last executing test programs: 2m50.679919156s ago: executing program 3 (id=123): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1000}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000440)="42f7a85b"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0xf0ff, 0x0, 0x0, 0x48, 0x0, &(0x7f00000004c0)={@fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r3}, @fd={0x66642a85, 0x0, r0}}, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) setns(0xc9, 0x0) socket(0x8, 0x5, 0x5) r5 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r5, 0xc020f509, &(0x7f0000000000)={r5, 0x7, 0x3b, 0x8}) sendmsg$nl_route_sched_retired(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x25}}, 0x4000) r7 = socket$unix(0x1, 0x2, 0x0) ioctl$BTRFS_IOC_ENCODED_WRITE(r7, 0x40809440, &(0x7f0000000640)={&(0x7f00000005c0)=[{&(0x7f0000000100)="dfec6d5a6370ab25a2d0ec795f9132a61c8f71acf2ecb4e68e7d8fb4d1789f6368b2cc2da1a3293cb9e74526725cccf3339f537320dd3f4505cf86c7cb9292006ef1fce4642d423640e4032cba968cd70467a11494ea8e9e554231655beb7f1f6b89999d5fde3b5c8dc8bf77593d3eb945d7b865fa117c97c2e1fefc3512f9035428e3dd0d14e55ae0e209eddf0a0dfc05ff06cc9ff1db55f2abae32c5635bacb9304133ffd40c4050de92069213e58bfae5013210feebb86bb9350da155a00a8a8be7ed230c879553e0789b5b8c8736c604fd846bf655ca5a6c8a140a51ab1391636b238123eb7488dcd4a9e0a0866ffb8bb29bde46045b4d", 0xf9}, {&(0x7f0000000200)="fab6b91d07d1e2498d05b8a222c69ae99d1df162a29c580af92da5effc4cea83073fd24610334d3e174772fa773cbf0d21effa49d299ebb06746bdfec214313241dea3ef981cd3ca71a884e53115cf6d", 0x50}, {&(0x7f0000000280)="2e7572e8650ec7886ab2ac7cbcc6d06d7641b901244243d92c3d3f3f5e42077518ac9192bf6b4e980109bfd4a5e72694fe152ae887c43cb40b12a2947410e443fe71cea3320dbf58c2374993b8ce7ece8094fff77ccf5899f6f285dc6946f2b6cf51a3c8a6f09901442c40c86e6954f1a456b7e6c256e842de5d7e4c", 0x7c}, {&(0x7f0000000400)="b888759c2abc9407fec6a290a402b941c6550f44d72d3c07d96e688af3f93a0b4f2153f746df67e013fe37660aeb1b14c35b859a9128e24e0e339a689ef18baf4d2420ba37235bc7c7f5b72391decf521bf998c85ead4eeb02d7801947b10b132f2ef0438059f4c51de39fa2838007edf2b77002a649140fae01f656a96110b405f009b814f21b949ed32897c8bcc0d95e5b1ae3cc4bd6b9ec2b3b9f25db4ef8778906b366f310f6", 0xa8}, {&(0x7f00000004c0)="ccf311d6e26addca78be3362958a52e94fe54701b41ac79e699e08640481badb99696006a3e4b1ef6db3085f50f698a73b764e4e5b56d2e735148b675df6ef3823ea3754c5112159ea4028842bf68f0cecb821aca80d377c0e1de1d4d27f04c05b7a829765ac0db0587937d17961dfa8ab7d830cc63ecc541611761f185dcb1917bdb95c96b70852942b46b3732163dcc96d9cfe01a0bd4086cca226cd0779edd07540462bb9d7b007", 0xa9}, {&(0x7f0000000580)="e25d1ad530beec6b5788e1fd964dc9a3a3b55d440a2e5203b626c1915c66017cdf39a6bf734c64218e5cee42229e8490", 0x30}], 0x6, 0x8001, 0x0, 0xe03, 0x7fff, 0x9, 0x2, 0x1c5a}) 2m50.506682175s ago: executing program 3 (id=124): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x47f3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x200000005c832, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) r1 = userfaultfd(0x801) socket$inet6(0xa, 0x1, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa08, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) 2m50.102822661s ago: executing program 3 (id=125): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) keyctl$clear(0x3, 0xfffffffffffffffd) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) r5 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="0a000000090000000800000002"], 0x48) listen(r3, 0x0) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x6, &(0x7f0000000180)=@framed={{0x18, 0x2}, [@map_fd={0x18, 0x3, 0x1, 0x0, r5}, @call={0x85, 0x0, 0x0, 0x26}]}, &(0x7f0000000000)='GPL\x00'}, 0x90) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r4, @ANYRES32=r6, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r4, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r3}, 0x20) recvmsg(r3, &(0x7f00000028c0)={0x0, 0x0, 0x0}, 0x40006081) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/arp\x00') preadv(r7, &(0x7f0000000600)=[{&(0x7f0000000100)=""/127, 0x7f}], 0x1, 0x6, 0x0) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f00000000c0)) 2m49.06882152s ago: executing program 3 (id=128): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f00000003c0)='devtmpfs\x00', 0x2, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000180)='./file1\x00') setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x8, 0x3, 0x230, 0x0, 0xa, 0x148, 0xe8, 0x60, 0x1c0, 0x2a8, 0x2a8, 0x1c0, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x98, 0xc0, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@ecn={{0x28}, {0x33, 0x31, 0x4, 0x2}}]}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x100, 0xce3e}}}, {{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x8, 0x4, 0x1, 0xd8cb, 'netbios-ns\x00', 'syz1\x00', {0xa000000000000000}}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x290) r0 = syz_io_uring_setup(0x7250, &(0x7f0000000540)={0x0, 0x8550, 0x8, 0x1, 0x203}, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_WAITID={0x32, 0x51, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x4}}) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x2a080, 0x0) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0) r6 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001640)={&(0x7f0000001580)=ANY=[@ANYBLOB="1c000000020101010000000000000000020004090600024000020000"], 0x1c}}, 0x8000) io_uring_enter(r0, 0x1, 0x1, 0x61, 0x0, 0x0) r9 = syz_pidfd_open(r4, 0x0) process_mrelease(r9, 0x0) write(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r10, 0xffffffff80000800, 0x0, &(0x7f00000000c0)={0x4, 0xfffffffffffff18f, 0x1, 0x0, 0x2, 0x3, 0x1, 0x6, 0x7fffffff}) r11 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r11, 0x42, 0x1ff) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r12, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) 2m47.892144257s ago: executing program 3 (id=133): openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000040)='\x00', 0x1}, {&(0x7f0000000380)="8b73d9034339eff3a99e577eb847a066171661d4c12906fb9e1ad0", 0x1b}, {&(0x7f0000000400)="422c4a2bfaee958777246fff0638e2121e17", 0x12}], 0x3}}], 0x1, 0x20008050) socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000100), 0x4) 2m47.333544366s ago: executing program 3 (id=136): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x801, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x21514}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r2 = landlock_create_ruleset(&(0x7f0000000240)={0x2001}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000340)={0x2001}, 0x0) landlock_restrict_self(r2, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x80000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, 0x0) r4 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_ADAP_S_LOG_ADDRS(r4, 0xc05c6104, &(0x7f0000000040)={"dfff00", 0x0, 0x5, 0x6, 0xfffffff9, 0xe, "00000000020000000000002100", "00000001", "0052008f", "0000f807", ["fdd5c01000", "0000000000000400", "00f638000000007c0300", "ffe9ff00"]}) ioctl$FIBMAP(r4, 0x1, 0x0) ppoll(&(0x7f00000001c0)=[{r4, 0x4420}], 0x1, 0x0, 0x0, 0x0) ioctl$CEC_TRANSMIT(r4, 0xc0386105, &(0x7f00000000c0)={0xfffffffffffffbf7, 0x1000000001, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0x1, 0x56, 0x1, 0xfa, 0x9, 0x3, 0xf9}) ioctl$CEC_ADAP_S_LOG_ADDRS(r4, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x4, 0x0, 0x3, 0x1000006, "5500578ea5f4ffffffeb00001000", "1575b859", '\x00', '\'q6O', ["aabe8459c62224475793e8a7", "7f9ce2d2c4f439ff80e1d1c8", "fa0700f22b42a3023be516d1"]}) (fail_nth: 3) 2m46.791209779s ago: executing program 32 (id=136): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x801, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x21514}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r2 = landlock_create_ruleset(&(0x7f0000000240)={0x2001}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000340)={0x2001}, 0x0) landlock_restrict_self(r2, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x80000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, 0x0) r4 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_ADAP_S_LOG_ADDRS(r4, 0xc05c6104, &(0x7f0000000040)={"dfff00", 0x0, 0x5, 0x6, 0xfffffff9, 0xe, "00000000020000000000002100", "00000001", "0052008f", "0000f807", ["fdd5c01000", "0000000000000400", "00f638000000007c0300", "ffe9ff00"]}) ioctl$FIBMAP(r4, 0x1, 0x0) ppoll(&(0x7f00000001c0)=[{r4, 0x4420}], 0x1, 0x0, 0x0, 0x0) ioctl$CEC_TRANSMIT(r4, 0xc0386105, &(0x7f00000000c0)={0xfffffffffffffbf7, 0x1000000001, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0x1, 0x56, 0x1, 0xfa, 0x9, 0x3, 0xf9}) ioctl$CEC_ADAP_S_LOG_ADDRS(r4, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x4, 0x0, 0x3, 0x1000006, "5500578ea5f4ffffffeb00001000", "1575b859", '\x00', '\'q6O', ["aabe8459c62224475793e8a7", "7f9ce2d2c4f439ff80e1d1c8", "fa0700f22b42a3023be516d1"]}) (fail_nth: 3) 15.245530507s ago: executing program 2 (id=646): socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x76798000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) getpid() r2 = syz_open_dev$dvb_frontend(&(0x7f0000000040), 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r2, 0x4038587a, &(0x7f0000000380)={{r2, 0x0, 0x101, &(0x7f00000000c0)={@align=0x7, {0x99, 0x80, 0x1, 0xfffffffffffffffd}}, 0x0, 0x0, 0x0}, {[0x3, 0xb, 0xd3f, 0x77c]}, 0x7, 0x0, 0x0}) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, r4, 0x800, 0x55007}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 13.268232033s ago: executing program 2 (id=652): socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x76798000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r3, 0x11c, 0x4, 0x0, 0x0) getpid() r4 = syz_open_dev$dvb_frontend(&(0x7f0000000040), 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4038587a, &(0x7f0000000380)={{r4, 0x0, 0x101, &(0x7f00000000c0)={@align=0x7, {0x99, 0x80, 0x1, 0xfffffffffffffffd}}, 0x0, 0x0, 0x0}, {[0x3, 0xb, 0xd3f, 0x77c]}, 0x7, 0x0, 0x0}) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, r6, 0x800, 0x55007}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 12.736188161s ago: executing program 5 (id=655): r0 = syz_usb_connect$hid(0x0, 0x6c, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000000000040b827ed0100000000000109022400010000000009040000010300000009210000200122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) setns(0xc9, 0x20000000) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @any, 0xb, 0x2}, 0xe) socket$kcm(0x11, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xe) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r1, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000640)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a, 0xfffffffe, 0x4}, 0x9c) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000040)={0x0, 0x10, 0x5, 0xffff, 0x5, 0xf, 0xffff, 0x558, {0x0, @in6={{0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x2}}, 0x2, 0x7, 0x80, 0x3, 0x1d70}}, &(0x7f0000000140)=0xb0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000440)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r4, 0x40086602, &(0x7f0000000140)) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x4, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54, 0x4, 0x73}, 0x9c) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220500000067a7c1ed3636fe3cf46aa93880bd96089671a78cac33241d2b143dee856a641ee5b8bd00e8a1423426526a9ab67630cf5d3af6abc1deed47ef2de07124613e6816078f9a9c4f5ea7abd6dd7179d15749149e312b476480db6ae6192e2d19"], 0x0}, 0x0) socket$inet(0x2, 0x80001, 0x84) 12.250715095s ago: executing program 2 (id=657): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000180)={0x7, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x40002019}) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r3, 0x80e85411, &(0x7f0000000340)) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f0000000080)=0x7) r4 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) mount$fuse(0x0, 0x0, 0x0, 0x1800, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESOCT=r5, @ANYRES8=r4]) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000002140)=@filter={'filter\x00', 0x42, 0x4, 0x290, 0xffffffff, 0xc8, 0xc8, 0x160, 0xffffffff, 0xffffffff, 0x1f8, 0x1f8, 0x1f8, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'netpci0\x00', 'pim6reg0\x00', {}, {}, 0x0, 0x2}, 0x74000002, 0xa0, 0xc8, 0x1ba, {0x46010000, 0x2c000000000000}, [@common=@unspec=@cluster={{0x30}, {0x4, 0x6, 0x6}}]}, @REJECT={0x28}}, {{@ip={@empty, @remote, 0xff, 0x0, 'veth0_to_batadv\x00', 'team_slave_1\x00'}, 0x287, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x1ff, 0x2, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f0) r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYRES16=r7], 0x0) syz_open_dev$ublk_bdev(&(0x7f0000000280), 0x0, 0x82902) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0x20, &(0x7f0000000400)={&(0x7f00000000c0)=""/181, 0xb5, 0x0, &(0x7f0000000300)=""/240, 0xf0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000480)=r9, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_NL_NODE_GET(r10, &(0x7f0000001980)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001940)={&(0x7f0000002440)=ANY=[@ANYBLOB, @ANYRES16=r11, @ANYBLOB="00022abd7000bddbdf250d0000005401068004000200a9000300e2795a74ef559caccb4c4cc8bfeb490eac72a738d949ad4def5318dfd1bad17b9f7fbd3a731a0c1594a69caf8a8120279826400e0c055a7d5f32a940c7c43c1d5b705229358002262b92cbfecf728d2cd9d6d3a92cb613ec2a7aeb5b67b9999c3d7e77ef1211aa900666726e97780095e3d775aa7c9ec2f19949dcb25c9cc11d1b057a32154fd6d839b4094ac6ccce494a9ece48201ea2a79737f89fe5e9158e09a4f2293200000004000500040002004700040067636d28616573290000000000000000000000000000000000000000000000001f000000d9c6ddf3c52229c3694ea68ca4106619825795f576994314e6a867123b8365003e00040067636d286165732900000000000000000000000000000000000000000000000016000000e519ef297644c059bf3f4bffd243255ba693d348762c0000080006000500000008000100050000004c0004801300010062726f6164636173742d6c696e6b0000340007800800010012000000080001000c0000000800040001000080080004000900000008000300060000000800010011000000d400018044000400200001000a004e2300000006ff02000000000000000000000000000102000000200002000a004e2200000021000000000000000000000000000000000500000024000280080001001a0000000800020001000100080001001c000000080001001a0000004400028008000400ff7f00000800010003000000080002004dc20000080001000c00000008000100030000000800020006000000080004000200000008000300010000000f00010069623a70696d36726567000008000300000000800c0001006574683a77673200d00001800d00010069623a726f736530000000000b0001006574683a6c6f00001c0002800800040023000000080004000900000008000300060000000c00028008000300c300000044000280080001000000000008000200070000000800040001000000080001001a000000080003000300000008000200010000800800020006000000080003000700000044000400200001000a0000080000000800000000000000000000ffffffffffff0a000000200002000a004e231c000000fc010000000000000000000000000001000200005400028044000380080002000800000008000200ff03000008000200060000000800020006000000080001000000000008000200018000000800010004000000080001000100000008000100db000000040004001010068004000200041003003a8361a78261a12309b87ee6d2c36476518722f812fafc45713c34af2f34e58493eb9183b3ee2608bb8b82bf1054d762e9ac0c2aba0684f925c2f4fc70c6a4dd4269cce12a168759591331d3c573a7cdbc4ae488884181ce83ac2c733107ee4bd31a9f8133679154a36ab82dbdd055901006c1bdfabd4cd2717291ebd89e82c8edaf3325ec6b7f64977d80166d609749cf7a1ffb7e10288faa95f21a8c8cf49f9f2a32f347c29d4589e6714076b5bf1cb05535535b879c8901da919fb64c64d2eb715518f1514f1cc069b0987a5105c0b701cc52093d08cec844fb92c0c0e7035ac5695f60ddf3b1737d63e7a13ecfb62e2c1df2012f448fa4fafbcccaa0e2777a651affb5cf926d49dd957265333e6c35461a4a6864e4f74b4a878de10e40afc5f3851f4556fd26bafb19376e921920b34559d404fe6c3d58b487c868adbb6de652192c9c7d27b84a78af33dd1ad5fa1d973efe275a8657e9ed1daff2b5dfa47e543627693e42a39dd089fe78fe186b8492a5c98c0fbdd6c28476340fc33c4623aa76008293e6bd345886940335766071351b81158f7a36653ba5a1a15a3fc86516cd1d95f16002feaca1863b2922a33baea8834e3a8857ff34d17fe43cf091bc05281c580191fe3d00e82241a46434e4f992838a81fbb76977641e5a0f95c77f588b048e3cf63dbdc99a65455aca957bd6f0d9ed665cb107a978ba887a37132399e6155feb81e769db7739ab504a01e76a668f2ea5f7a257b8fa9d554c35cc9054c29147782b803e9d019a5b350afc451368c741ee40942277fc239b7f327f0b5986fbe00812769f555e980ec7cd1489505bd594c7c0f9815d5c208a6483107d7e3ec060c87d900f68d3ef73562b302ba14d48216584b3e0d27fb9335d83ab57161659b8b218796144448688e72625f330d43106078c0c802855f65aa813b9ca3d1646989de8d44a960f6a144827fc12499e565e17bfe3af2a20d38e2974f6bdda2fdbeadf8e2bc2b8628f5039cd00977dc322d9a4d40271ceecc0c0c36c52e4181e7fef0ae59334ea8ed17ff15865429f540914b6cba1d3b0e427f13afa69bfaeca379b8babe69879eaee704897e86858ed419dfc7583c1fb7b2d86102235723c8258e07dc2b70b085174ef5b0decce5da7cbce4f47f4c53a30c25b433965c2ae73c8a535a0b412855e9d626a3661ab294b882b2598b7719a212939f13f4879a34f10a526340ad616cfc154c9d1b85798c8a62544c0c9da96f5b5feb305f124b0c1939f1e8b3eaff909ee4c4d7e36f0b0ea1a5825ef702ee90dac3443540c780d5c71ae2ebfd7842f5b331130a33050083c3da01ef4d2c167460120f4eca65049700794a0bb5cb3392998d1a695f98863a4bceba8b651b038ed72528c80f0ab0e7e46b6c062085bf763eff63724dd87ff99340e6a414acfda8b2f2cbfb9bd7b10bce9fb74b9ca4e75361f5014dd36186731197124e2ab1a69f9ce2b60d953ee907545432efbb283a91dbcd2eb45072f05c00dd9dc342c2f6f26ab8484238c445a613608c48d04be609f761c25d8b43bb288602f01e7a75e8a40e6179a7e59fb923fab74ac0d0192e8d4cd7a83f226b2df337db69cc88bc2d1b3250e8995610d1929101f50c5fe66dc3151eb09b04b048c780281e0b3aeb6ab1da56d7fcc8a9077accb226a9c8fc68d821c740158dd5dd3e2f0386f284034e150e597944121af8ec99c061eaf043b9557b9574c2518489e92916d19549b2f33f25cf65452ec109ebd5d6e03221895f4be755978b27421803f854d43cde230b0eebe980af0ee1b9e4532d1f73e8ce1de45a07853bbcc071a661a01ba5768f56e48c548c50a9b1147421cf90050a4647df84908f96171d1b2b34fea17316c81706add803f3d29204d84af18bf706916be41a69cdce9652b996475ecd36661b5a28791b0178f976206ea23ebdbe87f214879b02eaf83e7b1e8d4dca8e92fcffc0d165bde9db86563343814fb7854d3931445a2811b7663beb4e5f75f66458a38969e8c95246e72f977551e382294c5341449800fa3e078b4dcffd7f0ba210d2ae8b6bb0db349d181ace488176c79ff5604a3a4af684c99b97835eee1c6e78a9b314b566d5c3d49c8093131b0f858039538213faa748b439dfab915825e745002a3a1f2b9ad852a817df1eeb30c1a51118ce3ffee3b3b41f758dce650c6ca00f327e0659465fa0c157721fbbabc170ba11e06196cddbf93feb5032ec5af5100dd51ef4bd589ea0d804ff8690f4c1f8c63e45f6115a41dc429ba8193195a094043a2ee6e66569a6475e7825fe9a69eb4d6ecc2d8a58d4da7fe941f5c47ce8702e81a17a41108027178262e170ba49bb3791acae94624a4e86a234112f130a58443bac0ca26a4a7bbbe1feaedbced6b04ebd70cbbb16dd9aa2582d885201fcaf35074fb611b8efcdc0af3887384fdbcb4f5feb5303e00d9fcb1b4299a25dff73cd0092ab12e44ca59b2e288543fa6c54d67cc83365f1ea842d6410cb31264a60eafb3dd8ebf76ff1bbb49c6db801eed3add84c015f4118ae2fd646e295ddc4d4f3362727b93305cead0c0f5e20400cb06954ae137b1b97d42aaa7098f140e57463e947bfd6ebfcacf32bc137231e7c7e7f59cc748c487fd0b8ebfd446acdc2f503d51a2f86b069339636fec538a58e6ea1f884266c12122a17fdc01831a410f93221eb10b9eb0295eee41b0195d9773eb7fe063209d737ad4232c75182e3c101d23e3f74b28834dc435eed35ad16199bb4285605ca60f0ad3542295d7c1224e20a77368bcd340053bb010a5c460089eeb3cc9252a109e75aec4ded0305cb3ccb8c20c5a94cdf7653d30e9c925127ab38b5016acabcca5a8890e98dae8ba8431fee40659185bcd90a1ba2b5f44d5a629db23f933ed32a0eeb3f7ba21b696a12c1722933fcdc83ee30c8fe1ed8596d7dba353d60721e4e0c9166305aed6a9ec8a6638e1a04f94ef03464bdcd9ba876d12ed7f60d42572f90267caebd196d0a537c98a978e81f649b17f8880ae8852c72e40dc20509133a7478a913f553d195558d912ffeed6ccbb2e3819a1d7bc40314db0b229381de85d442814f26f75c8ae98503d6f2b39a98780fa231c9685654ec8730183450def4648777fb781ecb4daa2dd5d30f3c6b3407480bad7817f7d5fd7240c694b0e4a20e704cfd06ced93e80b8605546e3733130feed5f3f6dbd4f86745d28df5a0b872dfd06072fbba55b7fef74610e0d350746066a9f88697d525891cd6f0c20b863478b52493b08063a09a7a501e5a4e7b2f7cf9a77f2ea5b452562216d8c47ecda23a94c1b97c12658e13abad7e873565af397cf9eb5aed7d6f3af133bb17006d3c31d9885890eb1e2e7bc2a05cef939c7114bdb190c751b5bee0144e4aac8392812cafe3f7a90b64a01661a34f9ce3c19091174b86225a3de45bee24f437a0904afed9df2230eccb98788c452e26a7dcb22c77e42764a15c90968eec05b7efc0a7930fbaf8624362949e05c5a47cb113837fabe66b0a0c459ac5c165a097b5e8d5e2f45cbc5b9bc18cf3f943bd74eabf747fd64580e9c98507d48b6769740caaade7321a4a0c2517e5158b29cad81e23063715be33cccd1cee73417da76d86e25a47b4883ed047ba234530903fad954b8b7028c6c9571188028bd64375496becf1dd41d877b08a58810b182e706d917633df6b7e8ade8e8d191964c15a2a53da0e384814d4d41472af6d1ef78cd373cdfddeeb05e89c6592480a9ebbd44a21348b250c78d2475df3e1d502a88d1875c2768dbc91d07d40e23f436a37aa7081c38ba6f51df95dcb46c74b93cfc443cc8f949149b5b8dcb859dd85f8ec1a5498a0df1af662b6be3547945a20257b86ae3972261c8f6881b50a90d57b261535af585b0d11ea3ca824619d73d8c053766471170dfb9534799bcd0e3da5227bdb5d47039c94c9b5f5b2781e5811fa93a21e942ba80a4eb0d07173e058170f6ed8c7646c7db6cd402080a7becbd171706e21c757db028c0abd4da791485299dc4df8b6338f40f932b6ebfa9389912ab2ad7d7efcdfb234ce528583c0c7dda523112504560340dd7a4533468c105f75a12d7ac73b75e1419a6ba93afbcc430fba9759a745b3027eb66800062cc25abd1623c651b084cc8ba677fbaf4903ecdb6c0ce618fc0b4e750de3e2cef6ebf1e9bfdfd630fd079fe077e7da3a81b97e4ee7c4b008c16e1aa145a3fbe7d5a02555dbadf00ab59dcb872a0773f327a9a86bd2ff192f662209133973e55521f278cac3f9f740ea7358970c97e509bd8c97ccf8f407ae6ff0ed1ec5214433469b83d44822b810747a80bc2e5652430eac4416b28263c5273b6203b1f3320612e61ebb8b1feb4be4176421d74d651a6d803171092656f6aa4b37bee7a57eda9a8a8b0f0ec60c6c350ad4c0e3fc3cf2ce1ff0fb9fbe572a652ffafd41f36a6a994bf0a87d41352b3b6cc274aa476221bacd8e06e32810d50eeffd1f11e226cd802c5c82bd4fe3e5186e79ccd6c7f102910306cf078110b82ff15d433c31d07dbb62315d48fe8219f76889d9539c70fce75bad4b1312bae568461c73b58c5a89a89fb10b225a92aee7ad73023eab3643f1745bfa9ffde27c2fc2169dce87fb54c92a51368447c18fbd22b3da90795625988c2a223b44bd83e7df9052f5d8dead54515c5c0fc4839c40b8a6a6fb7d7b22b83e879d28e1c3982a6bdd367a639de69e2fd2c09c60bcd6eb43caca8466fec3dc8e0c33f13b774658f501a0c9fcaf038e454085e86d976d04a5e16c3882738d1740ad07eb6c0e1009cad48ab696755a4adf19849dbd5383d3707eaaceb3674ac3b15b5f8045a6a1a9f23903942aef21ed8b3fff7404f067b1107c08dd5f89b716d2c638d0b50517745868ac83c2c1858c232db87c84ff0c97e2262c96c1b590449907556e6d03d91d3745041e86e3fc0d47d04e788edaf55a4987b7df5ec65655ebae6ba27c01d862ea2c296b3eb162054b32721d654f9201fc4ebc14ca374457b505be436b5fbe9a0b97c1bd73474d108a75e9021274bb8a86c0083acf135f66d3a04321bfcd440a5a5aeb4af66450c2de93634b19eb7936f6f2073eed56c48f469ba5c0b69022f8f457033e6abb1fb55459d02de87b62b9b18d0e37af056d9025113979f01c065ef2c4a68d7cb5b9289a14f62aa37c828b898602e008d983078ff6cc0701827bbe35732f9e00b97a31e16ce67f6c908ab80d131150fa455da11ffd4825cbfb9ab3e9cf63ae5b392442a1e2d4fedd223b2249184ba9bfb490a47c1ecc77d4af653c91df681f012c4edc34418596a3993e45dfacf04c81a89dc99b4eb4778864e9e557699899052c4782b26e6bbb86611947dcb602f15c4143650b1b39f32d1d7e845e408aeee547f2a789124ebdc685572624e4ea5d2d6f2fa8bdd589fcbcf7dd01a7fa75949559bbfe18dfc39db36eb4f17d5d9997803a55c51ed833612d951b3b4c93c18f39411fefe17d20ed81454d45accee77d948f54abe0779514eb6b62414a0482e6155c5abeec8221fdfc8c5cbf0499bf24089f6ef8b0383cd7ed3ca7ee68c000657eef77b3d950932dc3d76dbf89fff8959cc496083e155d21f6b3e97fbaaddd0dfffed4a2e2a4e5b6bc390040945507e521e95064f0a9cd400ded2b06f6d3cfe21e19ff70be01bc8acb5882d5ba3cae1b874cef003794c2ca3c4542317fe2411b3ba29629099ac3b868f015fa616046f723bd421948ea3e21c09dd672af883ac4b3e1cd6693c497bef33ab560ab8a0400020044000380080002000400000008000100752a000008000200030000000800030007000000080003000500000008000200060000000800010070feffff08000200010000004400098008000100bf7e00000800020004000000080002000900000008000100000000000800020009000000080001000d000000080001001d0000000800020009000000"], 0x1444}, 0x1, 0x0, 0x0, 0x24000000}, 0xc0c0) syz_usb_control_io$hid(r8, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$rtl8150(r8, 0x0, 0x0) 11.683156367s ago: executing program 1 (id=659): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x9, 0x5c, 0x0, 0x0, 0x13, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x4, 0x2001) sendmsg(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='9', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) syz_usb_connect$cdc_ecm(0x0, 0x74, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000020000402505a1a4400000000101090262000101000000090400001202060000052406000005240000000d24010000000006241af7ff230c24130017e56b9ecbee"], 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x300, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960003000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900000000060000000000000000e2001e25b9bb47bc00", [0x8, 0xffffffff9673e35a]}}) 9.42052113s ago: executing program 5 (id=664): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg$unix(r1, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r4 = open$dir(&(0x7f0000000000)='./file0\x00', 0x800, 0x11) mkdirat(r4, 0x0, 0xa6) openat$comedi(0xffffffffffffff9c, 0x0, 0x20043, 0x0) prlimit64(0x0, 0xf, &(0x7f0000000140)={0x8, 0x5}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r7 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r7, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r9, 0xc0a85320, &(0x7f00000000c0)={{0x80, 0x77}, 'port1\x00', 0xeb, 0xb1c07, 0x10, 0x0, 0x1001, 0x0, 0x0, 0x0, 0x2}) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000800100000020000180060001000a000000140004"], 0x34}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) 9.100006536s ago: executing program 2 (id=665): r0 = syz_usb_connect(0x2, 0x3f, &(0x7f00000007c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$FS_IOC_GETVERSION(r1, 0x40025b0c, &(0x7f0000000040)) 8.685131355s ago: executing program 1 (id=667): socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x76798000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r3, 0x11c, 0x4, 0x0, 0x0) getpid() r4 = syz_open_dev$dvb_frontend(&(0x7f0000000040), 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4038587a, &(0x7f0000000380)={{r4, 0x0, 0x101, &(0x7f00000000c0)={@align=0x7, {0x99, 0x80, 0x1, 0xfffffffffffffffd}}, 0x0, 0x0, 0x0}, {[0x3, 0xb, 0xd3f, 0x77c]}, 0x7, 0x0, 0x0}) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, r6, 0x800, 0x55007}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 7.853608831s ago: executing program 4 (id=669): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x4008af04, &(0x7f0000000040)) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000001140)={0x2, 0x0, &(0x7f0000000080)=""/88, &(0x7f0000000100)=""/4096, &(0x7f0000001100)=""/13, 0x2000}) shutdown(r2, 0x1) bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0) 7.813948702s ago: executing program 5 (id=670): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="1b0000001800dd8d000000000000000002000000"], 0x38}}, 0x0) 7.707118245s ago: executing program 4 (id=671): prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1b, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000001ffffffffffffff0001000000000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0xc, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14}, 0x94) 7.703116188s ago: executing program 5 (id=672): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x1fd2, 0x6007, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x50, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x4, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0xfc, 0x2, 0x7}}}}}]}}]}}, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='fd/3\x00') r2 = socket(0x1d, 0x2, 0x6) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) 7.627767951s ago: executing program 1 (id=673): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x3728e000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) setns(0xc9, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$packet(0x11, 0x2, 0x300) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f00000006c0)='.\x00', 0x40001a2) r4 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) sendfile(r4, r4, &(0x7f00000000c0)=0x10000000004, 0x8112) pwritev2(0xffffffffffffffff, &(0x7f00000020c0)=[{&(0x7f0000000180)="c1781283a3b0774fa68bb716beca1c5781d63a9ed0438129d734048a0563eeb966301f195d6039952c3c4d31f5a93c", 0x2f}, {&(0x7f0000000240)="bdfd39f1cf6d", 0x6}, {&(0x7f0000001f00)}, {&(0x7f0000002000)}], 0x4, 0xf, 0x4, 0x2) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000040)='mem\x00\xffEev\xf2r\xf1\x18\x1d\xb9\x00y_hug$\bo-\x03Q`]o\x8cr\x9d_etl\xf9\xdd\a\xad\\H\xe94\b,H\xbf', 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000040)) readv(r5, &(0x7f0000000100)=[{&(0x7f0000000000)=""/31, 0x1f}], 0x1) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000003f000500010000000000000001010000000000000f0001006f76732d73797374656d00000800020000000000080009002a"], 0x38}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1c0) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/kvm/exits\x00', 0x1, 0x0) write(r7, &(0x7f0000000180)='0', 0x1) 7.561860991s ago: executing program 4 (id=674): r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl(r0, 0x40186f40, &(0x7f0000000100)="ffffffff00"/18) 7.457167264s ago: executing program 4 (id=675): r0 = syz_usb_connect$hid(0x0, 0x6c, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000000000040b827ed0100000000000109022400010000000009040000010300000009210000200122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) setns(0xc9, 0x20000000) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @any, 0xb, 0x2}, 0xe) socket$kcm(0x11, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xe) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, r1, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000640)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a, 0xfffffffe, 0x4}, 0x9c) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) mkdir(&(0x7f0000000080)='./bus\x00', 0x63) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000440)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r4, 0x40086602, &(0x7f0000000140)) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x4, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54, 0x4, 0x73}, 0x9c) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220500000067a7c1ed3636fe3cf46aa93880bd96089671a78cac33241d2b143dee856a641ee5b8bd00e8a1423426526a9ab67630cf5d3af6abc1deed47ef2de07124613e6816078f9a9c4f5ea7abd6dd7179d15749149e312b476480db6ae6192e2d19"], 0x0}, 0x0) socket$inet(0x2, 0x80001, 0x84) 7.301830148s ago: executing program 0 (id=677): r0 = fanotify_init(0x200, 0x0) fanotify_mark(r0, 0x51, 0x110, 0xffffffffffffffff, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x80101, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) r1 = syz_usb_connect(0x0, 0x2e, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x644, 0x8047, 0x100, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1c, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x100, 0xa}}]}}]}}]}}, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_usb_control_io$hid(r1, 0x0, 0x0) ioctl(r2, 0xc4c85513, &(0x7f0000000200)) 6.688727534s ago: executing program 1 (id=678): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000400)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r3, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) read(0xffffffffffffffff, &(0x7f00000002c0)=""/10, 0x5b) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_MEMORY_ENCRYPT_UNREG_REGION(0xffffffffffffffff, 0x8010aebc, &(0x7f0000000040)={0x30000, 0x7000}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r7 = accept4$alg(r6, 0x0, 0x0, 0x80800) sendmmsg$alg(r7, &(0x7f0000000280)=[{0x0, 0x0, &(0x7f0000004100)=[{&(0x7f0000000100)="a92e81d0991828e33c2330164cf023df", 0x10}], 0x1, 0x0, 0x0, 0x20004801}], 0x1, 0x40000) recvmmsg(r7, &(0x7f0000002740)=[{{0x0, 0x0, &(0x7f0000002280)=[{&(0x7f0000000380)=""/139, 0x8b}], 0x1}, 0x6}], 0x1, 0x40002120, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r8, 0x4048aecb, &(0x7f0000000180)={0x4, 0x0, [{0x0, 0x0, 0x4, 0xb, 0x0, 0x10}, {0x0, 0x6}, {0x80000019, 0xffffffff, 0x0, 0x9, 0x1, 0x80000001, 0x8}, {0x80000001, 0xffffffff, 0x6, 0x8, 0x5, 0x111, 0x1}]}) 5.559914919s ago: executing program 1 (id=679): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_S_AUDOUT(r0, 0x40345632, &(0x7f00000000c0)={0x3f0d, "e6b0adab5875442f039e00cfb66dad18145dfa920cfd3e38795f0cb33053e981", 0x3, 0x1}) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x40, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000004c0), 0x208e24b) cachestat(r2, &(0x7f0000000040)={0x0, 0x3}, &(0x7f000009de80), 0x0) ioctl$DVB_DEMUX_DMX_START(r2, 0x6f29) fallocate(r1, 0x44, 0xffffffff, 0x20000000007) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x18, 0x1415, 0x103, 0x70bd29, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}}, 0x4000) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x420802, 0x0) ioctl$PPPIOCSCOMPRESS(r3, 0x4010744d) 5.090455417s ago: executing program 2 (id=680): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ba3000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000a18000/0x2000)=nil, &(0x7f0000e1d000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, 0x0}, 0x68) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r0, 0x0) socket$unix(0x1, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) bind$unix(0xffffffffffffffff, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004045) r1 = io_uring_setup(0x1b7e, &(0x7f0000000040)={0x0, 0x9888, 0x1f480, 0x0, 0x399}) r2 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) keyctl$read(0x2, r2, &(0x7f00000000c0)=""/4096, 0x1000) keyctl$read(0xb, r2, &(0x7f00000020c0)=""/4084, 0xff4) io_uring_enter(r1, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f00000010c0), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)}, &(0x7f0000000100)=0x10) ioctl$SOUND_MIXER_WRITE_RECSRC(r3, 0xc0044dff, &(0x7f0000000180)=0x4) ioctl$SNDCTL_DSP_SYNC(r3, 0x5001, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, &(0x7f0000000040)) open(&(0x7f0000000080)='./file1\x00', 0x64842, 0x1a7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/tracing/trace_pipe\x00', 0x800, 0x0) 4.991930745s ago: executing program 5 (id=681): write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x4e24, 0x40003, @mcast1}, {0x2, 0xfff9, 0xc60, @remote, 0x9}, 0xffffffffffffffff, 0x9dffffff}}, 0x48) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000001540)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, &(0x7f0000000540)={0x34, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x6}, 0x0, 0x0, 0x0}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x20042, 0x0) syz_ublk_setup_queues(r5, r4, &(0x7f0000000340)={0x0, 0x3, 0x10, 0x8001, 0x257, 0x0, r5}, &(0x7f0000000580)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5020, 0x20, 0x1000000, 0x4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x20, 0x0, 0x22a}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f6d, 0x4000, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xb4ac, 0x8, 0x8, 0x9d7c, 0x0, r0}}], 0x1, &(0x7f00000014c0)={0x2e, 0x0, 0x0, r5, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, '\x00', {0x1, 0x5, 0x0, 0x0}}, 0x0) syz_usb_connect(0x0, 0x40, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000407205feca00000000000109022e0001010080fa0904000004ffffff000705810340000107050103"], 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$DRM_IOCTL_GET_CLIENT(r5, 0xc0286405, &(0x7f0000000000)={0x0, 0xac, {}, {}, 0x22}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x400, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x28100, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) prlimit64(0x0, 0x5, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r7 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioprio_set$pid(0x2, 0x0, 0x2000) socket$nl_netfilter(0x10, 0x3, 0xc) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(0x0, 0x1d5) mount$overlay(0x0, 0x0, &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r8 = open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6) write$FUSE_CREATE_OPEN(r8, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x4, 0x1, 0x5, 0x1, 0x3, 0x4, {0x1, 0xfd, 0x20ff, 0x9, 0xe, 0xd615, 0x9, 0x3, 0xfffffffc, 0x6000, 0x0, 0x0, 0x0, 0x2, 0x7}}, {0x0, 0x13}}}, 0xa0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) 4.238013001s ago: executing program 0 (id=682): r0 = io_uring_setup(0x68ca, &(0x7f0000000d80)={0x0, 0x2e19, 0x1, 0x3, 0x258}) io_uring_register$IORING_REGISTER_PROBE(r0, 0x8, 0xffffffffffffffff, 0x0) 4.117431662s ago: executing program 4 (id=683): socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x76798000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r3, 0x11c, 0x4, 0x0, 0x0) getpid() r4 = syz_open_dev$dvb_frontend(&(0x7f0000000040), 0x0, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4038587a, &(0x7f0000000380)={{r4, 0x0, 0x101, &(0x7f00000000c0)={@align=0x7, {0x99, 0x80, 0x1, 0xfffffffffffffffd}}, 0x0, 0x0, 0x0}, {[0x3, 0xb, 0xd3f, 0x77c]}, 0x7, 0x0, 0x0}) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, r6, 0x800, 0x55007}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 2.981385592s ago: executing program 0 (id=684): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d40)={0x3, 0xc, &(0x7f0000000700)=ANY=[@ANYRES16=0x0, @ANYRES16=0xffffffffffffffff, @ANYBLOB="2d4f8eadc8926f7ae71f0a34b7e11743a5fdba9a3aa7a8d72961f7a8a1741a183d8f9dca485e322648d54893", @ANYRESDEC], &(0x7f0000000040)='syzkaller\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0x21}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket(0x2, 0x80805, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000300), 0x103000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="300000001000010029bd7000f9dbdf2500007300bb7590e4786f862436a0c559346dc3c2d9b3e09a59ed188caabb24f7839c6d02ecaa3bed6f8dbf95cda457aa267b5fdb0963a5620a8f8b10e5c6d86f792ac12799ee458f434d3e9becb01417b246079c4aeec87dc2cef1ce35d388808c762ad7dabf12dd63", @ANYRESOCT=r3, @ANYRESHEX=r0], 0x30}, 0x1, 0x0, 0x0, 0x64}, 0x4028000) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640), 0x1, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r8 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000680), 0x1, 0x0) writev(r8, &(0x7f00000025c0)=[{&(0x7f0000000240)='4', 0x1}, {0x0, 0x900}], 0x2) ioctl$INCFS_IOC_PERMIT_FILL(r2, 0x40046721, &(0x7f0000000340)={r3}) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x620}) ioctl$XFS_IOC_PATH_TO_HANDLE(r3, 0xc0385869, &(0x7f0000000540)={r7, &(0x7f00000003c0)='/dev/snd/midiC#D#\x00', 0x70100, &(0x7f0000000440)={@_ha_fsid={[0x866c]}, {0x3, 0x4bcf, 0xffffffff, 0xfffffffffffffffe}}, 0xcd, &(0x7f0000000600), &(0x7f0000000500)=0x2}) r9 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) tkill(r9, 0xb) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e23, @multicast2}}, 0x1ff, 0x86}, 0x90) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/fcloop/ctl/add_target_port\x00', 0x0, 0x63) write(r10, &(0x7f0000000400)='wwnn=0x3333333333333333,wwpn=0x4444444444444444', 0x2f) sendto$inet(r10, &(0x7f0000000100)="65b7e02057b4f1651e330a8ec721b1cb40b0d2455524180fbf4f392e6bcbcf2f491d28a15ea7d593adea3b49b222522fc4c5caeb5f730b628bf17caa40a9d4752cad1474556514f61a459e3a4fba6f69c251ac4e41", 0x55, 0x4000040, &(0x7f00000005c0)={0x2, 0x4e21, @loopback}, 0x10) 2.581215393s ago: executing program 1 (id=685): r0 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="9f013064026778b3eb0400001d90f19c0009051848c9292faae6fa376c55a21a0981af534a1896081fa9875c291a48497d97870d9ffdac7f350398ffad28308b860135180b7806d0256170737af8106099b2e5096fcd0f92b5e223ac67bf0300000000000000"], 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_connect$uac1(0x3, 0xb8, &(0x7f0000000280)=ANY=[@ANYBLOB="1201500200000010820514014000010203010902a60003010110020904000000010100000a2401020029000201020b240402062974f2ee440a092407030100742f590b240606010201000900030904010000010200000904010101010200000b240201d80109027960340924020101010dcbdc0a240201030407"], 0x0) r3 = open(&(0x7f0000000340)='./bus\x00', 0x14927e, 0x102) fallocate(r3, 0x0, 0x0, 0x1000f4) setns(0xc9, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="bc000000", @ANYRES16=r4, @ANYBLOB="050029bd7000000000002e00000008000300", @ANYRES32=r5, @ANYBLOB="2a00fe002bd45fc836f5980d9519b6cf0594a40cbd056ce1f0d422f4b890f3ce21aaa10ef658400a53d100000400670053001501ea2a374d2dce5307f33c021040fb51d91fb8bb33c3fc9f8ce03a4ed37a03bdc071ab0fad57b33a9930e2a4be9c434f7d123a6e7b51bf8658f3d6b8286a6f479176a2c5d19f8fc6d3c816cc1a8c74e1a0d40005000000040000000a004f0050505050505000000800c9009409"], 0xbc}, 0x1, 0x0, 0x0, 0x200048d0}, 0x40000) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x0, 0x4, 0x0, "e83ae75240c2d6d8ec87bb53679fd0450078548ceb6c4414fab091000000000000000776aea5922406b64cddaeb9d339ba3c01c2c7d0df8e61740b9af2d4e499d58654a4cf0fa0ce1f830c3279cffcfd"}, 0xd8) setsockopt$inet_tcp_int(r6, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r6, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r6, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0xd007) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000600)={0x0, 0x0, 0x9, 0x0, '\x00', [{0xa1, 0x73, 0x8, 0x80000000, 0x4000000003, 0x4000400000000000}, {0x81, 0x2, 0x8001, 0x1ec, 0x7ff, 0x6}], ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) syz_usb_connect$hid(0x4, 0xfffffffffffffeb4, 0x0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xbb, &(0x7f00000004c0)=@string={0x0, 0x3, "8d6e4abaf8999cc06d1efcac29b1a16e66497577ea212ae86dbc89bfb0d87229df7455273b515527427e41e448edec56994d40f919e2b79c66357b0b6775933da2ace3bd3f864004c6821f87323a170638c851948b0dfbb7982718b0d712cc65fa0cda367e57843f404bf9571f3a18304629414cf8f3cd45b9a474834070ceda9f"}}]}) syz_usb_ep_write(r1, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") syz_usb_connect(0x3, 0x24, &(0x7f0000000980)=ANY=[@ANYBLOB="1201500663605d20da0b53810b6f0102600000000000000000000055ce6080d0572b190671c80c7bb4dd6a656fde731937d6e8575fbe562d2e2bf98d506f2eb7152e2417d52aa2579e5edd595d2f4df1e27185305582b1fb2a83f90bb2bbbe9f7037f18956e08cce3cb104d146d8f96430413c200127a5616173277cb58a3a56f5886e312af89d11228da44dcdec138874fb9667d2c8858e586982aa8ec60e469ccff74947ac28667e6d9ff85134e05ce83f5882d4128ab21d7ad387e531488465b6a3d1c6550ebef4aba1aa50df0c1df3380f926fa410bfcd5ce741710509abb10e6536001852f792e68f28fa7033082d5638164db44dc7d3"], &(0x7f0000001140)={0x0, 0x0, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="050f0500aa"]}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r7, 0x107, 0x8, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) 2.004143429s ago: executing program 2 (id=686): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/intel_xhci_usb_sw/uevent\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='a', 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x12, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x6e, '\x00', 0x0, 0x13}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0xfdd6, &(0x7f00000007c0)=ANY=[@ANYBLOB="120110033ad7cd0872361a1f4bcd35d046010c14005a450102030109022400012108200f0904c70f00c6622307000125c4439014964109d803c00a9bd5dc329efdaa14aaa1f41f546a2ed200f0dfba03b17e8697294a6a62b36edb9d0daa38d7ba7cbe068a813d4fd650617bf6c01ea6f80cb3ef2eecfa4884458a16f0976c12da9f552be0ef36a59de6809248e897ca5157947e1483c8d36840495a7cf947f128dbf418720fd6d9d5f2e96912a5cc8e19c4ad2d69efb6ab04df20ab7d22"], 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x80000004, 0x30}, &(0x7f0000000300)=0xb) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000340)={r2, 0x76, "207abe5cc2e20810c8a0cf0e4c1c594366dee6a63796c5f46bdefe2aa81a7d73880d129efada65b87f59332fd73e76cfe54ce11cbac8409215772718880750795f8e032400238eb6594fcf2ccb60b540caa0fd6353bb57b08077faaf11196d8db3b66788ebf6ce67dcadffabb7000000000000000000"}, &(0x7f0000000440)=0x7e) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbhid/remove_id\x00', 0x1, 0x0) write(r3, &(0x7f0000000200)='1234 ', 0x5) r4 = socket$nl_route(0x10, 0x3, 0x0) fsconfig$FSCONFIG_SET_PATH(r3, 0x3, &(0x7f0000000140)='syzkaller0\x00', &(0x7f0000000180)='./sys/bus/usb/drivers/usbhid/remove_id\x00', r3) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f00000002c0)={0x0, 'syzkaller0\x00', {0x1}, 0xb5}) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r5, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r5, 0x7a0, &(0x7f0000000000)={@hyper, 0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r5, 0x7a8, &(0x7f0000000080)={{@local, 0x2}, @local, 0x0, 0x0, 0x5e, 0x200000000000, 0x100000000000006}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r5, 0x7a4, &(0x7f0000000540)={{@local, 0x2}, 0x0, 0x9, 0xffffffff, 0x40}) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x460200, 0x0) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff00000000000109022d000100000000090400001503000000092140000001220f00090581", @ANYRES8], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x410, &(0x7f0000000200)={0x2, 0x4, 0x1000000000000001, 0x9b}) syz_usb_control_io(r6, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f"], 0x0, 0x0, 0x0, 0x0}, 0x0) 705.181101ms ago: executing program 0 (id=687): r0 = socket$kcm(0x10, 0x2, 0x4) r1 = msgget$private(0x0, 0x4c0) msgsnd(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="02"], 0x107, 0x800) msgrcv(r1, &(0x7f0000000240)={0x0, ""/89}, 0x61, 0xd9fb39b35f04228c, 0x1800) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xf, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70200001c9e2f43b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r3, 0x4) r4 = socket$inet_icmp(0x2, 0x2, 0x1) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x320, &(0x7f0000000180)=[{&(0x7f0000000340)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f1400000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec001210000140090c0c00bdad446b9bbc7a46e39882a5dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1, 0x0, 0x0, 0xff0f0000}, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) syz_open_procfs(r5, &(0x7f00000001c0)='net/xfrm_stat\x00') 307.031715ms ago: executing program 5 (id=688): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = gettid() prlimit64(0x0, 0x0, &(0x7f00000000c0)={0x19, 0xffffffffffffffff}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x6, 0x7fc00100}]}) bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0) tkill(r1, 0x7) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r2, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0xf, 0x6, 0x0, 0x0, 0x0, {0xa, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6, 0xb, 0xffffffffffffffff}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x40010) setitimer(0x1, &(0x7f0000000080)={{0x77359400}, {0x0, 0xea60}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 257.441716ms ago: executing program 0 (id=689): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000400)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r3, 0x10, &(0x7f0000000140)) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) read(0xffffffffffffffff, &(0x7f00000002c0)=""/10, 0x5b) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_MEMORY_ENCRYPT_UNREG_REGION(0xffffffffffffffff, 0x8010aebc, &(0x7f0000000040)={0x30000, 0x7000}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r7 = accept4$alg(r6, 0x0, 0x0, 0x80800) sendmmsg$alg(r7, &(0x7f0000000280)=[{0x0, 0x0, &(0x7f0000004100)=[{&(0x7f0000000100)="a92e81d0991828e33c2330164cf023df", 0x10}], 0x1, 0x0, 0x0, 0x20004801}], 0x1, 0x40000) recvmmsg(r7, &(0x7f0000002740)=[{{0x0, 0x0, &(0x7f0000002280)=[{&(0x7f0000000380)=""/139, 0x8b}], 0x1}, 0x6}], 0x1, 0x40002120, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r8, 0x4048aecb, &(0x7f0000000180)={0x4, 0x0, [{0x0, 0x0, 0x4, 0xb, 0x0, 0x10}, {0x0, 0x6}, {0x80000019, 0xffffffff, 0x0, 0x9, 0x1, 0x80000001, 0x8}, {0x80000001, 0xffffffff, 0x6, 0x8, 0x5, 0x111, 0x1}]}) 234.936387ms ago: executing program 4 (id=690): r0 = syz_usb_connect(0x2, 0x3f, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$FS_IOC_GETVERSION(r1, 0x40025b0c, &(0x7f0000000040)) 0s ago: executing program 0 (id=691): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x1fd2, 0x6007, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x50, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x4, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0xfc, 0x2, 0x7}}}}}]}}]}}, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)='fd/3\x00') socket(0x1d, 0x2, 0x6) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) kernel console output (not intermixed with test programs): screwing up backlog [ 199.310921][ T5734] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 199.461247][ T5688] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 199.506956][ T7514] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 199.528605][ T30] corsair-cpro 0003:1B1C:0C10.0016: unknown main item tag 0x0 [ 199.528654][ T30] corsair-cpro 0003:1B1C:0C10.0016: unknown main item tag 0x0 [ 199.528675][ T30] corsair-cpro 0003:1B1C:0C10.0016: unknown main item tag 0x0 [ 199.528691][ T30] corsair-cpro 0003:1B1C:0C10.0016: unknown main item tag 0x0 [ 199.528709][ T30] corsair-cpro 0003:1B1C:0C10.0016: unknown main item tag 0x0 [ 199.544652][ T30] corsair-cpro 0003:1B1C:0C10.0016: hidraw0: USB HID v4.06 Device [HID 1b1c:0c10] on usb-dummy_hcd.1-1/input0 [ 199.624491][ T30] corsair-cpro 0003:1B1C:0C10.0016: probe with driver corsair-cpro failed with error -38 [ 199.726615][ T5608] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 199.774425][ T31] audit: type=1400 audit(1788009156.854:568): avc: denied { write } for pid=7487 comm="syz.1.392" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 199.800609][ T5703] usb 2-1: USB disconnect, device number 27 [ 199.856011][ T7522] fido_id[7522]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 199.918431][ T7518] netlink: 'syz.2.401': attribute type 1 has an invalid length. [ 199.988991][ T7529] netlink: 16 bytes leftover after parsing attributes in process `syz.2.401'. [ 200.076268][ T7532] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 201.095245][ T7529] ip6erspan0: entered promiscuous mode [ 201.105262][ T7518] netlink: 16 bytes leftover after parsing attributes in process `syz.2.401'. [ 201.436352][ T7513] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 202.283681][ T7557] FAULT_INJECTION: forcing a failure. [ 202.283681][ T7557] name failslab, interval 1, probability 0, space 0, times 0 [ 202.283731][ T7557] CPU: 0 UID: 0 PID: 7557 Comm: syz.2.413 Tainted: G L syzkaller #0 PREEMPT(full) [ 202.283756][ T7557] Tainted: [L]=SOFTLOCKUP [ 202.283762][ T7557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 202.283776][ T7557] Call Trace: [ 202.283781][ T7557] [ 202.283787][ T7557] dump_stack_lvl+0x100/0x190 [ 202.283813][ T7557] should_fail_ex.cold+0x5/0xa [ 202.283837][ T7557] should_failslab+0xc2/0x120 [ 202.283859][ T7557] __kmalloc_noprof+0xfc/0x840 [ 202.283876][ T7557] ? __memcg_list_lru_alloc+0x418/0x680 [ 202.283902][ T7557] __memcg_list_lru_alloc+0x418/0x680 [ 202.283923][ T7557] ? xa_load+0x149/0x2c0 [ 202.283947][ T7557] ? __pfx___memcg_list_lru_alloc+0x10/0x10 [ 202.283980][ T7557] memcg_list_lru_alloc+0xd3/0x100 [ 202.284003][ T7557] ? zswap_store+0x60a/0x2e70 [ 202.284024][ T7557] zswap_store+0x696/0x2e70 [ 202.284053][ T7557] ? lock_acquire+0x1d1/0x380 [ 202.284070][ T7557] ? __pfx_zswap_store+0x10/0x10 [ 202.284092][ T7557] ? lock_acquire+0x1d1/0x380 [ 202.284108][ T7557] ? do_raw_spin_lock+0x128/0x260 [ 202.284128][ T7557] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 202.284147][ T7557] ? find_held_lock+0x2b/0x80 [ 202.284180][ T7557] ? swap_writeout+0xdd8/0x1b20 [ 202.284201][ T7557] ? swap_writeout+0xdd8/0x1b20 [ 202.284228][ T7557] swap_writeout+0xde0/0x1b20 [ 202.284262][ T7557] shrink_folio_list+0x4ffb/0x5e40 [ 202.284291][ T7557] ? __pfx_shrink_folio_list+0x10/0x10 [ 202.284308][ T7557] ? lock_acquire+0x1d1/0x380 [ 202.284323][ T7557] ? unwind_next_frame+0xbd/0x2090 [ 202.284348][ T7557] ? unwind_next_frame+0xbd/0x2090 [ 202.284370][ T7557] ? find_held_lock+0x2b/0x80 [ 202.284390][ T7557] ? unwind_next_frame+0x3be/0x2090 [ 202.284415][ T7557] ? unwind_next_frame+0x3c8/0x2090 [ 202.284452][ T7557] ? __lock_acquire+0x4c5/0x1ec0 [ 202.284468][ T7557] ? __css_rstat_updated+0x1ce/0x590 [ 202.284487][ T7557] ? stack_depot_save_flags+0x27/0x9f0 [ 202.284505][ T7557] ? __pfx___css_rstat_updated+0x10/0x10 [ 202.284526][ T7557] reclaim_folio_list+0xe9/0x5e0 [ 202.284548][ T7557] ? __pfx_reclaim_folio_list+0x10/0x10 [ 202.284566][ T7557] ? __mod_memcg_lruvec_state+0x18c/0x5b0 [ 202.284593][ T7557] ? lru_gen_update_size+0x431/0xe20 [ 202.284615][ T7557] ? lru_gen_del_folio+0x382/0x5f0 [ 202.284634][ T7557] reclaim_pages+0x428/0x5e0 [ 202.284656][ T7557] ? __pfx_reclaim_pages+0x10/0x10 [ 202.284675][ T7557] ? find_held_lock+0x2b/0x80 [ 202.284696][ T7557] ? madvise_cold_or_pageout_pte_range+0xb8e/0x27b0 [ 202.284721][ T7557] madvise_cold_or_pageout_pte_range+0x15b5/0x27b0 [ 202.284750][ T7557] ? rcu_read_unlock+0x17/0x60 [ 202.284772][ T7557] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 202.284794][ T7557] ? __mod_zone_page_state+0xdb/0x190 [ 202.284820][ T7557] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 202.284842][ T7557] walk_pgd_range+0xbef/0x1e00 [ 202.284871][ T7557] ? find_held_lock+0x2b/0x80 [ 202.284899][ T7557] ? __pfx_walk_pgd_range+0x10/0x10 [ 202.284924][ T7557] ? __pfx_folio_batch_move_lru+0x10/0x10 [ 202.284948][ T7557] __walk_page_range+0x171/0x850 [ 202.284982][ T7557] walk_page_range_vma_unsafe+0x209/0x8f0 [ 202.285009][ T7557] ? __pfx_walk_page_range_vma_unsafe+0x10/0x10 [ 202.285038][ T7557] ? find_held_lock+0x2b/0x80 [ 202.285058][ T7557] ? mlock_drain_local+0x254/0x4e0 [ 202.285079][ T7557] ? mlock_drain_local+0x254/0x4e0 [ 202.285105][ T7557] walk_page_range_vma+0x63/0x90 [ 202.285131][ T7557] madvise_pageout+0x29e/0x5b0 [ 202.285150][ T7557] ? __lock_acquire+0x4c5/0x1ec0 [ 202.285166][ T7557] ? __pfx_madvise_pageout+0x10/0x10 [ 202.285194][ T7557] ? find_held_lock+0x2b/0x80 [ 202.285214][ T7557] ? mt_find+0x728/0x9b0 [ 202.285232][ T7557] ? mt_find+0x728/0x9b0 [ 202.285257][ T7557] madvise_vma_behavior+0x48b/0x2350 [ 202.285282][ T7557] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 202.285307][ T7557] ? find_vma_prev+0xd8/0x150 [ 202.285329][ T7557] ? find_vma+0xbf/0x140 [ 202.285344][ T7557] ? __pfx_find_vma+0x10/0x10 [ 202.285361][ T7557] ? lock_acquire+0x1d1/0x380 [ 202.285379][ T7557] madvise_walk_vmas+0x30e/0xc50 [ 202.285403][ T7557] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 202.285431][ T7557] ? lock_acquire+0x1d1/0x380 [ 202.285449][ T7557] madvise_do_behavior+0x1ea/0x510 [ 202.285472][ T7557] ? __pfx_madvise_do_behavior+0x10/0x10 [ 202.285493][ T7557] ? down_read+0x13b/0x4c0 [ 202.285523][ T7557] do_madvise+0x238/0x290 [ 202.285543][ T7557] ? __pfx_do_madvise+0x10/0x10 [ 202.285568][ T7557] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 202.285594][ T7557] ? ksys_write+0x1ac/0x250 [ 202.285609][ T7557] ? __pfx_ksys_write+0x10/0x10 [ 202.285627][ T7557] __x64_sys_madvise+0xa9/0x110 [ 202.285647][ T7557] ? lockdep_hardirqs_on+0x7d/0x110 [ 202.285664][ T7557] do_syscall_64+0x123/0x790 [ 202.285683][ T7557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 202.285700][ T7557] RIP: 0033:0x7fcf8c99e159 [ 202.285713][ T7557] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 202.285728][ T7557] RSP: 002b:00007fcf8d935028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 202.285744][ T7557] RAX: ffffffffffffffda RBX: 00007fcf8cc25fa0 RCX: 00007fcf8c99e159 [ 202.285755][ T7557] RDX: 0000000000000015 RSI: 7fffffffffffffff RDI: 0000200000000000 [ 202.285765][ T7557] RBP: 00007fcf8d935090 R08: 0000000000000000 R09: 0000000000000000 [ 202.285774][ T7557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 202.285784][ T7557] R13: 00007fcf8cc26038 R14: 00007fcf8cc25fa0 R15: 00007fff12ebc798 [ 202.285805][ T7557] [ 202.881057][ T7563] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 202.881083][ T7563] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 202.887196][ T7567] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.417'. [ 202.909995][ T7563] vhci_hcd vhci_hcd.0: Device attached [ 203.061799][ T7574] netlink: 656 bytes leftover after parsing attributes in process `syz.5.419'. [ 203.161701][ T5703] net_ratelimit: 6 callbacks suppressed [ 203.161744][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 203.190370][ T5805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 203.289858][ T5731] usb 36-1: SetAddress Request (2) to port 0 [ 203.289942][ T5731] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd [ 203.347990][ T7579] tipc: Enabling of bearer rejected, failed to enable media [ 203.480254][ T7569] vhci_hcd: connection reset by peer [ 203.630473][ T7586] ======================================================= [ 203.630473][ T7586] WARNING: The mand mount option has been deprecated and [ 203.630473][ T7586] and is ignored by this kernel. Remove the mand [ 203.630473][ T7586] option from the mount to silence this warning. [ 203.630473][ T7586] ======================================================= [ 204.023085][ T1851] vhci_hcd vhci_hcd.1: stop threads [ 204.023713][ T1851] vhci_hcd vhci_hcd.1: release socket [ 204.028644][ T1851] vhci_hcd vhci_hcd.1: disconnect device [ 204.169724][ T5805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 204.498904][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 204.950545][ T7600] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 204.969191][ T5688] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 205.409083][ T5688] usb 6-1: device descriptor read/64, error -71 [ 205.448810][ T31] audit: type=1400 audit(1788009162.524:569): avc: denied { write } for pid=7602 comm="syz.0.428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 205.476679][ T7603] netlink: 40 bytes leftover after parsing attributes in process `syz.0.428'. [ 205.486248][ T5703] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 205.499417][ T1816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 205.533204][ T7564] orangefs_mount: mount request failed with -4 [ 205.729387][ T5703] usb 5-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 205.738032][ T5703] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 205.738089][ T5703] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 205.738130][ T5703] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.086591][ T7607] FAULT_INJECTION: forcing a failure. [ 206.086591][ T7607] name failslab, interval 1, probability 0, space 0, times 0 [ 206.086626][ T7607] CPU: 1 UID: 0 PID: 7607 Comm: syz.2.429 Tainted: G L syzkaller #0 PREEMPT(full) [ 206.086641][ T7607] Tainted: [L]=SOFTLOCKUP [ 206.086645][ T7607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 206.086652][ T7607] Call Trace: [ 206.086656][ T7607] [ 206.086661][ T7607] dump_stack_lvl+0x100/0x190 [ 206.086682][ T7607] should_fail_ex.cold+0x5/0xa [ 206.086698][ T7607] should_failslab+0xc2/0x120 [ 206.086712][ T7607] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 206.086725][ T7607] ? shmem_huge_global_enabled.isra.0+0x6c/0x210 [ 206.086739][ T7607] ? ima_collect_measurement+0x531/0xb30 [ 206.086756][ T7607] krealloc_node_align_noprof+0x321/0x3e0 [ 206.086770][ T7607] ima_collect_measurement+0x531/0xb30 [ 206.086785][ T7607] ? __pfx_ima_collect_measurement+0x10/0x10 [ 206.086796][ T7607] ? jhash+0x50c/0x610 [ 206.086817][ T7607] ? process_measurement+0x5ab/0x2350 [ 206.086838][ T7607] ? vfs_getxattr_alloc+0x1ba/0x350 [ 206.086851][ T7607] ? vfs_getxattr_alloc+0xec/0x350 [ 206.086867][ T7607] ? ima_get_hash_algo+0x241/0x400 [ 206.086882][ T7607] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 206.086900][ T7607] ? process_measurement+0xdfe/0x2350 [ 206.086916][ T7607] process_measurement+0xdfe/0x2350 [ 206.086937][ T7607] ? avc_has_perm_noaudit+0x145/0x3b0 [ 206.086950][ T7607] ? __pfx_process_measurement+0x10/0x10 [ 206.086969][ T7607] ? __pfx_avc_has_perm+0x10/0x10 [ 206.086982][ T7607] ? avc_has_perm_noaudit+0x56/0x3b0 [ 206.086995][ T7607] ? find_held_lock+0x2b/0x80 [ 206.087023][ T7607] ? __file_map_prot_check+0x256/0x830 [ 206.087038][ T7607] ima_file_mmap+0x1bb/0x1e0 [ 206.087055][ T7607] ? __pfx_ima_file_mmap+0x10/0x10 [ 206.087075][ T7607] ? proc_fail_nth_write+0x9f/0x220 [ 206.087089][ T7607] ? find_held_lock+0x2b/0x80 [ 206.087105][ T7607] security_mmap_file+0x278/0x9b0 [ 206.087117][ T7607] vm_mmap_pgoff+0xec/0x470 [ 206.087129][ T7607] ? find_held_lock+0x2b/0x80 [ 206.087144][ T7607] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 206.087154][ T7607] ? __fget_files+0x215/0x3d0 [ 206.087169][ T7607] ? __fget_files+0x21f/0x3d0 [ 206.087183][ T7607] ksys_mmap_pgoff+0x3cb/0x610 [ 206.087197][ T7607] ? __pfx_ksys_mmap_pgoff+0x10/0x10 [ 206.087208][ T7607] ? fput+0x7c/0x100 [ 206.087220][ T7607] ? ksys_write+0x1ac/0x250 [ 206.087230][ T7607] ? __pfx_ksys_write+0x10/0x10 [ 206.087241][ T7607] __x64_sys_mmap+0x125/0x190 [ 206.087261][ T7607] do_syscall_64+0x123/0x790 [ 206.087275][ T7607] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 206.087287][ T7607] RIP: 0033:0x7fcf8c99e159 [ 206.087297][ T7607] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 206.087308][ T7607] RSP: 002b:00007fcf8d935028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 206.087319][ T7607] RAX: ffffffffffffffda RBX: 00007fcf8cc25fa0 RCX: 00007fcf8c99e159 [ 206.087326][ T7607] RDX: 000000000200000c RSI: 0000000000003000 RDI: 0000200000001000 [ 206.087333][ T7607] RBP: 00007fcf8d935090 R08: 0000000000000004 R09: 0000000000002000 [ 206.087340][ T7607] R10: 0000000000000013 R11: 0000000000000246 R12: 0000000000000001 [ 206.087346][ T7607] R13: 00007fcf8cc26038 R14: 00007fcf8cc25fa0 R15: 00007fff12ebc798 [ 206.087360][ T7607] [ 206.320488][ T31] audit: type=1800 audit(1788009163.164:570): pid=7607 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.429" name="file1" dev="tmpfs" ino=518 res=0 errno=0 [ 206.557247][ T5688] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 206.691271][ T30] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 206.709170][ T5703] usb 5-1: config 0 descriptor?? [ 206.849089][ T5688] usb 6-1: device descriptor read/64, error -71 [ 206.960184][ T5688] usb usb6-port1: attempt power cycle [ 207.180081][ T31] audit: type=1400 audit(1788009164.264:571): avc: denied { create } for pid=7598 comm="syz.4.427" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 207.229357][ T5734] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 207.277986][ T7622] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.278489][ T7622] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.299783][ T5688] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 207.329406][ T5688] usb 6-1: device descriptor read/8, error -71 [ 207.912727][ T1816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 208.884668][ T5805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 208.886188][ T5731] usb 36-1: device descriptor read/8, error -110 [ 208.940963][ T4928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 208.946676][ T31] audit: type=1400 audit(1788009166.024:572): avc: denied { setopt } for pid=7626 comm="syz.2.435" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 208.965590][ T31] audit: type=1400 audit(1788009166.044:573): avc: denied { write } for pid=7626 comm="syz.2.435" path="socket:[19663]" dev="sockfs" ino=19663 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 209.337675][ T5703] usbhid 5-1:0.0: can't add hid device: -71 [ 209.337769][ T5703] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 209.345645][ T5703] usb 5-1: USB disconnect, device number 15 [ 209.543142][ T31] audit: type=1400 audit(1788009166.624:574): avc: denied { create } for pid=7639 comm="syz.4.440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 209.553092][ T5731] usb usb36-port1: attempt power cycle [ 209.572816][ T31] audit: type=1400 audit(1788009166.654:575): avc: denied { write } for pid=7639 comm="syz.4.440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 209.633413][ T7645] FAULT_INJECTION: forcing a failure. [ 209.633413][ T7645] name failslab, interval 1, probability 0, space 0, times 0 [ 209.646229][ T7645] CPU: 0 UID: 0 PID: 7645 Comm: syz.1.441 Tainted: G L syzkaller #0 PREEMPT(full) [ 209.646257][ T7645] Tainted: [L]=SOFTLOCKUP [ 209.646263][ T7645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 209.646274][ T7645] Call Trace: [ 209.646280][ T7645] [ 209.646288][ T7645] dump_stack_lvl+0x100/0x190 [ 209.646319][ T7645] should_fail_ex.cold+0x5/0xa [ 209.646347][ T7645] should_failslab+0xc2/0x120 [ 209.646369][ T7645] __kmalloc_noprof+0xfc/0x840 [ 209.646387][ T7645] ? rcu_is_watching+0x13/0xc0 [ 209.646411][ T7645] ? tomoyo_realpath_from_path+0xb6/0x690 [ 209.646437][ T7645] tomoyo_realpath_from_path+0xb6/0x690 [ 209.646462][ T7645] tomoyo_check_open_permission+0x2af/0x3c0 [ 209.646489][ T7645] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 209.646524][ T7645] ? hook_file_open+0x248/0x8e0 [ 209.646564][ T7645] ? path_get+0x61/0x80 [ 209.646589][ T7645] tomoyo_file_open+0x6b/0x90 [ 209.646612][ T7645] security_file_open+0xb5/0x1e0 [ 209.646631][ T7645] do_dentry_open+0x588/0x14d0 [ 209.646654][ T7645] vfs_open+0x82/0x3f0 [ 209.646680][ T7645] path_openat+0x19fa/0x2440 [ 209.646705][ T7645] ? __pfx_path_openat+0x10/0x10 [ 209.646732][ T7645] do_file_open+0x20e/0x430 [ 209.646754][ T7645] ? __pfx_do_file_open+0x10/0x10 [ 209.646789][ T7645] ? _raw_spin_unlock+0x28/0x50 [ 209.646823][ T7645] ? alloc_fd+0x471/0x7a0 [ 209.646850][ T7645] do_sys_openat2+0x10f/0x1e0 [ 209.646873][ T7645] ? __pfx_do_sys_openat2+0x10/0x10 [ 209.646896][ T7645] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 209.646918][ T7645] ? __fget_files+0x21f/0x3d0 [ 209.646942][ T7645] __x64_sys_openat+0x12d/0x210 [ 209.646966][ T7645] ? __pfx___x64_sys_openat+0x10/0x10 [ 209.646988][ T7645] ? ksys_write+0x1ac/0x250 [ 209.647013][ T7645] do_syscall_64+0x123/0x790 [ 209.647035][ T7645] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 209.647053][ T7645] RIP: 0033:0x7f2b05f9e159 [ 209.647068][ T7645] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 209.647085][ T7645] RSP: 002b:00007f2b06f2e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 209.647102][ T7645] RAX: ffffffffffffffda RBX: 00007f2b06225fa0 RCX: 00007f2b05f9e159 [ 209.647113][ T7645] RDX: 0000000000000002 RSI: 0000200000000240 RDI: ffffffffffffff9c [ 209.647124][ T7645] RBP: 00007f2b06f2e090 R08: 0000000000000000 R09: 0000000000000000 [ 209.647134][ T7645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 209.647144][ T7645] R13: 00007f2b06226038 R14: 00007f2b06225fa0 R15: 00007ffd337d52c8 [ 209.647167][ T7645] [ 209.665129][ T7645] ERROR: Out of memory at tomoyo_realpath_from_path. [ 209.946355][ T31] audit: type=1400 audit(1788009167.024:576): avc: denied { mount } for pid=7653 comm="syz.2.442" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 209.981360][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 210.132689][ T31] audit: type=1400 audit(1788009167.214:577): avc: denied { ioctl } for pid=7653 comm="syz.2.442" path="socket:[19762]" dev="sockfs" ino=19762 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 210.436480][ T5805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 210.451239][ T7658] ubi: mtd0 is already attached to ubi0 [ 210.750884][ T5731] usb usb36-port1: unable to enumerate USB device [ 211.484059][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 211.536720][ T31] audit: type=1400 audit(1788009168.614:578): avc: denied { unmount } for pid=5601 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 212.533212][ T7681] netlink: 616 bytes leftover after parsing attributes in process `syz.2.451'. [ 212.555066][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 213.501238][ T5688] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 213.601390][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 213.730565][ T7704] ubi: mtd0 is already attached to ubi0 [ 214.380848][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 214.384266][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 214.402413][ T7025] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 214.405260][ T5805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 214.419265][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 214.627322][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 215.561739][ T5608] Bluetooth: hci4: Malformed HCI Event: 0x22 [ 215.665832][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 215.719536][ T7734] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 215.909291][ T5703] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 216.139449][ T5703] usb 2-1: Using ep0 maxpacket: 32 [ 216.146496][ T5703] usb 2-1: unable to get BOS descriptor or descriptor too short [ 216.146550][ T5703] usb 2-1: New USB device found, idVendor=0458, idProduct=7003, bcdDevice=fc.62 [ 216.165683][ T5703] usb 2-1: config 8 has an invalid interface number: 94 but max is 0 [ 216.165721][ T5703] usb 2-1: config 8 has no interface number 0 [ 216.165761][ T5703] usb 2-1: config 8 interface 94 has no altsetting 0 [ 216.193352][ T5703] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.193390][ T5703] usb 2-1: Product: syz [ 216.193423][ T5703] usb 2-1: Manufacturer: syz [ 216.193439][ T5703] usb 2-1: SerialNumber: syz [ 216.475155][ T5703] gspca_main: sn9c2028-2.14.0 probing 0458:7003 [ 216.484302][ T5703] gspca_sn9c2028: read1 error -71 [ 216.489838][ T5703] gspca_sn9c2028: read1 error -71 [ 216.495540][ T5703] gspca_sn9c2028: read1 error -71 [ 216.502317][ T5703] sn9c2028 2-1:8.94: probe with driver sn9c2028 failed with error -71 [ 216.519293][ T5703] usb 2-1: USB disconnect, device number 28 [ 216.589119][ T5688] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 217.114378][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 217.179571][ T5688] usb 3-1: Using ep0 maxpacket: 8 [ 217.180357][ T5688] usb 3-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 217.181377][ T5688] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 217.181401][ T5688] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 217.181432][ T5688] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 217.200448][ T5688] usb 3-1: config 0 descriptor?? [ 217.500664][ T5805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 217.717199][ T7747] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 217.717578][ T7747] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.738307][ T5688] hid-multitouch 0003:1FD2:6007.0017: hidraw0: USB HID v0.00 Joystick [HID 1fd2:6007] on usb-dummy_hcd.2-1/input0 [ 218.109122][ T5688] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 218.161958][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 218.180346][ T5805] usb 3-1: USB disconnect, device number 28 [ 218.380920][ T5688] usb 1-1: Using ep0 maxpacket: 16 [ 218.388137][ T7782] ubi: mtd0 is already attached to ubi0 [ 218.397415][ T5688] usb 1-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 218.418335][ T5688] usb 1-1: config 0 interface 0 altsetting 183 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 218.429077][ T5703] usb 2-1: new low-speed USB device number 29 using dummy_hcd [ 218.432191][ T5688] usb 1-1: config 0 interface 0 has no altsetting 0 [ 218.434214][ T5688] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.550190][ T5688] usb 1-1: config 0 descriptor?? [ 218.632669][ T5703] usb 2-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 218.633525][ T5703] usb 2-1: config index 0 descriptor too short (expected 1307, got 27) [ 218.633545][ T5703] usb 2-1: config 0 has an invalid interface number: 0 but max is -1 [ 218.633563][ T5703] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 218.633587][ T5703] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 218.633617][ T5703] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 218.633635][ T5703] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 218.636070][ T5703] usb 2-1: string descriptor 0 read error: -22 [ 218.636164][ T5703] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.720996][ T5703] usb 2-1: config 0 descriptor?? [ 218.721663][ T7778] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 218.726193][ T5703] hub 2-1:0.0: bad descriptor, ignoring hub [ 218.726213][ T5703] hub 2-1:0.0: probe with driver hub failed with error -5 [ 218.744941][ T5703] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input23 [ 219.035513][ T5688] hid_mf 0003:0079:1846.0018: ignoring exceeding usage max [ 219.047321][ T5688] hid_mf 0003:0079:1846.0018: global environment stack underflow [ 219.049143][ T7778] netlink: 8 bytes leftover after parsing attributes in process `syz.1.485'. [ 219.049162][ T7778] netlink: 4 bytes leftover after parsing attributes in process `syz.1.485'. [ 219.049182][ T7778] netlink: 'syz.1.485': attribute type 11 has an invalid length. [ 219.049194][ T7778] netlink: 'syz.1.485': attribute type 7 has an invalid length. [ 219.089528][ T5688] hid_mf 0003:0079:1846.0018: item 0 2 1 11 parsing failed [ 219.094979][ T7778] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.095096][ T7778] bridge0: port 2(bridge_slave_1) entered forwarding state [ 219.096385][ T7778] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.096915][ T7778] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.126284][ T5688] hid_mf 0003:0079:1846.0018: HID parse failed. [ 219.133041][ T5688] hid_mf 0003:0079:1846.0018: probe with driver hid_mf failed with error -22 [ 219.236343][ T5731] usb 2-1: USB disconnect, device number 29 [ 219.328345][ T5703] usb 1-1: USB disconnect, device number 16 [ 219.809268][ T5731] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 219.959190][ T5731] usb 5-1: Using ep0 maxpacket: 16 [ 219.971303][ T5731] usb 5-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 219.988763][ T5731] usb 5-1: config 0 interface 0 altsetting 183 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 220.005167][ T5731] usb 5-1: config 0 interface 0 has no altsetting 0 [ 220.005303][ T5731] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.066741][ T5731] usb 5-1: config 0 descriptor?? [ 220.220948][ T5703] net_ratelimit: 2 callbacks suppressed [ 220.220994][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 220.534440][ T5731] hid_mf 0003:0079:1846.0019: ignoring exceeding usage max [ 220.544822][ T5731] hid_mf 0003:0079:1846.0019: global environment stack underflow [ 220.555648][ T5731] hid_mf 0003:0079:1846.0019: item 0 2 1 11 parsing failed [ 220.556167][ T5731] hid_mf 0003:0079:1846.0019: HID parse failed. [ 220.556226][ T5731] hid_mf 0003:0079:1846.0019: probe with driver hid_mf failed with error -22 [ 220.557046][ T5734] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 220.592385][ T5702] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 220.619083][ T5688] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 220.633266][ T31] audit: type=1400 audit(1788009177.714:579): avc: denied { shutdown } for pid=7812 comm="syz.1.498" laddr=::1 lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 220.749992][ T5702] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 220.760571][ T5702] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 220.770647][ T5702] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 220.784706][ T5702] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.789790][ T5688] usb 1-1: Using ep0 maxpacket: 16 [ 220.791733][ T5688] usb 1-1: unable to get BOS descriptor or descriptor too short [ 220.791766][ T5688] usb 1-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 220.792608][ T5688] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 220.792651][ T5688] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 220.792680][ T5688] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 220.794356][ T5688] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 220.794391][ T5688] usb 1-1: Product: syz [ 220.794403][ T5688] usb 1-1: Manufacturer: syz [ 220.794416][ T5688] usb 1-1: SerialNumber: syz [ 221.015360][ T5731] usb 5-1: USB disconnect, device number 16 [ 221.097162][ T5702] usb 3-1: usb_control_msg returned -32 [ 221.097218][ T5702] usbtmc 3-1:16.0: can't read capabilities [ 221.120461][ T7824] ubi: mtd0 is already attached to ubi0 [ 221.225457][ T7810] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.225889][ T7810] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.339181][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 221.340666][ T5688] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 221.340940][ T5688] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 221.467390][ T7810] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.467806][ T7810] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.664727][ T7830] overlayfs: failed to resolve './file2': -2 [ 221.752437][ T7831] FAULT_INJECTION: forcing a failure. [ 221.752437][ T7831] name failslab, interval 1, probability 0, space 0, times 0 [ 221.767117][ T7831] CPU: 1 UID: 0 PID: 7831 Comm: syz.4.502 Tainted: G L syzkaller #0 PREEMPT(full) [ 221.767147][ T7831] Tainted: [L]=SOFTLOCKUP [ 221.767154][ T7831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 221.767164][ T7831] Call Trace: [ 221.767170][ T7831] [ 221.767177][ T7831] dump_stack_lvl+0x100/0x190 [ 221.767210][ T7831] should_fail_ex.cold+0x5/0xa [ 221.767236][ T7831] should_failslab+0xc2/0x120 [ 221.767259][ T7831] __kmalloc_noprof+0xfc/0x840 [ 221.767276][ T7831] ? rcu_is_watching+0x13/0xc0 [ 221.767298][ T7831] ? tomoyo_realpath_from_path+0xb6/0x690 [ 221.767321][ T7831] tomoyo_realpath_from_path+0xb6/0x690 [ 221.767347][ T7831] tomoyo_path_number_perm+0x23c/0x580 [ 221.767373][ T7831] ? tomoyo_path_number_perm+0x22e/0x580 [ 221.767400][ T7831] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 221.767435][ T7831] ? __lock_acquire+0x4c5/0x1ec0 [ 221.767465][ T7831] ? __fget_files+0x34/0x3d0 [ 221.767494][ T7831] ? find_held_lock+0x2b/0x80 [ 221.767517][ T7831] ? hook_file_ioctl_common+0x140/0x440 [ 221.767543][ T7831] ? __fget_files+0x21f/0x3d0 [ 221.767564][ T7831] security_file_ioctl+0xd3/0x230 [ 221.767591][ T7831] __x64_sys_ioctl+0xb7/0x210 [ 221.767619][ T7831] do_syscall_64+0x123/0x790 [ 221.767640][ T7831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 221.767657][ T7831] RIP: 0033:0x7fd99139e159 [ 221.767671][ T7831] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 221.767687][ T7831] RSP: 002b:00007fd992256028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 221.767705][ T7831] RAX: ffffffffffffffda RBX: 00007fd991626090 RCX: 00007fd99139e159 [ 221.767715][ T7831] RDX: 0000000000000005 RSI: 0000000000006f2d RDI: 0000000000000003 [ 221.767725][ T7831] RBP: 00007fd992256090 R08: 0000000000000000 R09: 0000000000000000 [ 221.767736][ T7831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 221.767746][ T7831] R13: 00007fd991626128 R14: 00007fd991626090 R15: 00007fffb2849f88 [ 221.767770][ T7831] [ 221.803638][ T7831] ERROR: Out of memory at tomoyo_realpath_from_path. [ 221.825142][ T31] audit: type=1400 audit(1788009178.904:580): avc: denied { map } for pid=7818 comm="syz.5.500" path="socket:[19396]" dev="sockfs" ino=19396 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 222.085191][ T7835] overlayfs: failed to resolve './file2': -2 [ 222.379611][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 222.789111][ T5805] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 222.946326][ T5805] usb 6-1: unable to get BOS descriptor or descriptor too short [ 222.946784][ T5805] usb 6-1: not running at top speed; connect to a high speed hub [ 222.946806][ T5805] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 222.947687][ T5805] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 222.947722][ T5805] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 222.955179][ T5805] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.955223][ T5805] usb 6-1: Product: syz [ 222.955237][ T5805] usb 6-1: Manufacturer: syz [ 222.955251][ T5805] usb 6-1: SerialNumber: syz [ 223.250016][ T31] audit: type=1400 audit(1788009180.334:581): avc: denied { connect } for pid=7855 comm="syz.4.511" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 223.285465][ T5731] usb 3-1: USB disconnect, device number 29 [ 223.308401][ T31] audit: type=1400 audit(1788009180.384:582): avc: denied { getopt } for pid=7855 comm="syz.4.511" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 223.335684][ T5608] Bluetooth: hci1: link tx timeout [ 223.396935][ T5608] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 223.432666][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 223.467203][ T5805] usb 6-1: 0:2 : does not exist [ 223.482510][ T5805] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 223.492131][ T5805] usb 6-1: 5:0: cannot get min/max values for control 2 (id 5) [ 223.492168][ T5805] usb 6-1: Warning! Unlikely small volume range (=1), linear volume or custom curve? [ 223.492329][ T5805] usb 6-1: [5] FU [Mic Capture Volume] ch = 1, val = 0/1/1 [ 223.497218][ T5805] usb 6-1: 5:0: cannot get min/max values for control 3 (id 5) [ 223.506611][ T5805] usb 6-1: 5:0: failed to get current value for ch 1 (-22) [ 223.589105][ T4928] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 223.689473][ T191] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 223.700606][ T5805] usb 6-1: 5:0: cannot get min/max values for control 3 (id 5) [ 223.707675][ T5805] usb 6-1: 5:0: cannot get min/max values for control 2 (id 5) [ 223.724664][ T5805] usb 6-1: USB disconnect, device number 20 [ 223.740234][ T5731] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 223.789923][ T4928] usb 5-1: device descriptor read/64, error -71 [ 223.812669][ T7870] ubi: mtd0 is already attached to ubi0 [ 223.818305][ T5688] usb 1-1: USB disconnect, device number 17 [ 223.909312][ T5731] usb 3-1: Using ep0 maxpacket: 8 [ 223.915967][ T5731] usb 3-1: New USB device found, idVendor=110a, idProduct=1130, bcdDevice=b3.a3 [ 223.928552][ T5731] usb 3-1: config 2 has an invalid interface number: 241 but max is 0 [ 223.928590][ T5731] usb 3-1: config 2 has no interface number 0 [ 223.928631][ T5731] usb 3-1: config 2 interface 241 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 223.928652][ T5731] usb 3-1: config 2 interface 241 has no altsetting 0 [ 223.975815][ T5589] udevd[5589]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 224.019361][ T5731] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 224.027594][ T5731] usb 3-1: Product: syz [ 224.032030][ T5598] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 224.042493][ T5731] usb 3-1: Manufacturer: syz [ 224.042525][ T5731] usb 3-1: SerialNumber: syz [ 224.055087][ T4928] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 224.072516][ T5731] ti_usb_3410_5052 3-1:2.241: TI USB 3410 1 port adapter converter detected [ 224.072709][ T5731] ti_usb_3410_5052 3-1:2.241: missing endpoints [ 224.116992][ T5615] udevd[5615]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 224.202819][ T4928] usb 5-1: device descriptor read/64, error -71 [ 224.320070][ T4928] usb usb5-port1: attempt power cycle [ 224.401784][ T5731] usb 3-1: USB disconnect, device number 30 [ 224.587008][ T1816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 224.679111][ T4928] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 224.710435][ T4928] usb 5-1: device descriptor read/8, error -71 [ 224.979324][ T4928] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 225.013108][ T4928] usb 5-1: device descriptor read/8, error -71 [ 225.140420][ T4928] usb usb5-port1: unable to enumerate USB device [ 225.419077][ T5598] Bluetooth: hci1: command 0x0406 tx timeout [ 225.529105][ T5688] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 225.552224][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead [ 225.552264][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead [ 225.552281][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0xd1af instead [ 225.552297][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0xb2ff instead [ 225.552309][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead [ 225.552321][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead [ 225.552333][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead [ 225.552349][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead [ 225.552374][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead [ 225.552398][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead [ 225.552410][ T7898] jffs2: Further such events for this erase block will not be printed [ 225.554047][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead [ 225.554066][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead [ 225.554082][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0xd1af instead [ 225.554098][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0xb2ff instead [ 225.554111][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead [ 225.554124][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead [ 225.554138][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead [ 225.554155][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead [ 225.554180][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead [ 225.554205][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead [ 225.554217][ T7898] jffs2: Further such events for this erase block will not be printed [ 225.554484][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0x4255 instead [ 225.554496][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0x0001 instead [ 225.554510][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0xd1af instead [ 225.554524][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000203c: 0xb2ff instead [ 225.554620][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x4255 instead [ 225.554635][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0x0001 instead [ 225.554649][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0xd1af instead [ 225.554666][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000303c: 0xb2ff instead [ 225.554704][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0x4255 instead [ 225.554718][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0x0001 instead [ 225.554733][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0xd1af instead [ 225.554750][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000403c: 0xb2ff instead [ 225.554788][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x4255 instead [ 225.554801][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x0001 instead [ 225.554815][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0xd1af instead [ 225.554830][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000503c: 0xb2ff instead [ 225.554866][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x4255 instead [ 225.554878][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0x0001 instead [ 225.554922][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0xd1af instead [ 225.554938][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000603c: 0xb2ff instead [ 225.554981][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0x4255 instead [ 225.554994][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0x0001 instead [ 225.555008][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0xd1af instead [ 225.555023][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000703c: 0xb2ff instead [ 225.555059][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x4255 instead [ 225.555072][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x0001 instead [ 225.555087][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0xd1af instead [ 225.555103][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000803c: 0xb2ff instead [ 225.555141][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x4255 instead [ 225.555154][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0x0001 instead [ 225.555168][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0xd1af instead [ 225.555183][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000903c: 0xb2ff instead [ 225.555219][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0x4255 instead [ 225.555232][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0x0001 instead [ 225.555246][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0xd1af instead [ 225.555261][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a03c: 0xb2ff instead [ 225.555297][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0x4255 instead [ 225.555310][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead [ 225.555324][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0xd1af instead [ 225.555338][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0xb2ff instead [ 225.555375][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead [ 225.555387][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead [ 225.555401][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0xd1af instead [ 225.555416][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0xb2ff instead [ 225.555452][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead [ 225.555465][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead [ 225.555479][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0xd1af instead [ 225.555493][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0xb2ff instead [ 225.555529][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead [ 225.555542][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead [ 225.555555][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0xd1af instead [ 225.555570][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0xb2ff instead [ 225.555606][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead [ 225.555619][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead [ 225.555672][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0xd1af instead [ 225.555689][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0xb2ff instead [ 225.555729][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead [ 225.555743][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead [ 225.555758][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0xd1af instead [ 225.555775][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0xb2ff instead [ 225.555813][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead [ 225.555827][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead [ 225.555841][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0xd1af instead [ 225.555858][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0xb2ff instead [ 225.555896][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead [ 225.555908][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead [ 225.560965][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0xd1af instead [ 225.560990][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0xb2ff instead [ 225.561034][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead [ 225.561048][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead [ 225.561062][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0xd1af instead [ 225.561077][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0xb2ff instead [ 225.561113][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead [ 225.561127][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead [ 225.561142][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0xd1af instead [ 225.561158][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0xb2ff instead [ 225.561196][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead [ 225.561209][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead [ 225.561222][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0xd1af instead [ 225.561237][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0xb2ff instead [ 225.561273][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead [ 225.561286][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead [ 225.561299][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0xd1af instead [ 225.561314][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0xb2ff instead [ 225.561350][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead [ 225.561363][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead [ 225.561376][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0xd1af instead [ 225.561390][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0xb2ff instead [ 225.561426][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead [ 225.561439][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead [ 225.561452][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0xd1af instead [ 225.561467][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0xb2ff instead [ 225.561503][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead [ 225.561516][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead [ 225.561529][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0xd1af instead [ 225.561544][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0xb2ff instead [ 225.561580][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead [ 225.561593][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead [ 225.561607][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0xd1af instead [ 225.561621][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0xb2ff instead [ 225.561656][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead [ 225.561669][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead [ 225.561683][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0xd1af instead [ 225.561698][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0xb2ff instead [ 225.561857][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead [ 225.561871][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead [ 225.561885][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0xd1af instead [ 225.561901][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0xb2ff instead [ 225.561940][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead [ 225.562012][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead [ 225.562028][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0xd1af instead [ 225.562044][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0xb2ff instead [ 225.562088][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead [ 225.562102][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead [ 225.562117][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0xd1af instead [ 225.562134][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0xb2ff instead [ 225.562172][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead [ 225.562186][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead [ 225.562201][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0xd1af instead [ 225.562218][ T7898] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0xb2ff instead [ 225.562248][ T7898] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes [ 225.562254][ T7898] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32 [ 225.669462][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 225.882169][ T5688] usb 1-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 225.924493][ T5688] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 225.924546][ T5688] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 225.924568][ T5688] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 225.924591][ T5688] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 225.970439][ T4928] usb 6-1: new full-speed USB device number 21 using dummy_hcd [ 226.020872][ T5688] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.020899][ T5688] usb 1-1: Product: syz [ 226.020911][ T5688] usb 1-1: Manufacturer: syz [ 226.020924][ T5688] usb 1-1: SerialNumber: syz [ 226.086385][ T5688] usb 1-1: config 0 descriptor?? [ 226.097633][ T7885] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 226.140243][ T4928] usb 6-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 226.141048][ T4928] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 226.141086][ T4928] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 226.141123][ T4928] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 226.141145][ T4928] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 226.142724][ T4928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 226.142741][ T4928] usb 6-1: Product: syz [ 226.142753][ T4928] usb 6-1: Manufacturer: syz [ 226.142764][ T4928] usb 6-1: SerialNumber: syz [ 226.144723][ T4928] usb 6-1: config 0 descriptor?? [ 226.145762][ T7896] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 226.338820][ T5731] usb 2-1: new full-speed USB device number 30 using dummy_hcd [ 226.370022][ T7896] MTD: Couldn't look up '/dev/md0': -2 [ 226.426512][ T4928] powermate: Expected payload of 3--6 bytes, found 64 bytes! [ 226.474909][ T7885] MTD: Couldn't look up '/dev/md0': -2 [ 226.476997][ T5688] powermate: Expected payload of 3--6 bytes, found 64 bytes! [ 226.491056][ T5688] input: Griffin SoundKnob as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input25 [ 226.570410][ T5731] usb 2-1: device descriptor read/64, error -71 [ 226.652434][ C0] powermate: config urb returned -71 [ 226.652580][ C0] powermate: config urb returned -71 [ 226.652732][ C0] powermate: config urb returned -71 [ 226.652884][ C0] powermate: config urb returned -71 [ 226.679537][ C0] powermate 1-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 226.679566][ T5688] usb 1-1: USB disconnect, device number 18 [ 226.699376][ T191] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 226.706620][ T4928] input: Griffin SoundKnob as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input24 [ 226.786725][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 226.808797][ C1] powermate: config urb returned -71 [ 226.808970][ C1] powermate: config urb returned -71 [ 226.819496][ C1] powermate: config urb returned -71 [ 226.829976][ C1] powermate: config urb returned -71 [ 226.864274][ T5731] usb 2-1: new full-speed USB device number 31 using dummy_hcd [ 227.149598][ T4928] usb 6-1: USB disconnect, device number 21 [ 227.149639][ C1] powermate 6-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 227.179107][ T5731] usb 2-1: device descriptor read/64, error -71 [ 227.292777][ T5731] usb usb2-port1: attempt power cycle [ 227.559958][ T31] audit: type=1400 audit(1788009184.644:583): avc: denied { create } for pid=7912 comm="syz.5.529" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 227.598052][ T31] audit: type=1400 audit(1788009184.674:584): avc: denied { write } for pid=7912 comm="syz.5.529" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 227.627847][ T31] audit: type=1400 audit(1788009184.704:585): avc: denied { create } for pid=7912 comm="syz.5.529" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 227.627902][ T31] audit: type=1400 audit(1788009184.704:586): avc: denied { ioctl } for pid=7912 comm="syz.5.529" path="socket:[20384]" dev="sockfs" ino=20384 ioctlcmd=0x7436 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 227.630763][ T5731] usb 2-1: new full-speed USB device number 32 using dummy_hcd [ 227.684418][ T5731] usb 2-1: device descriptor read/8, error -71 [ 227.880924][ T191] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 227.880995][ T1816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 227.939600][ T5731] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 227.959456][ T5731] usb 2-1: device descriptor read/8, error -71 [ 228.069513][ T5731] usb usb2-port1: unable to enumerate USB device [ 228.105567][ T7921] ubi: mtd0 is already attached to ubi0 [ 228.159248][ T1816] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 228.369101][ T1816] usb 5-1: Using ep0 maxpacket: 8 [ 228.382200][ T1816] usb 5-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 228.389287][ T1816] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 228.389317][ T1816] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 228.389347][ T1816] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 228.398139][ T1816] usb 5-1: config 0 descriptor?? [ 228.689015][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 228.939553][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 228.969866][ T7917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 228.970406][ T7917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.976758][ T1816] hid-multitouch 0003:1FD2:6007.001A: hidraw0: USB HID v0.00 Joystick [HID 1fd2:6007] on usb-dummy_hcd.4-1/input0 [ 229.401813][ T7936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.402129][ T7936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 229.615900][ T5688] usb 5-1: USB disconnect, device number 21 [ 229.749517][ T191] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 229.989667][ T4928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 230.194464][ T7951] FAULT_INJECTION: forcing a failure. [ 230.194464][ T7951] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.194510][ T7951] CPU: 1 UID: 0 PID: 7951 Comm: syz.5.541 Tainted: G L syzkaller #0 PREEMPT(full) [ 230.194533][ T7951] Tainted: [L]=SOFTLOCKUP [ 230.194539][ T7951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 230.194548][ T7951] Call Trace: [ 230.194554][ T7951] [ 230.194561][ T7951] dump_stack_lvl+0x100/0x190 [ 230.194595][ T7951] should_fail_ex.cold+0x5/0xa [ 230.194620][ T7951] _copy_to_user+0x32/0xd0 [ 230.194648][ T7951] simple_read_from_buffer+0xcb/0x170 [ 230.194670][ T7951] proc_fail_nth_read+0x1af/0x230 [ 230.194691][ T7951] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 230.194713][ T7951] ? rw_verify_area+0xce/0x6d0 [ 230.194738][ T7951] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 230.194759][ T7951] vfs_read+0x1e4/0xb40 [ 230.194785][ T7951] ? lock_acquire+0x1d1/0x380 [ 230.194804][ T7951] ? __fget_files+0x34/0x3d0 [ 230.194824][ T7951] ? __pfx_vfs_read+0x10/0x10 [ 230.194849][ T7951] ? find_held_lock+0x2b/0x80 [ 230.194874][ T7951] ? __fget_files+0x215/0x3d0 [ 230.194899][ T7951] ? __fget_files+0x21f/0x3d0 [ 230.194933][ T7951] ksys_read+0x12a/0x250 [ 230.194960][ T7951] ? __pfx_ksys_read+0x10/0x10 [ 230.194994][ T7951] do_syscall_64+0x123/0x790 [ 230.195017][ T7951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.195035][ T7951] RIP: 0033:0x7f1b4795e98e [ 230.195050][ T7951] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 230.195066][ T7951] RSP: 002b:00007f1b488a8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 230.195084][ T7951] RAX: ffffffffffffffda RBX: 00007f1b488a96c0 RCX: 00007f1b4795e98e [ 230.195095][ T7951] RDX: 000000000000000f RSI: 00007f1b488a90a0 RDI: 0000000000000006 [ 230.195115][ T7951] RBP: 00007f1b488a9090 R08: 0000000000000000 R09: 0000000000000000 [ 230.195126][ T7951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 230.195136][ T7951] R13: 00007f1b47c26038 R14: 00007f1b47c25fa0 R15: 00007ffda712d388 [ 230.195160][ T7951] [ 230.210760][ T5688] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 230.322085][ T31] audit: type=1400 audit(1788009187.404:587): avc: denied { bind } for pid=7952 comm="syz.2.542" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 230.323829][ T31] audit: type=1400 audit(1788009187.404:588): avc: denied { setopt } for pid=7952 comm="syz.2.542" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 230.340243][ T7958] FAULT_INJECTION: forcing a failure. [ 230.340243][ T7958] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 230.340398][ T7958] CPU: 0 UID: 0 PID: 7958 Comm: syz.2.542 Tainted: G L syzkaller #0 PREEMPT(full) [ 230.340422][ T7958] Tainted: [L]=SOFTLOCKUP [ 230.340428][ T7958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 230.340438][ T7958] Call Trace: [ 230.340444][ T7958] [ 230.340450][ T7958] dump_stack_lvl+0x100/0x190 [ 230.340480][ T7958] should_fail_ex.cold+0x5/0xa [ 230.340503][ T7958] _copy_to_user+0x32/0xd0 [ 230.340528][ T7958] rng_dev_read+0x223/0x910 [ 230.340548][ T7958] ? __pfx_virtio_read+0x10/0x10 [ 230.340569][ T7958] ? __pfx_rng_dev_read+0x10/0x10 [ 230.340587][ T7958] ? avc_policy_seqno+0x9/0x20 [ 230.340609][ T7958] ? bpf_lsm_file_permission+0x9/0x10 [ 230.340629][ T7958] ? security_file_permission+0x76/0x210 [ 230.340646][ T7958] ? rw_verify_area+0xce/0x6d0 [ 230.340668][ T7958] ? __pfx_rng_dev_read+0x10/0x10 [ 230.340687][ T7958] vfs_read+0x1e4/0xb40 [ 230.340711][ T7958] ? lock_acquire+0x1d1/0x380 [ 230.340727][ T7958] ? __fget_files+0x34/0x3d0 [ 230.340745][ T7958] ? __pfx_vfs_read+0x10/0x10 [ 230.340767][ T7958] ? find_held_lock+0x2b/0x80 [ 230.340787][ T7958] ? __fget_files+0x215/0x3d0 [ 230.340803][ T7958] ? __fget_files+0x215/0x3d0 [ 230.340824][ T7958] ? __fget_files+0x21f/0x3d0 [ 230.340847][ T7958] ksys_read+0x12a/0x250 [ 230.340870][ T7958] ? __pfx_ksys_read+0x10/0x10 [ 230.340899][ T7958] do_syscall_64+0x123/0x790 [ 230.340924][ T7958] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.340941][ T7958] RIP: 0033:0x7fcf8c99e159 [ 230.340955][ T7958] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 230.340970][ T7958] RSP: 002b:00007fcf8d8f3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 230.340986][ T7958] RAX: ffffffffffffffda RBX: 00007fcf8cc26180 RCX: 00007fcf8c99e159 [ 230.340997][ T7958] RDX: 00000000fffffec1 RSI: 00002000000024c0 RDI: 0000000000000007 [ 230.341006][ T7958] RBP: 00007fcf8d8f3090 R08: 0000000000000000 R09: 0000000000000000 [ 230.341016][ T7958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 230.341025][ T7958] R13: 00007fcf8cc26218 R14: 00007fcf8cc26180 R15: 00007fff12ebc798 [ 230.341046][ T7958] [ 230.367660][ T5688] usb 1-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 230.372721][ T5688] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 230.372759][ T5688] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 230.372781][ T5688] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 230.372802][ T5688] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 230.392075][ T5688] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.392098][ T5688] usb 1-1: Product: syz [ 230.392111][ T5688] usb 1-1: Manufacturer: syz [ 230.392123][ T5688] usb 1-1: SerialNumber: syz [ 230.442693][ T5688] usb 1-1: config 0 descriptor?? [ 230.443845][ T7947] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 230.686343][ T31] audit: type=1400 audit(1788009187.764:589): avc: denied { mounton } for pid=7956 comm="syz.4.543" path="/proc/378/task" dev="proc" ino=21538 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 230.747202][ T7961] MTD: Couldn't look up '/dev/md0': -2 [ 230.899127][ T5688] powermate: Expected payload of 3--6 bytes, found 64 bytes! [ 230.911661][ T5688] input: Griffin SoundKnob as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input27 [ 230.917003][ C0] powermate: config urb returned -71 [ 230.917177][ C0] powermate: config urb returned -71 [ 230.917352][ C0] powermate: config urb returned -71 [ 230.917528][ C0] powermate: config urb returned -71 [ 230.956143][ T5688] usb 1-1: USB disconnect, device number 19 [ 230.956245][ C0] powermate 1-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 231.021982][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 231.065456][ T31] audit: type=1400 audit(1788009188.144:590): avc: denied { write } for pid=7964 comm="syz.1.544" name="binder0" dev="binder" ino=7 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 231.173326][ T7967] FAULT_INJECTION: forcing a failure. [ 231.173326][ T7967] name failslab, interval 1, probability 0, space 0, times 0 [ 231.173402][ T7967] CPU: 1 UID: 0 PID: 7967 Comm: syz.1.544 Tainted: G L syzkaller #0 PREEMPT(full) [ 231.173430][ T7967] Tainted: [L]=SOFTLOCKUP [ 231.173437][ T7967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 231.173447][ T7967] Call Trace: [ 231.173454][ T7967] [ 231.173465][ T7967] dump_stack_lvl+0x100/0x190 [ 231.173497][ T7967] should_fail_ex.cold+0x5/0xa [ 231.173523][ T7967] should_failslab+0xc2/0x120 [ 231.173545][ T7967] __kmalloc_cache_noprof+0x91/0x6d0 [ 231.173572][ T7967] ? preempt_schedule_thunk+0x16/0x40 [ 231.173594][ T7967] ? binder_get_thread+0x201/0x850 [ 231.173626][ T7967] binder_get_thread+0x201/0x850 [ 231.173657][ T7967] binder_poll+0x3f/0x430 [ 231.173683][ T7967] ? __pfx_binder_poll+0x10/0x10 [ 231.173709][ T7967] do_select+0xd54/0x1850 [ 231.173747][ T7967] ? __pfx_do_select+0x10/0x10 [ 231.173765][ T7967] ? __lock_acquire+0x4c5/0x1ec0 [ 231.173790][ T7967] ? __pfx___pollwait+0x10/0x10 [ 231.173813][ T7967] ? __pfx_pollwake+0x10/0x10 [ 231.173834][ T7967] ? __pfx_pollwake+0x10/0x10 [ 231.173855][ T7967] ? __pfx_pollwake+0x10/0x10 [ 231.173875][ T7967] ? __pfx_pollwake+0x10/0x10 [ 231.173897][ T7967] ? __pfx_pollwake+0x10/0x10 [ 231.173917][ T7967] ? __pfx_pollwake+0x10/0x10 [ 231.173954][ T7967] ? __might_fault+0xc5/0x140 [ 231.173979][ T7967] ? find_held_lock+0x2b/0x80 [ 231.174003][ T7967] ? __might_fault+0xc5/0x140 [ 231.174026][ T7967] ? __might_fault+0xc5/0x140 [ 231.174058][ T7967] ? core_sys_select+0x55b/0xbb0 [ 231.174077][ T7967] core_sys_select+0x55b/0xbb0 [ 231.174102][ T7967] ? __pfx_core_sys_select+0x10/0x10 [ 231.174126][ T7967] ? lock_acquire+0x1d1/0x380 [ 231.174143][ T7967] ? finish_task_switch.isra.0+0x149/0x10d0 [ 231.174184][ T7967] ? __pfx_set_user_sigmask+0x10/0x10 [ 231.174220][ T7967] do_pselect.constprop.0+0x238/0x270 [ 231.174245][ T7967] ? __pfx_do_pselect.constprop.0+0x10/0x10 [ 231.174271][ T7967] ? exit_to_user_mode_loop+0x166/0x700 [ 231.174297][ T7967] __x64_sys_pselect6+0x149/0x1c0 [ 231.174321][ T7967] do_syscall_64+0x123/0x790 [ 231.174345][ T7967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.174365][ T7967] RIP: 0033:0x7f2b05f9e159 [ 231.174381][ T7967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 231.174398][ T7967] RSP: 002b:00007f2b06f0d028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 231.174418][ T7967] RAX: ffffffffffffffda RBX: 00007f2b06226090 RCX: 00007f2b05f9e159 [ 231.174429][ T7967] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000040 [ 231.174440][ T7967] RBP: 00007f2b06f0d090 R08: 0000000000000000 R09: 0000000000000000 [ 231.174452][ T7967] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 231.174463][ T7967] R13: 00007f2b06226128 R14: 00007f2b06226090 R15: 00007ffd337d52c8 [ 231.174488][ T7967] [ 232.067376][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 232.779252][ T191] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 233.109990][ T1816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 233.343122][ T7975] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 233.351675][ T7975] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 233.360016][ T7975] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 233.381542][ T7974] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 233.381683][ T7974] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 233.664649][ T7978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 234.485796][ T7983] ubi: mtd0 is already attached to ubi0 [ 234.913797][ T5702] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 235.073875][ T5702] usb 3-1: Using ep0 maxpacket: 8 [ 235.079523][ T5702] usb 3-1: New USB device found, idVendor=17cc, idProduct=1915, bcdDevice= 0.40 [ 235.099729][ T5702] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.107799][ T5702] usb 3-1: Product: ᤏ椟ꑌ톕溨惏뽼㘗缰찮㞛맽ㄋ곱ꕀ瑵焋容늸괘閥䥟퍙⡟탳揯ꥋ⡔圸뗣締뛰횭Ԍ☸ꢜ譡䭾벏Վ㝵㠷耙䃭筈亿嘜ꭀͪ짳晸冸퓦Ჷ䍝ꋹ롯䝽틐긴䤲㦓稷ꥅ婧붨ꎊ졨끢 [ 235.131770][ T5702] usb 3-1: Manufacturer: ᐁ [ 235.136426][ T5702] usb 3-1: SerialNumber: syz [ 235.590479][ T5702] usb 3-1: 1:1: invalid format type 0x1001 is detected, processed as PCM [ 235.599102][ T5702] usb 3-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 235.614470][ T5702] usb 3-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 235.628137][ T5702] usb 3-1: unit 2 not found! [ 235.677043][ T5702] usb 3-1: USB disconnect, device number 31 [ 235.727970][ T7279] udevd[7279]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 236.221332][ T5702] net_ratelimit: 8 callbacks suppressed [ 236.221372][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 236.306207][ T31] audit: type=1400 audit(1788009193.384:591): avc: denied { ioctl } for pid=7998 comm="syz.5.556" path="socket:[20775]" dev="sockfs" ino=20775 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 236.329087][ T191] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 236.340995][ T31] audit: type=1400 audit(1788009193.424:592): avc: denied { bind } for pid=7998 comm="syz.5.556" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 236.397259][ T31] audit: type=1400 audit(1788009193.474:593): avc: denied { write } for pid=7998 comm="syz.5.556" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 236.479074][ T191] usb 2-1: Using ep0 maxpacket: 8 [ 236.479867][ T191] usb 2-1: New USB device found, idVendor=17cc, idProduct=1915, bcdDevice= 0.40 [ 236.494915][ T5702] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 236.500689][ T191] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.500711][ T191] usb 2-1: Product: ᤏ椟ꑌ톕溨惏뽼㘗缰찮㞛맽ㄋ곱ꕀ瑵焋容늸괘閥䥟퍙⡟탳揯ꥋ⡔圸뗣締뛰횭Ԍ☸ꢜ譡䭾벏Վ㝵㠷耙䃭筈亿嘜ꭀͪ짳晸冸퓦Ჷ䍝ꋹ롯䝽틐긴䤲㦓稷ꥅ婧붨ꎊ졨끢 [ 236.500735][ T191] usb 2-1: Manufacturer: ᐁ [ 236.500747][ T191] usb 2-1: SerialNumber: syz [ 236.774512][ T5702] usb 1-1: Using ep0 maxpacket: 8 [ 236.776786][ T5702] usb 1-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 236.784957][ T5702] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 236.785022][ T5702] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 236.785142][ T5702] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.865374][ T5702] usb 1-1: config 0 descriptor?? [ 237.318003][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 237.421485][ T5688] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 237.444980][ T8018] openvswitch: netlink: IP tunnel TTL not specified. [ 237.456276][ T31] audit: type=1400 audit(1788009194.534:594): avc: denied { accept } for pid=8017 comm="syz.5.561" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 237.809040][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 237.979028][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 238.419647][ T8022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 238.420022][ T8022] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 238.466016][ T5702] hid-multitouch 0003:1FD2:6007.001B: hidraw0: USB HID v0.00 Joystick [HID 1fd2:6007] on usb-dummy_hcd.0-1/input0 [ 238.478426][ T4928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 238.586576][ T191] usb 2-1: 1:1: invalid format type 0x1001 is detected, processed as PCM [ 238.598296][ T191] usb 2-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 238.609358][ T191] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 238.616627][ T191] usb 2-1: unit 2 not found! [ 238.619112][ T5598] Bluetooth: hci1: command 0x0406 tx timeout [ 238.658370][ T191] usb 2-1: USB disconnect, device number 34 [ 238.680016][ T5616] udevd[5616]: setting owner of /dev/bus/usb/002/034 to uid=0, gid=0 failed: No such file or directory [ 238.701429][ T5702] usb 1-1: USB disconnect, device number 20 [ 238.730581][ T7279] udevd[7279]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 238.862683][ T5688] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 239.436555][ T8041] ubi: mtd0 is already attached to ubi0 [ 239.448826][ T31] audit: type=1400 audit(1788009196.524:595): avc: denied { connect } for pid=8036 comm="syz.0.567" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 239.482009][ T8037] nvme_fabrics: no handler found for transport r.ma. [ 239.504964][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 239.627379][ T31] audit: type=1400 audit(1788009196.704:596): avc: denied { watch } for pid=8045 comm="syz.5.562" path="/74/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="tmpfs" ino=423 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 239.659893][ T31] audit: type=1400 audit(1788009196.744:597): avc: denied { watch_sb watch_reads } for pid=8045 comm="syz.5.562" path="/74/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="tmpfs" ino=423 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 239.837628][ T8053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 239.856429][ T8053] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 240.129063][ T5688] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 240.279043][ T5688] usb 1-1: Using ep0 maxpacket: 16 [ 240.288195][ T5688] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 240.298780][ T5688] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 240.298821][ T5688] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 240.327096][ T5688] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.327135][ T5688] usb 1-1: Product: syz [ 240.327162][ T5688] usb 1-1: Manufacturer: syz [ 240.327179][ T5688] usb 1-1: SerialNumber: syz [ 240.353385][ T5688] usb 1-1: config 0 descriptor?? [ 240.361464][ T5688] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 240.372393][ T5688] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 240.556162][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 240.619721][ T5688] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 240.633740][ T5688] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 240.641225][ T5688] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 240.649225][ T5688] em28xx 1-1:0.0: No AC97 audio processor [ 240.666495][ T5688] usb 1-1: USB disconnect, device number 21 [ 240.676558][ T5688] em28xx 1-1:0.0: Disconnecting em28xx [ 240.689291][ T5688] em28xx: Freeing device [ 241.374776][ T8080] FAULT_INJECTION: forcing a failure. [ 241.374776][ T8080] name failslab, interval 1, probability 0, space 0, times 0 [ 241.374822][ T8080] CPU: 1 UID: 0 PID: 8080 Comm: syz.0.579 Tainted: G L syzkaller #0 PREEMPT(full) [ 241.374845][ T8080] Tainted: [L]=SOFTLOCKUP [ 241.374851][ T8080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 241.374860][ T8080] Call Trace: [ 241.374866][ T8080] [ 241.374872][ T8080] dump_stack_lvl+0x100/0x190 [ 241.374901][ T8080] should_fail_ex.cold+0x5/0xa [ 241.374920][ T8080] ? __netlink_lookup+0x652/0x900 [ 241.374972][ T8080] should_failslab+0xc2/0x120 [ 241.374991][ T8080] kmem_cache_alloc_noprof+0x92/0x6a0 [ 241.375009][ T8080] ? skb_clone+0x190/0x400 [ 241.375027][ T8080] skb_clone+0x190/0x400 [ 241.375043][ T8080] netlink_deliver_tap+0xaed/0xcc0 [ 241.375070][ T8080] netlink_unicast+0x62b/0x850 [ 241.375095][ T8080] ? __pfx_netlink_unicast+0x10/0x10 [ 241.375124][ T8080] netlink_sendmsg+0x8b0/0xda0 [ 241.375150][ T8080] ? __pfx_netlink_sendmsg+0x10/0x10 [ 241.375176][ T8080] ? selinux_socket_sendmsg+0x198/0x2f0 [ 241.375203][ T8080] ____sys_sendmsg+0xa4d/0xbe0 [ 241.375223][ T8080] ? __pfx_netlink_sendmsg+0x10/0x10 [ 241.375247][ T8080] ? __pfx_____sys_sendmsg+0x10/0x10 [ 241.375271][ T8080] ? lock_acquire+0x1d1/0x380 [ 241.375287][ T8080] ? get_pid_task+0x2a/0x250 [ 241.375310][ T8080] ___sys_sendmsg+0x190/0x1e0 [ 241.375331][ T8080] ? __pfx____sys_sendmsg+0x10/0x10 [ 241.375351][ T8080] ? get_pid_task+0x106/0x250 [ 241.375386][ T8080] ? find_held_lock+0x2b/0x80 [ 241.375421][ T8080] __sys_sendmsg+0x160/0x210 [ 241.375446][ T8080] ? __pfx___sys_sendmsg+0x10/0x10 [ 241.375482][ T8080] do_syscall_64+0x123/0x790 [ 241.375502][ T8080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 241.375519][ T8080] RIP: 0033:0x7f3a6fb9e159 [ 241.375533][ T8080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 241.375548][ T8080] RSP: 002b:00007f3a70a14028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 241.375565][ T8080] RAX: ffffffffffffffda RBX: 00007f3a6fe25fa0 RCX: 00007f3a6fb9e159 [ 241.375575][ T8080] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 241.375585][ T8080] RBP: 00007f3a70a14090 R08: 0000000000000000 R09: 0000000000000000 [ 241.375594][ T8080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 241.375604][ T8080] R13: 00007f3a6fe26038 R14: 00007f3a6fe25fa0 R15: 00007ffd96774a28 [ 241.375625][ T8080] [ 241.375712][ T8080] netlink: 20 bytes leftover after parsing attributes in process `syz.0.579'. [ 241.529234][ T5702] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 241.603700][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 241.829652][ T5702] usb 6-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 241.883543][ T5702] usb 6-1: config 1 has an invalid interface number: 3 but max is 0 [ 241.883586][ T5702] usb 6-1: config 1 has no interface number 0 [ 241.901347][ T5734] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 241.914980][ T5688] usb 1-1: new full-speed USB device number 22 using dummy_hcd [ 241.965377][ T5702] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.965433][ T5702] usb 6-1: Product: syz [ 241.965461][ T5702] usb 6-1: Manufacturer: syz [ 241.965477][ T5702] usb 6-1: SerialNumber: syz [ 242.827942][ T5688] usb 1-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 242.860138][ T5688] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 242.860308][ T5688] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 242.860378][ T5688] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 242.860453][ T5688] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 242.943202][ T5688] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 242.943270][ T5688] usb 1-1: Product: syz [ 242.943434][ T5688] usb 1-1: Manufacturer: syz [ 242.943719][ T5688] usb 1-1: SerialNumber: syz [ 242.995039][ T5688] usb 1-1: config 0 descriptor?? [ 242.997476][ T8083] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 243.091956][ T5702] usb 6-1: 3:1 : does not exist [ 243.091993][ T5702] usb 6-1: 3:2 : does not exist [ 243.147539][ T1816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 243.218689][ T8083] MTD: Couldn't look up '/dev/md0': -2 [ 243.268127][ T5688] powermate: Expected payload of 3--6 bytes, found 64 bytes! [ 243.278879][ T5688] input: Griffin SoundKnob as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input29 [ 243.289247][ T5805] usb 5-1: new full-speed USB device number 22 using dummy_hcd [ 243.303533][ C0] powermate: config urb returned -71 [ 243.309071][ C0] powermate: config urb returned -71 [ 243.309339][ C0] powermate: config urb returned -71 [ 243.309521][ C0] powermate: config urb returned -71 [ 243.355885][ T5688] usb 1-1: USB disconnect, device number 22 [ 243.362016][ C0] powermate 1-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 243.439738][ T5805] usb 5-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 243.450054][ T5805] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 243.450108][ T5805] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 243.450134][ T5805] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 243.450161][ T5805] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 243.494935][ T5805] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.494970][ T5805] usb 5-1: Product: syz [ 243.495002][ T5805] usb 5-1: Manufacturer: syz [ 243.495019][ T5805] usb 5-1: SerialNumber: syz [ 243.514436][ T31] audit: type=1400 audit(1788009200.594:598): avc: denied { write } for pid=8099 comm="syz.1.584" name="c.1" dev="configfs" ino=11188 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 243.541866][ T5805] usb 5-1: config 0 descriptor?? [ 243.574086][ T8091] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 244.063085][ T8089] MTD: Couldn't look up '/dev/md0': -2 [ 244.256733][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 244.277876][ T5805] powermate: Expected payload of 3--6 bytes, found 64 bytes! [ 244.292599][ T5805] input: Griffin SoundKnob as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input30 [ 244.324864][ T5702] usb 6-1: USB disconnect, device number 22 [ 244.361590][ C0] powermate: config urb returned -71 [ 244.361760][ C0] powermate: config urb returned -71 [ 244.361945][ C0] powermate: config urb returned -71 [ 244.362125][ C0] powermate: config urb returned -71 [ 244.409052][ C0] powermate 5-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 244.411598][ T5805] usb 5-1: USB disconnect, device number 22 [ 244.413588][ T8102] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 244.415135][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 244.805330][ T8119] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 244.813289][ T8119] ubi: bad wear-leveling threshold -741408768 [ 244.834123][ T8120] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 244.838334][ T8120] ubi: bad wear-leveling threshold -741408768 [ 245.141083][ T5805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 246.802540][ T1816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 247.019218][ T5688] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 247.856429][ T31] audit: type=1400 audit(1788009204.844:599): avc: denied { bind } for pid=8125 comm="syz.4.592" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 247.879986][ T1816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 248.011631][ T5702] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 248.123984][ T31] audit: type=1400 audit(1788009205.204:600): avc: denied { unmount } for pid=5602 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 248.152988][ T31] audit: type=1400 audit(1788009205.234:601): avc: denied { read } for pid=8137 comm="syz.1.596" name="msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 248.153055][ T31] audit: type=1400 audit(1788009205.234:602): avc: denied { open } for pid=8137 comm="syz.1.596" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 248.178875][ T5702] usb 3-1: Using ep0 maxpacket: 16 [ 248.217442][ T5702] usb 3-1: New USB device found, idVendor=0458, idProduct=5015, bcdDevice= 0.00 [ 248.235576][ T5734] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 248.266346][ T8141] netlink: 20 bytes leftover after parsing attributes in process `syz.1.596'. [ 248.277310][ T5702] usb 3-1: config 0 interface 0 altsetting 183 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 248.291090][ T5702] usb 3-1: config 0 interface 0 has no altsetting 0 [ 248.291288][ T5702] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.381319][ T5702] usb 3-1: config 0 descriptor?? [ 248.833277][ T8147] netlink: 24 bytes leftover after parsing attributes in process `syz.0.598'. [ 248.846485][ T31] audit: type=1800 audit(1788009205.924:603): pid=8147 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.598" name="memory_backed" dev="configfs" ino=21880 res=0 errno=0 [ 248.846607][ T31] audit: type=1800 audit(1788009205.924:604): pid=8147 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.598" name="zone_nr_conv" dev="configfs" ino=21881 res=0 errno=0 [ 248.846726][ T31] audit: type=1800 audit(1788009205.924:605): pid=8147 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.598" name="power" dev="configfs" ino=21882 res=0 errno=0 [ 249.173482][ T4928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 249.221965][ T8128] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 249.222252][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 249.222421][ T8128] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 249.226643][ T8128] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 249.226836][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 249.533188][ T5702] usbhid 3-1:0.0: can't add hid device: -71 [ 249.533287][ T5702] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 249.536808][ T5702] usb 3-1: USB disconnect, device number 32 [ 250.277362][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 250.277555][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 250.495007][ T31] audit: type=1400 audit(1788009207.574:606): avc: denied { read write } for pid=8154 comm="syz.0.600" name="nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 250.496465][ T31] audit: type=1400 audit(1788009207.574:607): avc: denied { ioctl open } for pid=8154 comm="syz.0.600" path="/dev/nvram" dev="devtmpfs" ino=623 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 251.372018][ T5688] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 251.560217][ T5688] usb 2-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 251.571733][ T5688] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 251.571767][ T5688] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 251.571799][ T5688] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 251.579823][ T5688] usb 2-1: config 0 descriptor?? [ 251.923989][ T4928] net_ratelimit: 22 callbacks suppressed [ 251.924029][ T4928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 252.061839][ T8184] netlink: 56 bytes leftover after parsing attributes in process `syz.1.603'. [ 252.122805][ T31] audit: type=1400 audit(1788009209.204:608): avc: denied { read } for pid=8176 comm="syz.4.608" dev="sockfs" ino=21218 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 252.159401][ T5688] hid-steam 0003:28DE:1142.001C: unknown main item tag 0x0 [ 252.174257][ T5688] hid-steam 0003:28DE:1142.001C: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 252.229224][ T5688] hid-steam 0003:28DE:1142.001C: Steam wireless receiver connected [ 252.245784][ T5688] hid-steam 0003:28DE:1142.001C: No HID_FEATURE_REPORT present for ID 0 [ 252.245823][ T5688] hid-steam 0003:28DE:1142.001C: steam_probe:steam_get_conn_status failed with error -22 [ 252.298410][ T5688] hid-steam 0003:28DE:1142.001D: unknown main item tag 0x0 [ 252.466105][ T5688] hid-steam 0003:28DE:1142.001D: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.1-1/input0 [ 252.512189][ T5734] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 252.669153][ T31] audit: type=1400 audit(1788009209.704:609): avc: denied { mount } for pid=8192 comm="syz.0.610" name="/" dev="overlay" ino=763 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 252.940504][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 252.949534][ T5734] usb 3-1: Using ep0 maxpacket: 8 [ 252.950002][ T5734] usb 3-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 252.950825][ T5734] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 252.950850][ T5734] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 252.950869][ T5734] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 252.950889][ T5734] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 68 [ 252.950917][ T5734] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.953109][ T5734] usb 3-1: config 0 descriptor?? [ 252.953745][ T8190] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 253.329221][ C1] Bluetooth: hci5: Unexpected continuation: 1 bytes [ 253.331873][ T5608] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 253.457726][ T8206] netlink: 'syz.4.614': attribute type 29 has an invalid length. [ 253.457762][ T8206] netlink: 8 bytes leftover after parsing attributes in process `syz.4.614'. [ 253.489613][ T5734] usb 2-1: reset high-speed USB device number 35 using dummy_hcd [ 253.533834][ T191] usb 3-1: USB disconnect, device number 33 [ 253.541178][ T5598] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 253.729100][ T5688] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 253.902799][ T5688] usb 5-1: Using ep0 maxpacket: 8 [ 253.905283][ T5688] usb 5-1: unable to get BOS descriptor or descriptor too short [ 253.905318][ T5688] usb 5-1: New USB device found, idVendor=dd02, idProduct=2e25, bcdDevice=fa.4e [ 253.906868][ T5688] usb 5-1: config 2 has an invalid interface number: 185 but max is 0 [ 253.906889][ T5688] usb 5-1: config 2 has no interface number 0 [ 253.906910][ T5688] usb 5-1: config 2 interface 185 has no altsetting 0 [ 253.909279][ T5688] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 253.909299][ T5688] usb 5-1: Product: syz [ 253.909312][ T5688] usb 5-1: Manufacturer: syz [ 253.909324][ T5688] usb 5-1: SerialNumber: syz [ 253.919765][ T9] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 253.997584][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 254.069927][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 254.072470][ T9] usb 1-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 254.074358][ T9] usb 1-1: config 0 interface 0 altsetting 183 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 254.074384][ T9] usb 1-1: config 0 interface 0 has no altsetting 0 [ 254.074410][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.080859][ T9] usb 1-1: config 0 descriptor?? [ 254.274246][ T5688] cdc_eem 5-1:2.185: probe with driver cdc_eem failed with error -22 [ 254.299805][ T5784] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 254.323367][ T5688] usb 5-1: USB disconnect, device number 23 [ 254.410542][ T31] audit: type=1400 audit(1788009211.494:610): avc: denied { listen } for pid=8218 comm="syz.1.619" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 254.453459][ T31] audit: type=1400 audit(1788009211.534:611): avc: denied { read } for pid=8218 comm="syz.1.619" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 254.537870][ T9] hid_mf 0003:0079:1846.001E: ignoring exceeding usage max [ 254.538572][ T9] hid_mf 0003:0079:1846.001E: global environment stack underflow [ 254.538587][ T9] hid_mf 0003:0079:1846.001E: item 0 2 1 11 parsing failed [ 254.540141][ T9] hid_mf 0003:0079:1846.001E: HID parse failed. [ 254.540189][ T9] hid_mf 0003:0079:1846.001E: probe with driver hid_mf failed with error -22 [ 254.746876][ T1816] usb 1-1: USB disconnect, device number 23 [ 254.953212][ T5805] usb 2-1: USB disconnect, device number 35 [ 255.026433][ T5805] hid-steam 0003:28DE:1142.001C: Steam wireless receiver disconnected [ 255.041333][ T1816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 255.340534][ T5734] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 255.380457][ T8237] overlayfs: overlapping lowerdir path [ 255.706181][ T5734] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 255.719329][ T5734] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.719715][ T5734] usb 5-1: Product: syz [ 255.719729][ T5734] usb 5-1: Manufacturer: syz [ 255.719742][ T5734] usb 5-1: SerialNumber: syz [ 256.061945][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 256.859106][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 257.291983][ T5688] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 257.323559][ T1816] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 257.340465][ T5688] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 257.724476][ T5734] (unnamed net_device) (uninitialized): Assigned a random MAC address: d6:db:a3:d9:9d:ec [ 257.822882][ T5734] rtl8150 5-1:1.0: eth5: rtl8150 is detected [ 257.843327][ T5734] usb 5-1: USB disconnect, device number 24 [ 258.017382][ T31] audit: type=1400 audit(1788009215.094:612): avc: denied { read } for pid=5263 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 258.413801][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 258.649595][ T8262] FAULT_INJECTION: forcing a failure. [ 258.649595][ T8262] name failslab, interval 1, probability 0, space 0, times 0 [ 258.662517][ T8262] CPU: 0 UID: 0 PID: 8262 Comm: syz.4.634 Tainted: G L syzkaller #0 PREEMPT(full) [ 258.662549][ T8262] Tainted: [L]=SOFTLOCKUP [ 258.662556][ T8262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 258.662567][ T8262] Call Trace: [ 258.662574][ T8262] [ 258.662582][ T8262] dump_stack_lvl+0x100/0x190 [ 258.662615][ T8262] should_fail_ex.cold+0x5/0xa [ 258.662638][ T8262] ? __netlink_lookup+0x652/0x900 [ 258.662668][ T8262] should_failslab+0xc2/0x120 [ 258.662691][ T8262] kmem_cache_alloc_noprof+0x92/0x6a0 [ 258.662712][ T8262] ? skb_clone+0x190/0x400 [ 258.662741][ T8262] skb_clone+0x190/0x400 [ 258.662760][ T8262] netlink_deliver_tap+0xaed/0xcc0 [ 258.662791][ T8262] netlink_unicast+0x62b/0x850 [ 258.662820][ T8262] ? __pfx_netlink_unicast+0x10/0x10 [ 258.662854][ T8262] netlink_sendmsg+0x8b0/0xda0 [ 258.662885][ T8262] ? __pfx_netlink_sendmsg+0x10/0x10 [ 258.662914][ T8262] ? selinux_socket_sendmsg+0x198/0x2f0 [ 258.662946][ T8262] ____sys_sendmsg+0xa4d/0xbe0 [ 258.662966][ T8262] ? __pfx_netlink_sendmsg+0x10/0x10 [ 258.662995][ T8262] ? __pfx_____sys_sendmsg+0x10/0x10 [ 258.663020][ T8262] ? _kstrtoull+0x144/0x200 [ 258.663039][ T8262] ? __pfx__kstrtoull+0x10/0x10 [ 258.663064][ T8262] ___sys_sendmsg+0x190/0x1e0 [ 258.663089][ T8262] ? __pfx____sys_sendmsg+0x10/0x10 [ 258.663122][ T8262] ? __fget_files+0x34/0x3d0 [ 258.663162][ T8262] __sys_sendmmsg+0x20c/0x440 [ 258.663184][ T8262] ? __pfx___sys_sendmmsg+0x10/0x10 [ 258.663200][ T8262] ? ksys_write+0x190/0x250 [ 258.663235][ T8262] ? fput+0x7c/0x100 [ 258.663258][ T8262] ? ksys_write+0x1ac/0x250 [ 258.663274][ T8262] ? __pfx_ksys_write+0x10/0x10 [ 258.663295][ T8262] __x64_sys_sendmmsg+0x9c/0x100 [ 258.663313][ T8262] ? lockdep_hardirqs_on+0x7d/0x110 [ 258.663333][ T8262] do_syscall_64+0x123/0x790 [ 258.663356][ T8262] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.663376][ T8262] RIP: 0033:0x7fd99139e159 [ 258.663392][ T8262] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 258.663409][ T8262] RSP: 002b:00007fd992277028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 258.663429][ T8262] RAX: ffffffffffffffda RBX: 00007fd991625fa0 RCX: 00007fd99139e159 [ 258.663441][ T8262] RDX: 0400000000000235 RSI: 0000200000000000 RDI: 0000000000000003 [ 258.663452][ T8262] RBP: 00007fd992277090 R08: 0000000000000000 R09: 0000000000000000 [ 258.663463][ T8262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 258.663474][ T8262] R13: 00007fd991626038 R14: 00007fd991625fa0 R15: 00007fffb2849f88 [ 258.663498][ T8262] [ 258.700680][ T8262] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 259.428965][ T4928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 259.585133][ T5598] Bluetooth: hci4: ACL packet for unknown connection handle 200 [ 259.693157][ T31] audit: type=1400 audit(1788009216.774:613): avc: denied { write } for pid=8274 comm="syz.1.638" name="functions" dev="configfs" ino=11183 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 259.717769][ T31] audit: type=1400 audit(1788009216.804:614): avc: denied { write } for pid=8274 comm="syz.1.638" name="target" dev="configfs" ino=3565 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 259.744796][ T31] audit: type=1400 audit(1788009216.824:615): avc: denied { write } for pid=8274 comm="syz.1.638" name="usb_gadget" dev="configfs" ino=22550 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 259.809256][ T5734] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 260.010883][ T8280] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 260.079545][ T5734] usb 5-1: Using ep0 maxpacket: 16 [ 260.085447][ T5734] usb 5-1: New USB device found, idVendor=0079, idProduct=1846, bcdDevice= 0.00 [ 260.095776][ T5734] usb 5-1: config 0 interface 0 altsetting 183 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 260.109643][ T5734] usb 5-1: config 0 interface 0 has no altsetting 0 [ 260.109698][ T5734] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 260.130064][ T5734] usb 5-1: config 0 descriptor?? [ 260.379780][ T5805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 260.911799][ T1816] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 260.912108][ T4928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 261.039563][ T1816] usb 2-1: device descriptor read/64, error -71 [ 261.049340][ T5734] hid_mf 0003:0079:1846.001F: ignoring exceeding usage max [ 261.058635][ T8285] netlink: 64 bytes leftover after parsing attributes in process `syz.2.641'. [ 261.070091][ T5734] hid_mf 0003:0079:1846.001F: global environment stack underflow [ 261.077883][ T5734] hid_mf 0003:0079:1846.001F: item 0 2 1 11 parsing failed [ 261.085756][ T5734] hid_mf 0003:0079:1846.001F: HID parse failed. [ 261.095356][ T5734] hid_mf 0003:0079:1846.001F: probe with driver hid_mf failed with error -22 [ 261.146198][ T8286] syzkaller1: entered promiscuous mode [ 261.146223][ T8286] syzkaller1: entered allmulticast mode [ 261.248112][ T9] usb 5-1: USB disconnect, device number 25 [ 261.279171][ T1816] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 261.419142][ T1816] usb 2-1: device descriptor read/64, error -71 [ 261.529719][ T1816] usb usb2-port1: attempt power cycle [ 261.590007][ T31] audit: type=1800 audit(1788009218.664:616): pid=8297 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.644" name="memory_backed" dev="configfs" ino=22579 res=0 errno=0 [ 261.590179][ T31] audit: type=1800 audit(1788009218.664:617): pid=8297 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.644" name="zone_nr_conv" dev="configfs" ino=22580 res=0 errno=0 [ 261.590316][ T31] audit: type=1800 audit(1788009218.664:618): pid=8297 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.644" name="power" dev="configfs" ino=22581 res=0 errno=0 [ 261.929087][ T1816] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 261.950162][ T1816] usb 2-1: device descriptor read/8, error -71 [ 261.991717][ T4928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 262.214281][ T1816] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 262.284277][ T1816] usb 2-1: device descriptor read/8, error -71 [ 262.429077][ T31] audit: type=1800 audit(1788009219.464:619): pid=8299 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.5.643" name="file0" dev="overlay" ino=528 res=0 errno=0 [ 262.499891][ T1816] usb usb2-port1: unable to enumerate USB device [ 263.205160][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 263.725395][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 264.241490][ T4928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 264.398097][ T8326] ubi: mtd0 is already attached to ubi0 [ 264.459182][ T1816] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 264.610560][ T1816] usb 2-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 264.612614][ T1816] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 264.612922][ T1816] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 264.612952][ T1816] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 264.612979][ T1816] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 264.616321][ T1816] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.616348][ T1816] usb 2-1: Product: syz [ 264.616373][ T1816] usb 2-1: Manufacturer: syz [ 264.616390][ T1816] usb 2-1: SerialNumber: syz [ 264.630524][ T1816] usb 2-1: config 0 descriptor?? [ 264.716267][ T8316] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 264.947267][ T8316] MTD: Couldn't look up '/dev/md0': -2 [ 264.964756][ T1816] powermate: Expected payload of 3--6 bytes, found 64 bytes! [ 264.990306][ T1816] input: Griffin SoundKnob as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input31 [ 265.034380][ C1] powermate: config urb returned -71 [ 265.034528][ C1] powermate: config urb returned -71 [ 265.034707][ C1] powermate: config urb returned -71 [ 265.034872][ C1] powermate: config urb returned -71 [ 265.076002][ T1816] usb 2-1: USB disconnect, device number 40 [ 265.076066][ C1] powermate 2-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 265.094627][ T5702] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 265.283870][ T4928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 265.589983][ T9] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 265.749151][ T9] usb 3-1: device descriptor read/64, error -71 [ 265.783137][ T5702] usb 6-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 265.785350][ T5702] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 265.785391][ T5702] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 265.785423][ T5702] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.787597][ T5702] usb 6-1: config 0 descriptor?? [ 265.861301][ T8342] FAULT_INJECTION: forcing a failure. [ 265.861301][ T8342] name failslab, interval 1, probability 0, space 0, times 0 [ 265.861349][ T8342] CPU: 1 UID: 0 PID: 8342 Comm: syz.0.658 Tainted: G L syzkaller #0 PREEMPT(full) [ 265.861373][ T8342] Tainted: [L]=SOFTLOCKUP [ 265.861378][ T8342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 265.861387][ T8342] Call Trace: [ 265.861393][ T8342] [ 265.861400][ T8342] dump_stack_lvl+0x100/0x190 [ 265.861431][ T8342] should_fail_ex.cold+0x5/0xa [ 265.861454][ T8342] should_failslab+0xc2/0x120 [ 265.861474][ T8342] kmem_cache_alloc_noprof+0x92/0x6a0 [ 265.861490][ T8342] ? skb_clone+0x190/0x400 [ 265.861510][ T8342] skb_clone+0x190/0x400 [ 265.861525][ T8342] netlink_deliver_tap+0xaed/0xcc0 [ 265.861553][ T8342] netlink_unicast+0x62b/0x850 [ 265.861585][ T8342] ? __pfx_netlink_unicast+0x10/0x10 [ 265.861614][ T8342] netlink_sendmsg+0x8b0/0xda0 [ 265.861640][ T8342] ? __pfx_netlink_sendmsg+0x10/0x10 [ 265.861665][ T8342] ? selinux_socket_sendmsg+0x198/0x2f0 [ 265.861693][ T8342] ____sys_sendmsg+0xa4d/0xbe0 [ 265.861710][ T8342] ? __pfx_netlink_sendmsg+0x10/0x10 [ 265.861734][ T8342] ? __pfx_____sys_sendmsg+0x10/0x10 [ 265.861758][ T8342] ? lock_acquire+0x1d1/0x380 [ 265.861775][ T8342] ? get_pid_task+0x2a/0x250 [ 265.861798][ T8342] ___sys_sendmsg+0x190/0x1e0 [ 265.861819][ T8342] ? __pfx____sys_sendmsg+0x10/0x10 [ 265.861839][ T8342] ? get_pid_task+0x106/0x250 [ 265.861868][ T8342] ? find_held_lock+0x2b/0x80 [ 265.861902][ T8342] __sys_sendmsg+0x160/0x210 [ 265.861927][ T8342] ? __pfx___sys_sendmsg+0x10/0x10 [ 265.861963][ T8342] do_syscall_64+0x123/0x790 [ 265.861984][ T8342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.862000][ T8342] RIP: 0033:0x7f3a6fb9e159 [ 265.862013][ T8342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 265.862028][ T8342] RSP: 002b:00007f3a70a14028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 265.862044][ T8342] RAX: ffffffffffffffda RBX: 00007f3a6fe25fa0 RCX: 00007f3a6fb9e159 [ 265.862054][ T8342] RDX: 0000000000000000 RSI: 0000200000003880 RDI: 0000000000000003 [ 265.862064][ T8342] RBP: 00007f3a70a14090 R08: 0000000000000000 R09: 0000000000000000 [ 265.862073][ T8342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 265.862082][ T8342] R13: 00007f3a6fe26038 R14: 00007f3a6fe25fa0 R15: 00007ffd96774a28 [ 265.862104][ T8342] [ 266.083276][ T9] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 266.170039][ T31] audit: type=1400 audit(1788009223.254:620): avc: denied { getopt } for pid=8345 comm="syz.0.660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 266.189942][ T31] audit: type=1400 audit(1788009223.274:621): avc: denied { bind } for pid=8345 comm="syz.0.660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 266.239161][ T1816] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 266.272462][ T9] usb 3-1: device descriptor read/64, error -71 [ 266.272849][ T31] audit: type=1400 audit(1788009223.354:622): avc: denied { setopt } for pid=8345 comm="syz.0.660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 266.319803][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 266.329885][ T31] audit: type=1400 audit(1788009223.404:623): avc: denied { write } for pid=8345 comm="syz.0.660" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 266.389903][ T9] usb usb3-port1: attempt power cycle [ 266.414670][ T1816] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 266.486329][ T8354] overlayfs: failed to resolve './bus': -2 [ 266.634072][ T5703] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 266.644560][ T1816] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 266.644613][ T1816] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 266.749693][ T1816] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 266.749747][ T1816] usb 2-1: SerialNumber: syz [ 266.789472][ T9] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 266.790861][ T5688] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 266.819314][ T9] usb 3-1: device descriptor read/8, error -71 [ 266.871704][ T5805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 267.071278][ T9] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 267.115258][ T9] usb 3-1: device descriptor read/8, error -71 [ 267.245520][ T9] usb usb3-port1: unable to enumerate USB device [ 267.606707][ T1816] cdc_ether 2-1:1.0: missing cdc ether descriptor [ 267.896036][ T8344] loop4: detected capacity change from 0 to 1 [ 267.992899][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 268.024549][ T8344] Dev loop4: unable to read RDB block 1 [ 268.024628][ T8344] loop4: AHDI p1 p2 p3 [ 268.024657][ T8344] loop4: partition table partially beyond EOD, truncated [ 268.025508][ T8344] loop4: p1 size 825635125 extends beyond EOD, truncated [ 268.062869][ T8357] synth uevent: /bus/platform/drivers/intel_xhci_usb_sw: unknown uevent action string [ 268.077707][ T8344] loop4: p3 start 335544320 is beyond EOD, truncated [ 268.112636][ T5702] hid-led 0003:27B8:01ED.0020: probe with driver hid-led failed with error -71 [ 268.135438][ T5702] usb 6-1: USB disconnect, device number 23 [ 268.153370][ T5731] usb 2-1: USB disconnect, device number 41 [ 268.195373][ T7279] udevd[7279]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 268.293431][ T8361] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.293664][ T8361] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.509652][ T5703] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 268.689297][ T5703] usb 1-1: Using ep0 maxpacket: 8 [ 268.849070][ T5688] usb 3-1: new full-speed USB device number 38 using dummy_hcd [ 269.012446][ T5688] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 269.030919][ T30] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 269.040819][ T5688] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 269.040860][ T5688] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 269.040900][ T5688] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.301067][ T5688] usb 3-1: usb_control_msg returned -32 [ 269.305061][ T8357] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.305396][ T8357] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.324097][ T5688] usbtmc 3-1:16.0: can't read capabilities [ 269.339809][ T5703] usb 1-1: unable to get BOS descriptor or descriptor too short [ 269.339856][ T5703] usb 1-1: New USB device found, idVendor=3672, idProduct=1f1a, bcdDevice=cd.4b [ 269.340715][ T5703] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 269.340741][ T5703] usb 1-1: can't read configurations, error -71 [ 269.750727][ T31] audit: type=1400 audit(1788009226.834:624): avc: denied { shutdown } for pid=8377 comm="syz.4.669" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 269.820198][ T5688] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.017274][ T8389] ubi: mtd0 is already attached to ubi0 [ 270.059469][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.139099][ T5688] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 270.309546][ T5688] usb 6-1: Using ep0 maxpacket: 8 [ 270.315192][ T5688] usb 6-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 270.325345][ T5688] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 270.325390][ T5688] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 270.325442][ T5688] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.359276][ T5688] usb 6-1: config 0 descriptor?? [ 270.439109][ T9] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 270.638095][ T31] audit: type=1400 audit(1788009227.714:625): avc: denied { mount } for pid=8386 comm="syz.1.673" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 270.682797][ T9] usb 5-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 270.694082][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 270.694120][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 270.694170][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 270.705303][ T5703] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 270.729446][ T9] usb 5-1: config 0 descriptor?? [ 270.842632][ T31] audit: type=1400 audit(1788009227.924:626): avc: denied { unmount } for pid=5606 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 270.864028][ T5703] usb 1-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 270.874051][ T5703] usb 1-1: config 1 has an invalid interface number: 3 but max is 0 [ 270.883160][ T5703] usb 1-1: config 1 has no interface number 0 [ 270.893100][ T5703] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 270.893138][ T5703] usb 1-1: Product: syz [ 270.893162][ T5703] usb 1-1: Manufacturer: syz [ 270.893178][ T5703] usb 1-1: SerialNumber: syz [ 270.930037][ T5688] usbhid 6-1:0.0: can't add hid device: -71 [ 270.930153][ T5688] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 270.942008][ T5688] usb 6-1: USB disconnect, device number 24 [ 270.967113][ T5703] usb 1-1: 3:1 : does not exist [ 270.973900][ T5703] usb 1-1: 3:2 : does not exist [ 271.103566][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 272.133953][ T5688] usb 1-1: USB disconnect, device number 27 [ 272.473562][ T5805] usb 3-1: USB disconnect, device number 38 [ 272.685547][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 272.859439][ T191] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 273.401797][ T9] hid-led 0003:27B8:01ED.0021: probe with driver hid-led failed with error -71 [ 273.414451][ T9] usb 5-1: USB disconnect, device number 26 [ 273.787063][ T8416] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 274.014675][ T31] audit: type=1400 audit(1788009230.874:627): avc: denied { read } for pid=8406 comm="syz.2.680" name="trace_pipe" dev="tracefs" ino=4030 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 274.521408][ T30] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 275.112334][ T8421] netlink: 16 bytes leftover after parsing attributes in process `syz.0.684'. [ 275.252094][ T31] audit: type=1400 audit(1788009232.264:628): avc: denied { ioctl } for pid=8418 comm="syz.0.684" path="socket:[23872]" dev="sockfs" ino=23872 ioctlcmd=0x6721 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 275.656472][ T30] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 275.893579][ T31] audit: type=1400 audit(1788009232.914:629): avc: denied { read write } for pid=5601 comm="syz-executor" name="loop2" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 275.893783][ T31] audit: type=1400 audit(1788009232.934:630): avc: denied { open } for pid=5601 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=647 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 275.895442][ T31] audit: type=1400 audit(1788009232.954:631): avc: denied { ioctl } for pid=5601 comm="syz-executor" path="/dev/loop2" dev="devtmpfs" ino=647 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 275.909301][ T5805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 276.145640][ T31] audit: type=1400 audit(1788009233.224:632): avc: denied { read write } for pid=8423 comm="syz.1.685" name="raw-gadget" dev="devtmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 276.218663][ T31] audit: type=1400 audit(1788009233.264:633): avc: denied { open } for pid=8423 comm="syz.1.685" path="/dev/raw-gadget" dev="devtmpfs" ino=814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 276.218870][ T31] audit: type=1400 audit(1788009233.284:634): avc: denied { ioctl } for pid=8423 comm="syz.1.685" path="/dev/raw-gadget" dev="devtmpfs" ino=814 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 276.459476][ T5688] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 276.532648][ T5703] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 276.670388][ T31] audit: type=1400 audit(1788009233.744:635): avc: denied { mounton } for pid=8425 comm="syz.2.686" path="/138/sys" dev="tmpfs" ino=802 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 276.693251][ T31] audit: type=1400 audit(1788009233.754:636): avc: denied { mount } for pid=8425 comm="syz.2.686" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 276.717857][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 276.727248][ T5703] usb 2-1: device descriptor read/64, error -71 [ 276.759140][ T8426] synth uevent: /bus/platform/drivers/intel_xhci_usb_sw: unknown uevent action string [ 277.089070][ T5703] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 277.160678][ T5731] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 277.244057][ T5703] usb 2-1: device descriptor read/64, error -71 [ 277.407872][ T5703] usb usb2-port1: attempt power cycle [ 277.418455][ T5731] usb 3-1: Using ep0 maxpacket: 8 [ 277.739780][ T30] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.750694][ T5703] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 277.771167][ T5703] usb 2-1: device descriptor read/8, error -71 [ 277.818100][ T8426] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 277.828176][ T8426] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 277.836109][ T5702] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 277.851517][ T5731] usb 3-1: unable to get BOS descriptor or descriptor too short [ 277.851568][ T5731] usb 3-1: New USB device found, idVendor=3672, idProduct=1f1a, bcdDevice=cd.4b [ 277.870313][ T5731] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 277.870358][ T5731] usb 3-1: can't read configurations, error -71 [ 277.973657][ T5598] [ 277.976007][ T5598] ====================================================== [ 277.983025][ T5598] WARNING: possible circular locking dependency detected [ 277.989055][ T5702] usb 1-1: Using ep0 maxpacket: 8 [ 277.989507][ T5702] usb 1-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 277.990296][ T5702] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 252, changing to 11 [ 277.990330][ T5702] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 277.990408][ T5702] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.009183][ T5703] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 278.029502][ T5703] usb 2-1: device descriptor read/8, error -71 [ 278.049454][ T5598] syzkaller #0 Tainted: G L [ 278.050340][ T5702] usb 1-1: config 0 descriptor?? [ 278.060342][ T5598] ------------------------------------------------------ [ 278.067354][ T5598] kworker/u9:2/5598 is trying to acquire lock: [ 278.073499][ T5598] ffffffff90f7e040 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_security_cfm+0x3f/0x4b0 [ 278.082734][ T5598] [ 278.082734][ T5598] but task is already holding lock: [ 278.090089][ T5598] ffffffff90f51500 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_encrypt_cfm+0x11b/0x740 [ 278.099406][ T5598] [ 278.099406][ T5598] which lock already depends on the new lock. [ 278.099406][ T5598] [ 278.109800][ T5598] [ 278.109800][ T5598] the existing dependency chain (in reverse order) is: [ 278.118804][ T5598] [ 278.118804][ T5598] -> #2 (hci_cb_list_lock){+.+.}-{4:4}: [ 278.126541][ T5598] lock_acquire+0x1d1/0x380 [ 278.131569][ T5598] __mutex_lock+0x1a4/0x1bc0 [ 278.136682][ T5598] hci_remote_features_evt+0x485/0x9b0 [ 278.142663][ T5598] hci_event_packet+0x8e9/0xcd0 [ 278.148032][ T5598] hci_rx_work+0x451/0xfc0 [ 278.152968][ T5598] process_one_work+0xac7/0x1b10 [ 278.158423][ T5598] worker_thread+0x5ef/0xe50 [ 278.163536][ T5598] kthread+0x373/0x450 [ 278.168127][ T5598] ret_from_fork+0x730/0xd60 [ 278.173233][ T5598] ret_from_fork_asm+0x1a/0x30 [ 278.178513][ T5598] [ 278.178513][ T5598] -> #1 (&hdev->lock){+.+.}-{4:4}: [ 278.185804][ T5598] lock_acquire+0x1d1/0x380 [ 278.190822][ T5598] __mutex_lock+0x1a4/0x1bc0 [ 278.195931][ T5598] l2cap_chan_connect+0xac/0x2050 [ 278.201487][ T5598] l2cap_sock_connect+0x37a/0x770 [ 278.207028][ T5598] kernel_connect+0x107/0x160 [ 278.212237][ T5598] rfcomm_dlc_open+0x838/0xac0 [ 278.217529][ T5598] rfcomm_sock_connect+0x42c/0x690 [ 278.223157][ T5598] __sys_connect_file+0x146/0x1a0 [ 278.228699][ T5598] __sys_connect+0x141/0x170 [ 278.233807][ T5598] __x64_sys_connect+0x72/0xb0 [ 278.239088][ T5598] do_syscall_64+0x123/0x790 [ 278.244191][ T5598] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 278.250598][ T5598] [ 278.250598][ T5598] -> #0 (rfcomm_mutex){+.+.}-{4:4}: [ 278.257976][ T5598] check_prev_add+0xeb/0xe60 [ 278.263076][ T5598] __lock_acquire+0x1492/0x1ec0 [ 278.268470][ T5598] lock_acquire+0x1d1/0x380 [ 278.273484][ T5598] __mutex_lock+0x1a4/0x1bc0 [ 278.278594][ T5598] rfcomm_security_cfm+0x3f/0x4b0 [ 278.284129][ T5598] hci_encrypt_cfm+0x18e/0x740 [ 278.289411][ T5598] hci_encrypt_change_evt+0x3e1/0xfb0 [ 278.295306][ T5598] hci_event_packet+0x8e9/0xcd0 [ 278.300706][ T5598] hci_rx_work+0x451/0xfc0 [ 278.305654][ T5598] process_one_work+0xac7/0x1b10 [ 278.311111][ T5598] worker_thread+0x5ef/0xe50 [ 278.316219][ T5598] kthread+0x373/0x450 [ 278.320894][ T5598] ret_from_fork+0x730/0xd60 [ 278.325997][ T5598] ret_from_fork_asm+0x1a/0x30 [ 278.331271][ T5598] [ 278.331271][ T5598] other info that might help us debug this: [ 278.331271][ T5598] [ 278.341490][ T5598] Chain exists of: [ 278.341490][ T5598] rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock [ 278.341490][ T5598] [ 278.354009][ T5598] Possible unsafe locking scenario: [ 278.354009][ T5598] [ 278.361447][ T5598] CPU0 CPU1 [ 278.366818][ T5598] ---- ---- [ 278.372175][ T5598] lock(hci_cb_list_lock); [ 278.377021][ T5598] lock(&hdev->lock); [ 278.383598][ T5598] lock(hci_cb_list_lock); [ 278.390611][ T5598] lock(rfcomm_mutex); [ 278.394759][ T5598] [ 278.394759][ T5598] *** DEADLOCK *** [ 278.394759][ T5598] [ 278.402884][ T5598] locks held by kworker/u9:2/5598: 4, last CPU#0: [ 278.409285][ T5598] #0: ffff88802e39e940 ((wq_completion)hci3#2){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 [ 278.419740][ T5598] #1: ffffc9000250fd08 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 [ 278.431153][ T5598] #2: ffff88807d7b80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_encrypt_change_evt+0x83/0xfb0 [ 278.441008][ T5598] #3: ffffffff90f51500 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_encrypt_cfm+0x11b/0x740 [ 278.450771][ T5598] [ 278.450771][ T5598] stack backtrace: [ 278.456659][ T5598] CPU: 0 UID: 0 PID: 5598 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT(full) [ 278.467681][ T5598] Tainted: [L]=SOFTLOCKUP [ 278.468737][ T5703] usb usb2-port1: unable to enumerate USB device [ 278.478306][ T5598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 278.488353][ T5598] Workqueue: hci3 hci_rx_work [ 278.493066][ T5598] Call Trace: [ 278.496421][ T5598] [ 278.499427][ T5598] dump_stack_lvl+0x100/0x190 [ 278.504113][ T5598] print_circular_bug.cold+0x178/0x1be [ 278.509576][ T5598] check_noncircular+0x146/0x160 [ 278.514519][ T5598] ? lock_acquire+0x1d1/0x380 [ 278.519191][ T5598] check_prev_add+0xeb/0xe60 [ 278.523777][ T5598] __lock_acquire+0x1492/0x1ec0 [ 278.528619][ T5598] ? l2cap_security_cfm+0x90b/0x1240 [ 278.533900][ T5598] lock_acquire+0x1d1/0x380 [ 278.538398][ T5598] ? rfcomm_security_cfm+0x3f/0x4b0 [ 278.543589][ T5598] ? __pfx___might_resched+0x10/0x10 [ 278.548865][ T5598] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 278.554839][ T5598] ? __pfx_rfcomm_security_cfm+0x10/0x10 [ 278.560473][ T5598] __mutex_lock+0x1a4/0x1bc0 [ 278.565073][ T5598] ? rfcomm_security_cfm+0x3f/0x4b0 [ 278.570268][ T5598] ? rfcomm_security_cfm+0x3f/0x4b0 [ 278.575466][ T5598] ? l2cap_security_cfm+0x910/0x1240 [ 278.580748][ T5598] ? __pfx___mutex_lock+0x10/0x10 [ 278.585944][ T5598] ? __lock_acquire+0x4c5/0x1ec0 [ 278.590879][ T5598] ? __pfx___mutex_lock+0x10/0x10 [ 278.595914][ T5598] ? __pfx_rfcomm_security_cfm+0x10/0x10 [ 278.601548][ T5598] ? rfcomm_security_cfm+0x3f/0x4b0 [ 278.606744][ T5598] rfcomm_security_cfm+0x3f/0x4b0 [ 278.611771][ T5598] ? __pfx_rfcomm_security_cfm+0x10/0x10 [ 278.617395][ T5598] hci_encrypt_cfm+0x18e/0x740 [ 278.622163][ T5598] hci_encrypt_change_evt+0x3e1/0xfb0 [ 278.627556][ T5598] ? __pfx_hci_encrypt_change_evt+0x10/0x10 [ 278.633459][ T5598] ? __skb_clone+0x570/0x760 [ 278.638054][ T5598] ? skb_pull_data+0x15f/0x1e0 [ 278.642824][ T5598] hci_event_packet+0x8e9/0xcd0 [ 278.647680][ T5598] ? __pfx_hci_encrypt_change_evt+0x10/0x10 [ 278.653578][ T5598] ? __pfx_hci_event_packet+0x10/0x10 [ 278.658950][ T5598] ? lockdep_hardirqs_on+0x7d/0x110 [ 278.664145][ T5598] hci_rx_work+0x451/0xfc0 [ 278.668566][ T5598] process_one_work+0xac7/0x1b10 [ 278.673554][ T5598] ? __pfx_process_one_work+0x10/0x10 [ 278.678938][ T5598] ? lock_acquire+0x1d1/0x380 [ 278.683636][ T5598] ? __pfx_hci_rx_work+0x10/0x10 [ 278.688578][ T5598] worker_thread+0x5ef/0xe50 [ 278.693175][ T5598] ? __pfx_worker_thread+0x10/0x10 [ 278.698285][ T5598] ? kthread+0x13a/0x450 [ 278.702555][ T5598] ? __pfx_worker_thread+0x10/0x10 [ 278.707672][ T5598] kthread+0x373/0x450 [ 278.711742][ T5598] ? __pfx_kthread+0x10/0x10 [ 278.716333][ T5598] ret_from_fork+0x730/0xd60 [ 278.720919][ T5598] ? __pfx_ret_from_fork+0x10/0x10 [ 278.726022][ T5598] ? __switch_to+0x800/0x10f0 [ 278.730704][ T5598] ? __pfx_kthread+0x10/0x10 [ 278.735296][ T5598] ret_from_fork_asm+0x1a/0x30 [ 278.740057][ T5598] [ 278.839138][ T5703] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 278.940385][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 278.983270][ T8455] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 278.992839][ T8455] PM: Image not found (code -6) [ 279.009054][ T8455] ubi: mtd0 is already attached to ubi0 [ 279.134788][ T5702] hid-multitouch 0003:1FD2:6007.0022: hidraw0: USB HID v0.00 Joystick [HID 1fd2:6007] on usb-dummy_hcd.0-1/input0 [ 279.181743][ T5688] usb 1-1: USB disconnect, device number 28 [ 279.200791][ T8456] fido_id[8456]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 279.900157][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 280.940298][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 281.979333][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 281.989389][ T5688] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 283.019838][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 284.059323][ T5702] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 285.020295][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 285.100755][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 286.059788][ T5805] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 286.139336][ T30] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 287.179760][ T5731] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog