0: couldn't setup AC97 register 6 [ 926.914835][ T11] em28xx 2-1:0.0: couldn't setup AC97 register 54 [ 926.915249][ T11] em28xx 2-1:0.0: couldn't setup AC97 register 56 [ 926.980147][ T11] usb 2-1: USB disconnect, device number 106 [ 927.890000][T18716] hsr_slave_0: left promiscuous mode [ 927.928820][T18716] hsr_slave_1: left promiscuous mode [ 927.932687][T18716] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 927.932708][T18716] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 927.966733][T18716] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 927.966765][T18716] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 928.065067][T18716] veth1_macvtap: left promiscuous mode [ 928.071626][T18716] veth0_macvtap: left promiscuous mode [ 928.071978][T18716] veth1_vlan: left promiscuous mode [ 928.072217][T18716] veth0_vlan: left promiscuous mode [ 928.395136][ T11] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 928.565013][ T11] usb 2-1: Using ep0 maxpacket: 16 [ 928.567045][ T11] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 928.567091][ T11] usb 2-1: New USB device found, idVendor=16c0, idProduct=05e1, bcdDevice= 0.00 [ 928.567109][ T11] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 928.644723][ T11] usb 2-1: config 0 descriptor?? [ 929.754189][ T11] usbhid 2-1:0.0: can't add hid device: -71 [ 929.754325][ T11] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 929.760571][ T11] usb 2-1: USB disconnect, device number 107 [ 929.775325][T18716] team0 (unregistering): Port device team_slave_1 removed [ 929.855269][T18716] team0 (unregistering): Port device team_slave_0 removed [ 930.343457][ T5255] 8021q: adding VLAN 0 to HW filter on device eth2 [ 930.353104][T22024] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6405'. [ 930.837057][ T11] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 930.913403][T16479] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 931.002100][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.002215][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.055199][ T11] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 931.055236][ T11] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 931.055277][ T11] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 931.055301][ T11] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 931.137759][T16479] usb 3-1: Using ep0 maxpacket: 16 [ 931.141313][T16479] usb 3-1: config 0 has an invalid interface number: 105 but max is 0 [ 931.141341][T16479] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 931.141361][T16479] usb 3-1: config 0 has no interface number 0 [ 931.144363][T16479] usb 3-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 931.144391][T16479] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 931.144413][T16479] usb 3-1: Product: syz [ 931.144427][T16479] usb 3-1: Manufacturer: syz [ 931.144443][T16479] usb 3-1: SerialNumber: syz [ 931.241380][ T11] usb 2-1: config 0 descriptor?? [ 931.255126][T16479] usb 3-1: config 0 descriptor?? [ 931.262829][T16479] uvcvideo 3-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 931.262897][T16479] uvcvideo 3-1:0.105: No valid video chain found. [ 931.465823][T16479] usb 3-1: USB disconnect, device number 87 [ 931.755795][ T11] playstation 0003:054C:0DF2.001C: unknown main item tag 0x0 [ 931.755834][ T11] playstation 0003:054C:0DF2.001C: unknown main item tag 0x0 [ 931.755862][ T11] playstation 0003:054C:0DF2.001C: unknown main item tag 0x0 [ 931.755889][ T11] playstation 0003:054C:0DF2.001C: unknown main item tag 0x0 [ 931.755917][ T11] playstation 0003:054C:0DF2.001C: unknown main item tag 0x0 [ 931.887490][ T11] playstation 0003:054C:0DF2.001C: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.1-1/input0 [ 931.946630][ T11] playstation 0003:054C:0DF2.001C: Failed to retrieve feature with reportID 9: -71 [ 931.946663][ T11] playstation 0003:054C:0DF2.001C: Failed to retrieve DualSense pairing info: -71 [ 931.946716][ T11] playstation 0003:054C:0DF2.001C: Failed to get MAC address from DualSense [ 931.946733][ T11] playstation 0003:054C:0DF2.001C: Failed to create dualsense. [ 931.953369][ T11] playstation 0003:054C:0DF2.001C: probe with driver playstation failed with error -71 [ 932.016342][ T11] usb 2-1: USB disconnect, device number 108 [ 932.105279][T22071] fido_id[22071]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 932.532861][ T5753] usb 3-1: new full-speed USB device number 88 using dummy_hcd [ 932.707319][ T5753] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 932.707352][ T5753] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 932.707374][ T5753] usb 3-1: Product: syz [ 932.707391][ T5753] usb 3-1: Manufacturer: syz [ 932.707408][ T5753] usb 3-1: SerialNumber: syz [ 932.757754][ T5753] usb 3-1: config 0 descriptor?? [ 933.013767][ T5753] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 933.387017][T22097] netlink: 128 bytes leftover after parsing attributes in process `syz.1.6428'. [ 933.397775][T22097] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 933.530597][T22097] comedi comedi3: pcl816: I/O port conflict (0x100,16) [ 934.267735][ T5753] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 934.960853][T16351] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 935.112689][T16351] usb 2-1: Using ep0 maxpacket: 16 [ 935.125934][T16351] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 935.125966][T16351] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 935.125989][T16351] usb 2-1: config 0 has no interface number 0 [ 935.167672][T16351] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 935.167700][T16351] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=21 [ 935.167716][T16351] usb 2-1: Product: syz [ 935.167726][T16351] usb 2-1: Manufacturer: syz [ 935.167737][T16351] usb 2-1: SerialNumber: syz [ 935.214658][T16351] usb 2-1: config 0 descriptor?? [ 935.257454][T16351] uvcvideo 2-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 935.257482][T16351] uvcvideo 2-1:0.105: No valid video chain found. [ 935.415742][ T32] usb 3-1: USB disconnect, device number 88 [ 935.944063][T21632] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 936.034026][T21632] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 936.039268][T21632] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 936.185680][T21632] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 936.194329][T21632] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 936.234281][T16351] usb 2-1: USB disconnect, device number 109 [ 936.284877][T21632] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 936.295125][T21632] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 936.344031][T21632] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 936.926737][T21632] 8021q: adding VLAN 0 to HW filter on device bond0 [ 937.059572][T16479] usb 3-1: new full-speed USB device number 89 using dummy_hcd [ 937.113091][T21632] 8021q: adding VLAN 0 to HW filter on device team0 [ 937.163799][T18716] bridge0: port 1(bridge_slave_0) entered blocking state [ 937.164058][T18716] bridge0: port 1(bridge_slave_0) entered forwarding state [ 937.242542][T16479] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 937.242576][T16479] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 937.242598][T16479] usb 3-1: Product: syz [ 937.242614][T16479] usb 3-1: Manufacturer: syz [ 937.242630][T16479] usb 3-1: SerialNumber: syz [ 937.297132][T16479] usb 3-1: config 0 descriptor?? [ 937.408381][ T147] bridge0: port 2(bridge_slave_1) entered blocking state [ 937.538652][ T147] bridge0: port 2(bridge_slave_1) entered forwarding state [ 937.564179][T16479] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 938.350327][T22110] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 938.867530][T16479] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 938.931087][T22226] netlink: 'syz.1.6456': attribute type 1 has an invalid length. [ 938.931112][T22226] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6456'. [ 939.587204][T22247] comedi comedi3: aio_iiro_16: I/O port conflict (0x100,8) [ 939.612449][T22250] comedi comedi3: aio_iiro_16: I/O port conflict (0x100,8) [ 939.880052][T21632] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 939.965872][T15649] usb 3-1: USB disconnect, device number 89 [ 940.174891][T22268] FAULT_INJECTION: forcing a failure. [ 940.174891][T22268] name failslab, interval 1, probability 0, space 0, times 0 [ 940.174931][T22268] CPU: 1 UID: 0 PID: 22268 Comm: syz.0.6467 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 940.174966][T22268] Tainted: [L]=SOFTLOCKUP [ 940.174975][T22268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 940.174990][T22268] Call Trace: [ 940.175000][T22268] [ 940.175010][T22268] dump_stack_lvl+0xe8/0x150 [ 940.175052][T22268] should_fail_ex+0x467/0x600 [ 940.175108][T22268] should_failslab+0xa8/0x100 [ 940.175145][T22268] __kmalloc_noprof+0xfb/0x790 [ 940.175176][T22268] ? tomoyo_encode+0x2ad/0x570 [ 940.175200][T22268] ? tomoyo_encode+0x2ad/0x570 [ 940.175233][T22268] tomoyo_encode+0x2ad/0x570 [ 940.175264][T22268] tomoyo_realpath_from_path+0x5fa/0x640 [ 940.175301][T22268] ? tomoyo_path_number_perm+0x219/0x5f0 [ 940.175337][T22268] tomoyo_path_number_perm+0x246/0x5f0 [ 940.175374][T22268] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 940.175409][T22268] ? __lock_acquire+0x6df/0x2e40 [ 940.175446][T22268] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 940.175471][T22268] ? lockdep_hardirqs_on+0x7a/0x110 [ 940.175512][T22268] ? __fget_files+0x2a/0x420 [ 940.175550][T22268] ? __fget_files+0x2a/0x420 [ 940.175582][T22268] ? __fget_files+0x3a8/0x420 [ 940.175616][T22268] ? __fget_files+0x2a/0x420 [ 940.175653][T22268] security_file_ioctl+0xb9/0x260 [ 940.175688][T22268] __se_sys_ioctl+0x47/0x170 [ 940.175713][T22268] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 940.175738][T22268] do_syscall_64+0x174/0x580 [ 940.175760][T22268] ? trace_irq_disable+0x3b/0x140 [ 940.175782][T22268] ? clear_bhb_loop+0x40/0x90 [ 940.175811][T22268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 940.175834][T22268] RIP: 0033:0x7f8b67c8de59 [ 940.175854][T22268] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 940.175875][T22268] RSP: 002b:00007f8b65ee6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 940.175898][T22268] RAX: ffffffffffffffda RBX: 00007f8b67f15fa0 RCX: 00007f8b67c8de59 [ 940.175914][T22268] RDX: 00002000000027c0 RSI: 00000000c01864c6 RDI: 0000000000000003 [ 940.175928][T22268] RBP: 00007f8b65ee6090 R08: 0000000000000000 R09: 0000000000000000 [ 940.175942][T22268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 940.175956][T22268] R13: 00007f8b67f16038 R14: 00007f8b67f15fa0 R15: 00007ffdaa658278 [ 940.175989][T22268] [ 940.182477][T22268] ERROR: Out of memory at tomoyo_realpath_from_path. [ 940.490394][T21632] veth0_vlan: entered promiscuous mode [ 940.561151][T21632] veth1_vlan: entered promiscuous mode [ 940.709004][T15649] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 940.784051][T21632] veth0_macvtap: entered promiscuous mode [ 940.831984][T21632] veth1_macvtap: entered promiscuous mode [ 940.838090][T15649] usb 3-1: device descriptor read/64, error -71 [ 940.960186][T21632] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 941.097115][T15649] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 941.112810][T21632] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 941.162020][T18712] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.165264][T18712] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.205544][T18712] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.207318][T18712] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.217325][ T5599] usb 2-1: new full-speed USB device number 110 using dummy_hcd [ 941.256978][T15649] usb 3-1: device descriptor read/64, error -71 [ 941.388102][ T5599] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 941.388137][ T5599] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 941.388158][ T5599] usb 2-1: Product: syz [ 941.388172][ T5599] usb 2-1: Manufacturer: syz [ 941.388185][ T5599] usb 2-1: SerialNumber: syz [ 941.431318][ T5599] usb 2-1: config 0 descriptor?? [ 941.470633][T15649] usb usb3-port1: attempt power cycle [ 941.677659][ T5599] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 941.898824][T15649] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 941.951140][T15649] usb 3-1: device descriptor read/8, error -71 [ 942.227699][T15649] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 942.257289][T15649] usb 3-1: device descriptor read/8, error -71 [ 942.378281][T15649] usb usb3-port1: unable to enumerate USB device [ 943.133363][ T5599] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 943.505119][T18716] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 943.505141][T18716] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 943.620148][ T2397] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 943.620171][ T2397] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 944.005473][ T5753] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 944.026022][T22319] FAULT_INJECTION: forcing a failure. [ 944.026022][T22319] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 944.026063][T22319] CPU: 0 UID: 0 PID: 22319 Comm: syz.0.6487 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 944.026095][T22319] Tainted: [L]=SOFTLOCKUP [ 944.026103][T22319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 944.026116][T22319] Call Trace: [ 944.026125][T22319] [ 944.026135][T22319] dump_stack_lvl+0xe8/0x150 [ 944.026171][T22319] should_fail_ex+0x467/0x600 [ 944.026209][T22319] _copy_from_iter+0x1d3/0x1660 [ 944.026234][T22319] ? trace_kmem_cache_alloc+0x29/0xe0 [ 944.026272][T22319] ? __pfx__copy_from_iter+0x10/0x10 [ 944.026289][T22319] ? __alloc_skb+0x276/0x7a0 [ 944.026314][T22319] ? __alloc_skb+0x276/0x7a0 [ 944.026341][T22319] ? netlink_sendmsg+0x650/0xb40 [ 944.026365][T22319] ? skb_put+0x112/0x210 [ 944.026395][T22319] netlink_sendmsg+0x6c0/0xb40 [ 944.026419][T22319] ? __pfx_netlink_sendmsg+0x10/0x10 [ 944.026438][T22319] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 944.026466][T22319] ? __kernel_text_address+0xd/0x30 [ 944.026494][T22319] ? unwind_get_return_address+0x4d/0x90 [ 944.026514][T22319] ? __pfx_netlink_sendmsg+0x10/0x10 [ 944.026531][T22319] sock_sendmsg_nosec+0x13a/0x180 [ 944.026556][T22319] ____sys_sendmsg+0x565/0x870 [ 944.026591][T22319] ? __pfx_____sys_sendmsg+0x10/0x10 [ 944.026626][T22319] ? import_iovec+0x73/0xa0 [ 944.026650][T22319] ___sys_sendmsg+0x2a5/0x360 [ 944.026678][T22319] ? __lock_acquire+0x6df/0x2e40 [ 944.026698][T22319] ? __pfx____sys_sendmsg+0x10/0x10 [ 944.026755][T22319] ? __fget_files+0x2a/0x420 [ 944.026782][T22319] ? __fget_files+0x3a8/0x420 [ 944.026817][T22319] __x64_sys_sendmsg+0x1b7/0x290 [ 944.026837][T22319] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 944.026868][T22319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 944.026888][T22319] do_syscall_64+0x174/0x580 [ 944.026906][T22319] ? trace_irq_disable+0x3b/0x140 [ 944.026923][T22319] ? clear_bhb_loop+0x40/0x90 [ 944.026946][T22319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 944.026964][T22319] RIP: 0033:0x7f8b67c8de59 [ 944.026982][T22319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 944.026998][T22319] RSP: 002b:00007f8b65ee6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 944.027018][T22319] RAX: ffffffffffffffda RBX: 00007f8b67f15fa0 RCX: 00007f8b67c8de59 [ 944.027031][T22319] RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000000000000003 [ 944.027043][T22319] RBP: 00007f8b65ee6090 R08: 0000000000000000 R09: 0000000000000000 [ 944.027054][T22319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 944.027071][T22319] R13: 00007f8b67f16038 R14: 00007f8b67f15fa0 R15: 00007ffdaa658278 [ 944.027098][T22319] [ 944.185494][ T5753] usb 3-1: Using ep0 maxpacket: 16 [ 944.338755][ T5753] usb 3-1: config 0 has an invalid interface number: 105 but max is 0 [ 944.338788][ T5753] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 944.338810][ T5753] usb 3-1: config 0 has no interface number 0 [ 944.358915][ T5753] usb 3-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 944.358950][ T5753] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 944.358972][ T5753] usb 3-1: Product: syz [ 944.358988][ T5753] usb 3-1: Manufacturer: syz [ 944.359004][ T5753] usb 3-1: SerialNumber: syz [ 944.423146][ T5753] usb 3-1: config 0 descriptor?? [ 944.440090][ T32] usb 2-1: USB disconnect, device number 110 [ 944.461754][ T5753] uvcvideo 3-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 944.461791][ T5753] uvcvideo 3-1:0.105: No valid video chain found. [ 944.629533][T16351] usb 3-1: USB disconnect, device number 94 [ 944.845095][ T32] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 945.227826][ T32] usb 2-1: device descriptor read/64, error -71 [ 945.465217][ T32] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 945.705963][ T32] usb 2-1: device descriptor read/64, error -71 [ 945.813783][T13973] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 945.863999][ T32] usb usb2-port1: attempt power cycle [ 945.882700][T13973] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 945.898134][T13973] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 945.902196][T13973] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 945.903014][T13973] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 945.977483][T17639] : (slave syz_tun): Releasing backup interface [ 946.224298][ T32] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 946.250586][ T32] usb 2-1: device descriptor read/8, error -71 [ 946.490288][ T32] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 946.509876][ T32] usb 2-1: device descriptor read/8, error -71 [ 946.614524][ T32] usb usb2-port1: unable to enumerate USB device [ 947.646112][T22354] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6497'. [ 948.023436][ T5601] Bluetooth: hci0: command tx timeout [ 948.065377][T18716] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 948.849370][T18716] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 948.911834][T22371] netlink: 128 bytes leftover after parsing attributes in process `syz.1.6502'. [ 948.912412][T22371] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 948.974169][T22334] lo speed is unknown, defaulting to 1000 [ 949.750254][T18716] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 949.896480][T16351] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 950.033141][T16351] usb 4-1: device descriptor read/64, error -71 [ 950.104542][ T5601] Bluetooth: hci0: command tx timeout [ 950.272198][T16351] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 950.464678][T16351] usb 4-1: device descriptor read/64, error -71 [ 950.497106][T18716] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 950.572353][T16351] usb usb4-port1: attempt power cycle [ 950.921884][T16351] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 950.947155][T16351] usb 4-1: device descriptor read/8, error -71 [ 951.211904][T16351] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 951.232628][T16351] usb 4-1: device descriptor read/8, error -71 [ 951.342250][T16351] usb usb4-port1: unable to enumerate USB device [ 951.538025][T22417] support for cryptoloop has been removed. Use dm-crypt instead. [ 952.188746][ T5601] Bluetooth: hci0: command tx timeout [ 952.367398][T22334] bridge0: port 1(bridge_slave_0) entered blocking state [ 952.367752][T22334] bridge0: port 1(bridge_slave_0) entered disabled state [ 952.368427][T22334] bridge_slave_0: entered allmulticast mode [ 952.410365][T22334] bridge_slave_0: entered promiscuous mode [ 952.558712][T22334] bridge0: port 2(bridge_slave_1) entered blocking state [ 952.560667][T22334] bridge0: port 2(bridge_slave_1) entered disabled state [ 952.564630][T22334] bridge_slave_1: entered allmulticast mode [ 952.592942][T22334] bridge_slave_1: entered promiscuous mode [ 952.621373][T16351] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 952.776017][T16351] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 952.776071][T16351] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 952.776098][T16351] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 952.849344][T16351] usb 3-1: config 0 descriptor?? [ 953.084527][T16351] usbhid 3-1:0.0: can't add hid device: -71 [ 953.084674][T16351] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 953.122148][T16351] usb 3-1: USB disconnect, device number 95 [ 953.322359][T22334] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 953.351851][T22334] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 953.493588][T18716] bridge_slave_1: left allmulticast mode [ 953.493624][T18716] bridge_slave_1: left promiscuous mode [ 953.495117][T18716] bridge0: port 2(bridge_slave_1) entered disabled state [ 953.597227][T16351] usb 3-1: new full-speed USB device number 96 using dummy_hcd [ 953.676595][T22375] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 953.813370][T16351] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 953.813424][T16351] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 953.813450][T16351] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 953.816931][T18716] bridge_slave_0: left allmulticast mode [ 953.816965][T18716] bridge_slave_0: left promiscuous mode [ 953.817242][T18716] bridge0: port 1(bridge_slave_0) entered disabled state [ 953.853832][T16351] usb 3-1: config 0 descriptor?? [ 954.260362][ T5601] Bluetooth: hci0: command tx timeout [ 954.717348][ T5601] Bluetooth: hci3: unexpected event for opcode 0x0c47 [ 954.726474][T16351] aiptek 3-1:0.0: Aiptek using 400 ms programming speed [ 954.737888][T16351] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input65 [ 955.242028][ C1] aiptek 3-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 955.242082][T16351] usb 3-1: USB disconnect, device number 96 [ 956.060627][T18716] (unregistering): (slave bond_slave_0): Releasing backup interface [ 956.140063][T18716] (unregistering): (slave bond_slave_1): Releasing backup interface [ 956.182277][T18716] (unregistering): Released all slaves [ 956.337069][T22471] syzkaller1: entered promiscuous mode [ 956.337095][T22471] syzkaller1: entered allmulticast mode [ 956.838448][T22334] team0: Port device team_slave_0 added [ 956.854009][T22334] team0: Port device team_slave_1 added [ 956.938103][T22484] netlink: 128 bytes leftover after parsing attributes in process `syz.1.6541'. [ 956.938763][T22484] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 956.969075][T16479] usb 4-1: new full-speed USB device number 25 using dummy_hcd [ 957.122835][T16479] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 957.122868][T16479] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 957.122896][T16479] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 957.122926][T16479] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 957.122950][T16479] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 957.226658][T22334] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 957.226678][T22334] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 957.226710][T22334] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 957.228235][T16479] usb 4-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 957.228263][T16479] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 957.228282][T16479] usb 4-1: Product: syz [ 957.228297][T16479] usb 4-1: Manufacturer: syz [ 957.228321][T16479] usb 4-1: SerialNumber: syz [ 957.312138][T18716] IPVS: stopping master sync thread 18536 ... [ 957.315949][T16479] usb 4-1: config 0 descriptor?? [ 957.421219][T16479] input: KB Gear Tablet as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input66 [ 957.467881][T22334] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 957.467899][T22334] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 957.467930][T22334] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 957.521616][T22480] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 957.650039][T16479] input: failed to attach handler mousedev to device input66, error: -5 [ 957.925654][T20411] usb 4-1: USB disconnect, device number 25 [ 958.255238][T22498] syzkaller1: entered promiscuous mode [ 958.255268][T22498] syzkaller1: entered allmulticast mode [ 958.301111][T22506] vxcan0: tx drop: invalid da for name 0x0000008000000000 [ 958.960555][T22524] FAULT_INJECTION: forcing a failure. [ 958.960555][T22524] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 958.960595][T22524] CPU: 1 UID: 0 PID: 22524 Comm: syz.2.6552 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 958.960673][T22524] Tainted: [L]=SOFTLOCKUP [ 958.960682][T22524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 958.960730][T22524] Call Trace: [ 958.960740][T22524] [ 958.960750][T22524] dump_stack_lvl+0xe8/0x150 [ 958.960794][T22524] should_fail_ex+0x467/0x600 [ 958.960837][T22524] _copy_from_user+0x2d/0xb0 [ 958.960870][T22524] ucma_write+0x166/0x2f0 [ 958.960906][T22524] ? __pfx_ucma_write+0x10/0x10 [ 958.960936][T22524] ? security_file_permission+0x68/0x220 [ 958.960975][T22524] ? rw_verify_area+0x209/0x4d0 [ 958.961003][T22524] vfs_writev+0x4c4/0x990 [ 958.961034][T22524] ? __pfx_ucma_write+0x10/0x10 [ 958.961070][T22524] ? __pfx_vfs_writev+0x10/0x10 [ 958.961115][T22524] ? __fget_files+0x2a/0x420 [ 958.961156][T22524] ? __fget_files+0x3a8/0x420 [ 958.961189][T22524] ? __fget_files+0x2a/0x420 [ 958.961234][T22524] do_writev+0x15a/0x2e0 [ 958.961267][T22524] ? __pfx_do_writev+0x10/0x10 [ 958.961306][T22524] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 958.961332][T22524] do_syscall_64+0x174/0x580 [ 958.961356][T22524] ? trace_irq_disable+0x3b/0x140 [ 958.961383][T22524] ? clear_bhb_loop+0x40/0x90 [ 958.961413][T22524] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 958.961437][T22524] RIP: 0033:0x7f8e18efde59 [ 958.961460][T22524] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 958.961479][T22524] RSP: 002b:00007f8e17135028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 958.961503][T22524] RAX: ffffffffffffffda RBX: 00007f8e19186090 RCX: 00007f8e18efde59 [ 958.961520][T22524] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000008 [ 958.961535][T22524] RBP: 00007f8e17135090 R08: 0000000000000000 R09: 0000000000000000 [ 958.961549][T22524] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 958.961562][T22524] R13: 00007f8e19186128 R14: 00007f8e19186090 R15: 00007ffe90133b08 [ 958.961596][T22524] [ 959.284621][T22334] hsr_slave_0: entered promiscuous mode [ 959.297796][T22334] hsr_slave_1: entered promiscuous mode [ 959.315668][T22334] debugfs: 'hsr0' already exists in 'hsr' [ 959.315698][T22334] Cannot create hsr debugfs directory [ 959.472130][T22529] netlink: 128 bytes leftover after parsing attributes in process `syz.3.6554'. [ 959.472632][T22529] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 959.508629][T22519] lo speed is unknown, defaulting to 1000 [ 959.994877][ T5255] 8021q: adding VLAN 0 to HW filter on device eth1 [ 960.045260][T22525] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 961.538315][T22583] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6565'. [ 961.816487][ T5255] 8021q: adding VLAN 0 to HW filter on device eth2 [ 961.965592][T18716] hsr_slave_0: left promiscuous mode [ 961.997045][T18716] hsr_slave_1: left promiscuous mode [ 961.998229][T18716] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 961.998257][T18716] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 962.045339][T18716] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 962.045375][T18716] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 962.191610][T18716] veth1_macvtap: left promiscuous mode [ 962.191689][T18716] veth0_macvtap: left promiscuous mode [ 962.191959][T18716] veth1_vlan: left promiscuous mode [ 962.192103][T18716] veth0_vlan: left promiscuous mode [ 962.808994][T22592] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 963.298375][T18716] team0 (unregistering): Port device team_slave_1 removed [ 963.359482][T18716] team0 (unregistering): Port device team_slave_0 removed [ 963.812294][T22597] netlink: 128 bytes leftover after parsing attributes in process `syz.3.6568'. [ 963.812866][T22597] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 964.297866][T22620] comedi comedi3: comedi_config --init_data is deprecated [ 966.228313][T22654] netlink: 128 bytes leftover after parsing attributes in process `syz.1.6582'. [ 966.228914][T22654] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 966.871099][T22648] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 966.967460][T22678] fuse: Bad value for 'fd' [ 967.318224][T22334] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 967.352059][T22334] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 967.446093][T22334] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 967.700946][T22334] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 967.725965][T22334] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 967.827341][T22700] FAULT_INJECTION: forcing a failure. [ 967.827341][T22700] name failslab, interval 1, probability 0, space 0, times 0 [ 967.827380][T22700] CPU: 0 UID: 0 PID: 22700 Comm: syz.2.6589 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 967.827411][T22700] Tainted: [L]=SOFTLOCKUP [ 967.827420][T22700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 967.827434][T22700] Call Trace: [ 967.827443][T22700] [ 967.827453][T22700] dump_stack_lvl+0xe8/0x150 [ 967.827487][T22700] should_fail_ex+0x467/0x600 [ 967.827527][T22700] should_failslab+0xa8/0x100 [ 967.827561][T22700] ? do_getname+0x2e/0x250 [ 967.827591][T22700] kmem_cache_alloc_noprof+0x9e/0x680 [ 967.827626][T22700] ? get_pid_task+0x20/0x1f0 [ 967.827654][T22700] ? get_pid_task+0x20/0x1f0 [ 967.827683][T22700] ? do_getname+0x2e/0x250 [ 967.827717][T22700] do_getname+0x2e/0x250 [ 967.827745][T22700] ? getname_flags+0x11/0x20 [ 967.827785][T22700] user_statfs+0x97/0x1c0 [ 967.827820][T22700] ? __pfx_user_statfs+0x10/0x10 [ 967.827863][T22700] __x64_sys_statfs+0x120/0x270 [ 967.827895][T22700] ? __pfx___x64_sys_statfs+0x10/0x10 [ 967.827925][T22700] ? rt_mutex_slowunlock+0x219/0x460 [ 967.827957][T22700] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 967.827982][T22700] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 967.828045][T22700] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 967.828070][T22700] do_syscall_64+0x174/0x580 [ 967.828092][T22700] ? trace_irq_disable+0x3b/0x140 [ 967.828115][T22700] ? clear_bhb_loop+0x40/0x90 [ 967.828147][T22700] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 967.828170][T22700] RIP: 0033:0x7f8e18efde59 [ 967.828192][T22700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 967.828212][T22700] RSP: 002b:00007f8e17156028 EFLAGS: 00000246 ORIG_RAX: 0000000000000089 [ 967.828236][T22700] RAX: ffffffffffffffda RBX: 00007f8e19185fa0 RCX: 00007f8e18efde59 [ 967.828253][T22700] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000680 [ 967.828268][T22700] RBP: 00007f8e17156090 R08: 0000000000000000 R09: 0000000000000000 [ 967.828284][T22700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 967.828298][T22700] R13: 00007f8e19186038 R14: 00007f8e19185fa0 R15: 00007ffe90133b08 [ 967.828333][T22700] [ 968.123324][T22334] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 968.128660][T22334] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 968.191053][T22334] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 968.434867][ T32] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 968.588946][ T32] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 968.588986][ T32] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 968.589002][ T32] usb 4-1: Product: syz [ 968.589013][ T32] usb 4-1: SerialNumber: syz [ 968.594832][T16351] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 968.624040][ T32] usb 4-1: config 0 descriptor?? [ 968.744787][T16351] usb 3-1: Using ep0 maxpacket: 16 [ 968.760664][T16351] usb 3-1: unable to get BOS descriptor or descriptor too short [ 968.763950][T16351] usb 3-1: config 7 has an invalid interface number: 116 but max is 2 [ 968.763979][T16351] usb 3-1: config 7 has an invalid interface number: 237 but max is 2 [ 968.764001][T16351] usb 3-1: config 7 has an invalid interface number: 4 but max is 2 [ 968.767843][T16351] usb 3-1: config 7 has no interface number 0 [ 968.767901][T16351] usb 3-1: config 7 has no interface number 1 [ 968.768109][T16351] usb 3-1: config 7 has no interface number 2 [ 968.768796][T16351] usb 3-1: config 7 interface 116 has no altsetting 0 [ 968.769006][T16351] usb 3-1: config 7 interface 237 has no altsetting 0 [ 968.769061][T16351] usb 3-1: config 7 interface 4 has no altsetting 0 [ 968.846751][T16351] usb 3-1: New USB device found, idVendor=1199, idProduct=9003, bcdDevice=45.be [ 968.846775][T16351] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 968.846790][T16351] usb 3-1: Product: syz [ 968.846801][T16351] usb 3-1: Manufacturer: syz [ 968.846812][T16351] usb 3-1: SerialNumber: syz [ 968.938286][T22727] netlink: 128 bytes leftover after parsing attributes in process `syz.1.6595'. [ 968.938912][T22727] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 969.357297][T16351] usb 3-1: selecting invalid altsetting 0 [ 969.357320][T16351] usb 3-1: Could not set interface, error -22 [ 969.401283][T16351] usb 3-1: USB disconnect, device number 97 [ 969.427595][T22334] 8021q: adding VLAN 0 to HW filter on device bond0 [ 969.591706][T22334] 8021q: adding VLAN 0 to HW filter on device team0 [ 969.624925][T18712] bridge0: port 1(bridge_slave_0) entered blocking state [ 969.625100][T18712] bridge0: port 1(bridge_slave_0) entered forwarding state [ 969.704394][T18712] bridge0: port 2(bridge_slave_1) entered blocking state [ 969.704577][T18712] bridge0: port 2(bridge_slave_1) entered forwarding state [ 970.583612][T16351] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 970.770388][T16351] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 970.770426][T16351] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 970.770456][T16351] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 970.819490][T16351] usb 3-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 970.819520][T16351] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 970.819538][T16351] usb 3-1: Product: syz [ 970.819551][T16351] usb 3-1: Manufacturer: syz [ 970.819564][T16351] usb 3-1: SerialNumber: syz [ 970.864605][T16351] usb 3-1: config 0 descriptor?? [ 970.896135][ T5753] usb 4-1: USB disconnect, device number 26 [ 971.602142][T22334] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 971.797055][T22781] comedi comedi3: pcl818: I/O port conflict (0x100,16) [ 972.135510][T22788] netlink: 128 bytes leftover after parsing attributes in process `syz.3.6604'. [ 972.136100][T22788] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 972.261701][T22334] veth0_vlan: entered promiscuous mode [ 972.427419][T22334] veth1_vlan: entered promiscuous mode [ 972.883951][T22334] veth0_macvtap: entered promiscuous mode [ 973.023919][T22334] veth1_macvtap: entered promiscuous mode [ 973.187581][T22334] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 973.276808][T22334] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 973.499497][ T2397] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 973.543643][ T2397] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 973.556876][ T2397] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 973.597865][ T2397] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 973.787096][T22812] FAULT_INJECTION: forcing a failure. [ 973.787096][T22812] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 973.787133][T22812] CPU: 1 UID: 0 PID: 22812 Comm: syz.1.6611 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 973.787163][T22812] Tainted: [L]=SOFTLOCKUP [ 973.787171][T22812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 973.787183][T22812] Call Trace: [ 973.787190][T22812] [ 973.787200][T22812] dump_stack_lvl+0xe8/0x150 [ 973.787232][T22812] should_fail_ex+0x467/0x600 [ 973.787270][T22812] _copy_from_user+0x2d/0xb0 [ 973.787297][T22812] do_sock_getsockopt+0x200/0x7e0 [ 973.787337][T22812] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 973.787379][T22812] ? __fget_files+0x3a8/0x420 [ 973.787408][T22812] ? __fget_files+0x2a/0x420 [ 973.787442][T22812] __x64_sys_getsockopt+0x1aa/0x250 [ 973.787477][T22812] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 973.787499][T22812] do_syscall_64+0x174/0x580 [ 973.787520][T22812] ? trace_irq_disable+0x3b/0x140 [ 973.787539][T22812] ? clear_bhb_loop+0x40/0x90 [ 973.787563][T22812] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 973.787583][T22812] RIP: 0033:0x7f8a7471de59 [ 973.787602][T22812] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 973.787628][T22812] RSP: 002b:00007f8a72976028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 973.787650][T22812] RAX: ffffffffffffffda RBX: 00007f8a749a5fa0 RCX: 00007f8a7471de59 [ 973.787665][T22812] RDX: 0000000000000014 RSI: 0000000000000084 RDI: 0000000000000003 [ 973.787678][T22812] RBP: 00007f8a72976090 R08: 0000200000000040 R09: 0000000000000000 [ 973.787693][T22812] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 973.787705][T22812] R13: 00007f8a749a6038 R14: 00007f8a749a5fa0 R15: 00007ffc36823f38 [ 973.787732][T22812] [ 975.043370][T22818] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6614'. [ 975.264547][T15649] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 975.542431][T15649] usb 2-1: Using ep0 maxpacket: 16 [ 975.545018][T15649] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 975.545047][T15649] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 975.545078][T15649] usb 2-1: config 0 has no interface number 0 [ 975.547861][T15649] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 975.547887][T15649] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 975.547907][T15649] usb 2-1: Product: syz [ 975.547921][T15649] usb 2-1: Manufacturer: syz [ 975.547936][T15649] usb 2-1: SerialNumber: syz [ 975.565857][T15649] usb 2-1: config 0 descriptor?? [ 975.592280][T15649] uvcvideo 2-1:0.105: Found UVC 0.00 device syz (046d:08f3) [ 975.592324][T15649] uvcvideo 2-1:0.105: No valid video chain found. [ 975.835471][ T9] usb 2-1: USB disconnect, device number 115 [ 976.140627][ T166] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 976.140648][ T166] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 976.253604][T22829] Bluetooth: MGMT ver 1.23 [ 976.435386][T18715] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 976.435411][T18715] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 976.785196][T22836] FAULT_INJECTION: forcing a failure. [ 976.785196][T22836] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 976.785240][T22836] CPU: 0 UID: 0 PID: 22836 Comm: syz.3.6620 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 976.785271][T22836] Tainted: [L]=SOFTLOCKUP [ 976.785279][T22836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 976.785292][T22836] Call Trace: [ 976.785302][T22836] [ 976.785311][T22836] dump_stack_lvl+0xe8/0x150 [ 976.785346][T22836] should_fail_ex+0x467/0x600 [ 976.785389][T22836] _copy_from_user+0x2d/0xb0 [ 976.785416][T22836] __sys_bind+0x1cc/0x410 [ 976.785449][T22836] ? __pfx___sys_bind+0x10/0x10 [ 976.785492][T22836] ? __pfx_ksys_write+0x10/0x10 [ 976.785520][T22836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 976.785562][T22836] __x64_sys_bind+0x7a/0x90 [ 976.785595][T22836] do_syscall_64+0x174/0x580 [ 976.785633][T22836] ? trace_irq_disable+0x3b/0x140 [ 976.785655][T22836] ? clear_bhb_loop+0x40/0x90 [ 976.785683][T22836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 976.785706][T22836] RIP: 0033:0x7f4b06dfde59 [ 976.785727][T22836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 976.785747][T22836] RSP: 002b:00007f4b05056028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 976.785770][T22836] RAX: ffffffffffffffda RBX: 00007f4b07085fa0 RCX: 00007f4b06dfde59 [ 976.785787][T22836] RDX: 0000000000000012 RSI: 0000200000000400 RDI: 0000000000000004 [ 976.785802][T22836] RBP: 00007f4b05056090 R08: 0000000000000000 R09: 0000000000000000 [ 976.785844][T22836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 976.785858][T22836] R13: 00007f4b07086038 R14: 00007f4b07085fa0 R15: 00007ffebd85d018 [ 976.785893][T22836] [ 977.613345][ T32] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 977.761489][ T32] usb 1-1: Using ep0 maxpacket: 16 [ 977.766508][ T32] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 977.766652][ T32] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 977.766695][ T32] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 977.766722][ T32] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 977.839763][ T32] usb 1-1: config 0 descriptor?? [ 977.955472][T22735] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 978.101059][T22857] binder: 22856:22857 ioctl 4004af61 200000000080 returned -22 [ 978.175333][T22847] macsec0: entered promiscuous mode [ 978.493437][T22847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 978.507036][T22847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 978.526009][T22846] macsec0: left promiscuous mode [ 978.738205][ T32] usbhid 1-1:0.0: can't add hid device: -71 [ 978.738419][ T32] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 978.806360][ T32] usb 1-1: USB disconnect, device number 79 [ 978.855895][T22877] 9p: Unknown access argument 18446744073709551615: -34 [ 978.973852][T22879] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 980.714763][T22887] syz.3.6638 (22887) used greatest stack depth: 18008 bytes left [ 980.911423][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88805cab4c00: rx timeout, send abort [ 981.135771][T22907] netlink: 128 bytes leftover after parsing attributes in process `syz.3.6645'. [ 981.136321][T22907] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 981.413825][ C1] vxcan1: j1939_tp_rxtimer: 0xffff88805cab4c00: abort rx timeout. Force session deactivation [ 981.756648][T22933] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 982.391062][T22941] FAULT_INJECTION: forcing a failure. [ 982.391062][T22941] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 982.391103][T22941] CPU: 0 UID: 0 PID: 22941 Comm: syz.3.6658 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 982.391133][T22941] Tainted: [L]=SOFTLOCKUP [ 982.391142][T22941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 982.391157][T22941] Call Trace: [ 982.391166][T22941] [ 982.391177][T22941] dump_stack_lvl+0xe8/0x150 [ 982.391211][T22941] should_fail_ex+0x467/0x600 [ 982.391251][T22941] _copy_from_iter+0x1d3/0x1660 [ 982.391282][T22941] ? trace_kmem_cache_alloc+0x29/0xe0 [ 982.391316][T22941] ? __pfx__copy_from_iter+0x10/0x10 [ 982.391338][T22941] ? __alloc_skb+0x276/0x7a0 [ 982.391368][T22941] ? __alloc_skb+0x276/0x7a0 [ 982.391410][T22941] ? netlink_sendmsg+0x650/0xb40 [ 982.391432][T22941] ? skb_put+0x112/0x210 [ 982.391469][T22941] netlink_sendmsg+0x6c0/0xb40 [ 982.391501][T22941] ? __pfx_netlink_sendmsg+0x10/0x10 [ 982.391527][T22941] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 982.391558][T22941] ? __kernel_text_address+0xd/0x30 [ 982.391590][T22941] ? unwind_get_return_address+0x4d/0x90 [ 982.391616][T22941] ? __pfx_netlink_sendmsg+0x10/0x10 [ 982.391649][T22941] sock_sendmsg_nosec+0x13a/0x180 [ 982.391678][T22941] ____sys_sendmsg+0x565/0x870 [ 982.391720][T22941] ? __pfx_____sys_sendmsg+0x10/0x10 [ 982.391772][T22941] ? import_iovec+0x73/0xa0 [ 982.391802][T22941] ___sys_sendmsg+0x2a5/0x360 [ 982.391833][T22941] ? __lock_acquire+0x6df/0x2e40 [ 982.391856][T22941] ? __pfx____sys_sendmsg+0x10/0x10 [ 982.391951][T22941] ? __fget_files+0x2a/0x420 [ 982.391985][T22941] ? __fget_files+0x3a8/0x420 [ 982.392027][T22941] __x64_sys_sendmsg+0x1b7/0x290 [ 982.392050][T22941] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 982.392088][T22941] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 982.392125][T22941] do_syscall_64+0x174/0x580 [ 982.392149][T22941] ? trace_irq_disable+0x3b/0x140 [ 982.392171][T22941] ? clear_bhb_loop+0x40/0x90 [ 982.392199][T22941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 982.392223][T22941] RIP: 0033:0x7f4b06dfde59 [ 982.392245][T22941] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 982.392262][T22941] RSP: 002b:00007f4b05056028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 982.392289][T22941] RAX: ffffffffffffffda RBX: 00007f4b07085fa0 RCX: 00007f4b06dfde59 [ 982.392301][T22941] RDX: 0000000000000000 RSI: 0000200000003b80 RDI: 0000000000000003 [ 982.392312][T22941] RBP: 00007f4b05056090 R08: 0000000000000000 R09: 0000000000000000 [ 982.392340][T22941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 982.392372][T22941] R13: 00007f4b07086038 R14: 00007f4b07085fa0 R15: 00007ffebd85d018 [ 982.392406][T22941] [ 982.419078][ T9] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 982.670548][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 982.670616][ T9] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 982.670642][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 982.720183][T22945] trusted_key: encrypted_key: hex blob is missing [ 982.721015][ T9] usb 1-1: config 0 descriptor?? [ 982.994370][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 982.994504][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 983.019182][ T9] usb 1-1: USB disconnect, device number 80 [ 983.508786][T22966] netlink: 128 bytes leftover after parsing attributes in process `syz.2.6666'. [ 983.546510][T22966] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 983.559422][ T9] usb 1-1: new full-speed USB device number 81 using dummy_hcd [ 983.742345][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 983.742418][ T9] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 983.742444][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 983.769027][ T9] usb 1-1: config 0 descriptor?? [ 984.057512][ T9] aiptek 1-1:0.0: Aiptek using 400 ms programming speed [ 984.068112][ T9] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input68 [ 984.207213][T22960] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 984.307184][ T9] usb 1-1: USB disconnect, device number 81 [ 984.307281][ C0] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 985.652971][T22997] netlink: 119 bytes leftover after parsing attributes in process `syz.1.6674'. [ 985.685126][T22995] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6676'. [ 986.287503][T23015] netlink: 128 bytes leftover after parsing attributes in process `syz.1.6680'. [ 986.288116][T23015] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 986.898072][T23012] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 986.979968][ T5709] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 987.048426][ T9] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 987.148316][ T5709] usb 4-1: Using ep0 maxpacket: 32 [ 987.150960][ T5709] usb 4-1: config 0 has an invalid interface number: 146 but max is 0 [ 987.150990][ T5709] usb 4-1: config 0 has no interface number 0 [ 987.151047][ T5709] usb 4-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 987.151073][ T5709] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 987.151102][ T5709] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 987.151131][ T5709] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 987.151157][ T5709] usb 4-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 987.151184][ T5709] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 987.151208][ T5709] usb 4-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 987.151235][ T5709] usb 4-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 12408, setting to 64 [ 987.151263][ T5709] usb 4-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 987.154736][ T5709] usb 4-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 987.154783][ T5709] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 987.154807][ T5709] usb 4-1: Product: syz [ 987.154824][ T5709] usb 4-1: Manufacturer: syz [ 987.154840][ T5709] usb 4-1: SerialNumber: syz [ 987.165240][ T5709] usb 4-1: config 0 descriptor?? [ 987.221351][T23031] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 987.224479][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 987.224642][ T9] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 987.224669][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 987.242405][ T5709] usb 4-1: can only deal with bulk endpoints; endpoint 1 is not bulk. [ 987.242432][ T5709] usb 4-1: couldn't find an output bulk endpoint. Bailing out. [ 987.262305][ T9] usb 1-1: config 0 descriptor?? [ 987.442887][T16479] usb 4-1: USB disconnect, device number 27 [ 987.519790][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 987.519919][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 987.535667][ T9] usb 1-1: USB disconnect, device number 82 [ 988.018337][T16479] usb 2-1: new low-speed USB device number 116 using dummy_hcd [ 988.048204][ T9] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 988.201043][T16479] usb 2-1: unable to get BOS descriptor or descriptor too short [ 988.203393][T16479] usb 2-1: config 64 has an invalid interface number: 5 but max is 0 [ 988.203412][T16479] usb 2-1: config 64 has no interface number 0 [ 988.204057][T16479] usb 2-1: config 64 interface 5 altsetting 7 endpoint 0x4 has invalid maxpacket 512, setting to 8 [ 988.204080][T16479] usb 2-1: config 64 interface 5 has no altsetting 0 [ 988.219391][ T9] usb 1-1: no configurations [ 988.219410][ T9] usb 1-1: can't read configurations, error -22 [ 988.292155][T16479] usb 2-1: New USB device found, idVendor=05c6, idProduct=9031, bcdDevice=e5.1d [ 988.292307][T16479] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 988.292332][T16479] usb 2-1: Product: ъ [ 988.292349][T16479] usb 2-1: Manufacturer: и [ 988.292365][T16479] usb 2-1: SerialNumber: 㜟怤䩕﮲씇昞脈屶ᜬ運艟셬䕑絸⃯ɯ㒈㘵맰侧㭝䈈䷯শ짳깢䙁ᇣဃ釿뎰⌽᥋⏍焽⽃ꮻ鴓⺄䗚屲秐ᷤ캸䗣꛸ݽ쇖ι❗萷ឈﻶ豰Ჽᤗ젹鍉팩픏၊阵쓝퉷蠬ᮅ㍇ɡ잴ბ力㦒㔳Ŗ祐ᵿ䀖ỿや엑͡㘰匞踉낏肔흗⏓僬㍖戾ꇼ溲 [ 988.348006][ T9] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 988.394751][T23040] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 988.540020][ T9] usb 1-1: no configurations [ 988.540042][ T9] usb 1-1: can't read configurations, error -22 [ 988.541373][ T9] usb usb1-port1: attempt power cycle [ 988.618127][T15649] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 988.636780][T16479] usb 2-1: USB disconnect, device number 116 [ 988.771279][T15649] usb 4-1: unable to get BOS descriptor or descriptor too short [ 988.773124][T15649] usb 4-1: config 1 has an invalid descriptor of length 73, skipping remainder of the config [ 988.773151][T15649] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 988.773218][T15649] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 988.776937][T15649] usb 4-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 988.776967][T15649] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 988.776990][T15649] usb 4-1: Product: syz [ 988.777007][T15649] usb 4-1: Manufacturer: syz [ 988.777024][T15649] usb 4-1: SerialNumber: syz [ 988.907944][ T9] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 988.941700][ T9] usb 1-1: no configurations [ 988.941722][ T9] usb 1-1: can't read configurations, error -22 [ 989.079300][ T9] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 989.103879][ T9] usb 1-1: no configurations [ 989.103900][ T9] usb 1-1: can't read configurations, error -22 [ 989.104581][ T9] usb usb1-port1: unable to enumerate USB device [ 989.531505][T23055] Bluetooth: MGMT ver 1.23 [ 989.640931][T23059] netlink: 132 bytes leftover after parsing attributes in process `syz.2.6694'. [ 989.800833][T15649] usb 4-1: USB disconnect, device number 28 [ 989.913350][T23062] netlink: 128 bytes leftover after parsing attributes in process `syz.1.6695'. [ 989.914847][T23062] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 990.419134][T23072] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 990.514747][T23060] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 991.784957][T16351] iguanair 3-1:0.0: failed to get version [ 991.860555][ C1] iguanair 3-1:0.0: failed to resubmit urb: -1 [ 991.861309][T16351] iguanair 3-1:0.0: probe with driver iguanair failed with error -110 [ 991.870834][T16351] ================================================================== [ 991.870850][T16351] BUG: KASAN: vmalloc-out-of-bounds in __list_add_valid_or_report+0x4e/0x130 [ 991.870880][T16351] Read of size 8 at addr ffffc9000f669008 by task kworker/1:1/16351 [ 991.870898][T16351] [ 991.870914][T16351] CPU: 1 UID: 0 PID: 16351 Comm: kworker/1:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 991.870945][T16351] Tainted: [L]=SOFTLOCKUP [ 991.870965][T16351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 991.870979][T16351] Workqueue: usb_hub_wq hub_event [ 991.871012][T16351] Call Trace: [ 991.871021][T16351] [ 991.871031][T16351] dump_stack_lvl+0xe8/0x150 [ 991.871059][T16351] print_address_description+0x55/0x1e0 [ 991.871111][T16351] ? __list_add_valid_or_report+0x4e/0x130 [ 991.871131][T16351] print_report+0x58/0x70 [ 991.871163][T16351] kasan_report+0x117/0x150 [ 991.871199][T16351] ? __list_add_valid_or_report+0x4e/0x130 [ 991.871226][T16351] __list_add_valid_or_report+0x4e/0x130 [ 991.871250][T16351] kcov_remote_stop+0x457/0x680 [ 991.871287][T16351] hub_event+0x4789/0x4cf0 [ 991.871345][T16351] ? __pfx_hub_event+0x10/0x10 [ 991.871380][T16351] ? rcu_is_watching+0x15/0xb0 [ 991.871415][T16351] ? process_one_work+0x7fd/0x1480 [ 991.871440][T16351] process_one_work+0xaaf/0x1480 [ 991.871475][T16351] ? __pfx_process_one_work+0x10/0x10 [ 991.871496][T16351] ? do_raw_spin_lock+0x12b/0x2f0 [ 991.871532][T16351] ? assign_work+0x3cf/0x5d0 [ 991.871557][T16351] worker_thread+0xb05/0x10d0 [ 991.871588][T16351] ? __kthread_parkme+0x71/0x1f0 [ 991.871619][T16351] kthread+0x388/0x470 [ 991.871649][T16351] ? __pfx_worker_thread+0x10/0x10 [ 991.871672][T16351] ? __pfx_kthread+0x10/0x10 [ 991.871713][T16351] ret_from_fork+0x514/0xb70 [ 991.871745][T16351] ? __pfx_ret_from_fork+0x10/0x10 [ 991.871774][T16351] ? __switch_to+0xc89/0x1420 [ 991.871802][T16351] ? __pfx_kthread+0x10/0x10 [ 991.871832][T16351] ret_from_fork_asm+0x1a/0x30 [ 991.871870][T16351] [ 991.871879][T16351] [ 991.871885][T16351] The buggy address belongs to a vmalloc virtual mapping [ 991.871914][T16351] Memory state around the buggy address: [ 991.871927][T16351] ffffc9000f668f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 991.871942][T16351] ffffc9000f668f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 991.871957][T16351] >ffffc9000f669000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 991.871969][T16351] ^ [ 991.872045][T16351] ffffc9000f669080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 991.872060][T16351] ffffc9000f669100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 991.872071][T16351] ================================================================== [ 991.872094][T16351] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 991.872112][T16351] CPU: 1 UID: 0 PID: 16351 Comm: kworker/1:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 991.872142][T16351] Tainted: [L]=SOFTLOCKUP [ 991.872151][T16351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 991.872164][T16351] Workqueue: usb_hub_wq hub_event [ 991.872194][T16351] Call Trace: [ 991.872202][T16351] [ 991.872212][T16351] vpanic+0x5d9/0xad0 [ 991.872235][T16351] ? __pfx_vpanic+0x10/0x10 [ 991.872255][T16351] ? vprintk_emit+0x4eb/0x560 [ 991.872281][T16351] ? __pfx_vprintk_emit+0x10/0x10 [ 991.872313][T16351] panic+0xc5/0xd0 [ 991.872333][T16351] ? __pfx_panic+0x10/0x10 [ 991.872355][T16351] ? __list_add_valid_or_report+0x4e/0x130 [ 991.872376][T16351] ? rcu_is_watching+0x15/0xb0 [ 991.872405][T16351] ? __list_add_valid_or_report+0x4e/0x130 [ 991.872441][T16351] check_panic_on_warn+0x89/0xb0 [ 991.872470][T16351] ? __list_add_valid_or_report+0x4e/0x130 [ 991.872490][T16351] end_report+0x73/0x170 [ 991.872519][T16351] ? __list_add_valid_or_report+0x4e/0x130 [ 991.872539][T16351] kasan_report+0x128/0x150 [ 991.872571][T16351] ? __list_add_valid_or_report+0x4e/0x130 [ 991.872597][T16351] __list_add_valid_or_report+0x4e/0x130 [ 991.872619][T16351] kcov_remote_stop+0x457/0x680 [ 991.872653][T16351] hub_event+0x4789/0x4cf0 [ 991.872709][T16351] ? __pfx_hub_event+0x10/0x10 [ 991.872743][T16351] ? rcu_is_watching+0x15/0xb0 [ 991.872767][T16351] ? process_one_work+0x7fd/0x1480 [ 991.872788][T16351] process_one_work+0xaaf/0x1480 [ 991.872821][T16351] ? __pfx_process_one_work+0x10/0x10 [ 991.872842][T16351] ? do_raw_spin_lock+0x12b/0x2f0 [ 991.872877][T16351] ? assign_work+0x3cf/0x5d0 [ 991.872902][T16351] worker_thread+0xb05/0x10d0 [ 991.872931][T16351] ? __kthread_parkme+0x71/0x1f0 [ 991.872961][T16351] kthread+0x388/0x470 [ 991.872990][T16351] ? __pfx_worker_thread+0x10/0x10 [ 991.873012][T16351] ? __pfx_kthread+0x10/0x10 [ 991.873042][T16351] ret_from_fork+0x514/0xb70 [ 991.873092][T16351] ? __pfx_ret_from_fork+0x10/0x10 [ 991.873123][T16351] ? __switch_to+0xc89/0x1420 [ 991.873150][T16351] ? __pfx_kthread+0x10/0x10 [ 991.873180][T16351] ret_from_fork_asm+0x1a/0x30 [ 991.873218][T16351] [ 991.873380][T16351] Kernel Offset: disabled